# changelog

author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-10
changelog:
  - Bump version to 1.3.6.1-10
  - Resolves: Bug 1444938 - nsslapd-allowed-sasl-mechanisms doesn't reset to default val 
  - Resolves: Bug 1111400 - logconv.pl lists sasl binds with no dn as anonymous 
  - Resolves: Bug 1377452 - Integer overflow in performance counters
  - Resolves: Bug 1441790 - ldapserch for nsslapd-errorlog-level returns incorrect values
  - Resolves: Bug 1444431 - ERR - symload_report_error - Netscape Portable Runtime error -5975
  - Resolves: Bug 1447015 - Adjust db2bak.pl help and man page to reflect changes introduced to the script


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-11
changelog:
  - Bump version to 1.3.6.1-11
  - Resolves: Bug 1410207 - Utility command had better use INFO log level for the output
  - Resolves: Bug 1049190 - Better input argument validation and error messages for db2index and db2index.pl


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-13
changelog:
  - Bump version to 1.3.6.1-13
  - Resolves: Bug 1444938 - Fix backport issue from build 1.3.6.1-10 (part 2)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-14
changelog:
  - Bump version to 1.3.6.1-14
  - Resolves: Bug 1450910 - Modifying "nsslapd-cache-autosize" parameter using ldapmodify command is failing.
  - Resolves: Bug 1450893 - When nsslapd-cache-autosize is not set in dse.ldif, ldapsearch does not show the default value
  - Resolves: Bug 1449098 - ns-slapd crashes in role cache creation
  - Resolves: Bug 1441522 - AddressSanitizer: heap-use-after-free in libreplication-plugin.so
  - Resolves: Bug 1437492 - "ERR - cos-plugin - cos_cache_query_attr - cos attribute krbPwdPolicyReference failed schema check" in error log
  - Resolves: Bug 1429770 - ds-logpipe.py crashes for non-existing users
  - Resolves: Bug 1451657 - -v option is not working for db2ldif.pl


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-15
changelog:
  - Bump version to 1.3.6.1-15
  - Resolves: Bug 1429770 - ds-logpipe.py crashes for non-existing users
  - Resolves: Bug 1444938 - nsslapd-allowed-sasl-mechanisms doesn't reset to default values without a restart
  - Resolves: Bug 1450896 - Manual resetting of nsslapd-dbcachesize using ldapmodify 
  - Resolves: Bug 1357682 - RHDS fails to start with message: "Failed to delete old semaphore for stats file"
  - Resolves: Bug 1452739 - Zero value of nsslapd-cache-autosize-split makes dbcache to be equal 0


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-16
changelog:
  - Bump version to 1.3.6.1-16
  - Resolves: Bug 1444938 - nsslapd-allowed-sasl-mechanisms doesn't reset to default values without a restart
  - Resolves: Bug 1447015 - Adjust db2bak.pl help and man page to reflect changes introduced to the script
  - Resolves: Bug 1450896 - Manual resetting of nsslapd-dbcachesize using ldapmodify
  - Resolves: Bug 1454921 - Fixup memberof task throws error "memberof_fix_memberof_callback: Weird
  - Resolves: Bug 1456774 - ipa-replica server fails to upgrade


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-17
changelog:
  - Bump version to 1.3.6.1-17
  - Resolves: Bug 1476161 - replication halt - pending list first CSN not committed, pending list increasing
  - Resolves: Bug 1476162 - Change the retrochangelog default cache size


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-18
changelog:
  - Bump version to 1.3.6.1-18
  - Require srvcore 4.1.3
  - Resolves: Bug 1479757 - dse.ldif and fsync
  - Resolves: Bug 1479755 - backup fails if changelog is enabled
  - Resolves: Bug 1479756 - Locked account provides different return code if password is correct


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.19-1
changelog:
  - Bump version to 1.3.6.19-1
  - Remove old mozldap and db4 requirements
  - Resolves: Bug 1483865 - Crash while binding to a server during replication online init


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-19
changelog:
  - Bump version to 1.3.6.1-19
  - Remove old mozldap and db4 requirements
  - Resolves: Bug 1483865 - Crash while binding to a server during replication online init


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-20
changelog:
  - Bump verions to 1.3.6.1-20
  - Resolves: Bug 1489693 - PasswordCheckSyntax attribute fails to validate cn, sn, uid
  - Resovles: Bug 1492829 - patch should of been applied to 7.4 but got missed
  - Resolves: Bug 1486128 - Performance issues with RHDS 10 - NDN cache investigation
  - Resolves: Bug 1489694 - crash in send_ldap_result
  - Resolves: Bug 1491778 - crash when adding invalid repl agmt
  - Resolves: Bug 1492830 - password expired control not sent
  - Resolves: Bug 1492833 - sasl-mechanisms removed during upgrade


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-21
changelog:
  - Bump verions to 1.3.6.1-21
  - Resolves: Bug 1498958 - unable to retrieve specific cosAttribute when subtree password policy is configured


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-23
changelog:
  - Bump version to 1.3.6.1-23
  - Resolves: Bug 1504536 - [memberOf Plugin] bulk deleting users causes deadlock when there are multiple backends
  - Resolves: Bug 1503001 - Adding a database entry fails if the same database was deleted after an import
  - Resolves: Bug 1506912 - Improve valueset sort performance during valueset purging


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-24
changelog:
  - Bump version to 1.3.6.1-24
  - Resolves: Bug 1508978 - replicated MODRDN fails breaking replication
  - Resolves: Bug 1511940 - heap corruption during import
  - Resolves: Bug 1510319 - [abrt] 389-ds-base: SLL_Next(): ns-slapd killed by SIGSEGV 
  - Resolves: Bug 1509347 - cleanallruv task is not logging any information


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-25
changelog:
  - Bump version to 1.3.6.1-25
  - Resolves: Bug 1526928 - search with CoS attribute is getting slower after modifying/adding CosTemplate
  - Resolves: Bug 1523505 - opened connection are hanging, no longer poll
  - Resolves: Bug 1523507 - IPA server replication broken, after DS stop-start, due to changelog reset


author: Laszlo Ersek <lersek@redhat.com> - ovmf-20160419-2.git90bb4c5.el7
changelog:
  - Submit scratch builds from the exploded tree again to
    supp-rhel-7.3-candidate, despite FatPkg being OSS at this point; see
    bz#1329559.


author: Laszlo Ersek <lersek@redhat.com> - ovmf-20160608-1.git988715a.el7
changelog:
  - Resolves: bz#1341733
    (prevent SMM stack overflow in OVMF while enrolling certificates in "db")
  - Resolves: bz#1257882
    (FEAT: support to boot from virtio 1.0 modern devices)
  - Resolves: bz#1333238
    (Q35 machine can not boot up successfully with more than 3 virtio-scsi
    storage controller under switch)
  - Resolves: bz#1330955
    (VM can not be booted up from hard disk successfully when with a passthrough
    USB stick)


author: Miroslav Rezanina <mrezanin@redhat.com> - OVMF-20160608-2.git988715a.el7
changelog:
  - ovmf-ArmPkg-ArmGicV3Dxe-configure-all-interrupts-as-non-s.patch [bz#1349407]
  - ovmf-ArmVirtPkg-PlatformBootManagerLib-Postpone-the-shell.patch [bz#1353689]
  - Resolves: bz#1349407
    (AArch64: backport fix to run over gicv3 emulation)
  - Resolves: bz#1353689
    (AAVMF: Drops to shell with uninitialized NVRAM file)


author: Miroslav Rezanina <mrezanin@redhat.com> - OVMF-20160608-3.git988715a.el7
changelog:
  - ovmf-MdePkg-PCI-Add-missing-PCI-PCIE-definitions.patch [bz#1332408]
  - ovmf-ArmPlatformPkg-NorFlashDxe-accept-both-non-secure-an.patch [bz#1353494]
  - ovmf-ArmVirtPkg-ArmVirtQemu-switch-secure-boot-build-to-N.patch [bz#1353494]
  - ovmf-ArmPlatformPkg-NorFlashAuthenticatedDxe-remove-this-.patch [bz#1353494]
  - ovmf-ArmVirtPkg-add-FDF-definition-for-empty-varstore.patch [bz#1353494]
  - ovmf-redhat-package-the-varstore-template-produced-by-the.patch [bz#1353494]
  - ovmf-ArmVirtPkg-Re-add-the-Driver-Health-Manager.patch [bz#1353494]
  - ovmf-ArmVirtPkg-HighMemDxe-allow-patchable-PCD-for-PcdSys.patch [bz#1353494]
  - ovmf-ArmVirtPkg-ArmVirtQemuKernel-make-ACPI-support-AARCH.patch [bz#1353494]
  - ovmf-ArmVirtPkg-align-ArmVirtQemuKernel-with-ArmVirtQemu.patch [bz#1353494]
  - ovmf-ArmVirtPkg-ArmVirtQemu-factor-out-shared-FV.FvMain-d.patch [bz#1353494]
  - ovmf-ArmVirtPkg-factor-out-Rules-FDF-section.patch [bz#1353494]
  - ovmf-ArmVirtPkg-add-name-GUIDs-to-FvMain-instances.patch [bz#1353494]
  - ovmf-OvmfPkg-add-a-Name-GUID-to-each-Firmware-Volume.patch [bz#1353494]
  - ovmf-OvmfPkg-PlatformBootManagerLib-remove-stale-FvFile-b.patch [bz#1353494]
  - ovmf-MdePkg-IndustryStandard-introduce-EFI_PCI_CAPABILITY.patch [bz#1332408]
  - ovmf-MdeModulePkg-PciBusDxe-look-for-the-right-capability.patch [bz#1332408]
  - ovmf-MdeModulePkg-PciBusDxe-recognize-hotplug-capable-PCI.patch [bz#1332408]
  - ovmf-OvmfPkg-add-PciHotPlugInitDxe.patch [bz#1332408]
  - ovmf-ArmPkg-ArmGicLib-manage-GICv3-SPI-state-at-the-distr.patch [bz#1356655]
  - ovmf-ArmVirtPkg-PlatformBootManagerLib-remove-stale-FvFil.patch [bz#1353494]
  - ovmf-OvmfPkg-EnrollDefaultKeys-assign-Status-before-readi.patch [bz#1356913]
  - ovmf-OvmfPkg-EnrollDefaultKeys-silence-VS2015x86-warning-.patch [bz#1356913]
  - ovmf-CryptoPkg-update-openssl-to-ignore-RVCT-3079.patch [bz#1356184]
  - ovmf-CryptoPkg-Fix-typos-in-comments.patch [bz#1356184]
  - ovmf-CryptoPkg-BaseCryptLib-Avoid-passing-NULL-ptr-to-fun.patch [bz#1356184]
  - ovmf-CryptoPkg-BaseCryptLib-Init-the-content-of-struct-Ce.patch [bz#1356184]
  - ovmf-CryptoPkg-OpensslLib-Upgrade-OpenSSL-version-to-1.0..patch [bz#1356184]
  - Resolves: bz#1332408
    (Q35 machine can not hot-plug scsi controller under switch)
  - Resolves: bz#1353494
    ([OVMF] "EFI Internal Shell" should be removed from "Boot Manager")
  - Resolves: bz#1356184
    (refresh embedded OpenSSL to 1.0.2h)
  - Resolves: bz#1356655
    (AAVMF: stop accessing unmapped gicv3 registers)
  - Resolves: bz#1356913
    (fix use-without-initialization in EnrollDefaultKeys.efi)


author: Laszlo Ersek <lersek@redhat.com> - ovmf-20160608b-1.git988715a.el7
changelog:
  - rework downstream-only commit dde83a75b566 "setup the tree for the secure
    boot feature (RHEL only)", excluding patent-encumbered files from the
    upstream OpenSSL 1.0.2g tarball [bz#1374710]
  - rework downstream-only commit dfc3ca1ee509 "CryptoPkg/OpensslLib: Upgrade
    OpenSSL version to 1.0.2h", excluding patent-encumbered files from the
    upstream OpenSSL 1.0.2h tarball [bz#1374710]


author: Laszlo Ersek <lersek@redhat.com> - ovmf-20170228-1.gitc325e41585e3.el7
changelog:
  - Rebase to upstream c325e41585e3 [bz#1416919]
  - Resolves: bz#1373812
    (guest boot from network even set 'boot order=1' for virtio disk with OVMF)
  - Resolves: bz#1380282
    (Update OVMF to openssl-1.0.2k-hobbled)
  - Resolves: bz#1412313
    (select broadcast SMI if available)
  - Resolves: bz#1416919
    (Rebase OVMF for RHEL-7.4)
  - Resolves: bz#1426330
    (disable libssl in CryptoPkg)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20170228-2.gitc325e41585e3.el7
changelog:
  - ovmf-MdeModulePkg-Core-Dxe-downgrade-CodeSegmentCount-is-.patch [bz#1433428]
  - Resolves: bz#1433428
    (AAVMF: Fix error message during ARM guest VM installation)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20170228-3.gitc325e41585e3.el7
changelog:
  - ovmf-ArmVirtPkg-FdtClientDxe-supplement-missing-EFIAPI-ca.patch [bz#1430262]
  - ovmf-ArmVirtPkg-ArmVirtPL031FdtClientLib-unconditionally-.patch [bz#1430262]
  - ovmf-MdeModulePkg-RamDiskDxe-fix-C-string-literal-catenat.patch [bz#1430262]
  - ovmf-EmbeddedPkg-introduce-EDKII-Platform-Has-ACPI-GUID.patch [bz#1430262]
  - ovmf-EmbeddedPkg-introduce-PlatformHasAcpiLib.patch [bz#1430262]
  - ovmf-EmbeddedPkg-introduce-EDKII-Platform-Has-Device-Tree.patch [bz#1430262]
  - ovmf-ArmVirtPkg-add-PlatformHasAcpiDtDxe.patch [bz#1430262]
  - ovmf-ArmVirtPkg-enable-AcpiTableDxe-and-EFI_ACPI_TABLE_PR.patch [bz#1430262]
  - ovmf-ArmVirtPkg-FdtClientDxe-install-DT-as-sysconfig-tabl.patch [bz#1430262]
  - ovmf-ArmVirtPkg-PlatformHasAcpiDtDxe-don-t-expose-DT-if-Q.patch [bz#1430262]
  - ovmf-ArmVirtPkg-remove-PURE_ACPI_BOOT_ENABLE-and-PcdPureA.patch [bz#1430262]
  - Resolves: bz#1430262
    (AAVMF: forward QEMU's DT to the guest OS only if ACPI payload is unavailable)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20170228-4.gitc325e41585e3.el7
changelog:
  - ovmf-ShellPkg-Shell-clean-up-bogus-member-types-in-SPLIT_.patch [bz#1442908]
  - ovmf-ShellPkg-Shell-eliminate-double-free-in-RunSplitComm.patch [bz#1442908]
  - Resolves: bz#1442908
    (Guest hang when running a wrong command in Uefishell)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20170228-5.gitc325e41585e3.el7
changelog:
  - ovmf-OvmfPkg-EnrollDefaultKeys-update-SignatureOwner-GUID.patch [bz#1443351]
  - ovmf-OvmfPkg-EnrollDefaultKeys-expose-CertType-parameter-.patch [bz#1443351]
  - ovmf-OvmfPkg-EnrollDefaultKeys-blacklist-empty-file-in-db.patch [bz#1443351]
  - ovmf-OvmfPkg-introduce-the-FD_SIZE_IN_KB-macro-build-flag.patch [bz#1443351]
  - ovmf-OvmfPkg-OvmfPkg.fdf.inc-extract-VARS_LIVE_SIZE-and-V.patch [bz#1443351]
  - ovmf-OvmfPkg-introduce-4MB-flash-image-mainly-for-Windows.patch [bz#1443351]
  - ovmf-OvmfPkg-raise-max-variable-size-auth-non-auth-to-33K.patch [bz#1443351]
  - ovmf-OvmfPkg-PlatformPei-handle-non-power-of-two-spare-si.patch [bz#1443351]
  - ovmf-redhat-update-local-build-instructions-with-D-FD_SIZ.patch [bz#1443351]
  - ovmf-redhat-update-OVMF-build-commands-with-D-FD_SIZE_4MB.patch [bz#1443351]
  - Resolves: bz#1443351
    ([svvp][ovmf] job "Secure Boot Logo Test" failed  with q35&ovmf)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-2
changelog:
  - core: fix persisting managed state of device (rh #1440171)
  - proxy: fix use-after-free (rh #1450459)
  - device: don't wrongly delay startup complete waiting for carrier (rh #1450444)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-3
changelog:
  - dhcp: don't add route to DHCP4 server (rh #1448987)
  - libnm: fix NUL termination of device's description (rh #1443114)
  - libnm, core: ensure valid UTF-8 in device properties (rh #1443114)
  - core: fix device's UDI property on D-Bus (rh #1443114)
  - ifcfg-rh: omit empty next hop for routes in legacy format (rh #1452648)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.8.0-4
changelog:
  - device: update external configuration before commit (rh #1449873)
  - bluetooth: fix crash on connecting to a NAP (rh #1454385)
  - device: release removed devices from master on cleanup (rh #1448907)
  - core: activate slaves using ifindex order by default (rh #1452585)
  - nmcli: fix crash when setting 802-1x.password-raw (rh #1456362)
  - po: update translations (rh #1382625)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-5
changelog:
  - ifcfg-rh: fix writing legacy NETMASK value (rh #1445414)
  - tui: fix crash during connect (rh #1456826)
  - libnm: fix libnm rejecting VLAN ID 4095 (rh #1456911)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-6
changelog:
  - connectivity: fix periodic connectivity check (rh #1458399)
  - bond: improve option matching on daemon restart (rh #1457909)
  - device: fix touching device after external activation (rh #1457242)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-7
changelog:
  - bond: fix crash comparing mode while generating bond connection (rh #1459580)
  - connectivity: fix route penalty if WWAN and BT device using ip-ifindex (rh #1459932)
  - device: persist nm-owned in run state (rh #1376199)
  - device: fix assuming master device on restart (rh #1452062)
  - device: apply route metric penality only when the default route exists (rh #1459604)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.8.0-8
changelog:
  - cli: fix output of iface in overview output (rh#1460219)
  - ppp: unexport NMPPPManager instance on dispose (rh#1459579)
  - cli: remove spurious device names from wifi subcommands output (rh#1460527)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-9
changelog:
  - device: don't change MTU unless explicitly configured (rh #1460760)
  - core: don't remove external IPv4 addresses (rh #1459813)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-11
changelog:
  - core: fix wrongly delaying startup-complete for unrealized devices (rh#1498807)
  - core: fix unfreezing signals when unrealizing device fails (rh#1498755)


author: Ray Strode <rstrode@redhat.com> - 0.6.35-11
changelog:
  - address minor bug in previous patch
    Related: #1220904

  - fix memory leak in log handler
    Resolves: #1292543


author: Ray Strode <rstrode@redhat.com> - 0.6.42-2
changelog:
  - Update to 0.6.44
    Related: #1424623
  - export password expiration policy from shadow
    Resolves: #1334464


author: Ray Strode <rstrode@redhat.com> - 0.6.45-1
changelog:
  - Update to 0.6.45 so password expiration policy is wrapped by libaccountsservice
    Related: #1424623 #1334464


author: Ray Strode <rstrode@redhat.com> - 0.6.45-2
changelog:
  - Don't tread explicitly requested users as cached
    Fixes UncacheUser operation.
    Resolves: 1446620
    Related: #1432602


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.114-1
changelog:
  - Show the text of completions in the datetime spoke. (vponcova)
    Related: rhbz#1447984
  - Look higher for the combobox associated with an entry (dshea)
    Resolves: rhbz#1447984
  - Fix the addon handlers for the checkbox (vponcova)
    Resolves: rhbz#1448187


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.115-1
changelog:
  - Show a no network warning for network installation source. (vponcova)
    Related: rhbz#1418604
  - Show warnings about enabling the network time (vponcova)
    Resolves: rhbz#1418604
  - Fix generating UUID even for pre snapshots (jkonecny)
    Related: rhbz#1113207


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.116-1
changelog:
  - Allow nonstrict behaviour for all passwords in tui (vponcova)
    Resolves: rhbz#1450326
  - Fix setting errors and warnings in the StorageCheckHandler (vponcova)
    Resolves: rhbz#1453130
  - Mark post inst tools as disabled only if firstboot --disable is used
    (mkolman)
    Resolves: rhbz#1448940
  - Set the default filesystem type from a kickstart file (vponcova)
    Resolves: rhbz#1449099


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.117-1
changelog:
  - Root checking fixes password for password from kickstart (mkolman)
    Related: rhbz#1356966
  - Improve the GUI password checker (mkolman)
    Related: rhbz#1356966
  - Respect changesok policy on root password spoke (mkolman)
    Resolves: rhbz#1356966
  - Update translations of password checking strings (rvykydal)
    Resolves: rhbz#1383911


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.118-1
changelog:
  - rpmostreepayload: [rhel7only] Move tmpfiles to after mount setup (walters)
    Resolves: rhbz#1459623
  - rpmostreepayload: Handle /var as a user-specified mountpoint (walters)
    Resolves: rhbz#1459623


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.121-1
changelog:
  - rpmostreepayload: Stub out payload methods which use `import rpm` (walters)
    Related: rhbz#1462979


author: Marcela Mašláňová <mmaslano@redhat.com> - 3.1.13-16
changelog:
  - the correct solution is remove smp_flags, they don't work properly on ppc with
    the option mpower7
  - Related: rhbz#1048745


author: Tomáš Mráz <tmraz@redhat.com> - 3.1.13-21
changelog:
  - correct the DST correction when using UTC time specification (#1328832)
  - clear non-job files from at dir and test for write error on fclose
    to fix bogus syslog messages


author: Tomáš Mráz <tmraz@redhat.com> - 3.1.13-22.2
changelog:
  - fix handling of the aborted jobs (due to possibly
    temporary conditions) and avoid flooding the syslog


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-12
changelog:
  - Add patch for Dovecot, mailbox and quote support (RHBZ#1064387)
  - Add patch for Keepalived, virtual server fixes (RHBZ#1064388)
  - Add patch for Krb5, parse braces in values (RHBZ#1066419)


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-13
changelog:
  - aug_save: return error when unlink fails (RHBZ#1091143)
  - augtool: add aliases to autocomplete (RHBZ#1100076)
  - augtool: remove unused dump-xml arg (RHBZ#1100106)
  - Automounter: parse hostnames with hyphens (RHBZ#1075162)
  - Cgconfig: parse other valid controllers (RHBZ#1112543)
  - Chrony: add lens (RHBZ#1071947)
  - docs: update man page with new commands (RHBZ#1100077)
  - Exports: permit colons for IPv6 client addresses (RHBZ#1067030)
  - Httpd: parse continued, quoted lines (RHBZ#1100551)
  - Ldso: parse hwcap lines (RHBZ#1102629)
  - NagiosCfg: parse nrpe.cfg with Nrpe (RHBZ#1102623)
  - Rmt: add lens (RHBZ#1100549)
  - Services: permit colons in service name (RHBZ#1121527)
  - Shellvars: support arithmetic expansion (RHBZ#1100550)
  - Syslog: parse TCP loghosts (RHBZ#1129386)
  - Syslog: parse IPv6 loghost addresses (RHBZ#1129388)
  - Systemd: parse /etc/sysconfig/*.systemd (RHBZ#1083022)
  - Systemd: parse quoted environment vars (RHBZ#1100547)


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-14
changelog:
  - Kdump: parse new options, EOL comments (RHBZ#1139298)
  - Rsyslog: parse property filters and templates (RHBZ#1138402)
  - Systemd: parse semicolons inside entry values (RHBZ#1139498)
  - Systemd: parse environment variables where value is quoted (RHBZ#1138508)


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-16
changelog:
  - Iptables: parse /etc/sysconfig/iptables.save (RHBZ#1144651)
  - Lvm: parse /etc/lvm/lvm.conf (RHBZ#1145495)
  - Shadow: add lens (RHBZ#1145249)


author: Dominic Cleal <dcleal@redhat.com> - 1.4.0-1
changelog:
  - Rebase to Augeas 1.4.0
  - Revert some changes for better compatibility with 1.1.0-17:
    * Dhcpd: keep 1.1.0 behaviour, add Dhcpd_140 for 1.4.0 features
    * Dnsmasq: revert splitting of address/server options
    * Dovecot: restore quotes within values
    * Jaas: revert semicolon and line break changes
    * Slapd: keep 1.1.0 behaviour, add Slapd_140 for 1.4.0 features
    * Sshd: keep 1.1.0 behaviour, add Sshd_140 for 1.4.0 features
    * Syslog: restore tree without protocol for UDP hosts
    * UpdateDB: keep Simplevars to load config by default


author: Ian Kent <ikent@redhat.com> - 5.0.7-61
changelog:
  - bz1101782 - autofs configured with sssd is not finding any maps
    - work around sss startup delay.
    - add sss master map wait config option (wait initially 0, disabled).
  - Resolves: rhbz#1101782


author: Ian Kent <ikent@redhat.com> - 5.0.7-62
changelog:
  - bz1367576 - [RFE] Add browsing support into autofs for AMD format maps
    - use autofs_point to store expire timeout where possibe.
  - Related: rhbz#1367576


author: Ian Kent <ikent@redhat.com> - 5.0.7-63
changelog:
  - bz1101782 - autofs configured with sssd is not finding any maps
    - fix work around sss startup delay.
  - bz1367576 - [RFE] Add browsing support into autofs for AMD format maps
    - fix possible NULL derefernce.
  - Related: rhbz#1101782 rhbz#1367576


author: Ian Kent <ikent@redhat.com> - 5.0.7-64
changelog:
  - bz1440769 - autofs is facing scalability issues
    - improve scalability of direct mount path component creation.
  - Resolves: rhbz#1440769


author: Ian Kent <ikent@redhat.com> - 5.0.7-65
changelog:
  - bz1367576 - [RFE] Add browsing support into autofs for AMD format maps
    - fix invalid reference in remount_active_mount().
  - Related: rhbz#1367576


author: Ian Kent <ikent@redhat.com> - 5.0.7-66
changelog:
  - bz1435736 - autofs fails with kernel: automount[3386]:
      segfault at 7f3fb7595ca8 ip 00007f3fb61e353a sp 00007f3fb7595cb0
      error 6 in libc-2.17.so[7f3fb60b7000+1b6000]
    - increase worker thread per-thread stack size.
    - limit getgrgid_r() buffer size.
    - add congigure option for limiting getgrgid_r() stack usage.
    - use above option to limit getgrgid_r() stack usage with configure.
  - Resolves: rhbz#1435736


author: Ian Kent <ikent@redhat.com> - 5.0.7-68
changelog:
  - bz1435736 - autofs fails with kernel: automount[3386]:
      segfault at 7f3fb7595ca8 ip 00007f3fb61e353a sp 00007f3fb7595cb0
      error 6 in libc-2.17.so[7f3fb60b7000+1b6000]
    - fix unset tsd group name handling.
  - Related: rhbz#1435736


author: Ian Kent <ikent@redhat.com> - 5.0.7-69
changelog:
  - bz1435736 - autofs fails with kernel: automount[3386]:
      segfault at 7f3fb7595ca8 ip 00007f3fb61e353a sp 00007f3fb7595cb0
      error 6 in libc-2.17.so[7f3fb60b7000+1b6000]
    - fix a couple of covarity warning resulting in group name handling change.
  - Related: rhbz#1435736


author: Ian Kent <ikent@redhat.com> - 5.0.7-70.el7_4
changelog:
  - bz1503945 - autofs option parsing for maps with fstype=autofs no longer
    works [rhel-7.4.z]
    - revert fix argc off by one in mount_autofs.c.
  - bz1503946 - autofs map entry options field does not accept dot character
    [rhel-7.4.z]
    - allow dot in OPTIONSTR value lexer pattern.
    - handle additional nfs versions in mount_nfs.c.
  - Resolves: rhbz#1503945 rhbz#1503946


author: Ian Kent <ikent@redhat.com> - 5.0.7-70.el7_4.1
changelog:
  - bz1515311 - Automount cannot access host shares after a reboot [rhel-7.4.z]
    - reset master map list on startup retry.
  - Resolves: rhbz#1515311


author: Ian Kent <ikent@redhat.com> - 5.0.7-60
changelog:
  - bz1382093 - Improve logging in autofs
     - add the mount requestor's pid to pending_args.
     - create thread-local ID for mount attempts.
     - log functions to prefix messages with attempt_id if available.
     - factor out set_thread_mount_request_log_id().
     - add config option to use mount request log id.
  - Resolves: rhbz#1382093


author: Petr Spacek <pspacek@redhat.com> - 9.0-1
changelog:
  - update to latest upstream version
  - related: #1292145 Rebase bind-dyndb-ldap to latest upstream version


author: Petr Spacek <pspacek@redhat.com> - 10.0-1
changelog:
  - update to latest upstream version
  - resolves: #1292145 Rebase bind-dyndb-ldap to latest upstream version


author: Tomas Krizek <tkrizek@redhat.com> - 11.1-1
changelog:
  - update to letest upstream version
  - resolves: #1393889 Rebase to bind-dyndb-ldap 11+
  - resolves: #1165796 bind-dyndb-ldap crashes if server is shutting down and connection to LDAP is down
  - resolves: #1413805 bind-dyndb-ldap default schema is shipped with syntax error


author: Nick Clifton <nickc@redhat.com> 2.27-1.base
changelog:
  - Rebase on FSF binutils 2.27
  + Retire: binutils-2.20.51.0.2-ia64-lib64.patch
  + Retire: binutils-2.20.51.0.10-copy-osabi.patch
  + Retire: binutils-rh1260158.patch
  + Retire: binutils-rh1300734.patch
  + Retire: binutils-2.25.1-aarch64-overflow-warnings.patch
  + Retire: binutils-2.25-aarch64-pr18668.patch
  + Retire: binutils-2.25.1-aarch64-pagesize.patch
  + Retire: binutils-rh1304451.patch
  + Retire: binutils-2.25.1-x86-Zepplin.patch
  + Retire: binutils-2.25.1-power9.patch
  + Retire: binutils-2.25.1-x86-mwaitx.patch
  + Retire: binutils-rh1162655.patch
  + Retire: binutils-2.25.1-aarch64-arch-extension.patch
  + Retire: binutils-2.25.1-s390-z13.patch
  + Retire: binutils-2.25.1-gold-resolving-to-hidden-symbols.patch
  - Import Power9 bug fixes from FSF mainline.
    (#1356856)


author: Nick Clifton <nickc@redhat.com> - 2.27-8.base
changelog:
  - Restore rebase to 2.27.
    (#1449585)
    (#1449586)
  - Disable patch for BZ 1406430 - it prevents building correct s390 binaries.
    (#1406430)
    (#1447209)
  - Fix generation of PLT entries for s390 binaries.
    (#1440168)


author: Don Zickus <dzickus@redhat.com> 5.41-1
changelog:
  - Update to 5.41
  - obexd fixes to prevent crashes
  - add /etc/bluetooth/main.conf config file
  Resolves: #1313363, #1336476, #1338895


author: David Arcari <darcari@redhat.com> 5.44-1
changelog:
  - Update to 5.44
  - Ship btattach tool
  - Configure systemctl settings for bluez-obex correctly
  - Add Provides: bluez-obexd
  Resolves: #1434581, #1401501


author: Karanbir Singh <kbsingh@centos.org> 7.0.el7.0.140617.3
changelog:
  - rebuild for 2014-06-17 pub qa release
  - ensure we get the right cpe info
  - ensure centos-release is trackable


author: Karanbir Singh <kbsingh@centos.org>
changelog:
  - Trial run for CentOS DateStamp release
  - Add stubs for the yum repos
  - fix os-release to only have one ID_LIKE ( Avij #7171)
  - make the yum repo definitions be config noreplace ( Trevor )


author: Karanbir Singh <kbsingh@centos.org>
changelog:
  - Roll in the final name change conversation results
  - Stage for release content
  - Add yum repos
  - Add distro keys ( incomplete )


author: Karanbir Singh <kbsingh@centos.org>
changelog:
  - add a yum var to route mirrorlist accurately
  - add CentOS-fastrack repo
  - Trim the CentOS-Debug-7 key
  - rename the Debug repo to base-debug so yum-utils can consume easier


author: Karanbir Singh <kbsingh@centos.org>
changelog:
  - Bump Release for 1503 
  - add ABRT specific content to os-release
  - split redhat-release from centos-release


author: Lars Kellogg-Stedman <lars@redhat.com> 0.7.9-6
changelog:
  - add power-state-change module to cloud_final_modules (rhbz#1252477)
  - remove 'tee' command from logging configuration (rhbz#1424612)
  - limit permissions on def_log_file (rhbz#1424612)
  - Bounce network interface for Azure when using the built-in path. (rhbz#1434109)
  - OpenStack: add 'dvs' to the list of physical link types. (rhbz#1442783)


author: Lars Kellogg-Stedman <lars@redhat.com> 0.7.9-7
changelog:
  - Add missing sysconfig unit test data (rhbz#1438082)
  - Fix dual stack IPv4/IPv6 configuration for RHEL (rhbz#1438082)
  - sysconfig: Raise ValueError when multiple default gateways are present. (rhbz#1438082)
  - Bounce network interface for Azure when using the built-in path. (rhbz#1434109)
  - Do not write NM_CONTROLLED=no in generated interface config files (rhbz#1385172)


author: Lars Kellogg-Stedman <lars@redhat.com> 0.7.9-9
changelog:
  - RHEL/CentOS: Fix default routes for IPv4/IPv6 configuration. (rhbz#1438082)
  - azure: ensure that networkmanager hook script runs (rhbz#1440831 rhbz#1460206)
  - Fix ipv6 subnet detection (rhbz#1438082)


author: Dominik Perpeet <dperpeet@redhat.com> 138-3
changelog:
  - Fix issues with connections between multiple hosts
  - Fix format string type mismatch on some architectures


author: Martin Pitt <mpitt@redhat.com> 138-10
changelog:
  - Backport upstream patches to fix integration tests
  - Fix unit test failure in mock with nspawn
  - Fix created timer units so that they can actually get enabled and started
    rhbz#1478832
  - Fix connecting to remote servers with non-standard ssh port rhbz#1478828


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-2
changelog:
  - Resolves: rhbz#1363654

  - Config: Flag config uidgid entries (rhbz#1363654)
  - merge upstream commit f837f95dfe96d60f2367e900efd4def7a07b2a89 (rhbz#1363654)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-3
changelog:
  - Related: rhbz#1363654

  - Enhance spec so corosync-qdevice subpackage depends on same version of
    the corosync and corosynclib packages.


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-4
changelog:
  - Resolves: rhbz#1367813

  - Man: Fix corosync-qdevice-net-certutil link (rhbz#1367813)
  - merge upstream commit 49a9f722bba13e4b2762151b7b96b1d4196fd5e0 (rhbz#1367813)
  - man: mention qdevice incompatibilites in votequorum.5 (rhbz#1367813)
  - merge upstream commit 0da1b7446239424b76b1d5eb7c3640afce9b054e (rhbz#1367813)
  - Qnetd LMS: Fix two partition use case (rhbz#1367813)
  - merge upstream commit b0c850f308d44ddcdf1a1f881c1e1142ad489385 (rhbz#1367813)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-6
changelog:
  - Resolves: rhbz#1371880

  - libvotequorum: Bump version (rhbz#1371880)
  - merge upstream commit 96f91f23a6a413535cc2f0e8492e2300373fed40 (rhbz#1371880)
  - votequorum: Don't update expected_votes display if value is too high (rhbz#1371880)
  - merge upstream commit 596433066805af029be1292a37a35ce31307f0bf (rhbz#1371880)
  - votequorum: simplify reconfigure message handling (rhbz#1371880)
  - merge upstream commit 4a385f2e94c7168dbd92168c54a80ee97a3c2140 (rhbz#1371880)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-7
changelog:
  - Related: rhbz#1371880

  - Fix build on RHEL7.3 latest (rhbz#1371880)
  - merge upstream commit 19e48a6eee20d5f34f79a3b8d4e1c694169c1d7b (rhbz#1371880)
  - Enable aarch64 build (bz#1422598)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-8
changelog:
  - Resolves: rhbz#1434528
  - Resolves: rhbz#1434529
  - Resolves: rhbz#1434534

  - cfg: Prevents use of uninitialized buffer (rhbz#1434528)
  - merge upstream commit 52e6ae57ea06d0bef61c5c9250881bef1372ead2 (rhbz#1434528)
  - man: Fix typos in man page (rhbz#1434529)
  - merge upstream commit b642904ea9640bd7a1573a8c0d2c5bcb43a10dfc (rhbz#1434529)
  - Fix typo: Destorying -> Destroying (rhbz#1434529)
  - merge upstream commit 117d9e4eb77ef9941fdeaf17ddfd892514da8143 (rhbz#1434529)
  - init: Add doc URIs to the systemd service files (rhbz#1434529)
  - merge upstream commit 21a728785027483786e41c19f6aff57a95b80aa5 (rhbz#1434529)
  - man: Modify man-page according to command usage (rhbz#1434529)
  - merge upstream commit 79898e8cb1715e79b7467b91661b7341e2664550 (rhbz#1434529)
  - Totempg: remove duplicate memcpy in mcast_msg func (rhbz#1434528)
  - merge upstream commit 4a8e9d80409590cb42732ae3105b5ae71fda52c1 (rhbz#1434528)
  - upstart: Add softdog module loading example (rhbz#1434529)
  - merge upstream commit 75474d69bebea6c9c4ef2252476ce738cf92f0f4 (rhbz#1434529)
  - Remove deprecated doxygen flags (rhbz#1434529)
  - merge upstream commit b252013e42007ea7284ae54d035a30ca40f20fc0 (rhbz#1434529)
  - Remove redundant header file inclusion (rhbz#1434528)
  - merge upstream commit d6c7ade277a4a23d84c56d7fde6b60b377a1023b (rhbz#1434528)
  - Qdevice: fix spell errors in qdevice (rhbz#1434529)
  - merge upstream commit d9caa09c45d4560c89a1ad873087c0476cabab46 (rhbz#1434529)
  - doc: document watchdog_device parameter (rhbz#1434529)
  - merge upstream commit a5f97ae1b99063383d8f45168125b34232b91faf (rhbz#1434529)
  - Logsys: Change logsys syslog_priority priority (rhbz#1434534)
  - merge upstream commit 609cc0cc100aa1070d97b405273373682da0e270 (rhbz#1434534)
  - logconfig: Do not overwrite logger_subsys priority (rhbz#1434534)
  - merge upstream commit c866a2f8603b44e89eb21a6cf7d88134af2e8b66 (rhbz#1434534)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-9
changelog:
  - Resolves: rhbz#1445001

  - Main: Call mlockall after fork (rhbz#1445001)
  - merge upstream commit 238e2e62d8b960e7c10bfa0a8281d78ec99f3a26 (rhbz#1445001)
  - Disable aarch64 build (bz#1422598)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-9.1
changelog:
  - Resolves: rhbz#1477461

  - main: Add option to set priority (rhbz#1477461)
  - merge upstream commit a008448efb2b1d45c432867caf08f0bcf2b4b9b0 (rhbz#1477461)
  - main: Add support for libcgroup (rhbz#1477461)
  - merge upstream commit c56086c701d08fc17cf6d8ef603caf505a4021b7 (rhbz#1477461)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-9.2
changelog:
  - Resolves: rhbz#1484264

  - totem: Propagate totem initialization failure (rhbz#1484264)
  - merge upstream commit 0413a8f4672352171f0df731b7d9c1fe20acbc4c (rhbz#1484264)
  - totemcrypto: Refactor symmetric key importing (rhbz#1484264)
  - merge upstream commit a885868181c07ba9ab5cdfdad1d66d387b2a4428 (rhbz#1484264)
  - totemcrypto: Use different method to import key (rhbz#1484264)
  - merge upstream commit 5dadebd21862074deaeb9a337fc9e49f5e9f692a (rhbz#1484264)
  - totemcrypto: Fix compiler warning (rhbz#1484264)
  - merge upstream commit fdeed33f514e0056e322a45d9a0a04ca4b9a2709 (rhbz#1484264)


author: Pavel Raiskup <praiskup@redhat.com> - 2.11-17
changelog:
  - fix small memory leak in copyin.c (#919454)
  - remove %defattr and install 'cpio' to real %{_bindir}
  - CovScan: add %{?_rawbuild}


author: Pavel Raiskup <praiskup@redhat.com> - 2.11-20
changelog:
  - fix another bogus date in changelog
  - update config.guess/config.sub for aarm64 build (#925189)
  - run autoreconf instead of autoheader


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-8
changelog:
  - fix a bug in C++ ref-to-ptr conversion (#1344807)
  - fix combiner handling of jumps on aarch64 (#1344672,
    PR rtl-optimization/52714)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-9
changelog:
  - backport OpenMP 4.5 support to libgomp (library only; #1357060,
    PRs libgomp/68579, libgomp/64625)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-11
changelog:
  - on aarch64 emit scheduling barriers before stack deallocation in
    function epilogues (#1362635, PR target/63293)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-12
changelog:
  - fix up std::rethrow_exception (#1375711, PR libstdc++/62258)
  - use _Unwind_GetIPInfo in __gcc_personality_v0 (#1387402, PR libgcc/78064)
  - fix vec_vsx_ld/st on ppc64le (#1389801, PR target/72863, PR target/78084)
  - fix ICE in gfc_compare_derived_types (#1369183)
  - fix EH from C++ thunks (#1427412, PR ipa/68184)
  - on ppc64{,le} emit nop after recursive call if the current function
    is replaceable (#1420723, PR target/79439)
  - on aarch64 with -frounding-math use fnmul only with -(a*b) and not
    with (-a)*b (#1418446, PR target/66731)
  - constrain std::valarray functions and operators (#1416214,
    PR libstdc++/69116)
  - fix gimplification of aggregate assignments when lhs is used
    (#1396298, PR middle-end/72747, PR c/78408)
  - fix aarch64 TLS with -mcmodel=large (#1389276, PR target/78796)
  - fix aarch64 reloading of floating point constants into general purpose
    registers (#1349067, PR target/70549)
  - fix DW_AT_decl_line on DW_TAG_enumeration_type for C enumeration
    definitions following forward declarations (#1423460, PR c/79969)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-13
changelog:
  - add -mstack-protector-guard={tls,global}, -mstack-protector-guard-reg=
    and -mstack-protector-guard-offset= options on ppc* (#1415952,
    PR target/78875)


author: Dave Anderson <anderson@redhat.com> - 7.1.2-3
changelog:
  - crash fails to read or wrongly reads some parts of memory in sadump vmcore format
    Resolves: rhbz#1282997


author: Dave Anderson <anderson@redhat.com> - 7.1.5-1
changelog:
  - Rebase to upstream version 7.1.5
    Resolves: rhbz#1292566
  - Decode clflushopt instruction
    Resolves: rhbz#1262479
  - Support AArch64 QEMU generated dumps 
    Resolves: rhbz#1299873
  - crash: zero-size memory allocation (aarch64) 
    Resolves: rhbz#1312738


author: Dave Anderson <anderson@redhat.com> - 7.1.5-2
changelog:
  - Fix for kernel module symbol gathering when the ordering of module
    symbol name strings does not match the order of the kernel_symbol
    structures.
  - Resolves: rhbz#1375130


author: Dave Anderson <anderson@redhat.com> - 7.1.8-1
changelog:
  - Rebase to upstream version 7.1.8
    Resolves: rhbz#1393534
  - POWER9 - Power ISA 3.0 related support for crash utility
    Resolves: rhbz#1368711
  - crash package update - ppc64/ppc64le
    Resolves: rhbz#1384944
  - exception RIP: unknown or invalid address
    Resolves: rhbz#1350457
  - Crash does not always parse correctly the modules symbol tables
    Resolves: rhbz#1360415
  - ARM64: crash live system from: WARNING: cannot read linux_banner string
    Resolves: rhbz#1392007
  - kmem: invalid structure member offset: page_count
    Resolves: rhbz#1392011
  - Kernel address space randomization [KASLR] support 
    Resolves: rhbz#1392658
  - invalid structure size: tnt
    Resolves: rhbz#1420653


author: Dave Anderson <anderson@redhat.com> - 7.1.9-1
changelog:
  - Rebase to upstream version 7.1.9
    Resolves: rhbz#1393534
  - Fix gdb "set scope" option for KASLR kernels.
    Resolves: rhbz#1440725
  - Fix for the determination of the x86_64 "phys_base" value when it is
    not passed in the VMCOREINFO data of ELF vmcores
    Resolves: rhbz#1439170


author: Dave Anderson <anderson@redhat.com> - 7.1.9-2
changelog:
  - Rebase to github commits 87179026 to ad3b8476
    Resolves: rhbz#1393534
  - Prohibit native gdb disassemble command when KASLR
    Resolves: rhbz#1445649


author: Adrian Reber <areber@redhat.com> - 2.12-3
changelog:
  - Removed aio-fix.patch for rhel-alt-7.4 rebuild
  - Made spec-file rhel-alt-7.4 defines aware
  - Rebuilt for rhel-alt-7.4 to pick up correct kernel defines
  - Added aarch64 architecture for rhel-alt-7.4


author: Ondrej Kozina <okozina@redhat.com> - 1.6.7-1
changelog:
  - Update to cryptsetup 1.6.7.
  - patch: avoid use of kernel crypto API socket which is known
    to be broken in RHEL7.0 kernel (7.1+ is fine).
  - Resolves: #1206170


author: Andreas Schneider <asn@redhat.com> - 4.6.2-7
changelog:
  - resolves: #1461336 - Fix smbclient username parsing
  - resolves: #1460937 - Fix username normalization with winbind


author: Andreas Schneider <asn@redhat.com> - 4.6.2-10
changelog:
  - resolves: #1484423 - Require at least krb5 version 1.15.1
  - resolves: #1484713 - Fix password changes for users via smbpasswd
  - resolves: #1484723 - Be more graceful on FSCTL_VALIDATE_NEGOTIATE_INFO
                         returned errors


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-34
changelog:
  - acknowledge the --no-sessionid/CURLOPT_SSL_SESSIONID_CACHE option
    (required by the fix for CVE-2016-5419)


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-37
changelog:
  - fix tight loop in non-blocking TLS handhsake over proxy (#1388162)
  - handle cookies with numerical IPv6 address (#1341503)
  - make libcurl recognize chacha20-poly1305 and SHA384 cipher-suites (#1374740)
  - curl -E: allow to escape ':' in cert nickname (#1376062)
  - run automake in %prep to avoid patching Makefile.in files from now on


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.49.31-1
changelog:
  - ipv6: wait for all global IPv6 addresses to leave the "tentative" state
  - source_config: tell NetworkManger to load ifcfg file even for NM_CONTROLLED=no
  - ifup-aliases: inherit ARPCHECK from parent device
  - rhel-dmesg: don't start in containers
  - ifup-eth: fix typo in error message (#1038776)
  - sysctl.conf: steal comments about /usr,/etc,... from fedora's sysctl.conf
  - rwtab: /var/lib/nfs needs to copy the files
  - functions: improve killing loops
  - ipcalc: detect invalid mask
  - ifup: set valid_lft and preferred_lft to forever for static ip
  - service: use systemd mangle for given service
  - ifup-post: check resolve.conf also with DNS2
  - ifdown-post: remove resolv.conf only in specific cases
  - spec: ghost /var/log/dmesg
  - network-functions: is_available_wait should wait even in the case that is_available returns 2
  - autorelabel: turn quota off before relabeling
  - autorelabel: call dracut-initramfs-restore before forced reboot


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.38-1
changelog:
  - ifdown-eth: we need to flush global scope as well
  - killproc/status: add missing '-b <binary>' option
  - specfile: mark 'rwtab' and 'statetab' as config files
  - spec: we need newer lvm
  - rwtab: add /var/lib/systemd/timers
  - ifup-eth: remove quote marks
  - 9.70-sync: Move everything to github
  - 9.70-sync: rwtab updated
  - 9.70-sync: service file updated
  - 9.70-sync: syconfig.txt updated
  - 9.70-sync: systemd/rhel-import-state updated
  - 9.70-sync: sysconfig/network-scripts/* updated - part 2
  - 9.70-sync: sysconfig/network-scripts/* updated - part 1
  - 9.70-sync: rc.d/init.d/network updated
  - 9.70-sync: rc.d/init.d/netconsole updated
  - 9.70-sync: rc.d/init.d/functions updated
  - 9.70-sync: ipv6-6to4.howto example updated
  - 9.70-sync: examples/networking/ifcfg-bridge updated
  - network: load NetworkManager connection via dbus
  - network: check for running NetworkManager via dbus


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.39-1
changelog:
  - sysconfig.txt: mention previously introduced NO_DHCP_HOSTNAME option
  - DHCP_FQDN and DHCP_SEND_HOSTNAME introduced
  - re-add missing $HOSTNAME initialization
  - ifup: add support for VLAN_EGRESS_PRIORITY_MAP
  - rhel-autorelabel: synchronize cached writes before reboot


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-104
changelog:
  - Change _pkgconfdir from /usr/share/pkgconfig to /usr/lib/pkgconfig
  - Modify 0209-UPBZ-1430097-multipath-C-API.patch
    * change _pkgconfdir and fixed double-closing fd
  - Add 0211-RH-strlen-fix.patch
    * checks that variables are not NULL before passing them to strlen
  - Related: bz #1430097


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-107
changelog:
  - Modify 0197-RHBZ-1394059-max-sectors-kb.patch
    * Make multipath only change max_sectors_kb on creates. On reloads, it
      just makes sure the new path matches the multipath device.
  - Refresh 0198-RHBZ-1372032-detect-path-checker.patch
  - Refresh 0201-RHBZ-1403552-silence-warning.patch
  - Refresh 0206-RHBZ-1239173-pt2-no-paths.patch
  - Refresh 0207-UP-add-libmpathcmd.patch
  - Refresh 0212-RHBZ-1431562-for-read-only.patch
  - Resolves: bz #1394059


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-109
changelog:
  - Add 0214-RHBZ-1392115-set-paths-not-ready.patch
    * Set ENV{SYSTEMD_READY}="0" on multipath path devices
  - Resolves: bz #1392115


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-110
changelog:
  - Add 0215-RHBZ-1444194-fix-check-partitions.patch
    * make sure kpartx partions match the correct device
  - Add 0216-RHBZ-1448562-fix-reserve.patch
    * don't join threads that haven't been created
  - Add 0217-RHBZ-1437329-blacklist-oracle-devs.patch
    * blacklist db2.* devices
  - Add 0218-RHBZ-1448576-3PAR-config.patch
  - Resolves: bz #1444194, #1448562, #1437329, #1448576


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-111
changelog:
  - Remove 0217-RHBZ-1437329-blacklist-oracle-devs.patch
    * Incorrect change, and the bug is already fixed.
  - Move 0218-RHBZ-1448576-3PAR-config.patch to
    0217-RHBZ-1448576-3PAR-config.patch
  - Resolves: bz #1448576


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-111.1
changelog:
  - Add 0218-RHBZ-1510837-add-feature-fix.patch
    * handle null feature string
  - Add 0219-RHBZ-1510834-unpriv-sgio.patch
    * add unpriv_sgio configuration option to set unpriv_sgio on multipath device
      and paths
  - Add 0220-RHBZ-1510834-prkey.patch
    * allow setting reservation_key to "file" to set and read keys from
      prkey_file. Also add new multipathd commands to modify the prkey file.
  - Add 0221-RHBZ-1510839-nimble-config.patch
  - Resolves: bz #1510834, #1510837, #1510839


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-111.2
changelog:
  - Modify Add 0220-RHBZ-1510834-prkey.patch
    * Improve error checking for mpathpersist
  - Resolves: bz #1510834


author: Peter Rajnoha <prajnoha@redhat.com> - 0.6.2-2
changelog:
  - Improve documentation and messages on output file preallocation
    when using thin_repair and thin_restore.


author: Peter Rajnoha <prajnoha@redhat.com> - 0.7.0-0.1-rc3
changelog:
  - Update to latest upstream release including various bug fixes and new features.
  - New thin_show_duplicates command.
  - Add '--skip-mappings' and '--format custom' options to thin_dump.


author: Peter Rajnoha <prajnoha@redhat.com> - 0.7.0-0.1-rc6
changelog:
  - Don't open devices as writeable if --clear-needs-check-flag is not set.
  - Fix cache metadata format version 2 superblock packing.


author: Pavel Zhukov <pzhukov@redhat.com> - 12:4.2.5-55
changelog:
  - Resolves: #1349044 - Add disclamer for chaging /etc/dhcp permission for scripts
  - Fix syntax error in attr


author: Petr Menšík <pemensik@redhat.com> - 2.76-1
changelog:
  - Rebase to 2.76 (#1375527)
  - Include also dhcp_release6 (#1375569)
  - Fix compilation warnings
  - Correct manual about interface aliases, warn if used without --bind*


author: Petr Menšík <pemensik@redhat.com> - 2.76-2
changelog:
  - Fix a few coverity warnings
  - package is dual-licensed GPL v2 or v3
  - don't include /etc/dnsmasq.d in triplicate, ignore RPM backup files instead


author: Petr Menšík <pemensik@redhat.com> - 2.76-2.1
changelog:
  - Fix CVE-2017-14491
  - Fix CVE-2017-14492
  - Fix CVE-2017-14493
  - Fix CVE-2017-14494
  - Fix CVE-2017-14496
  - Fix CVE-2017-14495
  - extra fixes


author: Lukáš Nykrýn <lnykryn@redhat.com> - 033-487
changelog:
  - add upstream tests
  - dracut.sh: fail hard, if we find modules and modules.dep is missing
  Resolves: rhbz#1298656
  - add dracut.pc pkg-config file
  Resolves: rhbz#1397853
  - systemd/dracut-cmdline.sh: unset "UNSET" $root
  Releated: rhbz#1365667
  - dracut.conf.5.asc: add Warning about leading and trailing spaces in lists
  - fips/module-setup.sh: make tcrypt non-optional


author: Lukáš Nykrýn <lnykryn@redhat.com> - 033-495
changelog:
  - ifup: don't ifup team master indefinitely
  Resolves: rhbz#1416958
  - write-ifcfg: do't write MTU twice for regular eth devices
  Resolves: rhbz#1366163
  - network/ifup: write override file before dhcp_do
  Resolves: rhbz#1415004


author: Lukáš Nykrýn <lnykryn@redhat.com> - 033-499
changelog:
  - module-setup.sh: Add ARM specific driver to initramfs image
  Resolves: #1459277
  - Revert "systemd/dracut-initqueue.sh: don't go into emergency"
  Resolves: #1396865
  - udev-rules: pull in 40-redhat-cpu-hotplug.rules
  Resolves: #1460707


author: Kamil Dudka <kdudka@redhat.com> - 0.12-0.34.pre6
changelog:
  - update to latest upstream pre-release
  - drop unneeded patches
  - fix autoconf warnings
  - explicitly disable using OpenSSL and GnuTLS


author: Petr Stodulka <pstodulk@redhat.com> -1.8.3.1-9
changelog:
  - add control of GSSAPI credential delegation to enable HTTP(S)-SSO
    authentication
    Resolves: #1369173


author: Marek Grac <mgrac@redhat.com> - 4.0.11-57
changelog:
  - Set SELinux booleans required for fence agent integration with cluster
    Resolves: rhbz#1427986
  - Add consistency of parameters between STDIN and command-line
    Resolves: rhbz#1403028


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.0.11-66.3
changelog:
  - fence_compute/fence_scsi: fix issue with some parameters
    (for ABI compatibility)
    Resolves: rhbz#1497241


author: David King <dking@redhat.com> - 0.8.4-2
changelog:
  - Sync bzip2 dependency with Fedora package
  - Make the libs subpackage depend on the base package for libostree
  - Fix multilib issues with XML-based documentation


author: Colin Walters <walters@verbum.org> - 0.8.7-2
changelog:
  - Fix libostree bundling:
    Ensure we do not Provide or Require libostree.
    Move the shared library into flatpak-libs so flatpak always
    depends on it.
    Keep the shared library filename as libostree, but put it
    under a private directory.  Renaming the file on disk did not
    really do much since the dynamic linker and RPM work from the
    soname.
    Resolves: #1476905
  - Tweak build to work both with and without BZ#1392354


author: David King <dking@redhat.com> - 0.8.7-3
changelog:
  - Fix crasher in xdg-desktop-portal
  - Tweak spec file so it still builds even though we need to
    autoreconf.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.12-1
changelog:
  - Upgrade to upstream v3.0.12 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.7 or later minor release
    Resolves: Bug#1358989 FreeRADIUS stops reading the accounting packets from the
                          detail file
    Resolves: Bug#1269217 FreeRADIUS triggers mprotect with large radius reply
    Resolves: Bug#1344183 radiusd crashed in rbtree_find() after receiving a packet
    Resolves: Bug#1370431 FreeRADIUS fails to establish LDAP connections under
                          load
    Resolves: Bug#1397981 [abrt] freeradius: radiusd killed by SIGSEGV


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.12-2
changelog:
  - Do not fail logrotate if radiusd is not running.
    Resolves: Bug#1365226 error running non-shared postrotate script for
                          /var/log/radius/radius.log of
                          '/var/log/radius/radius.log '
  - Fix output to log file specified with -l option.
    Resolves: Bug#1421207 radiusd does not work with log file specified by -l
                          option
  - Fix long hostnames interpreted as IP addresses.
    Resolves: Bug#1420359 radclient does not detect 4. level and higher domain
                          name as a domain name
  - Avoid clashes with libtool library symbols.
    Resolves: Bug#1391960 undefined symbol: get_vtable in
                          /usr/lib64/libtdsodbc.so.0 with freeradius-unixODBC
  - Remove mentions of Auth-Type = System from docs.
    Resolves: Bug#1420293 Freeradius does not know Auth-Type = System
  - Improve ip/v4/v6/addr documentation.
    Resolves: Bug#1179736 add description for ipaddr = hostname from DNS with A
                          and AAAA entries


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-1
changelog:
  - Upgrade to upstream v3.0.13 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release
    Resolves: Bug#1329181 freeradius-python fix libpython2.7.so dependency at
                          compile time
    Resolves: Bug#1425869 Radiusd does not trigger modules.sql.fail trap if it
                          can't connect to mysql server
    Resolves: Bug#1427829 Stack overflow when passing bare IPv6 to radclient


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-2
changelog:
  - Fix some issues found with static analyzers.
    Resolves: Bug#1432103 FreeRADIUS fails covscan checks
  - Revert rlm_eap_tnc removal, because the tncfhh package is still in RHEL.
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-3
changelog:
  - Explicitly disable rlm_cache_memcached to avoid error when the module's
    dependencies are installed, and it is built, but not packaged.
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release
  - Prevent segfaults by adding a missing handling of connection errors in
    rlm_ldap.
    Resolves: Bug#1437409 [abrt] freeradius: radiusd killed by SIGSEGV
  - Make radtest use Cleartext-Password for EAP, fixing its support for eap-md5.
    Resolves: Bug#1436619 radtest does not work with eap-md5


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-4
changelog:
  - Disable internal OpenSSL cache.
    Resolves: Bug#1458746 CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass
  - Check sizeof(*packet), not sizeof(packet) in EAP-PWD
    Resolves: Bug#1459073 Potential buffer overflow in FreeRADIUS EAP-PWD
  - Parse port as well as address for dhcpclient destination
    Resolves: Bug#1457825 dhcpclient does no accept IP:PORT


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-5
changelog:
  - Refer to correct package version in configuration comments for Bug#1458746
    (CVE-2017-9148) fix.
    Related: Bug#1458746  CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-6
changelog:
  - Avoid race condition when creating session cache file
    Resolves: Bug#1458746 CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-7
changelog:
  - Resolves: Bug#1469409 CVE-2017-10978 freeradius: Out-of-bounds read/write due
                          to improper output buffer size check in make_secret()
  - Resolves: Bug#1469413 CVE-2017-10983 freeradius: Out-of-bounds read in
                          fr_dhcp_decode() when decoding option 63
  - Resolves: Bug#1469414 CVE-2017-10984 freeradius: Out-of-bounds write in
                          data2vp_wimax()
  - Resolves: Bug#1469417 CVE-2017-10985 freeradius: Infinite loop and memory
                          exhaustion with 'concat' attributes
  - Resolves: Bug#1469418 CVE-2017-10986 freeradius: Infinite read in
                          dhcp_attr2vp()
  - Resolves: Bug#1469421 CVE-2017-10987 freeradius: Buffer over-read in
                          fr_dhcp_decode_suboptions()


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-8
changelog:
  - Avoid misinterpreting zero-size malloc in data2vp_extended() fix.
  - Related: Bug#1469414 CVE-2017-10984 freeradius: Out-of-bounds write in
                         data2vp_wimax()


author: Ray Strode <rstrode@redhat.com> - 3.22.3-4
changelog:
  - Drop reference to wayland in config file
  - use autosetup to simplify spec maintenance
    Related: #1386862


author: Ray Strode <rstrode@redhat.com> 3.22.3-8
changelog:
  - Reap transient login screens when they are no longer needed
  - Jump to login screen if we end up on a blank VT
    Resolves: #1301028


author: Ray Strode <rstrode@redhat.com> - 3.22.3-10
changelog:
  - Add patches to try to maintain some semblance of compatibility
    when live upgrading between 7.3 and 7.4
    Related: #1448786


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-21
changelog:
  - Added security fixes for:
    - CVE-2013-5653 (bug #1380327)
    - CVE-2016-7977 (bug #1380415)
    - CVE-2016-7978 (bug #1382300)
    - CVE-2016-7979 (bug #1382305)
    - CVE-2016-8602 (bug #1383940)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-25
changelog:
  - Added security fix for CVE-2017-7207 (bug #1434353)
  - Added explicit requirement for lcms2 version we are build with (bug #1436273)


author: Carlos O'Donell <carlos@redhat.com> - 2.17-190
changelog:
  - Add transparent lock elision for default POSIX mutexes on
    Intel hardware with support for Intel TSX (#841653).
  - Update dynamic loader trampoline for Intel Skylake server (#1421155).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-191
changelog:
  - Add transparent lock elision for default POSIX mutexes on
    IBM POWER hardware with support for IBM POWER HTM (#731835).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-192
changelog:
  - Exclude lock elision support for older Intel hardware with
    Intel TSX that has hardware errata (#841653).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-196.2
changelog:
  - Update HWCAP bits for IBM POWER9 DD2.1 (#1515114)
  - Improve memcpy performance for POWER9 DD2.1 (#1516402)


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 1.8.9-2
changelog:
  - Remove bundled JARs and classes
  - Add workaround for rhbz#971483
  - Add Public Domain to licenses
  - Install ASL 2.0 license text, resolves: rhbz#858257


author: Peter Jones <pjones@redhat.com> - 2.02-0.60
changelog:
  - Fix ppc64 deciding /boot/efi might somehow be the CHRP partition if it
    exists.  This is also why the bug we fixed in 0.59 showed up at all.
    Resolves: rhbz#1443809
    Resolves: rhbz#1442970
  - Fix a regexp problem where rpm spec parser un-escapes things that
    don't need escaping, which causes our s/-mcpu=power8/-mcpu=power6/
    to fail.
    Related: rhbz#1443809


author: Peter Jones <pjones@redhat.com> - 2.02-0.61
changelog:
  - Fix some minor ia32 booting bugs
    Related: rhbz#1310763
    Related: rhbz#1411748
    Related: rhbz#1300009
  - Add support for non-Ethernet network cards
    Related: rhbz#1232432
  - Add support for http booting
    Resolves: rhbz#1232432
  - Fix efi module subpackage obsoletes/provides
    Resolves: rhbz#1447723
  - Make ppc modules subpackages use different directories on the filesystem.
    Resolves: rhbz#1455243


author: Peter Jones <pjones@redhat.com> - 2.02-0.65.1
changelog:
  - More precise requires and obsoletes on the -tools* subpackages to avoid
    issues with mixing and matching repos the subpackages are split between.
    Resolves: rhbz#1499669


author: CentOS Sources <bugs@centos.org> - 2.02-0.65.el7.centos.2
changelog:
  - Roll in CentOS Secureboot keys
  - Move the edidir to be CentOS, so people can co-install fedora, rhel and centos


author: Fabiano Fidêncio <fidencio@redhat.com> - 2.7.1-5
changelog:
  - Bump http-parser release number to avoid people pulling EPEL package instead
    of RHEL package
    Resolves: rhbz#1480321


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-60
changelog:
  - Resolves: #1414258 - Crash during restart or at startup in mod_ssl,
    in certinfo_free() function registered by ssl_stapling_ex_init()


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-61
changelog:
  - Related: #1414258 - Crash during restart or at startup in mod_ssl,
    in certinfo_free() function registered by ssl_stapling_ex_init()


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-62
changelog:
  - Resolves: #1397241 - Backport Apache Bug 53098 - mod_proxy_ajp:
    patch to set worker secret passed to tomcat


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-64
changelog:
  - Resolves: #1442872 - apache user is not created during httpd installation
    when apache group already exist with GID other than 48


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-67.2
changelog:
  - Resolves: #1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw()
    authentication bypass
  - Resolves: #1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer dereference
  - Resolves: #1463207 - CVE-2017-7679 httpd: mod_mime buffer overread
  - Resolves: #1463205 - CVE-2017-7668 httpd: ap_find_token() buffer overread
  - Resolves: #1470748 - CVE-2017-9788 httpd: Uninitialized memory reflection
    in mod_auth_digest


author: CentOS Sources <bugs@centos.org> - 2.4.6-67.el7.centos.2
changelog:
  - Remove index.html, add centos-noindex.tar.gz
  - change vstring
  - change symlink for poweredby.png
  - update welcome.conf with proper aliases


author: Jarod Wilson <jarod@redhat.com> - 13-1
changelog:
  - Update to rdma-core v13 release (rhbz 1404035)
  - Mellanox mlx5 Direct Verbs support (rhbz 1426430)
  - Get build working on s390x, less mlx5 (rhbz 1434029)


author: Jarod Wilson <jarod@redhat.com> 13-6
changelog:
  - Clean up htonll/ntohll handling for opa-ff/infiniband-diags compile
  - Add necessary Provides/Obsoletes for old -static packages
  - Remove ibverbs providers that we aren't currently able to support
  - Resolves: rhbz#1453096, rhbz#1451607


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-17.el7
changelog:
  - Resolve: #1455946 Provide a tooling automating the configuration 
    of Smart Card authentication on a FreeIPA master
    - server certinstall: update KDC master entry
    - pkinit manage: introduce ipa-pkinit-manage
    - server upgrade: do not enable PKINIT by default
    - Extend the advice printing code by some useful abstractions
    - Prepare advise plugin for smart card auth configuration
  - Resolve: #1461053 allow to modify list of UPNs of a trusted forest
    - trust-mod: allow modifying list of UPNs of a trusted forest
    - WebUI: add support for changing trust UPN suffixes


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-18.el7
changelog:
  - Resolves: #1449189 ipa-kra-install timeouts on replica
    - kra: promote: Get ticket before calling custodia


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-19.el7
changelog:
  - Resolves: #1462112 ipaserver installation fails in FIPS mode: OpenSSL
    internal error, assertion failed: Digest MD4 forbidden in FIPS mode!
    - ipa-sam: replace encode_nt_key() with E_md4hash() 
    - ipa_pwd_extop: do not generate NT hashes in FIPS mode
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces 
    - Fix local IP address validation 
    - ipa-dns-install: remove check for local ip address
    - refactor CheckedIPAddress class
    - CheckedIPAddress: remove match_local param
    - Remove ip_netmask from option parser
    - replica install: add missing check for non-local IP address
    - Remove network and broadcast address warnings


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-20.el7
changelog:
  - Resolves: #1452216 Replica installation grants HTTP principal
    access in WebUI
    - Make sure we check ccaches in all rpcserver paths


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7
changelog:
  - Resolves: #1470125 Replica install fails to configure IPA-specific
    temporary files/directories
    - replica install: drop-in IPA specific config to tmpfiles.d
  - Resolves: #1469978 bind package is not automatically updated during
    ipa-server upgrade process
    - Bumped Required version of bind-dyndb-ldap and bind package


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1
changelog:
  - Resolves: #1473272 Provide a tooling automating the configuration
    of Smart Card authentication on a FreeIPA master
    - smart-card advises: configure systemwide NSS DB also on master
    - smart-card advises: add steps to store smart card signing CA cert
    - Allow to pass in multiple CA cert paths to the smart card advises
    - add a class that tracks the indentation in the generated advises
    - delegate the indentation handling in advises to dedicated class
    - advise: add an infrastructure for formatting Bash compound statements
    - delegate formatting of compound Bash statements to dedicated classes
    - Fix indentation of statements in Smart card advises
    - Use the compound statement formatting API for configuring PKINIT
    - smart card advises: use a wrapper around Bash `for` loops
    - smart card advise: use password when changing trust flags on HTTP cert
    - smart-card-advises: ensure that krb5-pkinit is installed on client
  - Resolves: #1477046 Use CommonNameToSANDefault in default profile 
    (new installs only)
    - Add CommonNameToSANDefault to default cert profile
  - Resolves: #1475664 NULL LDAP context in call to ldap_search_ext_s
    during search in cn=ad,cn=trusts,dc=example,dc=com
    - NULL LDAP context in call to ldap_search_ext_s during search


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1.1
changelog:
  - Resolves: #1477046 Use CommonNameToSANDefault in default profile
    (new installs only)
    - Restore old version of caIPAserviceCert for upgrade only


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-21.el7.2
changelog:
  - Resolves: #1486794 - [ipa-replica-install] - 406 Client Error: Failed to
    validate message: Incorrect number of results (0) searching forpublic
    key for host
      - Always check peer has keys before connecting
  - Resolves: #1489300 - Unable to set ca renewal master on replica
      - Fix ipa config-mod --ca-renewal-master
  - Resolves: #1489815 - TypeError in renew_ca_cert prevents from swiching
    back to self-signed CA
      - Backport PR 988 to ipa-4-5 Fix Certificate renewal (with ext ca)
  - Resolves: #1489817 - ipa-server-upgrade failes with "This entry already exists"
      - Backport PR 1008 to ipa-4-5 Fix ipa-server-upgrade: This entry already exists
  - Resolves: #1490331 - FreeIPA/IdM installations which were upgraded from
    versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
    thus startup of Web UI fails
      - Adds whoami DS plugin in case that plugin is missing
  - Resolves: #1491545 - IPA WebUI does not work after upgrade from IPA 4.4 to 4.5
      - Fixing how sssd.conf is updated when promoting a client to replica
  - Resolves: #1492616 - ipa-otptoken-import - XML file is missing PBKDF2
    parameters!
      - ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace
  - Resolves: #1493153 - Updating from RHEL 7.3 fails with Server-Cert not found
    (ipa-server-upgrade)
      - Backport 4-5: Fix ipa-server-upgrade with server cert tracking


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-21.el7.2.2
changelog:
  - Resolves: #1493410 ipa-server-upgrade timeouts on wait_for_open ports
    expecting IPA services listening on IPv6 ports
      - Make sure upgrade also checks for IPv6 stack
      - control logging of host_port_open from caller
      - log progress of wait_for_open_ports
  - Resolves: #1493411 ipa help command returns traceback when no cache
    is present
      - Store help in Schema before writing to disk
      - Disable pylint in get_help function because of type confusion.


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-22.el7
changelog:
  - Resolves: #1506528 In case full PKINIT configuration is failing during
    server/replica install the error message should be more meaningful.
      - Less confusing message for PKINIT configuration during install
  - Resolves: #1506526 Use X509v3 Basic Constraints "CA:TRUE" instead of
    "CA:FALSE" IPA CA CSR
      - Include the CA basic constraint in CSRs when renewing a CA
  - Resolves: #1506913 ipa-replica-install might fail because of an already
    existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
      - Checks if replica-s4u2proxy.ldif should be applied
  - Resolves: #1506525 server-del doesn't remove dns-server configuration
    from ldap
      - server.py: Removes dns-server configuration from ldap


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-13.el7
changelog:
  - Resolves: #1451804 "AttributeError: 'tuple' object has no attribute 'append'"
    error observed during ipa upgrade with latest package. 
    - ipa-server-install: fix uninstall
  - Resolves: #1445390 ipa-[ca|kra]-install with invalid DM password break
    replica 
    - ca install: merge duplicated code for DM password
    - installutils: add DM password validator
    - ca, kra install: validate DM password


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-14.el7
changelog:
  - Resolves: #1438731 Extend ipa-server-certinstall and ipa-certupdate to 
    handle PKINIT certificates/anchors
    - certdb: add named trust flag constants
    - certdb, certs: make trust flags argument mandatory
    - certdb: use custom object for trust flags
    - install: trust IPA CA for PKINIT
    - client install: fix client PKINIT configuration
    - install: introduce generic Kerberos Augeas lens
    - server install: fix KDC PKINIT configuration
    - ipapython.ipautil.run: Add option to set umask before executing command
    - certs: do not export keys world-readable in install_key_from_p12
    - certs: do not export CA certs in install_pem_from_p12
    - server install: fix KDC certificate validation in CA-less
    - replica install: respect --pkinit-cert-file
    - cacert manage: support PKINIT
    - server certinstall: support PKINIT
  - Resolves: #1444432 CA-less pkinit not installable with --pkinit-cert-file
    option
    - certs: do not export CA certs in install_pem_from_p12
    - server install: fix KDC certificate validation in CA-less
  - Resolves: #1451228 ipa-kra-install fails when primary KRA server has been
    decommissioned
    - ipa-kra-install: fix pkispawn setting for pki_security_domain_hostname 
  - Resolves: #1451712 KRA installation fails on server that was originally
    installed as CA-less
    - ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
  - Resolves: #1441499 ipa cert-show does not raise error if no file name
    specified
    - ca/cert-show: check certificate_out in options
  - Resolves: #1449522 Deprecate `ipa pkinit-anonymous` command in FreeIPA 4.5+
    - Remove pkinit-anonymous command
  - Resolves: #1449523 Provide an API command to retrieve PKINIT status
    in the FreeIPA topology
    - Allow for multivalued server attributes
    - Refactor the role/attribute member reporting code
    - Add an attribute reporting client PKINIT-capable servers
    - Add the list of PKINIT servers as a virtual attribute to global config
    - Add `pkinit-status` command
    - test_serverroles: Get rid of MockLDAP and use ldap2 instead
  - Resolves: #1452216 Replica installation grants HTTP principal access in WebUI
    - Fix rare race condition with missing ccache file
  - Resolves: #1455045 Simple service uninstallers must be able to handle
    missing service files gracefully
    - only stop/disable simple service if it is installed
  - Resolves: #1455541 after upgrade login from web ui breaks
    - krb5: make sure KDC certificate is readable
  - Resolves: #1455862 "ipa: ERROR: an internal error has occurred" on executing
    command "ipa cert-request --add" after upgrade
    - Change python-cryptography to python2-cryptography


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-15.el7
changelog:
  - Resolves: #1442233 IPA client commands fail when pointing to replica 
    - httpinstance: wait until the service entry is replicated
  - Resolves: #1456769 ipaAnchorUUID index incorrectly configured and then
    not indexed
    - Fix index definition for ipaAnchorUUID
  - Resolves: #1438016 gssapi errors after IPA server upgrade
    - Avoid possible endless recursion in RPC call
    - rpc: preparations for recursion fix
    - rpc: avoid possible recursion in create_connection
  - Resolves: #1446087 services entries missing krbCanonicalName attribute.
    - Changing cert-find to do not use only primary key to search in LDAP.
  - Resolves: #1452763 ipa certmaprule change not reflected in krb5kdc workers
    - ipa-kdb: reload certificate mapping rules periodically
  - Resolves: #1455541 after upgrade login from web ui breaks
    - kdc.key should not be visible to all 
  - Resolves: #1435606 Add pkinit_indicator option to KDC configuration
    - ipa-kdb: add pkinit authentication indicator in case of a successful
      certauth
  - Resolves: #1455945 Enabling OCSP checks in mod_nss breaks certificate
    issuance when ipa-ca records are not resolvable
    - Turn off OCSP check
  - Resolves: #1454483 rhel73 ipa ui - cannot del server - IPA Error 903 -
    server_del - TypeError: 'NoneType' object is not iterable
    - fix incorrect suffix handling in topology checks


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-16.el7
changelog:
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces
    - Only warn when specified server IP addresses don't match intf
  - Resolves: #1438016 gssapi errors after IPA server upgrade
    - Bump version of python-gssapi
  - Resolves: #1457942 certauth: use canonical principal for lookups
    - ipa-kdb: use canonical principal in certauth plugin
  - Resolves: #1459153 Do not send Max-Age in ipa_session cookie to avoid
    breaking older clients
    - Add code to be able to set default kinit lifetime
    - Revert setting sessionMaxAge for old clients


author: Ivan Vecera <ivecera@redhat.com> [3.10.0-84.el7]
changelog:
  - tc: Add support for the matchall traffic classifier. (Ivan Vecera) [1435624]
  - tc: man: Add man entry for the matchall classifier. (Ivan Vecera) [1435624]
  - tc: add missing limits.h header (Ivan Vecera) [1435624]
  - tc: man: matchall: Fix example indentation (Ivan Vecera) [1435624]
  - tc: matchall: Print skip flags when dumping a filter (Ivan Vecera) [1435624]
  - tc, clsact: add clsact frontend (Ivan Vecera) [1435624]


author: Eric Garver <egarver@redhat.com> [3.10.0-86.el7]
changelog:
  - Revert "ip-route man: add usage and description for lwtunnel encap attributes" (Eric Garver) [1459975]
  - Revert "lwtunnel: implement support for ip6 encap" (Eric Garver) [1459975]
  - Revert "lwtunnel: fix argument parsing" (Eric Garver) [1459975]
  - Revert "lwtunnel: Add encapsulation support to ip route" (Eric Garver) [1459975]


author: Sabrina Dubroca <sdubroca@redhat.com> [3.10.0-87.el7]
changelog:
  - devlink: Add e-switch support (Sabrina Dubroca) [1459772]
  - devlink: whitespace cleanup (Sabrina Dubroca) [1459772]
  - devlink: Convert conditional in dl_argv_handle_port() to switch() (Sabrina Dubroca) [1459772]
  - devlink: write usage help messages to stderr (Sabrina Dubroca) [1459772]
  - devlink: Add usage help for eswitch subcommand (Sabrina Dubroca) [1459772]
  - devlink: Call dl_free in early exit case (Sabrina Dubroca) [1459772]


author: Phil Sutter <psutter@redhat.com> [4.11.0-2.el7]
changelog:
  - rt_dsfield: Ship deprecated values for compatibility (Phil Sutter) [1480136]
  - bpf: Make bytecode-file reading a little more robust (Phil Sutter) [1477491]
  - tc: fix m_simple usage (Phil Sutter) [1477523]
  - tc-simple: Fix documentation (Phil Sutter) [1477523]
  - Really fix get_addr() and get_prefix() error messages (Phil Sutter) [1477206]


author: Phil Sutter <psutter@redhat.com> [4.11.0-3.el7]
changelog:
  - lib/bpf: Fix bytecode-file parsing (Phil Sutter) [1477491]
  - tc-simple.8: Fix reference to non-existing tc-actions.8 (Phil Sutter) [1477523]
  - ss: Fix for added diag support check (Phil Sutter) [1487152]


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-14
changelog:
  - Add cgroup support (RHBZ#1058660)
  - Add wait seonds support for commands (RHBZ#1156411)
  - Add dhcpv6-client in default IPv6 firewall rules (RHBZ#1169036)
  - Add message for init script error returns (RHBZ#1200415)
  - Use flock for wait option (RHBZ#1202435)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-16
changelog:
  - Fix important coverity findings: missing include for flock and use bash for
    init script (RHBZ#1264399)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-17
changelog:
  - Fixed init script not to fail on missing restorecon (RHBZ#1246380)
  - Adapted man page snipplet for TRACE to use proper logging backend names
    (RHBZ#1261238)
  - Warn about use of DROP in nat table (RHBZ#1298879)
  - Fixed modules unload in init script (RHBZ#1324102)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-18
changelog:
  - Add support for --wait options to restore commands (RHBZ#1438597)
  - Do not set changed flag for rule check operations with module targets
    (RHBZ#1438597)
  - Add version option to restore commands (RHBZ#1438597)


author: Phil Sutter - 1.4.21-18.2
changelog:
  - Prevent iptables.service and ip6tables.service from running in parallel
    (RHBZ#1491963)
  - Don't restart services upon upgrade (RHBZ#1491961)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20130517-4.gitc4bce43
changelog:
  - ipxe-Use-next-server-from-filename-s-settings-block.patch [bz#1062644]
  - Resolves: bz#1062644
    (pxe boot fails if next-server details come from a different dhcp server)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20130517-5.gitc4bce43.el7
changelog:
  - ipxe-Enable-infrastructure-to-specify-an-autoboot-device-.patch [bz#1031518]
  - ipxe-Allow-prefix-to-specify-a-PCI-autoboot-device-locati.patch [bz#1031518]
  - ipxe-Store-boot-bus-dev.fn-address-as-autoboot-device-loc.patch [bz#1031518]
  - ipxe-Ignore-PCI-autoboot-device-location-if-set-to-00-00..patch [bz#1031518]
  - ipxe-Revert-Remove-2-second-startup-wait.patch [bz#857123]
  - ipxe-Allow-ROM-banner-timeout-to-be-configured-independen.patch [bz#857123]
  - ipxe-Customize-ROM-banner-timeout.patch [bz#857123]
  - Resolves: bz#1031518
    (iPXE does not honor specified boot device)
  - Resolves: bz#857123
    (Guests never get an iPXE prompt)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20130517-6.gitc4bce43.el7
changelog:
  - ipxe-import-EfiRom-from-edk2-BaseTools-RHEL-only.patch [bz#1084561]
  - ipxe-add-custom-Makefile-for-EfiRom-RHEL-only.patch [bz#1084561]
  - ipxe-redhat-build-and-install-combined-legacy-UEFI-roms-f.patch [bz#1084561]
  - Resolves: bz#1084561
    (RFE: ship UEFI drivers for ipxe in RHEL-7.y)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20160127-2.git6366fa7a.el7
changelog:
  - ipxe-Enable-IPv6-protocol-in-non-QEMU-builds.patch [bz#1350167]
  - Resolves: bz#1350167
    (ipxe: enable IPV6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20160127-3.git6366fa7a.el7
changelog:
  - ipxe-Add-pci_find_next_capability.patch [bz#1242850]
  - ipxe-Add-virtio-1.0-constants-and-data-structures.patch [bz#1242850]
  - ipxe-Add-virtio-1.0-PCI-support.patch [bz#1242850]
  - ipxe-Add-virtio-net-1.0-support.patch [bz#1242850]
  - ipxe-Renumber-virtio_pci_region-flags.patch [bz#1242850]
  - ipxe-Fix-virtio-pci-logging.patch [bz#1242850]
  - Resolves: bz#1242850
    (Ipxe can not recognize "network device" when enable virtio-1 of virtio-net-pci)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20160127-4.git6366fa7a.el7
changelog:
  - ipxe-Send-TCP-keepalives-on-idle-established-connections.patch [bz#1322056]
  - ipxe-enable-e1000e-rom.patch [bz#1361534]
  - Resolves: bz#1322056
    (ipxe freeze during HTTP download with last RPM)
  - Resolves: bz#1361534
    (RFE: Integrate e1000e implementation in downstream QEMU)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20160127-5.git6366fa7a.el7
changelog:
  - ipxe-Strip-802.1Q-VLAN-0-priority-tags.patch [bz#1316329]
  - Resolves: bz#1316329
    ([RFE] Properly Handle 8021.Q VID 0 Frames, as new vlan model in linux kernel does.)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20170123-1.git4e85b27.el7_4.1
changelog:
  - ipxe-Support-VIRTIO_NET_F_IOMMU_PLATFORM.patch [bz#1481180]
  - Resolves: bz#1481180
    (iommu platform support for ipxe [rhel-7.4.z])


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.2
changelog:
  - Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
  - Update jstack tapset to handle AArch64
  - Handle unsupported architectures by calling the error function rather than a parse failure
  - ABS_JAVA_HOME_DIR is no longer used in the updated tapsets
  - Resolves: rhbz#1373986


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.3
changelog:
  - Backport "8173783: IllegalArgumentException: jdk.tls.namedGroups"
  - Apply backports before local RPM fixes so they will be the same as when applied upstream
  - Adjust RH1022017 following application of 8173783
  - Resolves: rhbz#1422738


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.1
changelog:
  - Bump to 2.6.10 and u141b00.
  - Add more detailed output to fsg.sh and generate_source_tarball.sh.
  - Update md5sum list with checksum for the new java.security file.
  - Drop 8173783 backport which is now applied upstream.
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.3
changelog:
  - Add support for using RSAandMGF1 with the SHA hash algorithms in the PKCS11 provider 
  - Resolves: rhbz#1273760


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.4
changelog:
  - Fix merge error with "native2ascii changes file permissions of input file"
  - Resolves: rhbz#1446700


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.141-2.6.10.5
changelog:
  - make to use latest c-j-c and so fix persisting issues with java.security and other configfiles
  - aligned with this change, applied repackReproduciblePolycies.sh
  - 1183793 is missing blocker
  - Resolves: rhbz#1448880


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.151-2.6.11.1
changelog:
  - Bump to 2.6.11 and u151b00.
  - Update java-access-bridge-security.patch to apply against 2.6.11.
  - Drop 7177216 merge fix which is applied upstream.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.161-2.6.12.0
changelog:
  - Bump to 2.6.12 and u161b00.
  - Update SystemTap tapsets to version in IcedTea 2.6.12pre01 to fix RH1492139.
  - Drop 8185716 patch, now applied upstream.
  - Update location of OpenJDK zlib system library source code in remove-intree-libraries.sh
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.161-2.6.12.0
changelog:
  - Add missing implementation of Matcher::pass_original_key_for_aes() on AArch64 (PR3497)
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.0
changelog:
  - Bump to 2.6.13 and u171b01.
  - Update java-1.7.0-openjdk-java-access-bridge-security.patch to apply after 8186080
  - Drop PR3497 AArch64 patch now applied upstream.
  - Update RC4 patch (8076221/PR2809) to apply after 8148108 (DH lower limit increase)
  - Fix file path in rh1022017.patch.
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.0
changelog:
  - Extend pr3393-rh1273760.patch so Token.getMechanismInfo can handle CK_MECHANISM
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.0
changelog:
  - Update to new tarball with AArch64 return value fixes, dropping local patch.
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.0
changelog:
  - Fix missing return statement in src/os_cpu/linux_zero/vm/os_linux_zero.cpp (non-LP64 only)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-8.b12
changelog:
  - Restore cacerts symlink as some broken apps hardcode the path (see RH1448802)
  - Resolves: rhbz#1319875


author: Zhengyu Gu <zgu@redhat.com> - 1:1.8.0.131-10.b12
changelog:
  - Added 8181055-pr3394-rh1448880.patch to fix a corner case of previous change
  - Resolves: rhbz#1448880


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.131-11.b12
changelog:
  - make to use latest c-j-c and so fix persisting issues with java.security and other configfiles
  - 1183793 is missing blocker
  - Resolves: rhbz#1448880


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-12.b12
changelog:
  - Add backports from 8u152 (8179084/RH1455694, 8181419/RH1463144, 8175887) ahead of July CPU.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-1.b15
changelog:
  - Update to aarch64-jdk8u141-b15 and aarch64-shenandoah-jdk8u141-b15.
  - Update location of OpenJDK system library source code in remove-intree-libraries.sh
  - Drop upstreamed patches for 6515172, 8144566, 8155049, 8165231, 8174164, 8174729 and 8175097.
  - Update PR1983, PR2899 and PR2934 (SunEC + system NSS) to accomodate 8175110.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-2.b16
changelog:
  - Update to aarch64-jdk8u141-b16 and aarch64-shenandoah-jdk8u141-b16.
  - Revert change to remove-intree-libraries.sh following backout of 8173207
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Switch AArch64 to using java-1.8.0-openjdk to bootstrap until RH1482244 is fixed in bootstrap
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Add 8075484/PR3473/RH1490713 which is listed as being in 8u151 but not supplied by Oracle.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Update SystemTap tapsets to version in IcedTea 3.6.0pre02 to fix RH1492139.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Correct fix to RH1191652 root patch so existing COMMON_CCXXFLAGS_JDK is not lost.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - 8188030 is not yet upstream, so it should be listed under upstreamable fixes.
  - 8181055, 8181419, 8145913, 8168318, 8170328 & 8181810 all now in 8u162.
  - Resolves: rhbz#1499207


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - repack policies adapted to new counts and paths
  - note that also c-j-c is needed to make this apply in next update
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - Reverting to java-1.7.0-openjdk on AArch64 as rhel-7.4-z-java-unsafe-candidate using wrong suffix.
  - Resolves: rhbz#1499207


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.151-5.b12
changelog:
  - Backport "8180048: Interned string and symbol table leak memory during parallel unlinking" (gnu_andrew)
  - Resolves: rhbz#1515212


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.161-0.b12
changelog:
  - Update to aarch64-jdk8u161-b12 and aarch64-shenandoah-jdk8u161-b12 (mbalao)
  - Drop upstreamed patches for 8075484 (RH1490713), 8153711 (RH1284948),
    8162384 (RH1358661), 8164293 (RH1459641), 8173941, 8175813 (RH1448880),
    8175887 and 8180048 (RH1449870).(mbalao)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-0.b12
changelog:
  - Switch bootstrap back to java-1.7.0-openjdk on all architectures, depending on RH1482244 fix
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-0.b12
changelog:
  - Replace tarballs with version including AArch64 fix for 8174962 (S8194686)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-0.b13
changelog:
  - Update to b13 including Zero fix for 8174962 (S8194739) and restoring tzdata2017c update
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.144-0.b01
changelog:
  - Update to aarch64-jdk8u144-b01 and aarch64-shenandoah-jdk8u144-b01.
  - Exclude 8175887 from Shenandoah builds as it has been included in that repo.
  - Resolves: rhbz#1481947


author: Pavel Alexeev <Pahan@Hubbitus.info> - 1:1.8.5-11
changelog:
  - Thanks to Ville Skyttä (bz#875343) build against libedit instead of readline
  	what simplify licensing apparently without any loss of functionality


author: Elio Maldonado <emaldona@redhat.com> - 4.4.0-1
changelog:
  - Bugzilla Bug #1394414 - Rebase jss to 4.4.0 in RHEL 7.4
  - ## JSS 4.4.0 includes the following patches ported from downstream:
  - Mozilla Bugzilla #507536 - Add IPv6 functionality to JSS
  - Mozilla Bugzilla #1307872 - Expose NSS calls for OCSP settings
  - Mozilla Bugzilla #1307882 - RFE ecc - add ecc curve name support in JSS and
    CS interface
  - Mozilla Bugzilla #1307993 - Expose updated certificate verification function
    in JSS
  - Mozilla Bugzilla #1308000 - Incorrect socket accept error message due to bad
    pointer arithmetic
  - Mozilla Bugzilla #1308001 - Verification should fail when a revoked
    certificate is added
  - Mozilla Bugzilla #1308004 - Warnings should be cleaned up in JSS build
  - Mozilla Bugzilla #1308006 - DRM failed to recovery keys when in FIPS mode
    (HSM + NSS)
  - Mozilla Bugzilla #1308008 - Defects revealed by Coverity scan
  - Mozilla Bugzilla #1308009 - Add support for PKCS5v2; support for secure PKCS12
  - Mozilla Bugzilla #1308012 - DRM: during archiving and recovering, wrapping
    unwrapping keys should be done in the token
  - Mozilla Bugzilla #1308013 - JSS - HSM token name was mistaken for
    manufacturer identifier
  - Mozilla Bugzilla #1308017 - Un-deprecate previously deprecated methods in
    JSS 4.2.6
  - Mozilla Bugzilla #1308019 - Provide Tomcat support for TLS v1.1 and
    TLS v1.2 via NSS through JSS
  - Mozilla Bugzilla #1308026 - JSS certificate validation does not pass up exact
    error from NSS
  - Mozilla Bugzilla #1308027 - Merge pki-symkey into jss
  - Mozilla Bugzilla #1308029 - Resolve Javadoc build issues
  - Mozilla Bugzilla #1308047 - support ECC encryption key archival and recovery
  - Mozilla Bugzilla #1313122 - Remove bypass tests as latest NSS has removed
    PKCS#11 bypass support
  - Mozilla Bugzilla #1328675 - Simple problem unwrapping AES sym keys on token
  - Mozilla Bugzilla #1345174 - Cannot create system certs when using LunaSA HSM
    in FIPS Mode and ECC algorithms
  - Mozilla Bugzilla #1345613 - expose AES KeyWrap and add some useful OID
    functions
  - Mozilla Bugzilla #1346410 - Load JSS libraries appropriately
  - ## JSS 4.4.0 includes the following changes for building and testing:
  - Mozilla Bugzilla #1331765 - Simplify JSS Makefile build and test
  - Mozilla Bugzilla #1346420 - Document steps required to use the proper
    libjss4.so when running certain HMAC Algorithms tests


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-4
changelog:
  - Bugzilla Bug #1394414 - Rebase jss to 4.4.0 in RHEL 7.4
  - Updated build requirements for NSPR
  - Updated build and runtime requirements for NSS
  - ## 'jss-post-rebase.patch' resolves the following issues ported from
    - Mozilla Bugzilla #1337092 - CMC conformance update: Implement required ASN.1
    code for RFC5272+ (cfu)
  - Mozilla Bugzilla #1347394 - Eclipse project files for JSS (edewata)
  - Mozilla Bugzilla #1347429 - Deprecated SSL 3.0 cipher names in SSLSocket
    class. (edewata)
  - Mozilla Bugzilla #1348856 - SSL alert callback (edewata)
  - Mozilla Bugzilla #1349278 - SSL cipher enumeration (edewata)
  - Mozilla Bugzilla #1349349 - Problem with Password.readPasswordFromConsole().
    (edewata)
  - Mozilla Bugzilla #1349831 - Revise top-level README file (mharmsen)
  - Mozilla Bugzilla #1349836 - Changes to JSS Version Block (mharmsen)
  - Mozilla Bugzilla #1350130 - Missing
    CryptoManager.verifyCertificateNowCUNative() implementation. (emaldona)


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-5
changelog:
  - Mozilla Bugzilla #1355268 - JSS 4.4 is incompatible with versions of
    idm-console-framework < 1.1.17-4
  - Red Hat Bugzilla #1435076 - Remove unused legacy lines from JSS spec files


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-6
changelog:
  - Mozilla Bugzilla #1352476 - RFE: Document on the README how to create a
    release tag (mharmsen)
  - Mozilla Bugzilla #1355358 - CryptoStore: add methods for importing and
    exporting EncryptedPrivateKeyInfo (ftweedal)
  - Mozilla Bugzilla #1359731 - CryptoStore.importPrivateKey enhancements
    (ftweedal)


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-7
changelog:
  - Bump NSS dependencies from 4.28.3 to 4.28.4-6 to pick-up fix in
    Mozilla Bugzilla #1360207 - Fix incorrect if (ss->...) in SSL_ReconfigFD


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-8
changelog:
  - Bugzilla #1488846 - Fix HmacTest code for AES encrypt/unwrap [rhel-7.4.z]
    (jmagne)
  - Bugzilla #1490494 - PKCS12: (JSS) upgrade to at least AES and SHA2 (FIPS)
    [RHEL-7.4.z] (ftweedal)
  - Bugzilla #1490740 - PK11Store.getEncryptedPrivateKeyInfo() segfault if
    export fails [rhel-7.4.z] (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-9
changelog:
  - Bugzilla #1505690 - new JSS failures: HMAC Unwrap and KeyWrapping
    FIPSMODE [rhel-7.4.z] (jmagne)


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-15.el7a]
changelog:
  - [kernel] sched/deadline: Use the revised wakeup rule for suspending constrained dl tasks (Xunlei Pang) [1471599]
  - [kernel] sched/deadline: Fix dl_bw comment (Xunlei Pang) [1471599]
  - [kernel] sched/deadline: Zero out positive runtime after throttling constrained tasks (Xunlei Pang) [1471599]
  - [virt] KVM: trigger uevents when creating or destroying a VM (BZ#1394223) (Paolo Bonzini) [1394223]
  - [redhat] config: x86_64/powerpc64le: enable DEVICE_PUBLIC & DEVICE_PUBLIC (Jerome Glisse) [1459704]
  - [mm] memcontrol: support MEMORY_DEVICE_PRIVATE and MEMORY_DEVICE_PUBLIC v3 (Jerome Glisse) [1459704]
  - [mm] memcontrol: allow to uncharge page without using page->lru field (Jerome Glisse) [1459704]
  - [mm] hmm: add new helper to hotplug CDM memory region v3 (Jerome Glisse) [1459704]
  - [mm] device-public-memory: device memory cache coherent with CPU v4 (Jerome Glisse) [1459704]
  - [mm] zone-device: rename DEVICE_PUBLIC to DEVICE_HOST (Jerome Glisse) [1459704]
  - [mm] hmm: fix handling of pmd inside HMM CPU page table snapshot helper (Jerome Glisse) [1459704]
  - [mm] hmm: update pegas HMM to lastest HMM v24 (Jerome Glisse) [1459704]
  - [powerpc] hugetlbfs: Export HPAGE_SHIFT (Jerome Glisse) [1459703]
  - [mm] huge_memory.c: deposit a pgtable for DAX PMD faults when required (Jerome Glisse) [1459703]
  - [mm] huge_memory.c: use zap_deposited_table() more (Jerome Glisse) [1459703]
  - [powerpc] mm: Enable ZONE_DEVICE on powerpc (Jerome Glisse) [1459703]
  - [mm] x86: Add ARCH_HAS_ZONE_DEVICE to Kconfig (Jerome Glisse) [1459703]
  - [powerpc] mm: Add devmap support for ppc64 (Jerome Glisse) [1459703]
  - [powerpc] vmemmap: Add altmap support (Jerome Glisse) [1459703]
  - [powerpc] vmemmap: Reshuffle vmemmap_free() (Jerome Glisse) [1459703]
  - [redhat] configs: Enable CONFIG_MPROFILE_KERNEL for powerpc64le related fixes (Jiri Olsa) [1368733]
  - [redhat] configs: Enable CONFIG_KPROBES_ON_FTRACE for powerpc64le (Jiri Olsa) [1368733]
  - [redhat] configs: Enable function tracer for powerpc64le (Jiri Olsa) [1368733]
  - [powerpc] ftrace: Move stack setup and teardown code into ftrace_graph_caller() (Jiri Olsa) [1368733]
  - [powerpc] kprobes: Remove duplicate saving of MSR (Jiri Olsa) [1368733]
  - [tools] perf powerpc: Choose local entry point with kretprobes (Jiri Olsa) [1368733]
  - [tools] perf kretprobes: Offset from reloc_sym if kernel supports it (Jiri Olsa) [1368733]
  - [tools] perf probe: Factor out the ftrace README scanning (Jiri Olsa) [1368733]
  - [tools] perf probe: Generalize probe event file open routine (Jiri Olsa) [1368733]
  - [powerpc] kprobes: Fix handling of instruction emulation on probe re-entry (Jiri Olsa) [1368733]
  - [tools] perf sdt: Add scanning of sdt probes arguments (Jiri Olsa) [1368733]
  - [powerpc] kprobes: Prefer ftrace when probing function entry (Jiri Olsa) [1368733]
  - [powerpc] Introduce a new helper to obtain function entry points (Jiri Olsa) [1368733]
  - [powerpc] kprobes: Add support for KPROBES_ON_FTRACE (Jiri Olsa) [1368733]
  - [powerpc] ftrace: Restore LR from pt_regs (Jiri Olsa) [1368733]
  - [powerpc] kprobes: Convert __kprobes to NOKPROBE_SYMBOL() (Jiri Olsa) [1368733]
  - [powerpc] kprobes: Emulate instructions on kprobe handler re-entry (Jiri Olsa) [1368733]
  - [powerpc] kprobes: Factor out code to emulate instruction into a helper (Jiri Olsa) [1368733]
  - [powerpc] kretprobes: Override default function entry offset (Jiri Olsa) [1368733]
  - [kernel] powerpc/kprobes: Fix handling of function offsets on ABIv2 (Jiri Olsa) [1368733]
  - [kernel] kprobes: Convert kprobe_lookup_name() to a function (Jiri Olsa) [1368733]
  - [kernel] kprobes: Skip preparing optprobe if the probe is ftrace-based (Jiri Olsa) [1368733]
  - [tools] perf sdt powerpc: Add argument support (Jiri Olsa) [1368733]
  - [tools] perf/sdt/x86: Move OP parser to tools/perf/arch/x86/ (Jiri Olsa) [1368733]
  - [tools] perf/sdt/x86: Add renaming logic for (missing) 8 bit registers (Jiri Olsa) [1368733]
  - [tools] perf sdt x86: Add renaming logic for rNN and other registers (Jiri Olsa) [1368733]
  - [tools] perf probe: Add sdt probes arguments into the uprobe cmd string (Jiri Olsa) [1368733]
  - [kernel] trace/kprobes: Fix check for kretprobe offset within function entry (Jiri Olsa) [1368733]
  - [kernel] trace/kprobes: Add back warning about offset in return probes (Jiri Olsa) [1368733]
  - [kernel] trace/kprobes: Allow return probes with offsets and absolute addresses (Jiri Olsa) [1368733]
  - [kernel] kretprobes: Ensure probe location is at function entry (Jiri Olsa) [1368733]


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-16.el7a]
changelog:
  - [net] netfilter: xt_socket: Fix broken IPv6 handling (Hangbin Liu) [1471001]
  - [scsi] csiostor: update module version (Sai Vemuri) [1458005]
  - [scsi] csiostor: add check for supported fw version (Sai Vemuri) [1458005]
  - [scsi] csiostor: Avoid content leaks and casts (Sai Vemuri) [1458005]
  - [scsi] csiostor: add support for Chelsio T6 adapters (Sai Vemuri) [1458005]
  - [scsi] csiostor: fix use after free in csio_hw_use_fwconfig() (Sai Vemuri) [1458005]
  - [scsi] csiostor: switch to pci_alloc_irq_vectors (Sai Vemuri) [1458005]
  - [net] netfilter: ipt_CLUSTERIP: do not hold dev (Xin Long) [1449013]
  - [tools] perf vendor events: Add POWER9 PVRs to mapfile (Jiri Olsa) [1416317]
  - [tools] perf vendor events: Add POWER9 PMU events (Jiri Olsa) [1416317]
  - [net] netfilter: xtables: fix build failure from COMPAT_XT_ALIGN outside CONFIG_COMPAT (Florian Westphal) [1470745]
  - [net] netfilter: xtables: zero padding in data_to_user (Florian Westphal) [1470745]
  - [block] Fix __blkdev_issue_zeroout loop (Ming Lei) [1470923]
  - [block] blk-mq-sched: fix performance regression of mq-deadline (Ming Lei) [1470923]
  - [block] provide bio_uninit() free freeing integrity/task associations (Ming Lei) [1470923]
  - [block] blk-mq: fix performance regression with shared tags (Ming Lei) [1470923]
  - [block] Fix a blk_exit_rl() regression (Ming Lei) [1470923]
  - [block] Avoid that blk_exit_rl() triggers a use-after-free (Ming Lei) [1470923]
  - [block] cfq-iosched: fix the delay of cfq_group's vdisktime under iops mode (Ming Lei) [1470923]
  - [block] blk-mq: Take tagset lock when updating hw queues (Ming Lei) [1470923]
  - [block] partitions/msdos: FreeBSD UFS2 file systems are not recognized (Ming Lei) [1470923]
  - [block] blk-mq: NVMe 512B/4K+T10 DIF/DIX format returns I/O error on dd with split op (Ming Lei) [1470923]
  - [block] mq: fix potential deadlock during cpu hotplug (Ming Lei) [1470923]
  - [block] mq: Cure cpu hotplug lock inversion (Ming Lei) [1470923]
  - [block] cfq: Disable writeback throttling by default (Ming Lei) [1470923]
  - [block] fix inheriting request priority from bio (Ming Lei) [1470923]
  - [block] blkcg: allocate struct blkcg_gq outside request queue spinlock (Ming Lei) [1470923]
  - [block] block new I/O just after queue is set as dying (Ming Lei) [1470923]
  - [block] rename blk_mq_freeze_queue_start() (Ming Lei) [1470923]
  - [block] add a read barrier in blk_queue_enter() (Ming Lei) [1470923]
  - [block] blk-mq: comment on races related with timeout handler (Ming Lei) [1470923]
  - [block] Fix oops scsi_disk_get() (Ming Lei) [1470923]
  - [lib] kobject: Export kobject_get_unless_zero() (Ming Lei) [1470923]


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-17.el7a]
changelog:
  - [char] ipmi:ssif: Add missing unlock in error branch (Tony Camuso) [1473422]
  - [char] ipmi: constify bmc_dev_attr_group and bmc_device_type (Tony Camuso) [1473422]
  - [char] ipmi:ssif: Check dev before setting drvdata (Tony Camuso) [1473422]
  - [char] ipmi: get rid of field-by-field __get_user() (Tony Camuso) [1473422]
  - [char] ipmi: get COMPAT_IPMICTL_RECEIVE_MSG in sync with the native one (Tony Camuso) [1473422]
  - [char] ipmi: Convert DMI handling over to a platform device (Tony Camuso) [1473422]
  - [char] ipmi: Create a platform device for a DMI-specified IPMI interface (Tony Camuso) [1473422]
  - [char] ipmi: use rcu lock around call to intf->handlers->sender() (Tony Camuso) [1473422]
  - [char] ipmi:ssif: Use i2c_adapter_id instead of adapter->nr (Tony Camuso) [1473422]
  - [char] ipmi: Use the proper default value for register size in ACPI (Tony Camuso) [1473422]
  - [char] ipmi_ssif: remove redundant null check on array client->adapter->name (Tony Camuso) [1473422]
  - [char] ipmi/watchdog: fix watchdog timeout set on reboot (Tony Camuso) [1473422]
  - [char] ipmi_ssif: unlock on allocation failure (Tony Camuso) [1473422]
  - [char] ipmi/watchdog: fix wdog hang on panic waiting for ipmi response (Tony Camuso) [1473422]
  - [char] Annotate hardware config module parameters in drivers/char/ipmi/ (Tony Camuso) [1473422]
  - [kernel] Annotate module params that specify hardware parameters (eg. ioport) (Tony Camuso) [1473422]
  - [char] ipmi: bt-bmc: Add ast2500 compatible string (Tony Camuso) [1473422]
  - [char] ipmi_ssif: use setup_timer (Tony Camuso) [1473422]
  - [char] ipmi: Fix kernel panic at ipmi_ssif_thread() (Tony Camuso) [1473422]
  - [powerpc] KVM: PPC: Book3S HV: Don't sleep if XIVE interrupt pending on POWER9 (Mauricio Oliveira) [1474963]
  - [powerpc] KVM: PPC: Book3S HV: Don't let VCPU sleep if it has a doorbell pending (Mauricio Oliveira) [1474963]
  - [mm] mmap: expand_downwards: don't require the gap if !vm_prev (Rafael Aquini) [1461915] {CVE-2017-1000364}
  - [mm] fix overflow check in expand_upwards() (Rafael Aquini) [1461915] {CVE-2017-1000364}
  - [mm] mmap: do not blow on PROT_NONE MAP_FIXED holes in the stack (Rafael Aquini) [1461915] {CVE-2017-1000364}
  - [mm] fs/proc/task_mmu.c: remove obsolete comment in show_map_vma() (Rafael Aquini) [1461915] {CVE-2017-1000364}
  - [mm] fix new crash in unmapped_area_topdown() (Rafael Aquini) [1461915] {CVE-2017-1000364}
  - [mm] Allow stack to grow up to address space limit (Rafael Aquini) [1461915] {CVE-2017-1000364}
  - [mm] larger stack guard gap, between vmas (Rafael Aquini) [1461915] {CVE-2017-1000364}
  - [net] netfilter: ipt_CLUSTERIP: fix use-after-free of proc entry (Stefano Brivio) [1472835]
  - [redhat] configs: enable CHECKPOINT_RESTORE on aarch64 (Adrian Reber) [1464595]
  - [net] ipv6: avoid unregistering inet6_dev for loopback (Hangbin Liu) [1470935]
  - [net] ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER (Hangbin Liu) [1470935]
  - [net] ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf (Hangbin Liu) [1470935]
  - [net] ipv6: initialize route null entry in addrconf_init() (Hangbin Liu) [1470935]
  - [netdrv] net/mlx5e: Initialize CEE's getpermhwaddr address buffer to 0xff (Slava Shwartsman) [1472946]
  - [powerpc] powernv/npu-dma: Add explicit flush when sending an ATSD (Mauricio Oliveira) [1464978]
  - [powerpc] Only do ERAT invalidate on radix context switch on P9 DD1 (Mauricio Oliveira) [1471172]
  - [powerpc] Fix /proc/cpuinfo revision for POWER9 DD2 (Mauricio Oliveira) [1465951]
  - [powerpc] 64s: Invalidate ERAT on powersave wakeup for POWER9 (Mauricio Oliveira) [1465875]
  - [powerpc] 64s/idle: Branch to handler with virtual mode offset (Mauricio Oliveira) [1465875]
  - [powerpc] xive: Fix offset for store EOI MMIOs (Mauricio Oliveira) [1471163]
  - [fs] userfaultfd: shmem: handle coredumping in handle_userfault() (Andrea Arcangeli) [1466806]


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-18.el7a]
changelog:
  - [powerpc] KVM: PPC: Book3S HV: Enable TM before accessing TM registers (David Gibson) [1456910]
  - [powerpc] KVM: PPC: Book3S HV: Save/restore host values of debug registers (David Gibson) [1456910]
  - [powerpc] KVM: PPC: Book3S HV: Preserve userspace HTM state properly (David Gibson) [1456910]
  - [powerpc] KVM: PPC: Book3S HV: Restore critical SPRs to host values on guest exit (David Gibson) [1456910]
  - [powerpc] KVM: PPC: Book3S HV: Context-switch EBB registers properly (David Gibson) [1456910]
  - [netdrv] virtio-net: fix module unloading (Andrew Jones) [1472694]
  - [net] xfrm6: Fix IPv6 payload_len in xfrm6_transport_finish (Hangbin Liu) [1474815]
  - [net] xfrm: NULL dereference on allocation failure (Hangbin Liu) [1474815]
  - [net] xfrm: Oops on error in pfkey_msg2xfrm_state() (Hangbin Liu) [1474815]
  - [net] xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY (Hangbin Liu) [1474815]
  - [net] tcp: reset sk_rx_dst in tcp_disconnect() (Florian Westphal) [1474881]
  - [net] tcp: fix wraparound issue in tcp_lp (Florian Westphal) [1474881]
  - [net] tcp: fix access to sk->sk_state in tcp_poll() (Florian Westphal) [1474881]
  - [net] tcp: avoid fragmenting peculiar skbs in SACK (Florian Westphal) [1474881]
  - [net] tcp: eliminate negative reordering in tcp_clean_rtx_queue (Florian Westphal) [1474881]
  - [net] tcp: avoid fastopen API to be used on AF_UNSPEC (Florian Westphal) [1474881]
  - [net] ipv4: add reference counting to metrics (Florian Westphal) [1474881]
  - [net] tcp: disallow cwnd undo when switching congestion control (Florian Westphal) [1474881]
  - [net] igmp: acquire pmc lock for ip_mc_clear_src() (Florian Westphal) [1474881]
  - [net] igmp: add a missing spin_lock_init() (Florian Westphal) [1474881]
  - [powerpc] hotplug-mem: Fix missing endian conversion of aa_index (Laurent Vivier) [1473203]
  - [netdrv] net/mlx5e: Fix TX carrier errors report in get stats ndo (Slava Shwartsman) [1473362]
  - [mmc] core: Use device_property_read instead of of_property_read (Slava Shwartsman) [1466917]
  - [mmc] dw_mmc: Use device_property_read instead of of_property_read (Slava Shwartsman) [1466917]
  - [base] device property: Make dev_fwnode() public (Slava Shwartsman) [1466917]


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-19.el7a]
changelog:
  - [powerpc] pseries: Fix of_node_put() underflow during reconfig remove (Laurent Vivier) [1471745]
  - [powerpc] mm: Fix pmd/pte_devmap() on non-leaf entries (David Gibson) [1475118]
  - [powerpc] powernv: Enable PCI peer-to-peer (Steve Best) [1437849]
  - [scsi] ses: do not add a device to an enclosure if enclosure_add_links() fails (Maurizio Lombardi) [1427426]
  - [net] bridge: mdb: fix leak on complete_info ptr on fail path (Stefano Brivio) [1475402]
  - [net] bridge: fix a null pointer dereference in br_afspec (Stefano Brivio) [1475402]
  - [net] bridge: netlink: check vlan_default_pvid range (Stefano Brivio) [1475402]
  - [redhat] spec: don't ship build-id links installed by vdso_install target ("Herton R. Krzesinski") [1464263]
  - [redhat] configs: disable CHACHA20POLY1305 on ppc64le and SHA3 on ppc64le/arm64 ("Herton R. Krzesinski") [1475646]
  - [net] sctp: fix an array overflow when all ext chunks are set (Xin Long) [1474759]
  - [net] sctp: ensure ep is not destroyed before doing the dump (Xin Long) [1474759]
  - [net] sctp: return next obj by passing pos + 1 into sctp_transport_get_idx (Xin Long) [1474759]
  - [net] sctp: disable BH in sctp_for_each_endpoint (Xin Long) [1474759]
  - [net] sctp: set new_asoc temp when processing dupcookie (Xin Long) [1474759]
  - [net] sctp: fix stream update when processing dupcookie (Xin Long) [1474759]
  - [net] sctp: fix ICMP processing if skb is non-linear (Xin Long) [1474759]
  - [net] sctp: fix src address selection if using secondary addresses for ipv6 (Xin Long) [1474759]
  - [net] ipvs: explicitly forbid ipv6 service/dest creation if ipv6 mod is disabled (Matteo Croce) [1470957]


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-20.el7a]
changelog:
  - [net] netfilter: nf_ct_dccp/sctp: fix memory leak after netns cleanup (Davide Caratti) [1472535]
  - [net] netfilter: udplite: Remove duplicated udplite4/6 declaration (Davide Caratti) [1472535]
  - [net] ipv4: fib: Fix NULL pointer deref during fib_sync_down_dev() (Stefano Brivio) [1476681]
  - [redhat] configs: Disable CONFIG_IP_DCCP (Stefano Brivio) [1432597]
  - [redhat] configs: enable CONFIG_NET_ACT_TUNNEL_KEY (Davide Caratti) [1470564]
  - [net] account for current skb length when deciding about UFO (Sabrina Dubroca) [1476185]
  - [net] ping: do not abuse udp_poll() (Sabrina Dubroca) [1476185]
  - [net] sched: Fix one possible panic when no destroy callback (Stefano Brivio) [1475862]
  - [net] fix compile error in skb_orphan_partial() (Stefano Brivio) [1475856]
  - [net] netem: fix skb_orphan_partial() (Stefano Brivio) [1475856]
  - [net] netfilter: nft_set_rbtree: handle element re-addition after deletion (Stefano Brivio) [1475849]
  - [net] netfilter: synproxy: fix conntrackd interaction (Stefano Brivio) [1475849]
  - [wireless] mac80211: don't send SMPS action frame in AP mode when not needed (Stefano Brivio) [1475840]
  - [wireless] mac80211: don't look at the PM bit of BAR frames (Stefano Brivio) [1475840]
  - [wireless] mac80211: free netdev on dev_alloc_name() error (Stefano Brivio) [1475840]
  - [wireless] mac80211: fix dropped counter in multiqueue RX (Stefano Brivio) [1475840]
  - [wireless] mac80211: strictly check mesh address extension mode (Stefano Brivio) [1475840]
  - [wireless] mac80211: fix IBSS presp allocation size (Stefano Brivio) [1475840]
  - [netdrv] brcmfmac: fix double free upon register_netdevice() failure (Stefano Brivio) [1475527]
  - [net] 8021q: Fix one possible panic caused by BUG_ON in free_netdev (Stefano Brivio) [1475527]
  - [s390] net: s390: fix up for "Fix inconsistent teardown and release of private netdev state" (Stefano Brivio) [1475527]
  - [net] Fix inconsistent teardown and release of private netdev state (Stefano Brivio) [1475527]
  - [net] Fix an intermittent pr_emerg warning about lo becoming free (Stefano Brivio) [1475414]
  - [net] net/packet: fix missing net_device reference release (Stefano Brivio) [1475414]
  - [net] bpf: add bpf_clone_redirect to bpf_helper_changes_pkt_data (Stefano Brivio) [1475385]
  - [net] Bluetooth: Fix user channel for 32bit userspace on 64bit kernel (Stefano Brivio) [1475376]
  - [net] af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers (Stefano Brivio) [1475324]
  - [net] sock: reset sk_err when the error queue is empty (Sabrina Dubroca) [1475709]
  - [net] rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string (Sabrina Dubroca) [1475709]
  - [net] rtnetlink: add IFLA_GROUP to ifla_policy (Sabrina Dubroca) [1475709]
  - [net] Zero ifla_vf_info in rtnl_fill_vfinfo() (Sabrina Dubroca) [1475709]
  - [net] Improve handling of failures on link and route dumps (Sabrina Dubroca) [1475709]
  - [net] handle NAPI_GRO_FREE_STOLEN_HEAD case also in napi_frags_finish() (Sabrina Dubroca) [1475709]
  - [net] don't call strlen on non-terminated string in dev_set_alias() (Sabrina Dubroca) [1475709]
  - [net] core: Fix slab-out-of-bounds in netdev_stats_to_stats64 (Sabrina Dubroca) [1475709]
  - [net] iov_iter: don't revert iov buffer if csum error (Sabrina Dubroca) [1475709]
  - [net] ppp: Fix false xmit recursion detect with two ppp devices (Matteo Croce) [1473902]
  - [net] ip6_tunnel: Correct tos value in collect_md mode (Hangbin Liu) [1474767]
  - [net] ipv6: fix calling in6_ifa_hold incorrectly for dad work (Hangbin Liu) [1474767]
  - [net] ipv6: Compare lwstate in detecting duplicate nexthops (Hangbin Liu) [1474767]
  - [net] ipv6: Do not leak throw route references (Hangbin Liu) [1474767]
  - [net] ipv6: Release route when device is unregistering (Hangbin Liu) [1474767]
  - [net] ipv6: Fix CALIPSO causing GPF with datagram support (Hangbin Liu) [1474767]
  - [net] ip6_tunnel: fix traffic class routing for tunnels (Hangbin Liu) [1474767]
  - [net] ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets (Hangbin Liu) [1474767]
  - [net] ipv4, ipv6: ensure raw socket message is big enough to hold an IP header (Hangbin Liu) [1474767]
  - [net] ipv6: Do not duplicate DAD on link up (Hangbin Liu) [1474767]
  - [scsi] hisi_sas: optimise DMA slot memory (Jun Ma) [1474164]
  - [scsi] hisi_sas: create hisi_sas_get_fw_info() (Jun Ma) [1474164]
  - [scsi] hisi_sas: add pci_dev in hisi_hba struct (Jun Ma) [1474164]
  - [scsi] hisi_sas: relocate get_ncq_tag_v2_hw() (Jun Ma) [1474164]
  - [scsi] hisi_sas: relocate sata_done_v2_hw() (Jun Ma) [1474164]
  - [scsi] hisi_sas: relocate get_ata_protocol() (Jun Ma) [1474164]
  - [scsi] hisi_sas: optimise the usage of hisi_hba.lock (Jun Ma) [1474164]
  - [scsi] hisi_sas: define hisi_sas_device.device_id as int (Jun Ma) [1474164]
  - [scsi] hisi_sas: fix timeout check in hisi_sas_internal_task_abort() (Jun Ma) [1474164]


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-21.el7a]
changelog:
  - [netdrv] tap: convert a mutex to a spinlock (Steve Best) [1477345]
  - [net] rtnetlink: allocate more memory for dev_set_mac_address() (Stefano Brivio) [1477127]
  - [irqchip] gic-v3: Fix out-of-bound access in gic_set_affinity (Auger Eric) [1477112]
  - [irqchip] gic-v3-its: Don't assume GICv3 hardware supports 16bit INTID (Auger Eric) [1477112]
  - [irqchip] gic-v3-its: Fix MSI alias accounting (Auger Eric) [1477112]
  - [block] disable runtime-pm for blk-mq (Ming Lei) [1476998]
  - [tools] power turbostat: decode MSR_IA32_MISC_ENABLE only on Intel (Jiri Olsa) [1456386]
  - [mm] hmm: various fixes for powerpc and HMM (Jerome Glisse) [1459703]
  - [powerpc] mm: Wire up hpte_removebolted for powernv (Jerome Glisse) [1459703]
  - [scsi] qla2xxx: Deprecate unsupported ISP (Himanshu Madhani) [1452822]


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-22.el7a]
changelog:
  - [fs] xfs: drop iolock from reclaim context to appease lockdep (Brian Foster) [1450297]
  - [fs] xfs: handle array index overrun in xfs_dir2_leaf_readbuf() (Eric Sandeen) [1475852]
  - [net] netfilter: nf_ct_helper: permit cthelpers with different names via nfnetlink (Matteo Croce) [1472057]
  - [net] sit: use __GFP_NOWARN for user controlled allocation (Matteo Croce) [1472614]
  - [crypto] authencesn: Fix digest_null crash (Herbert Xu) [1425049]
  - [powerpc] perf: Add thread IMC PMU support (Jiri Olsa) [1379294]
  - [powerpc] perf: Add core IMC PMU support (Jiri Olsa) [1379294]
  - [powerpc] perf: Add nest IMC PMU support (Jiri Olsa) [1379294]
  - [powerpc] powernv: Detect and create IMC device (Jiri Olsa) [1379294]
  - [powerpc] powernv: Add IMC OPAL APIs (Jiri Olsa) [1379294]
  - [iommu] arm-smmu, ACPI: Enable Cavium SMMU-v3 (Robert Richter) [1431610]
  - [iommu] arm-smmu-v3: Add workaround for Cavium ThunderX2 erratum #126 (Robert Richter) [1431610]
  - [iommu] arm-smmu-v3: Add workaround for Cavium ThunderX2 erratum #74 (Robert Richter) [1431610]
  - [acpi] ACPI/IORT: Fixup SMMUv3 resource size for Cavium ThunderX2 SMMUv3 model (Robert Richter) [1431610]
  - [acpi] iommu/arm-smmu-v3, acpi: Add temporary Cavium SMMU-V3 IORT model number definitions (Robert Richter) [1431610]
  - [iommu] arm-smmu: Plumb in new ACPI identifiers (Robert Richter) [1431610]
  - [i2c] xgene-slimpro: Add ACPI support by using PCC mailbox (Iyappan Subramanian) [1437693]
  - [i2c] xgene-slimpro: Use a single function to send command message (Iyappan Subramanian) [1437693]
  - [i2c] xgene: Set ACPI_COMPANION_I2C (Iyappan Subramanian) [1437693]
  - [i2c] mailbox: pcc: Fix crash when request PCC channel 0 (Iyappan Subramanian) [1474962]


author: Jim Perrin <jperrin@centos.org> [4.11.0-22.el7a.3]
changelog:
  * Thu Sep 14 2017 Jim Perrin <jperrin@centos.org> [4.11.0-22.el7a.2]
  - Set default default gov to performance
  - Apply patch for CVE-2017-1000251 (blueborne)


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-36.el7a]
changelog:
  - [base] driver core: platform: fix race condition with driver_override (Mark Salter) [1494199] {CVE-2017-12146}
  - [powerpc] KVM: PPC: Book3S HV: Check for updated HDSISR on P9 HDSI exception (Mauricio Oliveira) [1489479]
  - [vfio] Stall vfio_del_group_dev() for container group detach (David Gibson) [1493216]
  - [vfio] vfio/pci: Virtualize Maximum Payload Size (Auger Eric) [1483768]
  - [powerpc] powerpc/sstep: mullw should calculate a 64 bit signed result (Steve Best) [1493926]
  - [powerpc] powerpc/sstep: Fix issues with mcrf (Steve Best) [1493926]
  - [powerpc] powerpc/sstep: Fix issues with set_cr0() (Steve Best) [1493926]
  - [net] xfrm: policy: check policy direction value (Herbert Xu) [1479418] {CVE-2017-11600}
  - [net] packet: Don't write vnet header beyond end of buffer (Stefano Brivio) [1492602] {CVE-2017-14497}
  - [net] Bluetooth: Properly check L2CAP config option output buffer length (Neil Horman) [1489794] {CVE-2017-1000251}
  - [powerpc] powerpc/tm: Flush TM only if CPU has TM feature (Steve Best) [1490282]
  - [net] packet: hold bind lock when rebinding to fanout hook (Xin Long) [1490772]
  - [netdrv] vxlan: do not output confusing error message (Sabrina Dubroca) [1490811]
  - [netdrv] vxlan: correctly handle ipv6.disable module parameter (Sabrina Dubroca) [1490811]
  - [arm64] aarch64: topology: Fix CPU topology description on multi-socket platforms (Al Stone) [1461591]
  - [kernel] sched/topology: Fix memory leak in __sdt_alloc() (Lauro Ramos Venancio) [1481077]
  - [vhost] vhost_net: disable zerocopy by default (Jason Wang) [1395105]
  - [acpi] ACPICA: Dispatcher: Remove unnecessary call to debugger (Al Stone) [1488850]
  - [block] bsg-lib: fix kernel panic resulting from missing allocation of reply-buffer (Ming Lei) [1485447]
  - [block] Change argument type of scsi_req_init() (Ming Lei) [1485447]
  - [block] Make most scsi_req_init() calls implicit (Ming Lei) [1485447]
  - [block] Introduce request_queue.initialize_rq_fn() (Ming Lei) [1485447]
  - [powerpc] kernel: Initialize load_tm on task creation (Gustavo Duarte) [1481880]
  - [powerpc] kernel: Fix FP and vector register restoration (Gustavo Duarte) [1481880]
  - [netdrv] mlx4_core: Enable 4K UAR if SRIOV module parameter is not enabled (Kamal Heib) [1459983]
  - [block] blk-mq: map queues to all present CPUs (Scott Wood) [1466046]
  - [block] blk-mq: Include all present CPUs in the default queue mapping (Scott Wood) [1466046]
  - [nvme] Allocate queues for all possible CPUs (Scott Wood) [1466046]
  - [block] blk-mq: Create hctx for each present CPU (Scott Wood) [1466046]
  - [block] blk-mq: Register <dev>/queue/mq after having registered <dev>/queue (Scott Wood) [1466046]


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-37.el7a]
changelog:
  - [mm] ratelimit PFNs busy info message (Jonathan Toppins) [1496525]
  - [powerpc] powerpc/eeh: Create PHB PEs after EEH is initialized (Steve Best) [1493012]
  - [powerpc] Handle MCE on POWER9 with only DSISR bit 30 set (Steve Best) [1489480]
  - [powerpc] powerpc/powernv: Clear LPCR(PECE1) via stop-api only for deep state offline (Mauricio Oliveira) [1488412]
  - [sound] ALSA: timer: Use common error handling code in alsa_timer_init() (Jaroslav Kysela) [1466001] {CVE-2017-1000380}
  - [sound] ALSA: timer: Adjust a condition check in snd_timer_resolution() (Jaroslav Kysela) [1466001] {CVE-2017-1000380}
  - [sound] ALSA: timer: Follow standard EXPORT_SYMBOL() declarations (Jaroslav Kysela) [1466001] {CVE-2017-1000380}
  - [sound] ALSA: timer: Wrap with spinlock for queue access (Jaroslav Kysela) [1466001] {CVE-2017-1000380}
  - [sound] ALSA: timer: Improve user queue reallocation (Jaroslav Kysela) [1466001] {CVE-2017-1000380}
  - [sound] ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT (Jaroslav Kysela) [1466001] {CVE-2017-1000380}
  - [sound] ALSA: timer: Fix race between read and ioctl (Jaroslav Kysela) [1466001] {CVE-2017-1000380}
  - [sound] ALSA: timer: Info leak in snd_timer_user_tinterrupt() (Jaroslav Kysela) [1466001] {CVE-2017-1000380}
  - [sound] ALSA: timer: remove some dead code (Jaroslav Kysela) [1466001] {CVE-2017-1000380}
  - [crypto] scompress: defer allocation of scratch buffer to first use (Herbert Xu) [1487149]


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-38.el7a]
changelog:
  - [powerpc] powerpc/powernv: Rework EEH initialization on powernv (Steve Best) [1496734]
  - [powerpc] powerpc/eeh: Remove unnecessary config_addr from eeh_dev (Steve Best) [1496734]
  - [powerpc] powerpc/eeh: Remove unnecessary pointer to phb from eeh_dev (Steve Best) [1496734]
  - [powerpc] powerpc/eeh: Reduce to one the number of places where edev is allocated (Steve Best) [1496734]
  - [scsi] aacraid: Fix 2T+ drives on SmartIOC-2000 (Raghava Aditya Renukunta) [1496666]
  - [scsi] aacraid: Add a small delay after IOP reset (Mauricio Oliveira) [1494623]
  - [scsi] scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly (Chris Leech) [1481997] {CVE-2017-14489}
  - [powerpc] Fix VSX enabling/flushing to also test MSR_FP and MSR_VEC (Steve Best) [1489477]
  - [powerpc] powerpc/64s: Add workaround for P9 vector CI load issue (Steve Best) [1489477]
  - [powerpc] powerpc/mce: Move 64-bit machine check code into mce.c (Steve Best) [1489477]
  - [powerpc] powerpc/book3s/mce: Move add_taint() later in virtual mode (Steve Best) [1489477]
  - [powerpc] powerpc/64s: Fix system reset vs general interrupt reentrancy (Steve Best) [1489477]
  - [scsi] scsi_transport_fc: fix NULL pointer dereference in fc_bsg_job_timeout (Ming Lei) [1495488]
  - [block] bsg-lib: don't free job in bsg_prepare_job (Ming Lei) [1495488]
  - [powerpc] powerpc/mm: Don't send IPI to all cpus on THP updates (David Gibson) [1493966]
  - [scsi] qla2xxx: Update driver version to 10.00.00.07.4a-k (Himanshu Madhani) [1490638]
  - [scsi] qla2xxx: Fix system crash while triggering FW dump (Himanshu Madhani) [1490638]
  - [scsi] Avoid that scsi_exit_rq() triggers a use-after-free (Ewan Milne) [1479753]
  - [scsi] qla2xxx: Fix an integer overflow in sysfs code ("Ewan D. Milne") [1487660] {CVE-2017-14051}


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-39.el7a]
changelog:
  - [powerpc] Fix workaround for spurious MCE on POWER9 (Steve Best) [1496591]
  - [net] netfilter: ipset: pernet ops must be unregistered last (Florian Westphal) [1495042]
  - [infiniband] IB/mlx5: Write combine mapping workaround for ThunderX2 (Vadim Lomovtsev) [1496554]
  - [pci] PCI: Avoid slot reset if bus reset is not possible (Robert Richter) [1439575]
  - [pci] PCI: Avoid bus reset for Cavium cn8xxx root ports (Robert Richter) [1439575]
  - [pci] PCI: Allow PCI_DEV_FLAGS_NO_BUS_RESET to be used on bus device (Robert Richter) [1439575]
  - [fs] ext4: fix off-by-in loop termination in ext4_find_unwritten_pgoff() (Bill O'Donnell) [1487528]
  - [fs] ext4: fix SEEK_HOLE (Bill O'Donnell) [1487528]
  - [fs] Reorder inode_owner_or_capable() to avoid needless (Bill O'Donnell) [1458832]
  - [netdrv] netdrivers: mark drivers unsupported (Jonathan Toppins) [1486939]
  - [redhat] config: re-enable bnx2 driver and mark unsupported (Jonathan Toppins) [1481788]
  - [kernel] rh_taint: add support for marking driver as unsupported (Jonathan Toppins) [1486929]


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-40.el7a]
changelog:
  - [of] drivers: of: increase MAX_RESERVED_REGIONS to 32 (Steve Best) [1494626]
  - [kernel] audit: fix memleak in auditd_send_unicast_skb (Jerome Marchand) [1479708]
  - [powerpc] KVM: PPC: Book3S: Fix server always zero from kvmppc_xive_get_xive() (Sam Bobroff) [1477391]
  - [vfio] vfio/spapr: Add cond_resched() for huge updates (Sam Bobroff) [1494122]
  - [drm] drm/vmwgfx: Make sure backup_handle is always valid (Rob Clark) [1462817] {CVE-2017-9605}
  - [drm] drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl() (Rob Clark) [1437863] {CVE-2017-7346}
  - [net] l2tp: fix race condition in l2tp_tunnel_delete (Sabrina Dubroca) [1485209]
  - [net] l2tp: prevent creation of sessions on terminated tunnels (Sabrina Dubroca) [1485209]
  - [net] l2tp: hold tunnel used while creating sessions with netlink (Sabrina Dubroca) [1485209]
  - [net] l2tp: hold tunnel while handling genl TUNNEL_GET commands (Sabrina Dubroca) [1485209]
  - [net] l2tp: hold tunnel while handling genl tunnel updates (Sabrina Dubroca) [1485209]
  - [net] l2tp: hold tunnel while processing genl delete command (Sabrina Dubroca) [1485209]
  - [net] l2tp: hold tunnel while looking up sessions in l2tp_netlink (Sabrina Dubroca) [1485209]
  - [net] l2tp: initialise session's refcount before making it reachable (Sabrina Dubroca) [1485209]
  - [net] netfilter: ebtables: fix race condition in frame_filter_net_init() (Artem Savkov) [1497221]
  - [pci] quirks: update Cavium ThunderX ACS quirk implementation (Vadim Lomovtsev) [1479894]
  - [net] netfilter: xtables: add scheduling opportunity in get_counters (Florian Westphal) [1496169]
  - [redhat] configs: Disable buggy vmx driver on ppc (Herbert Xu) [1490972]
  - [net] ip6_tunnel: do not allow loading ip6_tunnel if ipv6 is disabled in cmdline (Xin Long) [1490799]
  - [scsi] scsi_transport_sas: select BLK_DEV_BSGLIB (Gustavo Duarte) [1488371]
  - [scsi] scsi_transport_sas: switch to bsg-lib for SMP passthrough (Gustavo Duarte) [1488371]
  - [scsi] smartpqi: remove the smp_handler stub (Gustavo Duarte) [1488371]
  - [scsi] hpsa: remove the smp_handler stub (Gustavo Duarte) [1488371]
  - [scsi] bsg-lib: pass the release callback through bsg_setup_queue (Gustavo Duarte) [1488371]
  - [net] netfilter: ipvs: do not create conn for ABORT packet in sctp_conn_schedule (Xin Long) [1479257]
  - [net] netfilter: ipvs: fix the issue that sctp_conn_schedule drops non-INIT packet (Xin Long) [1479257]
  - [net] netlink: fix an use-after-free issue for nlk groups (Xin Long) [1482463]
  - [net] ipv6: do not set sk_destruct in IPV6_ADDRFORM sockopt (Xin Long) [1483284]
  - [netdrv] i40e: use cpumask_copy instead of direct assignment (Stefano Brivio) [1483725]


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-41.el7a]
changelog:
  - [tty] amba-pl011: Fix spurious TX interrupts (Iyappan Subramanian) [1498582]
  - [mm] cma: Limit cma reserve support only to systems with >=2G RAM (Bhupesh Sharma) [1492799]
  - [arm64] kexec: Limit crash dump support only to systems with >=2G RAM (Bhupesh Sharma) [1492799]
  - [net] netfilter: nat: avoid use of nf_conn_nat extension (Florian Westphal) [1471714]
  - [net] netfilter: nat: Do not use ARRAY_SIZE() on spinlocks to fix zero div (Florian Westphal) [1471714]
  - [net] netfilter: nat: use keyed locks (Florian Westphal) [1471714]
  - [net] netfilter: nat: Revert netfilter: nat: convert nat bysrc hash to rhashtable (Florian Westphal) [1471714]
  - [net] netfilter: nat: use atomic bit op to clear the _SRC_NAT_DONE_BIT (Florian Westphal) [1471714]


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-42.el7a]
changelog:
  - [kernel] sched,wake: simplify wake_affine (Rik van Riel) [1388460]
  - [kernel] sched, numa: scale scan period with tasks in group and shared/private (Rik van Riel) [1388460]
  - [kernel] numa, sched: slow down scan rate if shared faults dominate (Rik van Riel) [1388460]
  - [kernel] sched/fair: Fix wake_affine_llc() balancing rules (Rik van Riel) [1388460]
  - [kernel] sched/fair: Fix wake_affine() for !NUMA_BALANCING (Rik van Riel) [1388460]
  - [kernel] sched/numa: Hide numa_wake_affine() from UP build (Rik van Riel) [1388460]
  - [kernel] sched,fair: remove effective_load (Rik van Riel) [1388460]
  - [kernel] sched, numa: implement numa node level wake_affine (Rik van Riel) [1388460]
  - [kernel] sched: simplify wake_affine for single socket case (Rik van Riel) [1388460]
  - [kernel] sched/numa: Override part of migrate_degrades_locality() when idle balancing (Rik van Riel) [1388460]


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-43.el7a]
changelog:
  - [kernel] cgroup: Reinit cgroup_taskset structure before cgroup_migrate_execute() returns (Waiman Long) [1496999]
  - [fs] ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff() (Bill O'Donnell) [1500586]
  - [fs] fs/locks: Remove fl_nspid and use fs-specific l_pid for remote locks (Benjamin Coddington) [1493427]
  - [powerpc] KVM: PPC: Book3S HV: Don't access XIVE PIPR register using byte accesses (Suraj Jitindar Singh) [1496875]
  - [powerpc] KVM: PPC: Book3S HV: Workaround POWER9 DD1.0 bug causing IPB bit loss (Suraj Jitindar Singh) [1496875]
  - [arm64] mm: Use READ_ONCE when dereferencing pointer to pte table (Mark Langsdorf) [1475855]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.11.0-44.1.1.el7a]
changelog:
  - [netdrv] ib/mlx5: set UMR wqe fence according to HCA cap (Honggang Li) [1508606 1494261]
  - [netdrv] ib/mlx5: Define interface bits for fencing UMR wqe (Honggang Li) [1508606 1494261]
  - [scsi] aacraid: Fix controller initialization failure (Mauricio Oliveira) [1508580 1502892]
  - [powerpc] KVM: PPC: Book3S HV: Add more barriers in XIVE load/unload code (Suraj Jitindar Singh) [1508526 1497013]
  - [powerpc] xive: Fix the size of the cpumask used in xive_find_target_in_mask() (Steve Best) [1507413 1501747]
  - [redhat] hardcode .el7a dist tag (Frantisek Hrbata)


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.11.0-44.2.1.el7a]
changelog:
  - [powerpc] perf: Fix core-imc hotplug callback failure during imc initialization (Jiri Olsa) [1510165 1507609]
  - [misc] cxl: Set the valid bit in PE for dedicated mode (Waiman Long) [1510152 1498927]
  - [misc] cxl: Enable global TLBIs for cxl contexts (Waiman Long) [1510152 1498927]
  - [powerpc] powerpc/mm: Export flush_all_mm() (Waiman Long) [1510152 1498927]
  - [misc] cxl: Fix memory page not handled (Waiman Long) [1510152 1498927]
  - [misc] cxl: Fix driver use count (Waiman Long) [1510152 1498927]
  - [powerpc] powerpc/mm: Optimize detection of thread local mm's (Waiman Long) [1510152 1498927]
  - [powerpc] powerpc/mm: Ensure cpumask update is ordered (Waiman Long) [1510152 1498927]
  - [powerpc] perf: Fix for core/nest imc call trace on cpuhotplug (Jiri Olsa) [1508905 1493444]
  - [powerpc] perf: Fix IMC initialization crash (Jiri Olsa) [1508527 1500707]
  - [sched] core: Address more wake_affine() regressions (Lauro Ramos Venancio) [1508368 1465041]
  - [sched] core: Fix wake_affine() performance regression (Lauro Ramos Venancio) [1508368 1465041]
  - [kernel] revert "sched,wake: simplify wake_affine" (Lauro Ramos Venancio) [1508368 1465041]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.11.0-44.3.1.el7a]
changelog:
  - [block] blk-mq-tag: check for NULL rq when iterating tags (Ming Lei) [1518433 1498563]
  - [scsi] sd: Do not override max_sectors_kb sysfs setting (Steve Best) [1518432 1514951]
  - [net] i40e: Use smp_rmb rather than read_barrier_depends (Mauricio Oliveira) [1518412 1513182]
  - [net] ixgbe: Fix skb list corruption on Power systems (Mauricio Oliveira) [1518412 1513182]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.11.0-44.4.1.el7a]
changelog:
  - [mm] kernel: pmd can become dirty without going through a COW cycle (Chris von Recklinghausen) [1518611 1518612] {CVE-2017-1000405}
  - [powerpc] powernv: Fix missing attr initialisation in (Frantisek Hrbata) [1522845 1513834]
  - [powerpc] powernv: Add OPAL exports attributes to sysfs (Frantisek Hrbata) [1522845 1513834]
  - [cpufreq] stats: Handle the case when trans_table goes beyond PAGE_SIZE (Desnes Augusto Nunes do Rosario) [1522844 1499411]
  - [netdrv] i40e: avoid NVM acquire deadlock during NVM update (Frantisek Hrbata) [1522843 1511691]
  - [netdrv] i40e: point wb_desc at the nvm_wb_desc during (Frantisek Hrbata) [1522843 1511691]
  - [block] drain queue before waiting for q_usage_counter becoming zero (Ming Lei) [1522645 1513036]
  - [block] wake up all tasks blocked in get_request() (Ming Lei) [1522645 1513036]
  - [block] Make q_usage_counter also track legacy requests (Ming Lei) [1522645 1513036]
  - [powerpc] kvm: Tie KVM_CAP_PPC_HTM to the user-visible TM feature (Waiman Long) [1509974 1498555]
  - [powerpc] tm: P9 disable transactionally suspended sigcontexts (Waiman Long) [1509974 1498555]
  - [powerpc] powernv: Enable TM without suspend if possible (Waiman Long) [1509974 1498555]
  - [powerpc] Add PPC_FEATURE2_HTM_NO_SUSPEND (Waiman Long) [1509974 1498555]
  - [powerpc] tm: Add commandline option to disable hardware transactional memory (Waiman Long) [1509974 1498555]


author: Pingfan Liu <piliu@redhat.com> - 2.0.14-10
changelog:
  - kdumpctl: call strip_comments only when necessary to speedup
  - Revert "kdumpctl: improve "while read" time for /etc/kdump.conf"


author: Pingfan Liu <piliu@redhat.com> - 2.0.14-12
changelog:
  - kdump.sysconfig.x86_64: remove kaslr in kdump kernel cmdline
  - Revert commit b590153 kdump.sysconfig/x86_64: Add nokaslr to kdump kernel cmdline


author: Pingfan Liu <piliu@redhat.com> - 2.0.14-14
changelog:
  - kdump.conf.5: clarify the fence_kdump_nodes option
  - kdumpctl: for fence_kdump, the ipaddr of this node should be excluded from list


author: Pingfan Liu <piliu@redhat.com> - 2.0.14-15
changelog:
  - Revert "pc64/ppc64le: drop cpu online rule in 40-redhat.rules in kdump initramfs"
  - udev rules: mask cpu hotplug rules


author: Tony Camuso <tcamuso@redhat.com> - 20-9
changelog:
  - Must be bumped to 20-9 due to changes and version bumps in the
    7.2-z stream.
    Resolves: rhbz#1320204


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-10
changelog:
  - weak-modules: deprecate --delete-modules switch.
  - weak-modules: implement some pathes configuration from cmdline.
  - weak-modules: redesign to reuse depmod -aeE functionality
    (with some preparation changes).
    This is an updated version of the script which doesn't support
    multiple installation of the same out-of-tree module (stored in the
    'extra' subdirectory). But it more correctly checks dependencies
    between the modules.
    Resolves: rhbz#1367942


author: Tony Camuso <tcamuso@redhat.com> - 20-10
changelog:
  - Rename patches so they are not specific to the build. This was
    causing problems with z-stream builds.
    Resolves: rhbz#1416498


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-12
changelog:
  - weak-modules: fix coverity introduced by latest changes
  - weak-modules: fix "permission denied" on some upgrades.
    Resolves: rhbz#1416566


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-15.el7_4.2
changelog:
  - libkmod-elf: resolve CRC if module is built with MODULE_REL_CRCS.
  - weak-modules: process only weak-updates related depmod output.
    Resolves: rhbz#1482385


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-15.el7_4.3
changelog:
  - weak-modules: implement dry run by symlink restoration.
  - weak-modules: fix dry-run for non-lib-modules installation.
    Resolves: rhbz#1489696.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-15.el7_4.5
changelog:
  - weak-modules: use function to generate weak_updates_dir
  - weak-modules: implement dry-run on the tempdir
    Resolves: rhbz#1511943.


author: Karel Zak <kzak@redhat.com> 2.23.2-36
changelog:
  - fix #1344102 - fdisk does not handle 4kN devices correctly in 'Blocks' calculation
  - fix #1344720 - when fdisk detects gpt table, expected menu items seem to be missing in the 'm' output
  - fix #1323916 - logger unnecessarily splits messages sent via stdin into 1024 byte chunks
  - fix #1344726 - [RFE] fdisk: output UID from gpt in fdisk when detecting that a gpt partition table is present
  - fix #1362662 - fdisk -l fails/stops on first passive/not ready device, works on RHEL6
  - fix #1369436 - losetup man page incorrect syntax for Setup loop device
  - fix #1392656 - [LLNL 7.4 Bug] fix buffer overflows in util-linux with upstream patch
  - fix #1370959 - [FJ7.3 Bug]: man 8 umount is wrong.
  - fix #1357746 - mount -av" report NFS "successfully mounted" but it is not.
  - fix #1417722 - umount -a results in selinux being reported as Disabled
  - fix #1402825 - RHEL7: "sfdisk -s" can't list the disk size
  - fix #1403973 - /usr/bin/more crash on repeat search on failed regex match
  - fix #1403971 - /usr/bin/more crash in end_it due to double free
  - fix #1358095 - ipcs shows wrong gid information
  - fix #1358097 - ipcs shows strange status message in ja locale
  - fix #1378100 - fix swapon discard option parsing
  - fix #1416467 - [RFE] Add support for posix_fallocate(3) call in fallocate(1) utility
  - fix #1358755 - Backport request for zramctl on util-linux v2.23.2
  - fix #1392661 - [LLNL 7.4 Bug] add zfs patches to util-linux
  - fix #1360764 - SMT: "Threads Per Core" will automatically change when odd or even number of vcpu are enabled online.
  - fix #1397709 - [7.4 FEAT] Refresh code for lscpu to support s390x cpu topology
  - fix #1402183 - [HPE 7.3 Bug] fdisk -l does not list non-BTT NVDIMM devices


author: Karel Zak <kzak@redhat.com> 2.23.2-41
changelog:
  - fix #1451704 - IMSM RAID on 4k disks not assembled on boot
  - force gettext messages refresh (for #1358097 bugfix)


author: Karel Zak <kzak@redhat.com> 2.23.2-43.el7_4.1
changelog:
  - fix #1499760 - gvfs-udisks2-volume-monitor generates huge amount of audit log with access denied messages


author: Lukas Nykryn <lnykryn@redhat.com> - 219-35
changelog:
  - tmpfiles: add new 'e' action which cleans up a dir without creating it (#1225739)
  - util:bind_remount_recursive(): handle return 0 of set_consume() (#1433687)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-37
changelog:
  - core: add support for the "pids" cgroup controller (#1337244)
  - core: add new DefaultTasksMax= setting for system.conf (#1337244)
  - logind: add a new UserTasksMax= setting to logind.conf (#1337244)
  - core: support percentage specifications on TasksMax= (#1337244)
  - core: reinstate propagation of stop/restart jobs via RequsiteOf dependencies (#1436021)
  - core: when propagating restart requests due to deps, downgrade restart to try-restart (#1436021)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-39
changelog:
  - tests: set tasks_max to infinity (#1337244)
  - Avoid forever loop for journalctl --list-boots command (#4278) (#1294516)
  - sd-journal: return SD_JOURNAL_INVALIDATE only if journal files were actually deleted/moved (#5580) (#1446140)
  - load-fragment: don't print error about incorrect syntax when IPv6 is disabled (#1377055)
  - core: manager: add some missing dbus properties (#1427927)
  - core: manager: expose DefaultLimit* as properties on dbus (#1427927)
  - fstab-generator: remove bogus condition (#1446171)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-40
changelog:
  - readahead-collect: don't print warning message when handling symlink (#1387095)
  - tmpfiles: don't recursively descend into journal directories in /var (#1411199)
  - tmpfiles: also set acls on /var/log/journal (#1411199)
  - tmpfiles: set acls on system.journal explicitly (#1411199)
  - sysctl: configure kernel parameters in the order they occur in each sysctl configuration files (#4205) (#1382244)
  - units: drop explicit NotifyAccess setting from journald's unit file (#5749) (#1444356)
  - systemd-notify: Always pass a valid pid to sd_pid_notify (#1381743)
  - sd_pid_notify_with_fds: fix computing msg_controllen (#1381743)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-42.1
changelog:
  - Revert "udev: net_id: add support for phys_port_name attribute (#4506)" (#1477285)
  - reintroduce naming based on phys_port_name for mlxsw and rocker via udev rule


author: Lukas Nykryn <lnykryn@redhat.com> - 219-42.4
changelog:
  - manager: when reexecuting try to connect to bus only when dbus.service is around (#6773) (#1465737)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-42.5
changelog:
  - unmount: Pass in mount options when remounting read-only (#1312002)
  - shutdown: don't remount,ro network filesystems. (#6588) (#1312002)
  - shutdown: fix incorrect fscanf() result check (#6806) (#1312002)


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.28.1-1.52
changelog:
  - v2v: Warn if Group Policy or AV software may result in 7B boot failure
    (1260689)
  - v2v: Fix OVF XML to enable qxl display
    resolves: rhbz#1260590


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.28.1-1.53
changelog:
  - v2v: Error if certain options appear twice on the command line (1261242)
  - v2v: Add --dcpath parameter to allow dcPath to be overridden (1256823)
  - v2v: Partially revert: Fix OVF XML to enable qxl display (1260590)
  - v2v: Detect AVG Technologies as AV software (1261436)
    resolves: rhbz#1261281


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.32.7-3
changelog:
  - Rebase to libguestfs 1.32 in RHEL 7.3
    resolves: rhbz#1218766
  - The full tests are now run after the package has been built.
  - New tool and subpackage: virt-dib (safe diskimage-builder replacement).
  - New subpackage libguestfs-inspect-icons to reduce dependencies of main pkg
    (see https://bugzilla.redhat.com/1194158).
  - New tool: virt-get-kernel.
  - Depend on java-headless instead of full java.
  - New tool: virt-v2v-copy-to-local.
  - Disable virt-v2v subpackage on ppc64 etc
    resolves: rhbz#1287826
  - v2v: Remove VirtualBox Additions correctly
    resolves: rhbz#1296606
  - Add clearer warnings sections to all man pages
    resolves: rhbz#1293527
  - v2v: Disable the --in-place option.
  - v2v: Support conversion of Windows > 7
    resolves: rhbz#1190669
  - Add code to verify tarball signatures.
  - General performance improvements.
  - v2v: Prevent duplicate -b, -n, -oa options
    resolves: rhbz#1326266
    resolves: rhbz#1325825
  - v2v: Unquote UUID and LABEL in fstab (util-linux 1335671)
  - v2v: Fix alignment issues in treeviews in conversion dialog
    resolves: rhbz#1340407
  - p2v: spinner should be hidden when it stops spinning
    resolves: rhbz#1341564
  - p2v: ethtool command is not supported on p2v client
    resolves: rhbz#1341608
  - p2v: Add ifconfig command to ISO
    resolves: rhbz#1342447
  - p2v: Warn if virt-p2v-make-disk used on a partition
    resolves: rhbz#1342337
  - Build using OCaml with fix for CVE-2015-8869.
    resolves: rhbz#1343101
  - customize: Add --uninstall option (upstream 1343375)
  - p2v: Document permissions on id_rsa file
    resolves: rhbz#1343414
  - p2v: Print full curl error message
    resolves: rhbz#1343423
  - get-kernel: Fix --format auto
    resolves: rhbz#1341984
  - v2v: Provide better <Origin/> information to RHEV-M
    resolves: rhbz#1342398
  - customize: Give an error if --truncate-recursive path does not exist
    resolves: rhbz#1345809
  - sysprep: Add --network option so that --install option can be used
    resolves: rhbz#1345813
  - p2v: Print proper error if incorrect password is given
    resolves: rhbz#1227599
  - p2v: Print ssh error if incorrect hostname is given
    resolves: rhbz#1167916
  - p2v: Display progress of operation in non-GUI mode
    resolves: rhbz#1229386
  - p2v: Add a dialog confirming the user really means to cancel
    resolves: rhbz#1340464
  - p2v: log window should process colour escapes and backspaces
    resolves: rhbz#1314244
  - v2v: Fix installation of virtio drivers with *.dll files
    resolves: rhbz#1311373
  - p2v: Improve error message when ssh login to conversion server fails
    resolves: rhbz#1348900
  - v2v: Remove --dcpath parameter from manual
    resolves: rhbz#1315237
  - v2v: Fix conversion of guests with floppy drives
    resolves: rhbz#1309706
  - p2v: Better error when sudo requires a password
    resolves: rhbz#1340809
  - v2v: Refuse to convert if there is < 1GB free in temporary directory
    resolves: rhbz#1316479
  - inspection: Get Windows drive letters for GPT disks
    resolves: rhbz#1349237
  - p2v: Add disk utils and display serial number of disks
    resolves: rhbz#855058
  - p2v: Fix timeout error when connecting to unresponsive ssh server
    resolves: rhbz#1350363
  - Remove external dependency generator.  Use supermin RPM deps instead.
    related: rhbz#1309796
  - p2v: Flush messages to the journal immediately
    resolves: rhbz#1229386
  - customize: Fix --install on ppc64le
    resolves: rhbz#1264835
  - lib: Fix finding icons in Windows 7 64 bit guests
    resolevs: rhbz#1352761
  - v2v: Add virsh --quiet flag when running virt-v2v --quiet
    resolves: rhbz#1358142
  - lib: Fix inspection of ISOs with latest libosinfo
    resolves: rhbz#1359652
  - dib: Fix run_command exit handlers on failure
    resolves: rhbz#1362357
  - dib: Rework run of extra-data.d hooks
    resolves: rhbz#1362354
  - Miscellaneous fixes to man pages and --help output
    resolves: rhbz#1362668
  - lib: Specify backing format for read-only files
    resolves: rhbz#1354335
  - Fix --selinux-relabel option
    resolves: rhbz#1362669
  - sparsify: Fix --in-place option with UEFI guest
    resolves: rhbz#1364347
  - p2v: Use latest linux-firmware in ISO
    resolves: rhbz#1364419
  - v2v: Fix guest name when using -i disk
    resolves: rhbz#1365005
  - p2v: Fix GUI message.
  - v2v: Make fstrim message clearer
    resolves: rhbz#1366456
  - v2v: Fix conversion of UEFI guests when Secure Boot OVMF installed
    resolves: rhbz#1367615
  - lib: Fix assert-fail if port is missing in libvirt XML
    resolves: rhbz#1370424


author: Pino Toscano <ptoscano@redhat.com> - 1:1.36.3-6
changelog:
  - Rebase to libguestfs 1.36 in RHEL 7.4.
    resolves: rhbz#1359086
  - v2v: always use names for libvirt pools
    resolves: rhbz#1141631
  - v2v: correctly find GRUB in RHEL UEFI guests
  - v2v: uninstall VMware tools packages from guests
    resolves: rhbz#1155150
  - v2v: install RHEV-APT only when using -o rhev/-o vdsm
    resolves: rhbz#1161019
  - New API: btrfs-filesystem-show
    resolves: rhbz#1164765
  - p2v: always enable debugging when running virt-v2v
    resolves: rhbz#1167623
  - libguestfs prefers virtio-pci on aarch64
    resolves: rhbz#1237250
  - v2v: make sure to copy all the driver files on Windows
    resolves: rhbz#1255610
  - Better tolerate corrupted Windows hivex; bump the hivex BuildRequires and
    Requires to >= 1.3.10-5.8.el7
    resolves: rhbz#1311890
  - v2v: ignore all the environment variables for proxy when exporting from
    vCenter
    resolves: rhbz#1354507
  - virt-sysprep can deal with full-LUKS encrypted guests
    resolves: rhbz#1362649
  - All the tools have bash completion scripts.
    resolves: rhbz#1367738
  - v2v: do not remove Processor and Intelppm nodes in Windows guests
    resolves: rhbz#1372668
  - Fix SELinux relabelling in old RHEL 6 guests, by adjusting a broken
    regular expression in file_contexts file
    resolves: rhbz#1374232
  - v2v: set all the properties on creation when exporting to Glance
    resolves: rhbz#1374405
  - v2v: set hw_video_model when exporting to Glance
    resolves: rhbz#1374651
  - v2v: fix OVA conversion as root using the libvirt backend
    resolves: rhbz#1375157
  - Various improvements and fixes to the documentation
    resolves: rhbz#1377081
    resolves: rhbz#1390876
    resolves: rhbz#1398070
    resolves: rhbz#1425306
  - v2v: support <listen type='socket'> and <listen type='none'>
    resolves: rhbz#1378022
  - v2v: allow libvirt >= 2.1.0 for vCenter conversions
    resolves: rhbz#1379240
  - p2v: enable mnemonics in the GUI
    resolves: rhbz#1379289
  - Split virt-p2v, and the tools for it, in an own package: virt-p2v-maker
    resolves: rhbz#1382275
  - Correctly parse mount options in btrfs entries in /etc/fstab.
    resolves: rhbz#1383517
  - Read secrets from libvirt domains, when inspecting them
    resolves: rhbz#1392798
  - v2v: add --vdsm-compat=1.1 flag for VDSM
    resolves: rhbz#1400205
  - Fix inspection with UsrMove and /usr in a separate partition
    resolves: rhbz#1401474
  - v2v: improve import compatibility with OVAs produced by AWS
    resolves: rhbz#1402301
  - resize: allow URIs for the output disk
    resolves: rhbz#1404182
  - Disable EDD when launching the appliance
    resolves: rhbz#1404287
  - v2v: increase the memory allocated to the appliance
    resolves: rhbz#1418283
  - p2v: switch from GTK+ 2 to GTK+ 3
  - p2v: add dbus-devel as BuildRequires to disable suspension during the
    conversion
  - libguestfs-java: bump the java-headless Require to >= 1.7.0, matching the
    Build-Require, and the generated bytecode
    resolves: rhbz#1364518
  - Do not try to use/write to /var/cache/yum & /var/log/yum.log
  - Bump ocaml-findlib-devel BuildRequires to >= 1.3.3-7.el7, because of
    RHBZ#1403897
  - v2v: remove --dcpath & --dcPath from --help output too
    resolves: rhbz#1429430
  - v2v: force VNC as display for -i disk, as SDL is not supported
    resolves: rhbz#1372671
  - v2v, p2v: rename rhvm network to ovirtmgmt
    resolves: rhbz#1429491
  - v2v: when exporting to local disk, check that UEFI firmware is installed
    before conversion
    resolves: rhbz#1429506
  - dib: actually generate SHA256 checksums when using --checksum
    resolves: rhbz#1430184
  - v2v: do not mention SUSE Xen hosts as supported
    resolves: rhbz#1430203
  - v2v: depend on OVMF/AAVMF, for converting EFI guests
    resolves: rhbz#1429643
  - v2v: use absolute path when using an OVA as backing file
    resolves: rhbz#1430680
  - v2v: support Debian/Ubuntu guests
    resolves: rhbz#1387213
  - sysprep: remove DHCP_HOSTNAME entries
    resolves: rhbz#1427529
  - v2v: avoid repeated "run virt-v2v -v -x" message on error
    resolves: rhbz#1167623
  - bash-completion: add script for virt-v2v-copy-to-local
    resolves: rhbz#1367738
  - v2v: fix virtio block driver installation for Windows 10 and Windows 2016
    resolves: rhbz#1434737
  - Replace the libosinfo dependency with osinfo-db, since we are only using
    the osinfo database.
  - v2v: fix virtio driver installation for Windows 8 UEFI
    resolves: rhbz#1431579
  - v2v: new 'vmx' import method
    resolves: rhbz#1441197
  - v2v: properly identify Windows 2016 guests when exporting them to RHV-M
    resolves: rhbz#1447202
  - Run pvresize in non-interactive mode
    resolves: rhbz#1460692
  - resize: make sure the input disk is read-only
    resolves: rhbz#1463714
  - Switch qemu-kvm-rhev dependency to qemu-kvm on aarch64
    resolves: rhbz#1463646


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-43
changelog:
  - Resolves: rhbz#1440132 - fiter_users and filter_groups stop working
                             properly in v 1.15


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-44
changelog:
  - Resolves: rhbz#1457927 - getent failed to fetch netgroup information
                             after changing default_domain_suffix to
                             ADdomin in /etc/sssd/sssd.conf


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-47
changelog:
  - Resolves: rhbz#1430415 - ldap_purge_cache_timeout in RHEL7.3 invalidate
                             most of the entries once the cleanup task kicks in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-48
changelog:
  - Resolves: rhbz#1459846 - krb5: properly handle 'password expired'
                             information retured by the KDC during
                             PKINIT/Smartcard authentication


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-49
changelog:
  - Resolves: rhbz#1450107 - SSSD doesn't handle conflicts between users
                             from trusted domains with the same name when
                             shortname user resolution is enabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-50
changelog:
  - Resolves: rhbz#1457926 - Wrong search base used when SSSD is directly
                             connected to AD child domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-50.1
changelog:
  - Resolves: rhbz#1478250 - Idle nss file descriptors should be closed
                             [rhel-7.4.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-50.2
changelog:
  - Resolves: rhbz#1478252 - Querying the AD domain for external domain's
                             ID can mark the AD domain offline [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50.3
changelog:
  - Resolves: rhbz#1482927 - sssd_be is utilizing more CPU during sudoi
                             rules refresh [rhel-7.4.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-50.4
changelog:
  - Resolves: rhbz#1489290 - samba shares with sssd authentication broken
                             on 7.4 [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50.6
changelog:
  - Add a patch that was missed in 1.15.2-50.4
  - Related: rhbz#1489290 - samba shares with sssd authentication broken
                            on 7.4 [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50.7
changelog:
  - Resolves: rhbz#1506142 - SSSD can crash due to ABI changes in
                             libldb >= 1.2.0 (1.1.30) [rhel-7.4.z]
  - Resolves: rhbz#1506682 - sssd_client: add mutex protected call to the
                             PAC responder [rhel-7.4.z]
  - Resolves: rhbz#1499658 - CVE-2017-12173 sssd: unsanitized input when
                             searching in local cache database [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50.8
changelog:
  - Resolves: rhbz#1508972 - Accessing IdM kerberos ticket fails while id
                             mapping is applied [rhel-7.4.z]
  - Resolves: rhbz#1509177 - Race condition between refreshing the cr_domain
                             list and a request that is using the list can
                             cause a segfault is sssd_nss [rhel-7.4.z]


author: Rui Matos <rmatos@redhat.com> - 2.5.2-11
changelog:
  - Resolves: CVE-2017-13738, CVE-2017-13740, CVE-2017-13741,
    CVE-2017-13742, CVE-2017-13743, CVE-2017-13744, CVE-2014-8184


author: Paul Wouters <pwouters@redhat.com> - 3.15-6
changelog:
  - Resolves: rhbz#1283468 keyingtries=0 is broken
  - Resolves: rhbz#1297816 When using SHA2 as PRF algorithm, nonce payload is below the RFC minimum size
  - Resolves: rhbz#1344567 CVE-2016-5361 libreswan: IKEv1 protocol is vulnerable to DoS amplification attack
  - Resolves: rhbz#1313747 ipsec pluto returns zero even if it fails
  - Resolves: rhbz#1302778 fips does not check hash of some files (like _import_crl)
  - Resolves: rhbz#1278063 Unable to authenticate with PAM for IKEv1 XAUTH
  - Resolves: rhbz#1257079 Libreswan doesn't call NetworkManager helper in case of a connection error
  - Resolves: rhbz#1272112 ipsec whack man page discrepancies
  - Resolves: rhbz#1280449 PAM xauth method does not work with pam_sss
  - Resolves: rhbz#1290907 ipsec initnss/checknss custom directory not recognized
  - Resolves: rhbz#1309764 ipsec barf does not show pluto log correctly in the output
  - Resolves: rhbz#1347735 libreswan needs to check additional CRLs after LDAP CRL distributionpoint fails
  - Resolves: rhbz#1219049 Pluto does not handle delete message from responder site in ikev1
  - Resolves: rhbz#1276524 [USGv6] IKEv2.EN.R.1.1.3.2 case failed due to response to bad INFORMATIONAL request
  - Resolves: rhbz#1315412 ipsec.conf manpage does not contain any mention about crl-strict option
  - Resolves: rhbz#1229766 Pluto crashes after stop when I use floating ip address


author: Paul Wouters <pwouters@redhat.com> - 3.15-7
changelog:
  - Resolves: rhbz#1311360  When IKE rekeys, if on a different tunnel, all subsequent attempts to rekey fail
  - Resolves: rhbz#1361721 libreswan pluto segfault


author: Paul Wouters <pwouters@redhat.com> - 3.15-8
changelog:
  - Resolves: rhbz#1361721 libreswan pluto segfault [UPDATED]
  - Resolves: rhbz#1276524 [USGv6] IKEv2.EN.R.1.1.3.2 case failed due to response to bad INFORMATIONAL request [UPDATED]
  - Resolves: rhbz#1309764 ipsec barf [additional man page update and --no-pager]


author: Paul Wouters <pwouters@redhat.com> - 3.20-2
changelog:
  - Resolves: rhbz#1372279 ipsec auto --down CONNECTION returns error for tunnels
  - Resolves: rhbz#1444115 FIPS: libreswan must generate RSA keys with a minimal exponent of F4, nor E=3
  - Resolves: rhbz#1341353 Allow Preshared Key authentication in FIPS mode for libreswan


author: Paul Wouters <pwouters@redhat.com> - 3.20-3
changelog:
  - Resolves: rhbz#1372279 ipsec auto --down CONNECTION returns error for tunnels [updated]
  - Resolves: rhbz#1458227 CAVS test driver does not work in FIPS mode
  - Resolves: rhbz#1452672 (new-ksk-libreswan-el7) DNSSEC trust anchor cannot be updated without recompilation


author: Paul Wouters <pwouters@redhat.com> - 3.20-4
changelog:
  - Resolves: rhbz#1501809 libreswan does not establish IKE with xauth enabled but modecfg disabled
  - Resolves: rhbz#1503949 xauth password length limited to 64 bytes while XAUTH_MAX_PASS_LENGTH (128)


author: Gris Ge <fge@redhat.com> 1.4.0-1
changelog:
  - Add Python3 support.
  - New sub rpm package python3-libstoragemgmt.
  - Add support of lmiwbem.
  - Allow plugin test to be run concurrently.
  - Bug fixes:
      * Fix megaraid plugin for dell PERC.
      * Fix local disk rotation speed query on NVMe disk.
      * Fix lsmcli incorrect try-expect on local disk query.
      * Fix all the gcc compile warnings.
      * Fix the obsolete usage of AC_OUTPUT in configure.ac.
  - Library adds:
      * Query serial of local disk:
          lsm_local_disk_serial_num_get()/lsm.LocalDisk.serial_num_get()
      * Query LED status of local disk:
          lsm_local_disk_led_status_get()/lsm.LocalDisk.led_status_get()
      * Query link speed of local disk:
          lsm_local_disk_link_speed_get()/lsm.LocalDisk.link_speed_get()


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-8
changelog:
  - qemu: mkdir memory_backing_dir on startup (rhbz#1214369)
  - qemu: Don't error out if allocation info can't be queried (rhbz#1452045)
  - daemon: Don't initialize SASL context if not necessary (rhbz#1450095)
  - virDomainXMLOption: Introduce virDomainABIStabilityDomain (rhbz#1450349)
  - virQEMUDriverDomainABIStability: Check for memoryBacking (rhbz#1450349)
  - qemu: process: Save vcpu ordering information on reconnect (rhbz#1451251)
  - audit: Fix the output message for shmem (rhbz#1218603)
  - qemu: Set operation on completed migration job (rhbz#1457052)
  - qemu: Conditionally allow block-copy for persistent domains (rhbz#1459113)
  - virsh: Add support for VIR_DOMAIN_BLOCK_COPY_TRANSIENT_JOB (rhbz#1459113)
  - qemu: Fix serial stub console allocation (rhbz#1434278)
  - conf: Make error reporting in virCPUDefIsEqual optional (rhbz#1441662)
  - conf: Refactor virCPUDefParseXML (rhbz#1441662)
  - conf: Make virDomainSnapshotDefFormat easier to read (rhbz#1441662)
  - conf: Pass xmlopt to virDomainSnapshotDefFormat (rhbz#1441662)
  - qemu: Rename xml_len in virQEMUSaveHeader as data_len (rhbz#1441662)
  - qemu: Fix memory leaks in qemuDomainSaveImageOpen (rhbz#1441662)
  - qemu: Introduce virQEMUSaveData{New,Free} (rhbz#1441662)
  - qemu: Introduce virQEMUSaveDataFinish (rhbz#1441662)
  - qemu: Refactor qemuDomainSaveHeader (rhbz#1441662)
  - qemu: Introduce virQEMUSaveData structure (rhbz#1441662)
  - conf: Introduce virSaveCookie (rhbz#1441662)
  - conf: Add save cookie callbacks to xmlopt (rhbz#1441662)
  - qemu: Implement virSaveCookie object and callbacks (rhbz#1441662)
  - qemu: Store save cookie in save images and snapshots (rhbz#1441662)
  - qemu: Remember CPU def from domain start (rhbz#1441662)
  - qemu: Report the original CPU in migratable xml (rhbz#1441662)
  - qemu: Always send persistent XML during migration (rhbz#1441662)
  - qemu: Send updated CPU in migration cookie (rhbz#1441662)
  - qemu: Store updated CPU in save cookie (rhbz#1441662)
  - qemu: Use updated CPU when starting QEMU if possible (rhbz#1441662)
  - docs: correct improper information about domain states in virsh manpage (rhbz#1408778)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-10
changelog:
  - qemu: Set iface MTU on hotplug (rhbz#1408701)
  - Use a separate buffer for <input> subelements (rhbz#1283251)
  - Use a separate buffer for <disk><driver> (rhbz#1283251)
  - Use a separate buffer for <controller><driver> (rhbz#1283251)
  - Use a separate buffer for <filesystem><driver> (rhbz#1283251)
  - conf: introduce virDomainControllerDriverFormat (rhbz#1283251)
  - conf: add iotlb attribute to iommu (rhbz#1283251)
  - qemu: format device-iotlb on intel-iommu command line (rhbz#1283251)
  - qemuxml2xmltest: add virtio-options test (rhbz#1283251)
  - conf: use a leading space in virDomainVirtioNetDriverFormat (rhbz#1283251)
  - Add virtio-related options to interfaces (rhbz#1283251)
  - add virtio-related options to memballoon (rhbz#1283251)
  - Add virtio-related options to disks (rhbz#1283251)
  - Add virtio-related options to controllers (rhbz#1283251)
  - Add virtio-related options to filesystems (rhbz#1283251)
  - Add virtio-related options to rng devices (rhbz#1283251)
  - Add virtio-related options to video (rhbz#1283251)
  - Add virtio-related options to input devices (rhbz#1283251)
  - qemuxml2argvtest: add virtio-options test case (rhbz#1283251)
  - qemu: format virtio-related options on the command line (rhbz#1283251)
  - qemu: Allow memAccess for hugepages again (rhbz#1214369, rhbz#1458638)
  - qemu: Prefer hugepages over mem source='file' (rhbz#1214369)
  - qemu: Don't try to use hugepages if not enabled (rhbz#1214369)
  - qemu: Introduce qemuDomainDefFromXML helper (rhbz#1460952)
  - qemu: Add qemuDomainMigratableDefCheckABIStability (rhbz#1460952)
  - qemu: Add qemuDomainCheckABIStability (rhbz#1460952)
  - qemu: Use qemuDomainCheckABIStability where needed (rhbz#1460952)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-11
changelog:
  - util: storage: Output parsed network backing store string to debug log (rhbz#1461638)
  - util: storage: Add missing return to virStorageSourceParseBackingJSONGluster (rhbz#1461638)
  - util: storage: make virStorageSourceParseBackingJSONGlusterHost universal (rhbz#1461638)
  - util: storage: Add support for type 'inet' in virStorageSourceParseBackingJSONSocketAddress (rhbz#1461638)
  - util: storage: Split out parsing of TCP network host from JSON pseudoprotocol (rhbz#1461638)
  - util: storage: Report errors when source host data is missing (rhbz#1461638)
  - util: storage: Add JSON parser for new options in iSCSI protocol (rhbz#1461638)
  - util: storage: adapt to changes in JSON format for NBD (rhbz#1461638)
  - util: storage: adapt to changes in JSON format for ceph/rbd (rhbz#1461638)
  - util: storage: adapt to changes in JSON format for ssh (rhbz#1461638)
  - util: storage: adapt to changes in JSON format for sheepdog (rhbz#1461638)
  - qemu: Allow live-updates of coalesce settings (rhbz#1414627)
  - qemu: Pass the number of heads even with -vga qxl (rhbz#1283207)
  - util: storage: Export virStorageIsRelative (rhbz#1461303)
  - storage: Add helper to retrieve the backing store string of a storage volume (rhbz#1461303)
  - qemu: snapshot: Load data necessary for relative block commit to work (rhbz#1461303)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-14.el7_4.1
changelog:
  - qemu: Don't update CPU when checking ABI stability (rhbz#1470582)
  - cpu_x86: Properly disable unknown CPU features (rhbz#1470582)
  - qemu: Add qemuProcessFetchGuestCPU (rhbz#1470582)
  - qemu: Add qemuProcessVerifyCPU (rhbz#1470582)
  - qemu: Rename qemuProcessUpdateLiveGuestCPU (rhbz#1470582)
  - qemu: Add qemuProcessUpdateLiveGuestCPU (rhbz#1470582)
  - qemu: Export virQEMUCapsGuestIsNative (rhbz#1470582)
  - qemu: Move qemuProcessReconnect to the end of qemu_process.c (rhbz#1470582)
  - qemu: Update host-model CPUs on reconnect (rhbz#1470582)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-14.el7_4.2
changelog:
  - qemu: Fix qemuDomainGetBlockInfo allocation value setting (rhbz#1470127)
  - qemuDomainBuildNamespace: Handle special file mount points (rhbz#1471660)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-14.el7_4.4
changelog:
  - qemu: Pass virArch * to virQEMUCapsCPUFilterFeatures (rhbz#1508549)
  - qemu: Publish virQEMUCapsCPUFilterFeatures (rhbz#1508549)
  - qemu: Separate CPU updating code from qemuProcessReconnect (rhbz#1508549)
  - conf: Introduce virCPUDefFindFeature (rhbz#1508549)
  - qemu: Filter CPU features when using host CPU (rhbz#1508549)
  - qemu: Fix CPU model broken by older libvirt (rhbz#1508549)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-14.el7_4.5
changelog:
  - qemu: block commit: Don't overwrite error when rolling back disk labels (rhbz#1516717)
  - qemu: block commit: Determine relative path of images before initializing (rhbz#1516717)
  - qemu: domain: Don't call namespace setup for storage already accessed by vm (rhbz#1516717)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-15.el7a
changelog:
  - cpu_ppc64: Add support for host-model on POWER9 (rhbz#1450770)
  - RHEL-ALT: spec: Enable qemu driver on s390x (rhbz#1436140)
  - RHEL-ALT: spec: Always require qemu-kvm (rhbz#1464098)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-16
changelog:
  - qemu: Fix qemuDomainGetBlockInfo allocation value setting (rhbz#1473706)
  - qemu: report an error if usb keyboards are unsupported (rhbz#1460008)
  - qemu: caps: Tweak arm conditional in SupportsChardev (rhbz#1435681)
  - tests: qemuxml2argv: Add an aarch64 pci-serial test (rhbz#1435681)
  - qemu: command: Remove old style -parallel building (rhbz#1435681)
  - qemu: command: Drop some QEMU_CAPS_CHARDEV checks (rhbz#1435681)
  - qemu: command: always use -chardev for monitor config (rhbz#1435681)
  - tests: qemuxml2argv: drop redundant serial testing (rhbz#1435681)
  - tests: qemuxml2argv: Drop old style serial testing (rhbz#1435681)
  - tests: qemuxml2argv: Add some QEMU_CAPS_CHARDEV annotations (rhbz#1435681)
  - qemu: caps: blacklist QEMU_CAPS_CHARDEV (rhbz#1435681)
  - qemu: command: support -chardev for platform devices (rhbz#1435681)
  - qemu: Rename SupportsChardev to IsPlatformDevice (rhbz#1435681)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-17
changelog:
  - conf: Move virDomainPCIAddressBusIsFullyReserved() (rhbz#1431193)
  - conf: Tweak virDomainPCIAddressGetNextAddr() signature (rhbz#1431193)
  - qemu: Clean up qemuDomainAttachHostPCIDevice() (rhbz#1431193)
  - tests: Update qemumemlock data (rhbz#1431193)
  - tests: Mock IOMMU groups (rhbz#1431193)
  - conf: Simplify slot allocation (rhbz#1431193)
  - qemu: Allow qemuBuildControllerDevStr() to return NULL (rhbz#1431193)
  - qemu: Tweak index number checking (rhbz#1431193)
  - conf: Move index number checking to drivers (rhbz#1431193)
  - qemu: Relax pci-root index requirement for pSeries guests (rhbz#1431193)
  - conf: Add 'spapr-pci-host-bridge' controller model (rhbz#1431193)
  - conf: Parse and format <target index='...'/> (rhbz#1431193)
  - qemu: Automatically pick target index and model for pci-root controllers (rhbz#1431193)
  - qemu: Introduce QEMU_CAPS_DEVICE_SPAPR_PCI_HOST_BRIDGE (rhbz#1431193)
  - qemu: Deal with PHB naming conventions (rhbz#1431193)
  - qemu: Format additional PHBs on the command line (rhbz#1431193)
  - qemu: Take all PHBs into account while calculating memlock limits (rhbz#1431193)
  - tests: Add tests for pSeries guests with multiple PHBs (rhbz#1431193)
  - conf: Fix backwards migration of pSeries guests (rhbz#1431193)
  - tests: Add baseline tests for automatic PHB usage (rhbz#1280542)
  - qemu: Use PHBs to fill holes in PCI bus numbering (rhbz#1280542)
  - qemu: Use PHBs when extending the guest PCI topology (rhbz#1280542)
  - conf: Introduce isolation groups (rhbz#1280542)
  - conf: Implement isolation rules (rhbz#1280542)
  - qemu: Isolate hostdevs on pSeries guests (rhbz#1280542)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-18
changelog:
  - Add capabilities for qemu-2.9.0 ppc64 (rhbz#1474327)
  - qemu: capabilitity: Introduce QEMU_CAPS_SPAPR_PCI_HOST_BRIDGE_NUMA_NODE (rhbz#1474327)
  - qemu: Enable NUMA node tag in pci-root for PPC64 (rhbz#1474327)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-19
changelog:
  - util: new function virNetDevGetPhysPortID() (rhbz#1460082)
  - util: Fix const'ness of 1st arg to virPCIGetNetName() (rhbz#1460082)
  - util: make virPCIGetNetName() more versatile (rhbz#1460082)
  - util: match phys_port_id when converting PF-netdev to/from VF-netdev (rhbz#1460082)
  - util: save the correct VF's info when using a dual port SRIOV NIC in single port mode (rhbz#1460082)
  - util: restructure virNetDevReadNetConfig() to eliminate false error logs (rhbz#1460082)
  - util: check for PF online status earlier in guest startup (rhbz#1460082)
  - util: fix improper assignment of return value in virHostdevReadNetConfig() (rhbz#1460082)
  - util: eliminate superfluous saveVlan check in virNetDevSetNetConfig() (rhbz#1460082)
  - tests: Improve target index validation coverage (rhbz#1479647)
  - conf: Move target index validation (rhbz#1479647)
  - conf: Use the correct limit for the number of PHBs (rhbz#1479647)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-21
changelog:
  - qemu: Report error on failure to set isolation group (rhbz#1484254)
  - qemu: Handle host devices not being available better (rhbz#1484254)


author: Jiri Denemark <jdenemar@redhat.com> - 2.5.0-1
changelog:
  - Rebased to libvirt-python-2.5.0 (rhbz#1382642)
  - The rebase also fixes the following bugs:
      rhbz#1377071


author: Miroslav Lichvar <mlichvar@redhat.com> 1.4-1.20140718gitbdb6a3
changelog:
  - update to 20140718gitbdb6a3 (#1108795, #1059039)
  - fix PIE linking (#1092537)
  - replace hardening build flags with _hardened_build
  - include simulation test suite


author: Miroslav Lichvar <mlichvar@redhat.com> 1.4-2.20140718gitbdb6a3
changelog:
  - add timemaster (#1085580)
  - send peer messages to correct address
  - make NTP SHM segment number configurable
  - update UDS handling to allow running multiple ptp4l/phc2sys instances
  - fix warnings from static analysis


author: Miroslav Lichvar <mlichvar@redhat.com> 1.4-3.20140718gitbdb6a3
changelog:
  - fix resetting of linreg servo (#1165045)
  - fix phc2sys automatic mode with multiple interfaces (#1108795)


author: Java SIG <java-devel@lists.fedoraproject.org> - 0:1.2.17-7
changelog:
  - Update for https://fedoraproject.org/wiki/Fedora_19_Maven_Rebuild
  - Replace maven BuildRequires with maven-local


author: Paul Howarth <paul@city-fan.org> 2.3.9-1
changelog:
  - Update to 2.3.9
    - SECURITY: Fix possible heap buffer overwrite (CVE-2013-4365)
    - Add experimental cmake-based build system for Windows
    - Correctly parse quotation and escaped spaces in FcgidWrapper and the AAA
      Authenticator/Authorizor/Access directives' command line argument, as
      currently documented (PR#51194)
    - Honor quoted FcgidCmdOptions arguments (notably for InitialEnv
      assignments) (PR#51657)
    - Conform script response parsing with mod_cgid and ensure no response body
      is sent when ap_meets_conditions() determines that request conditions are
      met
    - Improve logging in access control hook functions
    - Avoid making internal sub-requests and processing Location headers when in
      FCGI_AUTHORIZER mode, as the auth hook functions already treat Location
      headers returned by scripts as an error since redirections are not
      meaningful in this mode
    - Revert fix for PR#53693, added in 2.3.8 but undocumented
    - Fix issues with a minor optimization added in 2.3.8


author: Luboš Uhliarik <luhliari@redhat.com> - 2.3.9-4.1
changelog:
  - Resolves: #1501307 - mod_fcgid cause Segmentation fault error while doing
    large file uploads over HTTPS


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-6
changelog:
  - Check the NSS certificate database directory for read permissions
    by the Apache user. (#1312583)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-8
changelog:
  - Fail start start when there are invalid Protocols defined (#1389114)
  - Handle group membership when testing NSS database filesystem
    permissions (#1395300)
  - Add OCSP cache tuning directives (#1392582) 
  - Don't share mod_nss NSS database with nss_pcache (#1382102)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-9
changelog:
  - Update nss_pcache.8 to drop directory and prefix options (#1382102)

  - Don't share mod_nss NSS database with nss_pcache (#1382102)


author: Thomas Woerner <twoerner@redhat.com> 2.3.4-1
changelog:
  - new version 2.3.4 with LGPL license
  - fixed some rpmlint warnings
  - new sub package for static libraries
  - added /etc/X11/mwm directory
  - removed defattrs


author: Thomas Woerner <twoerner@redhat.com> 2.3.4-2
changelog:
  - fixed requirements according to review (RHBZ#870049)
  - flex-static has been renamed to flex-devel with Fedora-18 and RHEL-7


author: Thomas Woerner <twoerner@redhat.com> - 2.3.4-8
changelog:
  - mwm: do not see outline of window when moving (RHBZ#1080548)
    Clone of RHBZ#997241
  - Fixed rendering issues seen while scrolling window (RHBZ#1134365)
    (MotifZone bug #1654)


author: Thomas Woerner <twoerner@redhat.com> - 2.3.4-9
changelog:
  - Fixed motif issue while navigating drop down menus with arrow keys
    (RHBZ#1396514) (MotifZone bug #1564)


author: Carlos Soriano <csoriano@redhat.com> - 2.3.4-10
changelog:
  - Fix last commit that is actually MotifZone#1565 and removes that patch since
    it was causing more problems. Fixes MotifZone#1576.
    Resolves: rhbz#1448509


author: Colin Walters <walters@redhat.com> - 17.0.0-12
changelog:
  - Add patch for aarch64
  - Fix for aarch64 64k pagesize. BZ#1076181 (Mark Salter <msalter@redhat.com>)
  - Resolves: #1027067


author: Colin Walters <walters@redhat.com> - 17.0.0-16
changelog:
  - Add patch for aarch64 48bit VA limits
    This changes the API/ABI only on aarch64, and hence we also bump
    the soname solely on those architectures.  We do retain the same pkg-config
    file name though, so dependencies should only need a rebuild.
  - Resolves: #1324216


author: Yaakov Selkowitz <yselkowi@redhat.com> - 17.0.0-19.p1
changelog:
  - Switch to upstream aarch64 48bit VA patch
    This reverts the previous API/ABI break on aarch64, so dependencies
    must be rebuilt again.
  - Resolves: #1393548


author: Florian Müllner <fmuellner@redhat.com> - 3.24.3-11
changelog:
  - Prevent crash when removing workspace with on-all-workspaces windows
    present (like desktop icons)
  - Resolves: #1453065


author: Carlos Soriano <csoriano@redhat.com> 3.14.3-8
changelog:
  - Backport fix for jp2 images crashing nautilus
  - Apply downstream translations
    Resolves: #1271297 #1272881


author: Carlos Soriano <csoriano@redhat.com> 3.14.3-9
changelog:
  - Apply downstream translations
  - Restrict icons on desktop to the primary monitor
    Resolves: #1207646 #1046876 #1272881


author: Miroslav Lichvar <mlichvar@redhat.com> 5.9-8.20130126
changelog:
  - update to 20130126
  - clear scrollback buffer in clear (#815790)
  - make -base and -term subpackages noarch
  - make some dependencies arch-specific


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-21
changelog:
  - Fixed crash on reloading 'exec' configuration options (#1228893)
  - Fixed CVE-2014-3565, snmptrapd died when parsing certain traps (#1209361)
  - Fixed storageUseNFS functionality in hrStorageTable (#1193006)
  - Fixed forwarding of traps with RequestID=0 in snmptrapd (#1192511)
  - Fixed hrStorageTable to contain 31 bits integers (#1192221)
  - Fixed 'clientaddr' option for UDPv6 client messages (#1190679)
  - Fixed log level of SMUX messages (#1189393)
  - Fixed UDP-MIB::udpTable index on big-endian platforms (#1184433)
  - Fixed client utilities reporting 'read_config_store open failure on
    /var/lib/net-snmp/snmpapp.conf' (#1151310)
  - Fixed snmpd crash when failed to parse SMUX message headers (#1140236)
  - Added 'diskio' option to snmpd.conf, it's possible to monitor only
    selected devices in diskIOTable (#1092308)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-23
changelog:
  - Fixed parsing of invalid variables in incoming packets (#1248414)
  - Fixed HOST-RESOURCES-MIB::hrFSAccess flag when read-only filesystem
    becomes writable (#1241897)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-24
changelog:
  - Fixed lmSensorsTable not reporting sensors with duplicate names
    (#1252053)
  - Fixed close() overhead of extend commands (#1252048)
  - Fixed out-of-bounds write in python code (#1252034)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-27
changelog:
  - Allow clients to use UDPv6 addresses without 'udp6:' prefix (#1326850)
  - snmpd: Speed up ipAddressTable loading. (#1327240)
  - Fixed net-snmp segfault in netsnmp_copy_fd_set_to_large_fd_set (#1327200)
  - Fixed issue with net-snmp-perl dependency on net-snmp-devel (#1438875)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.41
changelog:
  - nfsdcltrack: silence some expected errors (bz 1443176)
  - Conditionally restart gssproxy now that config file is installed (bz 1440887)
  - systemd: NFS server services should use network-online (bz 1409012)
  - Cleaned up some fuzzy patches (bz 1409012)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.43
changelog:
  - mount: explicit v4 mounts should not roll back to v3 (bz 1447849)
  - spec: Use reload-or-try-restart to restart gssproxy (bz 1440887)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.48
changelog:
  - exportfs: fix path comparison in unexportfs_parsed() (bz 1389046)
  - Correctly set the minor version when set in nfsmount.conf (1458504)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.40
changelog:
  - gssd: ensure that preferred_realm is non-NULL (bz 1432643)
  - mountstats: handle KeyError in accumulate_iostats() (bz 1400106)
  - mount: RPC_PROGNOTREGISTERED should not be a permanent error (bz 1404121)
  - sm-notify: ending the grace period early should be configurable (bz 1424599)
  - Fixed a couple typos that effected the '--mounts' nfsstat option (bz 1425956)
  - Manual page bug: two inaccuracies in nfsd(7) (bz 1432750)


author: Daiki Ueno <dueno@redhat.com> - 3.28.4-3
changelog:
  - Reorder ChaCha20-Poly1305 cipher suites, as suggested in:
    https://bugzilla.redhat.com/show_bug.cgi?id=1373158#c9


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-2
changelog:
  - Update to NSS 3.28.3
  - Remove upstreamed patches for the previous FIPS validation
  - Package lowkeyi.h and lowkeyti.h in freebl-devel
  - Pick up a patch in the Fedora package to fix build issue


author: Bob Relyea <rrelyea@redhat.com> - 3.28.3-4
changelog:
  - include new PKCS12 NSS specific mechanisms.
  - alias CKM_TLS_KDF to CKM_TLS_MAC to preserve ABI
  - add RSA PSS oid to decrypting PKCS #5 key blobs.
  - move ec public key check from softokn to freebl so apps like Java can benefit.


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-5
changelog:
  - fix login handling for FIPS slots, patch from rhbz#1390154
  - backport upstream fix for CVE-2017-5462 (DRBG leak)


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-2 + 0.10.3-1
changelog:
  - Fix coverity scan results
  - Adjust FIPS algorithms list (#1420910)
  - Revert problematic feature for chroot(#1418062)
  - Fix CBC weakness in released OpenSSH 7.5


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-3 + 0.10.3-1
changelog:
  - Do not completely disable SHA-1 key exchange methods in FIPS (#1324493)
  - Remove wrong coverity patches


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-5 + 0.10.3-1
changelog:
  - Fix the default key exchange proposal in FIPS mode (#1438414)
  - Remove another wrong coverity chunk to unbreak gsskex (#1438414)


author: William Cohen <wcohen@redhat.com> - 0.9.9-17
changelog:
  - Define some  Intel broadwell default unit masks by names
  - Add support for Harrisonville (Denverton SoC)
  - Add support for Skylake-SP server
  - Add support for Kabylake-U/Y
  - Add support for Kabylake-H/S
  - Make Nehalem, Westmere, and Haswell event names unique.


author: William Cohen <wcohen@redhat.com> - 0.9.9-22
changelog:
  - Update ppc64/ppc64le support. rhbz1385007
  - Add recognition check for POWER8NV and POWER8NVL. rhbz1426426


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-5
changelog:
  - Keep man pages compressed
  - Bugfixes for container bundles
  - Resolves: rhbz#1410886
  - Resolves: rhbz#1432722


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-7
changelog:
  - Avoid fencing old DC if it is shutting down while another node is joining
  - Improve crmd's handling of repeated fencing failures
  - Correct behavior when guest created by bundle has a node attribute
  - Show Red Hat bugzilla URL rather than upstream when generating cluster report
  - Resolves: rhbz#1430112
  - Resolves: rhbz#1432722


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-9
changelog:
  - Allow cleanup of guest nodes when guest is unmanaged
  - Allow bundles to run on Pacemaker Remote nodes
  - Handle slow IPC clients better
  - Update crmd throttle information when CPUs are hot-plugged in
  - Order pacemaker systemd unit after resource-agents-deps target
  - Resolves: rhbz#1303742
  - Resolves: rhbz#1432722
  - Resolves: rhbz#1435067
  - Resolves: rhbz#1444728
  - Resolves: rhbz#1446669


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-10
changelog:
  - Fix issues when running bundles on Pacemaker Remote nodes
  - Reap orphaned processes when running Pacemaker Remote as pid 1
  - Order remote actions after remote connection recovery
    (fixes regression in RHEL 7.3)
  - Avoid local resource manager daemon (lrmd) crash when an
    in-flight systemd operation is cancelled
  - Resolves: rhbz#1432722
  - Resolves: rhbz#1441603
  - Resolves: rhbz#1448772
  - Resolves: rhbz#1451170


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-12.1
changelog:
  - Add cluster-ipc-limit option to avoid CIB eviction in large clusters
  - Implement ordering constraints involving bundles
  - Always re-check resource placement after quorum loss
  - Avoid stonithd crash when disabling fence device with queued actions
  - Allow re-enabled fence devices to be used
  - Resolves: rhbz#1478298
  - Resolves: rhbz#1481139
  - Resolves: rhbz#1481140
  - Resolves: rhbz#1481141
  - Resolves: rhbz#1481142


author: William Cohen <wcohen@redhat.com> - 5.2.0-15
changelog:
  - Update papi L1 cache events on POWER7
  - Prevent papi-testsuite segfaults
  - Identify kernels that support rdpmc
  - Correct papi-testsuite byte_profile and sprofile tests on ppc64le
  - Update PAPI_L1_TCM event on Haswells


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-4
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1386303 - cannot extract generated private key from KRA when
    HSM is used. (alee)
  - Bugzilla Bug #1446364 - pkispawn returns before tomcat is ready (cheimes)
  - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false would cause
    error (cfu)
  - Bugzilla Bug #1448203 - CAInfoService: retrieve KRA-related values from
    the KRA (ftweedal)
  - Bugzilla Bug #1448204 - pkispawn of clone install fails with
    InvalidBERException (ftweedal)
  - Bugzilla Bug #1448521 - kra unable to extract symmetric keys generated on
    thales hsm (alee)
  - Updated "jss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - RHCS 9.2:
  - ##########################################################################
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-5
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1419761 - CC: allow CA to process pre-signed CMC renewal
    non-signing cert requests (cfu)
  - Bugzilla Bug #1447080 - CC: CMC: allow enrollment key signed (self-signed)
    CMC with identity proof (cfu)
  - Bugzilla Bug #1447144 - CA brought down during separate KRA instance
    creation (mharmsen)
  - Bugzilla Bug #1448903 - exception Invalid module "--ignore-banner" when
    defined in ~/.dogtag/pki.conf and run pki pkcs12-import --help (edewata)
  - Bugzilla Bug #1450143 - CA installation with HSM in FIPS mode fails (jmagne)
  - Bugzilla Bug #1452123 - CA CS.cfg shows default port (mharmsen)
  - Bugzilla Bug #1452250 - Inconsistent CERT_REQUEST_PROCESSED event in
    ConnectorServlet. (edewata)
  - Bugzilla Bug #1452340 - Ensuring common audit log correctness (edewata)
  - Bugzilla Bug #1452344 - Adding serial number into CERT_REQUEST_PROCESSED
    audit event. (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-7
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret)
    using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne)
  - Bugzilla Bug #1445519 - CA Server installation with HSM fails
    (jmagne)
  - Bugzilla Bug #1452617 - Unable to create IPA Sub CA
    (ftweedal)
  - Bugzilla Bug #1454471 - Enabling all subsystems on startup
    (edewata)
  - Bugzilla Bug #1455617 - Key recovery on token fails because
    key record is not marked encrypted (alee)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-8
changelog:
  - Require "selinux-policy-targeted >= 3.13.1-159" as a runtime requirement
  - Require "tomcatjss >= 7.2.1-4" as a build and runtime requirement
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS
    enabled system (edewata)
  - Bugzilla Bug #1447144 - CA brought down during separate KRA instance
    creation (edewata)
  - Bugzilla Bug #1447762 - pkispawn fails occasionally with this failure
    ACCESS_SESSION_ESTABLISH_FAILURE (edewata)
  - Bugzilla Bug #1454450 - SubCA installation failure with 2 step
    installation in fips enabled mode (edewata)
  - Bugzilla Bug #1456597 - Certificate import using pki client-cert-import
    is asking for password when already provided (edewata)
  - Bugzilla Bug #1456940 - Build failure due to Pylint issues (cheimes)
  - Bugzilla Bug #1458043 - Key recovery using externalReg fails
    with java null pointer exception on KRA (alee)
  - Bugzilla Bug #1458379 - Upgrade script for keepAliveTimeout parameter
    (edewata)
  - Bugzilla Bug #1458429 - client-cert-import --ca-cert should
    import CA cert with trust bits "CT,C,C" (edewata)
  - ##########################################################################
  - RHCS 9.2:
  - ##########################################################################
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-9
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret)
    using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne)
  - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC
    non-signing certificate requests (cfu)
  - Bugzilla Bug #1419777 - CC: allow CA to process pre-signed CMC
     revocation non-signing cert requests (cfu)
  - Bugzilla Bug #1458047 - change the way aes clients refer to
    aes keysets (alee)
  - Bugzilla Bug #1458055 - dont reuse IVs in the CMC code
    (alee)
  - Bugzilla Bug #1460028 - In keywrap mode, key recovery on
    KRA with HSM causes KRA to crash (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-10
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1458043 - Key recovery on token fails with
    invalid public key error on KRA (alee)
  - Bugzilla Bug #1460764 - CC: CMC: check HTTPS client
    authentication cert against CMC signer (cfu)
  - Bugzilla Bug #1461533 - Unable to find keys in the p12 file after
    deleting the any of the subsystem certs from it (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-11
changelog:
  - Resolves: rhbz #1469432
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1469432 - CMC plugin default change
  - Resolves CVE-2017-7537
  - Fixes BZ #1470948


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-12
changelog:
  - Resolves: rhbz #1472615,1472617,1469447,1463350,1469449,1472619,1464970,1469437,1469439,1469446
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1472615 - CC: allow CA to process pre-signed CMC non-signing
    certificate requests (cfu)
    [PREVIOUS PATCH:  pki-core-beta.patch]
    [PREVIOUS PATCH:  pki-core-snapshot-4.patch]
  - Bugzilla Bug #1472617 - CMC: cmc.popLinkWitnessRequired=false would cause
    error (cfu)
    [PREVIOUS PATCH:  pki-core-post-beta.patch]
  - Bugzilla Bug #1469447 - CC: CMC: check HTTPS client authentication cert
    against CMC signer (cfu)
    [PREVIOUS PATCH:  pki-core-CMC-check-HTTPS-client-authentication-cert.patch]
  - Bugzilla Bug #1463350 - Access banner validation (edewata)
    [pki-core-server-access-banner-validation.patch]
  - Bugzilla Bug #1469449 - CC: allow CA to process pre-signed CMC renewal
    non-signing cert requests (cfu)
    [PREVIOUS PATCH:  pki-core-snapshot-1.patch]
    [pki-core-pre-signed-CMC-renewal-UniqueKeyConstraint.patch]
  - Bugzilla Bug #1472619 - Platform Dependent Python Import (mharmsen)
    [pki-core-platform-dependent-python-import.patch]
  - Bugzilla Bug #1464970 - CC: CMC: replace id-cmc-statusInfo with
    id-cmc-statusInfoV2 (cfu)
    [pki-core-CMC-id-cmc-statusInfoV2.patch]
  - Bugzilla Bug #1469437 - subsystem-cert-update command lacks --cert option
    (dmoluguw)
    [pki-core-subsystem-cert-update-CLI-cert-option.patch]
  - Bugzilla Bug #1469439 - Fix Key Changeover with HSM to support SCP03
    (jmagne)
    [pki-core-HSM-key-changeover-SCP03-support.patch]
  - Bugzilla Bug #1469446 - CC: need CMC enrollment profiles for system
    certificates (cfu)
    [pki-core-system-cert-CMC-enroll-profile.patch]


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-13
changelog:
  - Resolves: rhbz #1463350
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1463350 - Access banner validation (edewata)
    [pki-core-server-access-banner-retrieval-validation.patch]


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-14
changelog:
  - Require "jss >= 4.4.0-8" as a build and runtime requirement
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Resolves: rhbz #1486870,1485833,1487509,1490241,1491332
  - Bugzilla Bug #1486870 - Lightweight CA key replication fails (regressions)
    [RHEL 7.4.z] (ftweedal)
  - Bugzilla Bug #1485833 - Missing CN in user signing cert would cause error
    in cmc user-signed [rhel-7.4.z] (cfu)
  - Bugzilla Bug #1487509 - pki-server-upgrade fails when upgrading from
    RHEL 7.1 [rhel-7.4.z] (ftweedal)
  - Bugzilla Bug #1490241 - PKCS12: upgrade to at least AES and SHA2 (FIPS)
    [rhel-7.4.z] (ftweedal)
  - Bugzilla Bug #1491332 - TPS UI: need to display tokenType and tokenOrigin
    for token certificates on TPS UI Server [rhel-7.4.z] (edewata)
  - dogtagpki Pagure Issue #2764 - py3: pki.key.archive_encrypted_data:
    TypeError: ... is not JSON serializable (ftweedal)
  - ##########################################################################
  - RHCS 9.2:
  - ##########################################################################
  - Resolves: rhbz #1486870,1485833,1487509,1490241,1491332,1482729,1462271
  - Bugzilla Bug #1462271 - TPS incorrectly assigns "tokenOrigin" and
    "tokenType" certificate attribute for recovered certificates. (cfu)
  - Bugzilla Bug #1482729 - TPS UI: need to display tokenType and tokenOrigin
    for token certificates on TPS UI (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-16
changelog:
  - ###########################################################################
  - ## RHCS 9.2
  - ###########################################################################
  - #Bugzilla Bug #1439228 - externalRegRecover does not support multiple
    - #Bugzilla Bug #1507160 - TPS new configuration to allow the protocol of
    - #Bugzilla Bug #1471996 - Certificate Revocation Reasons not being updated
    - ###########################################################################
  - ## RHEL 7.4
  - ###########################################################################
  - Bugzilla Bug #1500499 - Certificate Revocation Reasons not being updated
    in some cases [rhel-7.4.z] (cfu)
  - Bugzilla Bug #1502527 - CA cert without Subject Key Identifier causes
    issuance failure [rhel-7.4.z] (ftweedal)
  - Bugzilla Bug #1492560 - ipa-replica-install --setup-kra broken on DL0
    [rhel-7.4.z] (ftweedal)
    NOTE: Check-ins for #1492560 all reference the dogtagpki Pagure Issue
          associated with Bugzilla Bug #1402280 - CA Cloning: Failed to
          update number range in few cases (which is not yet fully resolved)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-17
changelog:
  - ###########################################################################
  - ## RHCS 9.2
  - ###########################################################################
  - #Bugzilla Bug #1507160 - TPS new configuration to allow the protocol of


author: Miloslav Trmač <mitr@redhat.com> - 0.112-12
changelog:
  - Fix a memory leak in PolkitPermission.
    Patch by Rui Matos <tiagomatos@gmail.com>
    Resolves: #1433915


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.12-1
changelog:
  - update to 9.2.12 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-12.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.13-1
changelog:
  - update to 9.2.13 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-13.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.14-1
changelog:
  - update to 9.2.14 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-14.html


author: Pavel Kajaba <pkajaba@redhat.com> - 9.2.15-1
changelog:
  - update to 9.2.15 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-15.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.18-1
changelog:
  - update to 9.2.18 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-18.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-17.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-16.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.21-1
changelog:
  - update to 9.2.21 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-21.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-20.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-19.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.22-1
changelog:
  - update to 9.2.22 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-22.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.23-1
changelog:
  - update to 9.2.23 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-23.html


author: Alex Wood <awood@redhat.com> 1.19.1-1
changelog:
  - Adjust our C bindings for OpenSSL v1.1 API. (awood@redhat.com)
  - Make python-rhsm Python-3 compatible (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.2-1
changelog:
  - 1423443: Handle IndexError during m2crypto request (khowell@redhat.com)
  - Move python-rhsm into subdirectory (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.3-1
changelog:
  - 1435475: Support older versions of M2Crypto (awood@redhat.com)
  - 1427069: Prioritize content from Basic entitlements (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.4-1
changelog:
  - 1438552: Allows releases to be listed through a proxy (csnyder@redhat.com)
  - 1420533: Add no_proxy option to API, config, UI (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.6-1
changelog:
  - 1426343: fixed rct to display cert without subjectAltName.
    (jhnidek@redhat.com)
  - Add Update subscriptions pools (tcoufal@redhat.com)
  - Add support to list future subscription pools (tcoufal@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.7-1
changelog:
  - 1443159: Added default value for splay configuration (jhnidek@redhat.com)
  - 1451166: Fix Host header when using proxy (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.9-1
changelog:
  - 1444453: Have gettext return unicode instead of bytes. (awood@redhat.com)
  - 1457197: Env. variable no_proxy=* is not ignored (jhnidek@redhat.com)


author: Christian Heimes <cheimes@redhat.com> - 1.7.2-1
changelog:
  - Update to 1.7.2
  - Disable pytest.deprecated_call() tests
  - Remove versioned pytest
  - Add build requirements pytz


author: Christian Heimes <cheimes@redhat.com> - 1.7.2-1.1
changelog:
  - Ignore errors on OpenSSL's error stack when initializing, fixes RHBZ#1485896
  - Fix parsing of long OIDs, fixes RHBZ#1485898


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-134.el7
changelog:
  - kvm-ui-vnc-introduce-VNC_DIRTY_PIXELS_PER_BIT-macro.patch [bz#1377977]
  - kvm-ui-vnc-derive-cmp_bytes-from-VNC_DIRTY_PIXELS_PER_BI.patch [bz#1377977]
  - kvm-ui-vnc-optimize-dirty-bitmap-tracking.patch [bz#1377977]
  - kvm-ui-vnc-optimize-setting-in-vnc_dpy_update.patch [bz#1377977]
  - kvm-ui-vnc-fix-vmware-VGA-incompatiblities.patch [bz#1377977]
  - kvm-ui-vnc-fix-potential-memory-corruption-issues.patch [bz#1377977]
  - kvm-vnc-fix-memory-corruption-CVE-2015-5225.patch [bz#1377977]
  - kvm-vnc-fix-overflow-in-vnc_update_stats.patch [bz#1377977]
  - kvm-i386-kvmvapic-initialise-imm32-variable.patch [bz#1335751]
  - kvm-qemu-iotests-Filter-out-actual-image-size-in-067.patch [bz#1427176]
  - vm-qcow2-Don-t-rely-on-free_cluster_index-in-alloc_ref2.patch [bz#1427176]
  - kvm-qemu-iotests-Fix-core-dump-suppression-in-test-039.patch [bz#1427176]
  - kvm-qemu-io-Add-sigraise-command.patch [bz#1427176]
  - kvm-iotests-Filter-for-Killed-in-qemu-io-output.patch [bz#1427176]
  - kvm-iotests-Fix-test-039.patch [bz#1427176]
  - kvm-blkdebug-Add-bdrv_truncate.patch [bz#1427176]
  - kvm-vhdx-Fix-zero-fill-iov-length.patch [bz#1427176]
  - kvm-qemu-iotests-Disable-030-040-041.patch [bz#1427176]
  - kvm-x86-add-AVX512_VPOPCNTDQ-features.patch [bz#1415830]
  - kvm-usb-ccid-check-ccid-apdu-length.patch [bz#1419818]
  - kvm-usb-ccid-better-bulk_out-error-handling.patch [bz#1419818]
  - kvm-usb-ccid-move-header-size-check.patch [bz#1419818]
  - kvm-usb-ccid-add-check-message-size-checks.patch [bz#1419818]
  - kvm-spec-Update-rdma-build-dependency.patch [bz#1433920]
  - Resolves: bz#1335751
    (CVE-2016-4020 qemu-kvm: Qemu: i386: leakage of stack memory to guest in kvmvapic.c [rhel-7.4])
  - Resolves: bz#1377977
    (qemu-kvm coredump in vnc_raw_send_framebuffer_update [rhel-7.4])
  - Resolves: bz#1415830
    ([Intel 7.4 FEAT] Enable vpopcntdq for KNM - qemu/kvm)
  - Resolves: bz#1419818
    (CVE-2017-5898 qemu-kvm: Qemu: usb: integer overflow in emulated_apdu_from_guest [rhel-7.4])
  - Resolves: bz#1427176
    (test cases of qemu-iotests failed)
  - Resolves: bz#1433920
    (Switch from librdmacm-devel to rdma-core-devel)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-135.el7
changelog:
  - kvm-fix-cirrus_vga-fix-OOB-read-case-qemu-Segmentation-f.patch [bz#1430060]
  - kvm-cirrus-vnc-zap-bitblit-support-from-console-code.patch [bz#1430060]
  - kvm-cirrus-add-option-to-disable-blitter.patch [bz#1430060]
  - kvm-cirrus-fix-cirrus_invalidate_region.patch [bz#1430060]
  - kvm-cirrus-stop-passing-around-dst-pointers-in-the-blitt.patch [bz#1430060]
  - kvm-cirrus-stop-passing-around-src-pointers-in-the-blitt.patch [bz#1430060]
  - kvm-cirrus-fix-off-by-one-in-cirrus_bitblt_rop_bkwd_tran.patch [bz#1430060]
  - Resolves: bz#1430060
    (CVE-2016-9603 qemu-kvm: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-7.4])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-136.el7
changelog:
  - kvm-target-i386-get-set-migrate-XSAVES-state.patch [bz#1327593]
  - kvm-Removing-texi2html-from-build-requirements.patch [bz#1440987]
  - kvm-Disable-build-of-32bit-packages.patch [bz#1441778]
  - kvm-Add-sample-images-to-srpm.patch [bz#1436280]
  - Resolves: bz#1327593
    ([Intel 7.4 FEAT] KVM Enable the XSAVEC, XSAVES and XRSTORS instructions)
  - Resolves: bz#1436280
    (sample images  for qemu-iotests are missing in the SRPM)
  - Resolves: bz#1440987
    (Remove texi2html build dependancy from RPM)
  - Resolves: bz#1441778
    (Stop building qemu-img for 32bit architectures.)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-137.el7
changelog:
  - kvm-ide-fix-halted-IO-segfault-at-reset.patch [bz#1299875]
  - Resolves: bz#1299875
    (system_reset should clear pending request for error (IDE))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-138.el7
changelog:
  - kvm-char-serial-cosmetic-fixes.patch [bz#1451470]
  - kvm-char-serial-Use-generic-Fifo8.patch [bz#1451470]
  - kvm-char-serial-serial_ioport_write-Factor-out-common-co.patch [bz#1451470]
  - kvm-char-serial-fix-copy-paste-error-fifo8_is_full-vs-em.patch [bz#1451470]
  - kvm-char-serial-Fix-emptyness-check.patch [bz#1451470]
  - kvm-char-serial-Fix-emptyness-handling.patch [bz#1451470]
  - kvm-serial-poll-the-serial-console-with-G_IO_HUP.patch [bz#1451470]
  - kvm-serial-change-retry-logic-to-avoid-concurrency.patch [bz#1451470]
  - kvm-qemu-char-ignore-flow-control-if-a-PTY-s-slave-is-no.patch [bz#1451470]
  - kvm-serial-check-if-backed-by-a-physical-serial-port-at-.patch [bz#1451470]
  - kvm-serial-reset-thri_pending-on-IER-writes-with-THRI-0.patch [bz#1451470]
  - kvm-serial-clean-up-THRE-TEMT-handling.patch [bz#1451470]
  - kvm-serial-update-LSR-on-enabling-disabling-FIFOs.patch [bz#1451470]
  - kvm-serial-only-resample-THR-interrupt-on-rising-edge-of.patch [bz#1451470]
  - kvm-serial-make-tsr_retry-unsigned.patch [bz#1451470]
  - kvm-serial-simplify-tsr_retry-reset.patch [bz#1451470]
  - kvm-serial-separate-serial_xmit-and-serial_watch_cb.patch [bz#1451470]
  - kvm-serial-remove-watch-on-reset.patch [bz#1451470]
  - Resolves: bz#1451470
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-139.el7
changelog:
  - kvm-char-change-qemu_chr_fe_add_watch-to-return-unsigned.patch [bz#1451470]
  - Resolves: bz#1451470
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-140.el7
changelog:
  - kvm-spice-fix-spice_chr_add_watch-pre-condition.patch [bz#1456983]
  - Resolves: bz#1456983
    (Character device regression due to missing patch)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7
changelog:
  - kvm-Fix-memory-slot-page-alignment-logic-bug-1455745.patch [bz#1455745]
  - kvm-Do-not-hang-on-full-PTY.patch [bz#1452067]
  - kvm-serial-fixing-vmstate-for-save-restore.patch [bz#1452067]
  - kvm-serial-reinstate-watch-after-migration.patch [bz#1452067]
  - kvm-nbd-Fully-initialize-client-in-case-of-failed-negoti.patch [bz#1451614]
  - kvm-nbd-Fix-regression-on-resiliency-to-port-scan.patch [bz#1451614]
  - Resolves: bz#1451614
    (CVE-2017-9524 qemu-kvm: segment fault when private user nmap qemu-nbd server [rhel-7.4])
  - Resolves: bz#1452067
    (migration can confuse serial port user)
  - Resolves: bz#1455745
    (Backport fix for broken logic that's supposed to ensure memory slots are page aligned)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.1
changelog:
  - kvm-qemu-nbd-Ignore-SIGPIPE.patch [bz#1468107]
  - Resolves: bz#1468107
    (CVE-2017-10664 qemu-kvm: Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.2
changelog:
  - kvm-virtio-net-dynamic-network-offloads-configuration.patch [bz#1482468]
  - kvm-Workaround-rhel6-ctrl_guest_offloads-machine-type-mi.patch [bz#1482468]
  - Resolves: bz#1482468
    (KVM: windows guest migration from EL6 to EL7 fails. [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.9.0-14.el7a
changelog:
  - kvm-sockets-ensure-we-can-bind-to-both-ipv4-ipv6-separat.patch [bz#1446003]
  - Resolves: bz#1446003
    (vnc cannot find a free port to use)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.9.0-15.el7a
changelog:
  - kvm-hw-ppc-spapr-Adjust-firmware-name-for-PCI-bridges.patch [bz#1459170]
  - Resolves: bz#1459170
    (SLOF: Can't boot from virtio-scsi disk behind pci-bridge: E3405: No such device)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.9.0-16.el7a
changelog:
  - kvm-AArch64-Add-pci-testdev.patch [bz#1465048]
  - Resolves: bz#1465048
    (AArch64: Add pci-testdev)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.9.0-17.el7a
changelog:
  - kvm-spapr-Consolidate-HPT-freeing-code-into-a-routine.patch [bz#1456287]
  - kvm-spapr-Add-a-no-HPT-encoding-to-HTAB-migration-stream.patch [bz#1456287]
  - kvm-spapr-Fix-migration-of-Radix-guests.patch [bz#1456287]
  - kvm-qemu-nbd-Ignore-SIGPIPE.patch [bz#1469463]
  - Resolves: bz#1456287
    ([Pegas1.0 EA2] [qemu-kvm-rhev-2.9] After 'virsh managedsave', domain not starting)
  - Resolves: bz#1469463
    (CVE-2017-10664 qemu-kvm: Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort [rhel-7.4-Alt])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.9.0-18.el7a
changelog:
  - kvm-ppc-kvm-have-the-family-CPU-alias-to-point-to-TYPE_H.patch [bz#1460908]
  - kvm-Disable-virtio-pci-for-s390x-builds.patch [bz#1469000]
  - kvm-target-ppc-Implement-ISA-V3.00-radix-page-fault-hand.patch [bz#1470558]
  - kvm-target-ppc-Fix-return-value-in-tcg-radix-mmu-fault-h.patch [bz#1470558]
  - kvm-target-ppc-Refactor-tcg-radix-mmu-code.patch [bz#1470558]
  - kvm-target-ppc-Add-debug-function-for-radix-mmu-translat.patch [bz#1470558]
  - Resolves: bz#1460908
    (qemu-kvm: POWER9 CPU model not usable on POWER9 machine)
  - Resolves: bz#1469000
    (Disable virtio-pci devices in qemu-kvm on s390x)
  - Resolves: bz#1470558
    ([qmp] qemu-kvm process aborted after issuing QMP 'memsave' command on Power9)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.9.0-19.el7a
changelog:
  - kvm-AArch64-remove-mach-virt-7.3-machine-type.patch [bz#1473548]
  - kvm-nbd-strict-nbd_wr_syncv.patch [bz#1473638]
  - kvm-nbd-read_sync-and-friends-return-0-on-success.patch [bz#1473638]
  - kvm-nbd-make-nbd_drop-public.patch [bz#1473638]
  - kvm-nbd-server-get-rid-of-nbd_negotiate_read-and-friends.patch [bz#1473638]
  - kvm-spapr-htab-fix-savevm.patch [bz#1470035]
  - kvm-migration-rdma-Fix-race-on-source.patch [bz#1475751]
  - kvm-migration-rdma-fix-qemu_rdma_block_for_wrid-error-pa.patch [bz#1475751]
  - kvm-migration-rdma-Allow-cancelling-while-waiting-for-wr.patch [bz#1475751]
  - kvm-migration-rdma-Safely-convert-control-types.patch [bz#1475751]
  - kvm-migration-rdma-Send-error-during-cancelling.patch [bz#1475751]
  - kvm-configure-allow-to-disable-VT-d-emulation.patch [bz#1465450]
  - kvm-Disable-VT-d-for-rhel-builds.patch [bz#1465450]
  - kvm-RHEL-Diff.-Add-option-in-configure-to-disable-live-b.patch [bz#1418532]
  - kvm-RHEL-Diff.-Unregister-live-block-operations.patch [bz#1418532]
  - kvm-RHEL-Diff.-Disable-live-block-operations-in-HMP-moni.patch [bz#1418532]
  - kvm-RHEL-Diff.-Add-rpm-spec-options-for-live-block-ops.patch [bz#1418532]
  - Resolves: bz#1418532
    ([Pegas 1.0] qemu-kvm differentiation patches for Power9 - block)
  - Resolves: bz#1465450
    ([Pegas 1.0] qemu-kvm differentiation - vIOMMU)
  - Resolves: bz#1470035
    ([qmp] Load internal snapshot failed on Power9)
  - Resolves: bz#1473548
    (AArch64: remove 7.3 machine type)
  - Resolves: bz#1473638
    (CVE-2017-7539 qemu-kvm-rhev: Qemu: qemu-nbd crashes due to undefined I/O coroutine [rhel-alt-7.4])
  - Resolves: bz#1475751
    (migration/RDMA: backport fixes)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.9.0-20.el7a
changelog:
  - kvm-Downstream-Update-pseries-machine-types-for-RHEL-ALT.patch [bz#1473518]
  - kvm-cpu-don-t-allow-negative-core-id.patch [bz#1476181]
  - kvm-pegas-add-disable-vhost-user.patch [bz#1455269]
  - kvm-pegas-add-rpm-spec-options-for-vhost-user.patch [bz#1455269]
  - Resolves: bz#1455269
    ([Pegas 1.0] qemu-kvm differentiation patches for Power9 - vhost-user)
  - Resolves: bz#1473518
    (Need to remove (or not?) pseries-rhel7.2.0, pseries-rhel7.3.0 machine types for RHEL-ALT qemu-kvm)
  - Resolves: bz#1476181
    (qemu core dumped  after hotplug one cpu core with a negative core id)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.9.0-21.el7a
changelog:
  - kvm-target-ppc-Implement-TIDR.patch [bz#1478822]
  - kvm-target-ppc-Add-stub-implementation-of-the-PSSCR.patch [bz#1478822]
  - kvm-target-ppc-Fix-size-of-struct-PPCElfPrstatus.patch [bz#1480418]
  - Resolves: bz#1478822
    (The KVM guest SPRs TIDR (144) and PSSCR (823) are  currently not migrated right on POWER9)
  - Resolves: bz#1480418
    ([guest memory dump] Dump guest's memory to file and GDB fails to process the core file)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.9.0-22.el7a
changelog:
  - kvm-qemu-kvm.spec-Configure-vm.allocate_pgste-for-s390x.patch [bz#1454281]
  - Resolves: bz#1454281
    (Enable vm.allocate_pgste sysctl before running qemu-kvm on s390x)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> -
changelog:
  - kvm-vfio-spapr-Fix-levels-calculation.patch [bz#1491749]
  - Resolves: bz#1491749
    (Pegas1.0 - Guest crashes during boot with VF Pass-through and 129GB memory (qemu-kvm))


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.1-7
changelog:
  - quagga is service which might implement networking, thus it should not have
    WantedBy=network.target in its systemd configuration
  - resolves: #976883


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.3-1
changelog:
  - update to 0.99.22.3
  - disable ospfapi and ospfclient
  - fix bogus dates in changelog
  - resolves : #984532


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.4-4
changelog:
  - fix link to upstream tarball (#1059219)
  - reference pidfiles of quagga daemons in service files (#842309)


author: Ondřej Lysoněk <olysonek@redhat.com> - 0.99.22.4-5
changelog:
  - Fixed CVE-2018-5379 - Double free vulnerability in bgpd when processing
    certain forms of UPDATE message allowing to crash or potentially execute
    arbitrary code
  - Resolves: rhbz#1546015


author: Petr Hracek <phracek@redhat.com> - 1.17.2-2
changelog:
  - rear does not require syslinux
  - changing to arch package so that syslinux is installed
  - Resolves: #1283927


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-4
changelog:
  - cd to the correct directory before md5sum to fix BACKUP_INTEGRITY_CHECK.
    Upstream PR#1685, bz1532676


author: Florian Festi <ffesti@redhat.com> - 9.1.0-70
changelog:
  - Be stricter with she bang lines in find-requires (#1179523)
  - Use --with-cpu=power8 for ppc64le (#1213268)
  - Fix stripping of binaries for changed file output (#1250015)
  - Fix find-provides.libtool for new libtool style (#1061619)
  - Restore UID/ GID on jar files (#1270053)
  - Fix latest_kernel macro (#1323087)
  - Add _pkgdocdir and _docdir_fmt macro (#1057327)
  - Fix detection for perl files in old depencency generator (#1324003)


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-102
changelog:
  - LVM: update metadata on start/relocate
  - LVM: warn when cache mode is not writethrough

    Resolves: rhbz#1451933


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-105.6
changelog:
  - ocf_attribute_target: add fallback for Pacemaker versions without
    bundle support

    Resolves: rhbz#1524454


author: Milan Zazrivec <mzazrivec@redhat.com> 5.0.9-1
changelog:
  - Update .po and .pot files for rhnsd.
  - New translations from Transifex for rhnsd.
  - Download translations from Transifex for rhnsd.


author: Michael Mraka <michael.mraka@redhat.com> 5.0.10-1
changelog:
  - let rhnsd.service be enabled after installation
  - Purging %changelog entries preceding Spacewalk 1.0, in active packages.


author: Grant Gainey 5.0.13-5
changelog:
  - Bump release to get past weirdness in brew-tags (ggainey@redhat.com)
  - Related: #1138939 - up2date and systemid files are managed by rhnsd itself,
    no need to break init script if they do not exist (jdobes@redhat.com)
  - Related: #1092518 - PIE+RELRO for rhnsd (mkollar@redhat.com)
  - Revert changes in order to clean up tagging issues with brew
    (ggainey@redhat.com)
  - Automatic commit of package [rhnsd] minor release [5.0.13-4-el7].
    (ggainey@redhat.com)
  - Bump release to get past weirdness in brew-tags (ggainey@redhat.com)
  - Automatic commit of package [rhnsd] minor release [5.0.13-2-el7].
    (ggainey@redhat.com)
  - Resolves: #1138939 - up2date and systemid files are managed by rhnsd itself,
    no need to break init script if they do not exist (jdobes@redhat.com)
  - Resolves: #1092518 - PIE+RELRO for rhnsd (mkollar@redhat.com)


author: Gennadii Altukhov <galt@redhat.com> 5.0.13-6
changelog:
  - 1409562 - RHEL7 rhnsd reload doesn't work (jdostal@redhat.com)
  - 1409562 - Reboot loop - rhn_check, rhnsd (jdostal@redhat.com)


author: Tomas Kasparek <tkasparek@redhat.com> 5.0.13-7.2
changelog:
  - Resolves: #1506911 - close and reopen syslog when redirecting child output
    (martin.matuska@axelspringer.de)


author: Roman Rakus <rrakus@redhat.com> - 2.2.7-3
changelog:
  - Fixed a typo
  - Added missing providers
  - improved providers registration
  - Fixed owning of filesystem's directories (man)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.8-7
changelog:
  - Fix sblim-gather is installing files under /etc/tmpfiles.d/
    Resolves: #1180992
  - Build with PIE and full RELRO
    Resolves: #1092566


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.8-8
changelog:
  - Fix reposd crashes with SIGFPE during calcluation of interval metric when there
    are duplicate data values in the repository
    Resolves: #1467038


author: Watson Sato <wsato@redhat.com> 0.1.30-5
changelog:
  - Fix template remediation function used by SSHD remediation
  - Reduce scope of patch that fixes SSHD remediation (RH BZ#1415152)


author: Watson Sato <wsato@redhat.com> 0.1.32-1
changelog:
  - Update to upstream version 0.1.32
  - New CMake build system
  - Improved NIST 800-171 profile
  - Initial RHVH profile
  - New CPE to identify systems like machines (bare-metal and VM) and containers (image and container)
  - Template clean up in lots of remediations


author: Watson Sato <wsato@redhat.com> 0.1.33-1
changelog:
  - Update to upstream version 0.1.33
  - DISA RHEL7 STIG profile alignment improved
  - Introduction of remediation roles
  - RPM and DEB test packages are built by CMake with CPack
  - Lots of remediation fixes


author: Lubos Kardos <lkardos@redhat.com> - 20130529-10
changelog:
  - Allow to use vendor prefix in packages names
  - Include %nfsmountable macro into scl's rpm macros file


author: Jan Zeleny <jzeleny@redhat.com> - 20130529-13
changelog:
  - bump the version to get in sync with 7.1 branch
  - Reflect the state of %nfsmountable macro in collections' rpm macro files
  - escape all the % chars in changelog


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-3.el7
changelog:
  - seabios-redhat-reserve-more-memory-on-fseg.patch [bz#1327060]
  - seabios-redhat-turn-off-some-config-options.patch [bz#1327060]
  - Resolves: bz#1327060
    ([Seabios]Limited boot number supported for SCSI/SATA)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-4.el7
changelog:
  - seabios-Build-vgabios-virtio.bin.patch [bz#1327001]
  - Resolves: bz#1327001
    (vgabios-virtio.bin should be included  in seavgabios-bin package)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-5.el7
changelog:
  - seabios-pci-don-t-map-virtio-1.0-storage-devices-above-4G.patch [bz#1373154]
  - Resolves: bz#1373154
    (Guest fails boot up with ivshmem-plain and virtio-pci device)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-5.el7_3.1
changelog:
  - seabios-vgabios-Reorder-video-modes-to-work-around-a-Windows.patch [bz#1392028]
  - Resolves: bz#1392028
    ([virtio-win][svvp][ws2016] cannot generate dump file when using nmi on ws2016 and win10-32/64)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.10.1-2.el7
changelog:
  - seabios-smm-disable-by-default.patch [bz#1378006]
  - seabios-ahci-Set-upper-32-bit-registers-to-zero.patch [bz#1418320]
  - Resolves: bz#1378006
    (guest paused on target host sometimes when do migration during guest boot)
  - Resolves: bz#1418320
    (Seabios does not fully reset AHCI adapters)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.10.2-2.el7
changelog:
  - seabios-resume-Don-t-attempt-to-use-generic-reboot-mechanism.patch [bz#1428347]
  - Resolves: bz#1428347
    (reboot hangs on rhel6 machine types (~1/20 times))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.10.2-3.el7
changelog:
  - seabios-blockcmd-accept-only-disks-and-CD-ROMs.patch [bz#1020622]
  - seabios-blockcmd-generic-SCSI-luns-enumeration.patch [bz#1020622]
  - seabios-virtio-scsi-enumerate-luns-with-REPORT-LUNS.patch [bz#1020622]
  - seabios-usb-uas-enumerate-luns-with-REPORT-LUNS.patch [bz#1020622]
  - Resolves: bz#1020622
    (seabios fail to recognize virtio-scsi device if specify LUN not 0)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 1.10.2-3.el7_4.1
changelog:
  - seabios-virtio-IOMMU-support.patch [bz#1472131]
  - Resolves: bz#1472131
    (Guest OS will down when disk enable the IOMMU for Virtio)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-163
changelog:
  - Allow sssd_t to read realmd lib files.
  Resolves: rhbz#1436689
  - Add permission open to files_read_inherited_tmp_files() interface
  Resolves: rhbz#1290633
  Resolves: rhbz#1457106


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-164
changelog:
  - Allow couple rules needed to start targetd daemon with SELinux in enforcing mode
  Resolves: rhbz#1424621
  - Add interface lvm_manage_metadata
  Resolves: rhbz#1424621


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-166
changelog:
  - Add new boolean gluster_use_execmem
  Resolves: rhbz#1469027
  - Allow cluster_t and glusterd_t domains to dbus chat with ganesha service
  Resolves: rhbz#1468581


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-166.6
changelog:
  - Allow tomcat domain to connect to mssql port
  Resolves: rhbz#1500697
  - Add keepalived domain setpgid capability
  Resolves: rhbz#1500813


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-166.7
changelog:
  - Allow cluster_t domain creating bundles directory with label var_log_t instead of cluster_var_log_t
  Resolves: rhbz:#1513075


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-170
changelog:
  - Add few rules to make working targetd daemon with SELinux
  Resolves: rhbz#1373860
  - Allow ipmievd_t domain to load kernel modules
  Resolves: rhbz#1441081
  - Allow logrotate to reload transient systemd unit
  Resolves: rhbz#1440515
  - Add certwatch_t domain dac_override and dac_read_search capabilities
  Resolves: rhbz#1422000
  - Allow postgrey to execute bin_t files and add postgrey into nsswitch_domain
  Resolves: rhbz#1412072
  - Allow nscd_t domain to search network sysctls
  Resolves: rhbz#1432361
  - Allow iscsid_t domain to read mount pid files
  Resolves: rhbz#1482097
  - Allow ksmtuned_t domain manage sysfs_t files/dirs
  Resolves: rhbz#1413865
  - Allow keepalived_t domain domtrans into iptables_t
  Resolves: rhbz#1477719
  - Allow rshd_t domain reads net sysctls
  Resolves: rhbz#1477908
  - Add interface seutil_dontaudit_read_module_store()
  - Update interface lvm_rw_pipes() by adding also open permission
  - Label /dev/clp device as vfio_device_t
  Resolves: rhbz#1477624
  - Allow ifconfig_t domain unmount fs_t
  Resolves: rhbz#1477445
  - Label /dev/gpiochip* devices as gpio_device_t
  Resolves: rhbz#1477618
  - Add interface  dev_manage_sysfs()
  Resolves: rhbz#1474989


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-171
changelog:
  - Allow targetd_t to create own tmp files.
  - Dontaudit targetd_t to exec rpm binary file.
  Resolves: rhbz#1373860
  Resolves: rhbz#1424621


author: Pavel Moravec <pmoravec@redhat.com> = 3.4-7
changelog:
  - [openstack plugins] Tripleo specific containerized services
    Resolves: bz1463635
  - [jars] Scan only /usr/{share,lib}/java by default
    Resolves: bz1482574
  - [gluster_block] Added new plugin gluster_block
    Resolves: bz1491964


author: Pavel Moravec <pmoravec@redhat.com> = 3.4-12
changelog:
  - [openstack_cinder] check for api service running
    Resolves: bz1511087
  - [plugins] allow add_cmd_output to collect binary output
    Resolves: bz1515113


author: Pavel Grunt <pgrunt@redhat.com> - 0.33-1
changelog:
  - Rebase to 0.33
    Resolves: rhbz#1402474
  - Rebuilt with correct hardening flags due to bug 1387475
    Resolves: rhbz#1420778
  - Fix copy paste issues
    Resolve: rhbz#1409854


author: Pavel Grunt <pgrunt@redhat.com> - 0.33-2
changelog:
  - Add missing patch for rebase
    Resolves: rhbz#1402474
  - Add obsoletes to the spec file to ease updates
    Resolves: rhbz#1432776
  - Fix black screen in virt-manager
    Resolves: rhbz#1433242
  - Make connection error message more clear
    Resolves: rhbz#1365736


author: Victor Toso <victortoso@redhat.com> - 0.33-3
changelog:
  - Avoid CRITICALs on copy-paste
    Resolves: rhbz#1440096
  - Avoid assertions on file-xfer while agent disconnects
    Related: rhbz#1440096


author: Pavel Grunt <pgrunt@redhat.com> - 0.33-4
changelog:
  - Make connection error message more clear
    Resolves: rhbz#1365736
  - Improve audio debug
    Resolves: rhbz#1436249
  - Fix wrong encoding of transferred files
    Resolves: rhbz#1440206


author: Kevin Howell <khowell@redhat.com> 1.19.15-1
changelog:
  - Sync zanata translations (khowell@redhat.com)
  - 1452737: Enable saving no_proxy settings from GUI (jhnidek@redhat.com)
  - 1451003: identity reports right info in name field (jhnidek@redhat.com)
  - 1432231: Support /etc/init.d daemon even on EL7 (khowell@redhat.com)
  - 1450818: Bug fix of com.redhat.Subscriptionmanager D-Bus policy
    (jhnidek@redhat.com)
  - 1450862: remove obsolete certificates of golden ticket (jhnidek@redhat.com)
  - 1450049: Replace `-` with `_` in completion functions (khowell@redhat.com)
  - 1450210: Make lscpu ignore locale again (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.17-1
changelog:
  - Bump python-rhsm requirement to 1.19.8 (khowell@redhat.com)
  - 1441397: Sync zanata translations (khowell@redhat.com)
  - 1441397: Added --noproxy to bash completion script (jhnidek@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.18-1
changelog:
  - Bump python-rhsm requirement to 1.19.9 (khowell@redhat.com)
  - 1452075: print only readable part of SSL error to console
    (jhnidek@redhat.com)
  - 1444453: Have gettext return unicode instead of bytes. (awood@redhat.com)
  - 1457197: Env. variable no_proxy=* is not ignored (jhnidek@redhat.com)
  - 1441397: added --noproxy for rhsm-debug auto-completion (jhnidek@redhat.com)
  - 1365472: Add mnemonic for subscription-manager spoke (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.21-1
changelog:
  - 1463765: Sync zanata translations (khowell@redhat.com)
  - 1463765: Fix wrong Indic-language translations (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.22-1
changelog:
  - 1486549: Do not update redhat.repo at RateLimitExceededException
    (jhnidek@redhat.com)
  - 1486326: Add subscription-manager plugin to yum-config-manager
    (khowell@redhat.com)
  - 1486338: Properly initialize clean repo copy (khowell@redhat.com)
  - 1484265: Force UTF-8 encoding in daemons (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.23-1
changelog:
  - Bump python-rhsm requirement to 1.19.10 (khowell@redhat.com)
  - 1481384: Improve error message for RateLimitExceededException
    (jhnidek@redhat.com)


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-2
changelog:
  - RHEL 7.4 erratum
  - Fixes coverity scan issues created by our patches: 
    - fixed resource leaks and a compiler warning in digest backport patch
    - removed needless code from cmnd_no_wait patch causing clang warning
    - format of the last changelog message causes problems to rhpkg push,
      so don't use that as a commit message 
    Resolves: rhbz#1360687


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-3
changelog:
  - RHEL 7.4 eratum
  - Fixes semicolon typo in digest backport patch from the previous build
    Resolves: rhbz#1360687


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-4
changelog:
  - RHEL 7.4 erratum
  - fixed cmnd_no_wait patch
  - backported iolog_flush sudoers default
    Resolves: rhbz#1369856
    Resolves: rhbz#1425853


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-5
changelog:
  - RHEL 7.4 erratum
  - added doc patch about sudo lookup issue
    Resolves: rhbz#1293306
  - added test suite patch
    Resolves: rhbz#1360687
  - fixed use after free fqdn problem
    Resolves: rhbz#1360687


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.19p2-7
changelog:
  - RHEL 7.4 erratum
  - added patch to fix output truncation (in some cases) when log_output
    option is enabled
    Resolves: rhbz#1454571


author: Jakub Jelen <jjelen@redhat.com> - 1.8.19p2-8
changelog:
  - RHEL 7.4 erratum
  - Fixes CVE-2017-1000367: Privilege escalation in via improper get_process_ttyname() parsing
    Resolves: rhbz#1455402


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-9
changelog:
  - RHEL 7.4 erratum
  - removed patch for output truncation (1454571) which introduced regression
    Resolves: rhbz#1360687


author: Frank Ch. Eigler <fche@redhat.com> - 3.0-3
changelog:
  - rhbz1346112 delay tls cert creation
  - rhbz1269062 null elevator
  - rhbz1337416 'count' tapset variable - autocast/@defined


author: David Smith <dsmith@redhat.com> - 3.1-3
changelog:
  - Added patches for:
  - rhbz1425568 task_dentry_path() fix
  - rhbz1431263 arm64 hardware breakpoint crash fix
  - rhbz1430828 replace task_exe_file() with current_exe_file()
  - rhbz1436845 adapt stapdyn to the dyninst 9.3.1 library search model
  - rhbz1433391 workaround parser issue in nfs_proc.stp
  - rhbz1428120 update lookup_bad_addr()


author: Jan Grulich <jgrulich@redhat.com> - 1.7.1-1
changelog:
  - Update to 1.7.1
    Resolves: bz#1388620
    Resolves: bz#1343899
    Resolves: bz#1410164
    Resolves: bz#1415547
    Resolves: bz#1418945
    Resolves: bz#1416290
    Resolves: bz#1342956
  - Fix shared memory leakage
    Resolves: bz#1358090
  - Added systemd unit file for xvnc
    Resolves: bz#1393971


author: Jan Grulich <jgrulich@redhat.com> - 1.7.1-2
changelog:
  - Be more restrictive with shared memory mode bits
    Resolves: bz#1152552
    Limit max username/password size in SSecurityPlain [CVE-2017-7394]
    Resolves: bz#1438737
    Fix crash from integer overflow in SMsgReader::readClientCutText [CVE-2017-7395]
    Resolves: bz#1438742


author: Jan Grulich <jgrulich@redhat.com> - 1.7.1-3
changelog:
  - Delete underlying ssecurity in SSecurityVeNCrypt [CCVE-2017-7392]
    Resolves: bz#1439127
    Prevent double free by crafted fences [CVE-2017-7393]
    Resolves: bz#1439134


author: Petr Pisar <ppisar@redhat.com> - 1.7-39
changelog:
  - Fix maximal RSS report (bug #702826)
  - Clean spec file
  - Recompute CPU usage at finer level (bug #527276)


author: Bastien Nocera <bnocera@redhat.com> 3.14.3-1
changelog:
  - Update to 3.14.3
  - Re-add opensubtitles plugin, as it doesn't depend on PyXDG anymore
  Resolves: #1174589


author: Bastien Nocera <bnocera@redhat.com> 3.14.3-4
changelog:
  - Remove Python3 plugins, they're mostly accessory plugins,
    and RHEL 7.2 only support Python2 for now
  Resolves: #1259643


author: Ray Strode <rstrode@redhat.com> 3.14.3-5
changelog:
  - Add more goo to the compat desktop file to prevent them
    from exposing in control-center
  Related: #1259292


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.8.0-1
changelog:
  - new release
    - rebase tuned to latest upstream
      resolves: rhbz#1388454
    - cpu-partitioning: enabled timer migration
      resolves: rhbz#1408308
    - cpu-partitioning: disabled kvmclock sync and ple
      resolves: rhbz#1395855
    - spec: muted error if there is no selinux support
      resolves: rhbz#1404214
    - units: implemented instance priority
      resolves: rhbz#1246172
    - bootloader: added support for initrd overlays
      resolves: rhbz#1414098
    - cpu-partitioning: set CPUAffinity early in initrd image
      resolves: rhbz#1394965
    - cpu-partitioning: set workqueue affinity early
      resolves: rhbz#1395899
    - scsi_host: fixed probing of ALPM, missing ALPM logged as info
      resolves: rhbz#1416712
    - added new profile cpu-partitioning
      resolves: rhbz#1359956
    - bootloader: improved inheritance
      resolves: rhbz#1274464
    - units: mplemented udev-based regexp device matching
      resolves: rhbz#1251240
    - units: introduced pre_script, post_script
      resolves: rhbz#1246176
    - realtime-virtual-host: accommodate new ktimersoftd thread
      resolves: rhbz#1332563
    - defirqaffinity: fixed traceback due to syntax error
      resolves: rhbz#1369791
    - variables: support inheritance of variables
      resolves: rhbz#1433496
    - scheduler: added support for cores isolation
      resolves: rhbz#1403309
    - tuned-profiles-nfv splitted to host/guest and dropped unneeded dependency
      resolves: rhbz#1413111
    - desktop: fixed typo in profile summary
      resolves: rhbz#1421238
    - with systemd don't do full rollback on shutdown / reboot
      resolves: rhbz#1421286
    - builtin functions: added virt_check function and support to include
      resolves: rhbz#1426654
    - cpulist_present: explicitly sorted present CPUs
      resolves: rhbz#1432240
    - plugin_scheduler: fixed initialization
      resolves: rhbz#1433496
    - log errors when applying a profile fails
      resolves: rhbz#1434360


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.8.0-2
changelog:
  - respin
    related: rhbz#1388454
  - systemd: added support for older systemd CPUAffinity syntax
    resolves: rhbz#1441791
  - scheduler: added workarounds for low level exceptions from
    python-linux-procfs
    resolves: rhbz#1441792
  - bootloader: workaround for adding tuned_initrd to new kernels on restart
    resolves: rhbz#1441797
  - cpu-partitioning: use tuna for cores isolation
    related: rhbz#1403309


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-2
changelog:
  - Rebase to tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07.
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Patsy Franklin <pfrankli@redhat.com> - 2016i-1
changelog:
  - Rebase to tzdata-2016i:
    - Cyprus is now split into two time zones as of 2016-10-30
    - Tonga will reintroduce DST on 2016-11-06


author: Patsy Franklin <pfrankli@redhat.com> - 2016j-1
changelog:
  - Rebase to tzdata-2016ij
    - Saratov region of Russia is moving from +03 offset to +04 offset
      on 2016-12-04.


author: Patsy Franklin <pfrankli@redhat.com> - 2017a-1
changelog:
  - Rebase to tzdata-2017a.
    - Mongolia no longer observes DST. (BZ #1425214)
    - Add upstream patch to fix over-runing of POSIX limit on zone abbreviations.
  - Add zone1970.tab file to the install list. (BZ #1414829)


author: Patsy Franklin <pfrankli@redhat.com> - 2017c-1
changelog:
  - Rebase to tzdata-2017c.
    - Northern Cyprus will revert to using EQ rules on October 29, 2017.
    - Sudan will switch from +03 to +02 on November 1, 2017.
    - Tonga will not change it's clocks on Novemeber 5, 2017 ending it's
      experiment with DST.
    - Fiji DST will end on January 14, 2018 rather than January 21, 2018.
    - Namibia - starting September 3, 2017 switches from +)1 with DST to
      +02 all year.  This change takes effect April 1, 2018.
    - Turks & Caicos changes from -04 all year to -05 with US DST starting
      on March 11, 2018.  Effective change date is November 4, 2018. 
    - tzdata now includes two text versions of the time zone data - tzdata.zi
      and leapseconds. 
    - Includes two patches to deal with build issues.


author: Patsy Franklin <pfrankli@redhat.com> - 2018b-1
changelog:
  - Rebase to tzdata-2018b
    - São Tomé and Príncipe changed from +00 to +01 on January 1, 2018
    - Brazil's DST will start on the first Sunday in November
    - Irish standard time is in the summer now, not the winter.
    - Support for the new zic -t option.
    - Add back pacificnew file omitted in tzdata-2018a


author: Mark Wielaard <mjw@redhat.com> - 3.11.0-20
changelog:
  - Rebase to fedora 3.11.0
    (#1316512 #1306844 #1305962 #1298888 #1296318 #1271754 #1265566 #1265557)


author: Mark Wielaard <mjw@redhat.com> - 3.11.0-21
changelog:
  - Add valgrind-3.11.0-deduppoolalloc.patch (#1328347)
  - Add valgrind-3.11.0-ppc-bcd-addsub.patch (#1331738)
  - Add valgrind-3.11.0-ppc64-vgdb-vr-regs.patch (#1331774)


author: Mark Wielaard <mjw@redhat.com> - 3.12.0-8
changelog:
  - Add valgrind-3.12.0-powerpc-register-pair.patch (#1437030)
  - Add valgrind-3.12.0-ppc64-isa-3_00.patch (#1437032)


author: Devan Goodwin <dgoodwin@rm-rf.ca> 0.15-1
changelog:
  - Update spec for renamed README.md. (dgoodwin@redhat.com)
  - Moves fakevirt._decode() to util.decode() (csnyder@redhat.com)
  - Adds the report.config.name to log message when refusing to send a report due
    to lack of change (csnyder@redhat.com)
  - VirtWho: Clears list of reports on reload (csnyder@redhat.com)
  - Revises change detection tests to account for changes in master
    (csnyder@redhat.com)
  - Libvirtd: Sends a report on start up, and on events (csnyder@redhat.com)
  - Removes trailing line at the end of the file (csnyder@redhat.com)
  - Test_Esx: Test Oneshot to ensure it queues a report (csnyder@redhat.com)
  - Esx: only queue data if the version has changed (csnyder@redhat.com)
  - Test_VirtWho:Patches manager.Manager.fromOptions, removes unnecessary mocks
    (csnyder@redhat.com)
  - Removes unhelpful debug log message (csnyder@redhat.com)
  - Fix spacing, remove unused imports (csnyder@redhat.com)
  - Test_VirtWho: Adds test to show same report will not be sent twice
    (csnyder@redhat.com)
  - VirtWho: Adds basic change detection using report hashs (csnyder@redhat.com)
  - Adds hash property to config (csnyder@redhat.com)
  - Adds hash property to DomainListReport and HypervisorGuestAssociationReport
    (csnyder@redhat.com)
  - Hypervisor: Adds getHash class method (csnyder@redhat.com)
  - Limits interval settings (wpoteat@redhat.com)
  - Retry sending data to subscription manager multiple times before dropping
    (rnovacek@redhat.com)
  - SubscriptionManager: nicely order keys in debug report (rnovacek@redhat.com)
  - Fix serialization of guest list in print mode (rnovacek@redhat.com)
  - Do not exit oneshot mode if any job exists (rnovacek@redhat.com)
  - SubscriptionManager: check if report result has failedUpdate item
    (rnovacek@redhat.com)
  - SubscriptionManager: minor logging fixes (rnovacek@redhat.com)
  - SubscriptionManager: add env var to disable asynchronous reporting
    (rnovacek@redhat.com)
  - Check jobs status in increasing interval (rnovacek@redhat.com)
  - Esx: report host even if it doesn't have any guests (rnovacek@redhat.com)
  - Hypervisors reported by hyperv now include hostname. (csnyder@redhat.com)
  - Removes completed jobs. (csnyder@redhat.com)
  - Fix output format in print mode (rnovacek@redhat.com)
  - Fix using empty list as default parameter value (rnovacek@redhat.com)
  - satellite: support new hypervisor format (rnovacek@redhat.com)
  - Fix tests failures (rnovacek@redhat.com)
  - Removes timeouts for jobs. All jobs in the list are now executed just before
    a new report is sent. (csnyder@redhat.com)
  - The virtwho loop now blocks on the report queue with a one second timeout
    (csnyder@redhat.com)
  - Removes unnecessary imports and queue (csnyder@redhat.com)
  - Rewrite readme to markdown syntax (rnovacek@redhat.com)
  - CI: install unittest2 from pypi (rnovacek@redhat.com)
  - CI: add -y option to add-apt-repository (rnovacek@redhat.com)
  - CI: another attempt on cloud archive for libvirt (rnovacek@redhat.com)
  - CI: try to install newer version of libvirt from cloud archive
    (rnovacek@redhat.com)
  - CI: add libvirt-dev dependency (rnovacek@redhat.com)
  - CI: install libvirt-python via pip (rnovacek@redhat.com)
  - CI: another attempt without site-packages (rnovacek@redhat.com)
  - CI: install python-rhsm dependencies (rnovacek@redhat.com)
  - Adds support for facts in Hypervisor profile. (csnyder@redhat.com)
  - Adds count of unchanged mappings to the info logged for the result of an
    async job (csnyder@redhat.com)
  - Adds tests for jobs in virtwho, removes unnecessary tests for managerprocess.
    (csnyder@redhat.com)
  - Changes to ensure backwards compatibility with python-rhsm
    (csnyder@redhat.com)
  - Fixes RhevM.getHostGuestMapping() as suggested by rnovacek
    (csnyder@redhat.com)
  - Adds layer to hypervisorId. Removes completed TODO (csnyder@redhat.com)
  - Moves all functionality of managerprocess into virtwho. (csnyder@redhat.com)
  - CI: use python with system side packages enabled (rnovacek@redhat.com)
  - CI: install m2crypto using apt instead of pip (rnovacek@redhat.com)
  - CI: install python-libvirt using apt instead of pip (rnovacek@redhat.com)
  - Add requirements.txt and .travis.yml for the CI (rnovacek@redhat.com)
  - Adds tests to verify the hostGuestAssociation is generated correctly.
    (csnyder@redhat.com)
  - Updates libvirtd and tests to add host name to hypervisor profile
    (csnyder@redhat.com)
  - Updates managerprocess with better logging and changes for the new tests.~~
    (csnyder@redhat.com)
  - Updates to use the new hypervisor class (csnyder@redhat.com)
  - print mode: format debug message about found hypervisors
    (rnovacek@redhat.com)
  - Removing uncesasary comments (csnyder@redhat.com)
  - Removes unused dictionary of jobs and associated methods.
    (csnyder@redhat.com)
  - Fixes tests data to include "status" key. (csnyder@redhat.com)
  - Updates tests to make use of new Hypervisor class. (csnyder@redhat.com)
  - Host name is now included in the hypervisor profile using the new Hypervisor
    class (csnyder@redhat.com)
  - Adds new Hypervisor class. (csnyder@redhat.com)
  - Adds new test for the updates to subscriptionmanager.py (csnyder@redhat.com)
  - Updates fakevirt to make use of virt.Guest classes (csnyder@redhat.com)
  - Changes to ensure proper execution post-merge (csnyder@redhat.com)
  - Removing more unnecessary prints (csnyder@redhat.com)
  - Fixes oneshot mode for work with new managerprocess (csnyder@redhat.com)
  - Cleaning up unneeded prints and adding more useful debug log messages
    (csnyder@redhat.com)
  - Adds async job status polling for use with the new report API
    (csnyder@redhat.com)
  - This (along with python-rhsm/csnyder/new_report_api ee38f15, allows
    communication with new report api (csnyder@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 0.19-1
changelog:
  - 1415497: Support rhev4 auto detection and usage (pcreech@redhat.com)
  - 1388577: Adding UTF-8 support (pcreech@redhat.com)
  - 1410000: Include org_id in hv base channel (pcreech@redhat.com)
  - 1400431: Fix AttributeError where val is missing (pcreech@redhat.com)
  - 1405967: Filter host via glob or regex (pcreech@redhat.com)
  - Adds --password option to virt-who-pasword (tstrachota@redhat.com)
  - 1392390 Fix default interval handling (pcreech@redhat.com)
  - BZ1405967  Add filter_hosts_regex, and exclude_hosts_regex to allow filtering
    large numbers of hosts easily (chris@chrisprocter.co.uk)
  - 1369107: Only load files with .conf extension (pcreech@redhat.com)
  - 1383436: Obey the interval setting (csnyder@redhat.com)
  - 1299643: Update virt-who-config man page to include NO_PROXY
    (csnyder@redhat.com)


author: Kevin Howell <khowell@redhat.com> 0.19-2
changelog:
  - 1437229: Fix syntax error in exception handling (pcreech@redhat.com)
  - Update the spec file for builds on more downstream platforms
    (csnyder@redhat.com)
  - 1437228: Handle utf-8 within Xmlrpc transport (pcreech@redhat.com)


author: Kevin Howell <khowell@redhat.com> 0.19-3
changelog:
  - Do not join threads not started, fix up fake backend (csnyder@redhat.com)
  - 1439317: Ensure reports are still sent despite duplicate configurations
    (csnyder@redhat.com)
  - 1436811: Send reports on the interval per destination (csnyder@redhat.com)
  - 1436517: Set Version header for version detect (pcreech@redhat.com)


author: Kevin Howell <khowell@redhat.com> 0.19-4
changelog:
  - 1436517: Fix api base detection for rhevm version 3 and 4
    (csnyder@redhat.com)
  - 1442337: Send updates immediately the first run (csnyder@redhat.com)


author: Kevin Howell <khowell@redhat.com> 0.19-5
changelog:
  - 1448267: Fix polling behavior for oneshot, CTRL-C, 429 responses
    (csnyder@redhat.com)
  - 1450747: Continue running destination threads on internal failure
    (csnyder@redhat.com)
  - 1444718: Log name of config when duplicate reports are retrieved
    (csnyder@redhat.com)
  - 1447264: Keep running on InvalidPasswordFormat given other valid configs
    (csnyder@redhat.com)
  - 1369107: Update docs and log messages to show the *.conf requirement
    (csnyder@redhat.com)


author: Tomas Popela <tpopela@redhat.com> - 2.14.6-1
changelog:
  - Update to 2.14.6
  - Resolves: rhbz#1440681
  - Don't crash is no render is available in AX render object
  - Resolves: rhbz#1437672


author: Tomas Popela <tpopela@redhat.com> - 2.14.6-3
changelog:
  - Bundle only needed icu libraries
  - Don't list bundled icu libraries in provides
  - Resolves: rhbz#1383614


author: Tomas Popela <tpopela@redhat.com> - 2.14.7-1
changelog:
  - Update to 2.14.7
  - Backport more of a11y fixes from upstream
  - Fix JSC crashes on big endian arches
  - Resolves: rhbz#1442160


author: Tomas Popela <tpopela@redhat.com> - 2.14.7-2
changelog:
  - Fix a CLoop patch that was not correctly backported from upstream, causing
    crashes on big endian machines
  - Resolves: rhbz#1442160


author: Tomas Popela <tpopela@redhat.com> - 2.14.7-3
changelog:
  - Update the bundled brotli and woff2 to the latest releases due to
    woff2's license incompatibility with WebKitGTK+ project
  - Resolves: rhbz#1500368


author: Tomas Hozza <thozza@redhat.com> - 1.14-8
changelog:
  - Fix deadcode and possible use of NULL in vprintf (#913153)
  - Add documentation for --regex-type and --preserve-permissions
  - Fix --preserve-permissions to work as documented (and expected)
  - Fix bug when authenticating using user:password@url syntax (#912358)
  - Document and fix --backups option


author: Tomas Hozza <thozza@redhat.com> - 1.14-12
changelog:
  - Fix wget to include Host header on CONNECT as required by HTTP 1.1 (#1203384)
  - Run internal test suite during build (#1295846)
  - Fix -nv being documented as synonym for two options (#1147572)


author: Tomas Hozza <thozza@redhat.com> - 1.14-15
changelog:
  - Added TLSv1_1 and TLSv1_2 as secure-protocol values to help (#1439811)
  - Fixed synchronization in randomly failing unit test Test-proxied-https-auth (#1448440)


author: Simo Sorce <simo@redhat.com> - 1.2.20-1
changelog:
  - New upstrema version with memleaks, crl checks and other fixes
  - enable make check during build
  - drop ecdsa patch as it has been included upstream


