# changelog

author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-12
changelog:
  - Bump version to 1.3.7.5-12
  - Resolves: Bug 1459946 - GetEffectiveRights gives false-negative with ACIs containing targetfilter
  - Resolves: Bug 1507194 - cleanallruv could break replication if anchor csn in ruv originated in deleted replica
  - Resolves: Bug 1517788 - password policy: minimum token length fails when the token length is equal to attribute length
  - Resolves: Bug 1518287 - heap-use-after-free in csn_as
  - Resolves: Bug 1531153 - Indexing of internationalized matching rules is failing
  - Resolves: Bug 1517383 - ns-slapd segfaults with ERR - connection_release_nolock_ext - conn=0 fd=0 Attempt to release connection that is not acquired
  - Resolves: Bug 1523183 - search with CoS attribute is getting slower after modifying/adding CosTemplate
  - Resolves: Bug 1457315 - cmocka tests are not executed during rpm build
  - Resolves: Bug 1516309 - After cleanALLruv, replication is looping on keep alive DEL


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-13
changelog:
  - Bump version to 1.3.7.5-13
  - Resolves: Bug 1533828 - Server allows to set nsds5replicaid=65535 in the existing replica entry
  - Resolves: Bug 1519406 - New defects found in 389-ds-base-1.3.7.5-3.el7
  - Resolves: Bug 1534379 - CVE-2017-15134: Remote DoS via search filters in slapi_filter_sprintf in slapd/util.c 
  - Resolves: Bug 1533571 - memberof: schema violation error message is confusing as memberof will likely repair target entry
  - Resolves: Bug 1535515 - local password policies should use the same defaults as the global policy


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-14
changelog:
  - Bump version to 1.3.7.5-14
  - Resolves: Bug 1519406 - New defects found in 389-ds-base-1.3.7.5-3.el7 (fix regression in -13)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-15
changelog:
  - Bump version to 1.3.7.5-15
  - Resolves: Bug 1533828 - Server allows to set nsds5replicaid=65535 in the existing replica entry
  - Resolves: Bug 1535515 - local password policies should use the same defaults as the global policy
  - Resolves: Bug 1541108 - Allow CRL handling to be configurable for outgoing connections


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-16
changelog:
  - Bump version to 1.3.7.5-16
  - Resolves: Bug 1542645 - Outgoing secure connection is failing with recent OpenLDAP


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5.17
changelog:
  - Bump version to 1.3.7.5.17
  - Resolves: Bug 1539082 - Child entry cenotaphs should not prevent the deletion of the parent
  - Resolves: Bug 1540106 - CVE-2018-1054 - remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8 
  - Resolves: Bug 1535538 - CVE-2017-15135 - Authentication bypass due to lack of size check in slapi_ct_memcmp


author: Matus Honek <mhonek@redhat.com> - 1.3.7.5-19
changelog:
  - Bump version to 1.3.7.5-19
  - Resolves: Bug 1563107 - IPA server is not responding, all authentication and admin tests failed [rhel-7.5.z]


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-20
changelog:
  - Bump version to 1.3.7.5-20
  - Resolves: Bug 1563079 - adjustment of csn_generator can fail so next generated csn can be equal to the most recent one received 
  - Resolves: Bug 1559764 - memberof fails if group is moved into scope
  - Resolves: Bug 1554720 - "Truncated search results" pop-up appears in user details in WebUI 
  - Resolves: Bug 1553605 - ipa-server-install fails with Error: Upgrade failed with no such entry
  - Resolves: Bug 1559760 - ds-replcheck: add -W option to ask for the password from stdin instead of passing it on command line
  - Resolves: Bug 1559464 - replica_write_ruv log a failure even when it succeeds


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-21
changelog:
  - Bump version to 1.3.7.5-21
  - Resolves: Bug 1559818 - EMBARGOED CVE-2018-1089 389-ds-base: ns-slapd crash via large filter value in ldapsearch


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-22
changelog:
  - Bump version to 1.3.5.7-22
  - Resolves: Bug 1563079 - adjustment of csn_generator can fail so next generated csn can be equal to the most recent one received
  - Resolves: Bug 1579702 - Replication stops working when MemberOf plugin is enabled on hub and consumer
  - Resolves: Bug 1579698 - replicated operations should be serialized
  - Resolves: Bug 1579700 - Upgrade script doesn't enable PBKDF password storage plug-in
  - Resolves: Bug 1580257 - ds-replcheck LDIF comparision fails when checking for conflicts
  - Resolves: Bug 1580523 - ns-slapd segfaults with ERR - connection_release_nolock_ext - conn=0 fd=0 Attempt to release connection that is not acquired


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-23
changelog:
  - Bump version to 1.3.7.5-23
  - Resolves: Bug 1581588 - ACI deny rules do not work correctly
  - Resolves: Bug 1582747 - DS only accepts RSA and Fortezza cipher families


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-25
changelog:
  - Bump version to 1.3.7.5-25
  - Resolves: Bug 1597530 - Async operations can hang when the server is running nunc-stans


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-26
changelog:
  - Bump version to 1.3.7.5-26
  - Resolves: Bug 1615924 - Fine grained password policy can impact search performance
  - Resolves: Bug 1614836 - Disable nunc-stans by default
  - Resolves: Bug 1614861 - ldapsearch with server side sort crashes the ldap server


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-28
changelog:
  - Bump version to 1.3.7.5-28
  - Resolves: Bug 1628676 - 389-ds-base: race condition on reference counter leads to DoS using persistent search
  - Resolves: Bug 1628677 - Crash in delete_passwdPolicy when persistent search connections are terminated unexpectedly


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-4
changelog:
  - settings: clear unsaved flag on new connections (rh #1525078)
  - platform-linux: reload qdiscs and tfilters after removing them (rh #1527197)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-5
changelog:
  - wwan: add default route even if modem didn't return a gateway (rh #1527934)
  - dhcp: fix assertion failure for dhcp-client-id (rh #1531173)


author: Thomas Haller <thaller@redhat.com> - 1:1.10.2-6
changelog:
  - core: use distinct route-metric to keep connectivity on first activated device (rh #1505893)
  - core: fix enabling connectivity-check-enabled via D-Bus (rh #1534477)
  - core: fix invalid assertion deleting volatile connection (rh #1506552)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.10.2-7
changelog:
  - po: import translations (rh #1481186)
  - device: increase carrier wait time to 6 seconds (rh #1520826)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-10
changelog:
  - device: skip IP configuration phase for external devices (rh #1530288)
  - platform: fix crash during route-get call (rh #1534721)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.10.2-11
changelog:
  - ovs-interface: avoid starting ip configuration twice (rh #1540063)
  - libnm-core: ensure alignment of team.config and other team properties (rh #1533830)
  - nmcli: clear link-watchers before adding the new ones (rh #1533926)
  - libnm-core: update team.runner description (rh #1533799)
  - libnm-core: team: fix runner sys_prio default value (rh #1533810)
  - libnm: avoid a symbol clash with json-glib (rh #1535905)
  - libnm-core: team: add support to runner "random" (rh #1538699)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-12
changelog:
  - ppp: don't start IPv6 configuration on the device (rh #1515829)
  - device: avoid setting the IPv4 rp_filter (rh #1492472)
  - nmcli: team: clear runner-tx-hash before adding new hashes (rh #1541922)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-14
changelog:
  - manager: retry activating devices when the parent becomes managed (rh #1553595)
  - manager: allow autoconnect-slaves to reconnect the same connection (rh #1548265)
  - manager: fix starting teamd after service restart  (rh #1551958)


author: Steve Grubb <sgrubb@redhat.com> 2.7.4-1
changelog:
  resolves: #1367703 - auvirt wasn't supporting date keywords
  resolves: #1396792 - augenrules includes files ending in regexp "rules"
  resolves: #1406525 - ausearch with '--raw' parameter outputs garbage character


author: Steve Grubb <sgrubb@redhat.com> 2.7.5-1
changelog:
  resolves: #1437187 - audit rpm postinstall script points to non-existing file
  resolves: #1437426 - Remove "--backlog_wait_time" from auditctl man page & rules
  resolves: #1437626 - PF_PACKET socket address will cause ausearch to segfault
  resolves: #1438997 - SECCOMP records have wrong syscall


author: Steve Grubb <sgrubb@redhat.com> 2.7.8-1
changelog:
  resolves: #1406887 - auditd validate_email uses obsolete gethostbyname
  resolves: #1448526 - aureport shows the wrong auid "-1"
  resolves: #1475998 - python audit crash if when using AUSOURCE_FILE_POINTER
  resolves: #1482121 - python audit crash dereferencing auparse_state_t le field


author: Steve Grubb <sgrubb@redhat.com> 2.8.1-1
changelog:
  resolves: #982154 - Can't find the "avc" event with the auvirt command
  resolves: #1101605 - Ipv6 seems no working
  resolves: #1399314 - Allow non-equality comparisons for uid and gid fields
  resolves: #1455598 - Default port is wrong in audisp-remote.conf
  resolves: #1476406 - Audit package rebase


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-14
changelog:
  - Kdump: parse new options, EOL comments (RHBZ#1139298)
  - Rsyslog: parse property filters and templates (RHBZ#1138402)
  - Systemd: parse semicolons inside entry values (RHBZ#1139498)
  - Systemd: parse environment variables where value is quoted (RHBZ#1138508)


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-16
changelog:
  - Iptables: parse /etc/sysconfig/iptables.save (RHBZ#1144651)
  - Lvm: parse /etc/lvm/lvm.conf (RHBZ#1145495)
  - Shadow: add lens (RHBZ#1145249)


author: Dominic Cleal <dcleal@redhat.com> - 1.4.0-1
changelog:
  - Rebase to Augeas 1.4.0
  - Revert some changes for better compatibility with 1.1.0-17:
    * Dhcpd: keep 1.1.0 behaviour, add Dhcpd_140 for 1.4.0 features
    * Dnsmasq: revert splitting of address/server options
    * Dovecot: restore quotes within values
    * Jaas: revert semicolon and line break changes
    * Slapd: keep 1.1.0 behaviour, add Slapd_140 for 1.4.0 features
    * Sshd: keep 1.1.0 behaviour, add Sshd_140 for 1.4.0 features
    * Syslog: restore tree without protocol for UDP hosts
    * UpdateDB: keep Simplevars to load config by default


author: Pino Toscano <ptoscanoredhat.com> - 1.4.0-4
changelog:
  - Fix CVE-2017-7555, improper handling of escaped strings (RHBZ#1481546)
  - Skip testSaveNoPermission when running as root (RHBZ#1269817)
  - Chrony: allow signed numbers (RHBZ#1302017)
  - Krb5: support includedir (RHBZ#1406111)


author: Pino Toscano <ptoscanoredhat.com> - 1.4.0-5
changelog:
  - Cgconfig: allow fperm & dperm in admin & task (RHBZ#1325741)
  - Grub: handle top-level "boot" directive (RHBZ#1484261)


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 1.14.28-5
changelog:
  - Append python-botocore and python-jmespath bundled directory to
    search path where needed

    Resolves: rhbz#1509434


author: Petr Menšík <pemensik@redhat.com> - 32:9.9.4-59
changelog:
  - Support for additional signing algorithms in rndc (#1501531)
  - New autogenerated rndc keys will use hmac-sha256 algorithm


author: Nick Clifton <nickc@redhat.com> 2.27-21.base
changelog:
  - Prevent the PowerPC64 linker from triggering a seg-fault when discarding dynamic sections.
    (#1513014)


author: Kai Engert <kaie@redhat.com> - 2017.2.11-71
changelog:
  - Update to CKBI 2.11 from NSS 3.28.1 with legacy modifications.
  - Use comments in extracted bundle files.
  - Change packaging script to support empty legacy bundles.


author: Kai Engert <kaie@redhat.com> - 2017.2.11-72
changelog:
  - Changed the packaged bundle to use the flexible p11-kit-object-v1 file format,
    as a preparation to fix bugs in the interaction between p11-kit-trust and
    Mozilla applications, such as Firefox, Thunderbird etc.
  - For CAs trusted by Mozilla, set attribute nss-mozilla-ca-policy: true
  - Require p11-kit 0.23.5
  - Added an utility to help with comparing output of the trust dump command.


author: Kai Engert <kaie@redhat.com> - 2017.2.16-71
changelog:
  - Update to CKBI 2.16 from NSS 3.32. In addition to removals/additions,
    Mozilla removed code signing trust from all CAs (rhbz#1472933)


author: Karanbir Singh <kbsingh@centos.org>
changelog:
  - add a yum var to route mirrorlist accurately
  - add CentOS-fastrack repo
  - Trim the CentOS-Debug-7 key
  - rename the Debug repo to base-debug so yum-utils can consume easier


author: Karanbir Singh <kbsingh@centos.org>
changelog:
  - Bump Release for 1503 
  - add ABRT specific content to os-release
  - split redhat-release from centos-release


author: Johnny Hughes <johnny@centos.org>
changelog:
  - Bump Release for 1511
  - Add CentOS-Media.repo and put CentOS-CR.repo in the
    tarball, then removed patch1000


author: Pablo Greco <pablo@fliagreco.com.ar>
changelog:
  - armhfp: Update rootfs-expand to detect rootfs
  - armhfp: Obsolete update-boot
  - armhfp: Remove old versions of rootfs-expand


author: Nalin Dahyabhai <nalin@redhat.com> 0.75.14-1
changelog:
  - make pathname canonicalization slightly smarter, to handle ".." in
    locations (#1131758)
  - updates to self-tests (#1144082)


author: Jan Cholasta <jcholast@redhat.com> - 0.75.14-2
changelog:
  - backport dogtag-submit: accept additional options to pass to the server when
    approving requests using agent creds (#1165155)


author: Jan Cholasta <jcholast@redhat.com> - 0.75.14-3
changelog:
  - backport change from git to correctly retrieve string values from DBus
    property interface replies (#1181022)


author: Jan Cholasta <jcholast@redhat.com> - 0.78.1-1
changelog:
  - Resolves: #1140241 RFE: Add SCEP support to certmonger
  - Resolves: #1148001 ipa-getcert killed by SIGABRT
  - Resolves: #1205756 Rebase certmonger to 0.77 or later
    - Update to upstream 0.78.1


author: Jan Cholasta <jcholast@redhat.com> - 0.78.3-1
changelog:
  - Resolves: #1244914 scep ca helper does not parse command line options
    correctly
  - Related:  #1205756 Rebase certmonger to 0.77 or later
    - Update to upstream 0.78.3


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-1
changelog:
  - Resolves: #1249753 challenge password not added in csr using start-tracking
  - Resolves: #1250397 Remove certmonger rekey feature in 7.2
    - Remove rekey feature
  - Related:  #1205756 Rebase certmonger to 0.77 or later
    - Update to upstream 0.78.4


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-2
changelog:
  - Resolves: #1345755 Support for specifying IPA lightweight CA
    - Add 'issuer' request option for specifying issuer
    - Documentation: mark $CERTMONGER_CA_ISSUER as 0.79
    - Comment/whitespace fixup
    - ipa-submit: Retry without "ca" on OptionError
    - getcert: fix a potential out-of-bounds
    - Document the -X option in the ipa-submit man page
  - Resolves: #1351052 certmonger build for RHEL 7.3 failure
    - Stop assuming RSA 512 works
    - Stop assuming RSA 512 works, part two
    - Fix a flakiness in the 028-dbus test


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-3
changelog:
  - Resolves: #1367683 getcert request command fails to use Sub CA using -X
    argument
    - Fix CA option name for ipa cert-request


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-3.1
changelog:
  - Use required DER encoding when setting CA basic constraint (#1560961)
  - NSS 3.34 more strictly enforces length checking when verifying signatures
    (#1560960)


author: Ryan McCabe <rmccabe@redhat.com> 0.7.9-18
changelog:
  - Start the cloud-init init local service after the dbus socket is created
    so that the hostnamectl command works.
    Resolves: rhbz#1450521


author: Ryan McCabe <rmccabe@redhat.com> 0.7.9-23
changelog:
  - Fix a bug tha caused cloud-init to fail as a result of trying
    to rename bonds.
    Resolves: rhbz#1512247


author: Ryan McCabe <rmccabe@redhat.com> 0.7.9-24
changelog:
  - Set DHCP_HOSTNAME on Azure to allow for the hostname to be
    published correctly when bouncing the network.
    Resolves: rhbz#1434109


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.7.9-24.el7_5.1
changelog:
  - ci-Revert-azure-Fix-publishing-of-hostname.patch [bz#1568717]
  - ci-DataSourceAzure.py-use-hostnamectl-to-set-hostname.patch [bz#1568717]
  - ci-sysconfig-Don-t-disable-IPV6_AUTOCONF.patch [bz#1578702]
  - Resolves: bz#1568717
    (Add patch to bounce NICs in Azure/update DNS [rhel-7.5.z])
  - Resolves: bz#1578702
    (cloud-init-0.7.9-9.el7_4.6 breaks IPv4/IPv6 dual-stack EC2 instances in AWS [rhel-7.5.z])


author: Andreas Schneider <asn@redhat.com> - 1.0.0-1
changelog:
  - Update to version 1.0.0:
    * Added new test runner with group fixtures. The old runner is deprecated
    * Added an extensible message output formatter
    * Added jUnit XML message output
    * Added subunit message output
    * Added Test Anything Protocol message output
    * Added skip() command
    * Added test_realloc()
    * Added a cmockery compat header
    * Fixed a lot of bugs on Windows


author: Andreas Schneider <asn@redhat.com> - 1.0.1-1
changelog:
  - Update to version 1.0.1:
    * Added a macro for assert_ptr_equal().
    * Fixed test_realloc() if 0 size is passed.
    * Fixed objects packaging bug.
    * Fixed building with newer gcc versions.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.0-1
changelog:
  - Update to version 1.1.0
      * Added support to catch multiple exceptions
      * Added support to verify call ordering
      * Added support to pass initial data to test cases
      * Added will_return_maybe() for ignoring mock returns
      * Added subtests for groups using TAP output
      * Added support to write multiple XML files for groups
      * Improved documentation
      * Fixed XML output generataion
      * Fixed Windows builds with VS2015


author: Bastien Nocera <bnocera@redhat.com> - 3.26.2-6
changelog:
  + control-center-3.26.2-6
  - Fix Clone MAC not being saved in Ethernet device properties
  - Resolves: #1467295


author: Bastien Nocera <bnocera@redhat.com> - 3.26.2-8
changelog:
  + control-center-3.26.2-8
  - Fix Wi-Fi networks not getting updated
  - Show "Wi-Fi disabled" page when Wi-Fi is disabled
  - Resolves: #1545713


author: Robert Relyea <rrelyea@redhat.com> - 1.1.0-34
changelog:
  - recognize up to 32 keys and certs in coolkeys. (can go up to 62 with just #define changes)
  - own our cache file.
  - verify we are using the correct mechanisms


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-6
changelog:
  - Resolves: rhbz#1371880

  - libvotequorum: Bump version (rhbz#1371880)
  - merge upstream commit 96f91f23a6a413535cc2f0e8492e2300373fed40 (rhbz#1371880)
  - votequorum: Don't update expected_votes display if value is too high (rhbz#1371880)
  - merge upstream commit 596433066805af029be1292a37a35ce31307f0bf (rhbz#1371880)
  - votequorum: simplify reconfigure message handling (rhbz#1371880)
  - merge upstream commit 4a385f2e94c7168dbd92168c54a80ee97a3c2140 (rhbz#1371880)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-7
changelog:
  - Related: rhbz#1371880

  - Fix build on RHEL7.3 latest (rhbz#1371880)
  - merge upstream commit 19e48a6eee20d5f34f79a3b8d4e1c694169c1d7b (rhbz#1371880)
  - Enable aarch64 build (bz#1422598)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-8
changelog:
  - Resolves: rhbz#1434528
  - Resolves: rhbz#1434529
  - Resolves: rhbz#1434534

  - cfg: Prevents use of uninitialized buffer (rhbz#1434528)
  - merge upstream commit 52e6ae57ea06d0bef61c5c9250881bef1372ead2 (rhbz#1434528)
  - man: Fix typos in man page (rhbz#1434529)
  - merge upstream commit b642904ea9640bd7a1573a8c0d2c5bcb43a10dfc (rhbz#1434529)
  - Fix typo: Destorying -> Destroying (rhbz#1434529)
  - merge upstream commit 117d9e4eb77ef9941fdeaf17ddfd892514da8143 (rhbz#1434529)
  - init: Add doc URIs to the systemd service files (rhbz#1434529)
  - merge upstream commit 21a728785027483786e41c19f6aff57a95b80aa5 (rhbz#1434529)
  - man: Modify man-page according to command usage (rhbz#1434529)
  - merge upstream commit 79898e8cb1715e79b7467b91661b7341e2664550 (rhbz#1434529)
  - Totempg: remove duplicate memcpy in mcast_msg func (rhbz#1434528)
  - merge upstream commit 4a8e9d80409590cb42732ae3105b5ae71fda52c1 (rhbz#1434528)
  - upstart: Add softdog module loading example (rhbz#1434529)
  - merge upstream commit 75474d69bebea6c9c4ef2252476ce738cf92f0f4 (rhbz#1434529)
  - Remove deprecated doxygen flags (rhbz#1434529)
  - merge upstream commit b252013e42007ea7284ae54d035a30ca40f20fc0 (rhbz#1434529)
  - Remove redundant header file inclusion (rhbz#1434528)
  - merge upstream commit d6c7ade277a4a23d84c56d7fde6b60b377a1023b (rhbz#1434528)
  - Qdevice: fix spell errors in qdevice (rhbz#1434529)
  - merge upstream commit d9caa09c45d4560c89a1ad873087c0476cabab46 (rhbz#1434529)
  - doc: document watchdog_device parameter (rhbz#1434529)
  - merge upstream commit a5f97ae1b99063383d8f45168125b34232b91faf (rhbz#1434529)
  - Logsys: Change logsys syslog_priority priority (rhbz#1434534)
  - merge upstream commit 609cc0cc100aa1070d97b405273373682da0e270 (rhbz#1434534)
  - logconfig: Do not overwrite logger_subsys priority (rhbz#1434534)
  - merge upstream commit c866a2f8603b44e89eb21a6cf7d88134af2e8b66 (rhbz#1434534)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-9
changelog:
  - Resolves: rhbz#1445001

  - Main: Call mlockall after fork (rhbz#1445001)
  - merge upstream commit 238e2e62d8b960e7c10bfa0a8281d78ec99f3a26 (rhbz#1445001)
  - Disable aarch64 build (bz#1422598)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-10
changelog:
  - Resolves: rhbz#1439205
  - Resolves: rhbz#1461450
  - Resolves: rhbz#1469170
  - Resolves: rhbz#1476214

  - main: Don't ask libqb to handle segv, it doesn't work (rhbz#1439205)
  - merge upstream commit c0da36a6c0ecf7bc7def252a06336a7088e68086 (rhbz#1439205)
  - totem: Propagate totem initialization failure (rhbz#1461450)
  - merge upstream commit 0413a8f4672352171f0df731b7d9c1fe20acbc4c (rhbz#1461450)
  - totemcrypto: Refactor symmetric key importing (rhbz#1461450)
  - merge upstream commit a885868181c07ba9ab5cdfdad1d66d387b2a4428 (rhbz#1461450)
  - totemcrypto: Use different method to import key (rhbz#1461450)
  - merge upstream commit 5dadebd21862074deaeb9a337fc9e49f5e9f692a (rhbz#1461450)
  - main: Add option to set priority (rhbz#1469170)
  - merge upstream commit a008448efb2b1d45c432867caf08f0bcf2b4b9b0 (rhbz#1469170)
  - main: Add support for libcgroup (rhbz#1476214)
  - merge upstream commit c56086c701d08fc17cf6d8ef603caf505a4021b7 (rhbz#1476214)
  - totemcrypto: Fix compiler warning (rhbz#1461450)
  - merge upstream commit fdeed33f514e0056e322a45d9a0a04ca4b9a2709 (rhbz#1461450)


author: Jan Friesse <jfriesse@redhat.com> 2.4.3-2
changelog:
  - Resolves: rhbz#1536219

  - logging: Make blackbox configurable (rhbz#1536219)
  - merge upstream commit 8af39f66e56e319b6b93804c0400e6e29737a90f (rhbz#1536219)
  - logging: Close before and open blackbox after fork (rhbz#1536219)
  - merge upstream commit 995ed0bd814ff3eacf6c09534841e6ce39ab6614 (rhbz#1536219)


author: Marek Polacek <polacek@redhat.com> 4.8.5-20
changelog:
  - handle exceptions in basic_istream::sentry (#1469384)
  - don't run pr63354.c on ppc (#1468546)
  - ensure proxy privatization safety (#1491395)
  - fix incorrect codegen from rdseed intrinsic use (#1482762, CVE-2017-11671)
  - on aarch64, remove libatomic.so (#1465510)


author: Marek Polacek <polacek@redhat.com> 4.8.5-21
changelog:
  - fix 27_io/basic_fstream/53984.cc
  - fix for classes with bases with mutable members (PR c++/77375)
  - fix handling side-effects of parameters (PR c/77767)
  - fix combine's make_extraction (PR rtl-optimization/78378)
  - fix gimplification of const var initialization from COND_EXPR (PR c++/80129)
  - fix -A / -B to A / B folding (PR middle-end/80362)
  - fix comparison of decimal float zeroes (PR middle-end/80692)
  - fix __mulv[dt]i3 and expand_mul_overflow (PR target/82274)


author: Jeff Law <law@redhat.com> 4.8.5-24
changelog:
  - Sync gcc48-rh1469697-13 patch to upstream (#1469697)
  - Avoid probing in the red zone for noreturn functions (#1507980, #1469697)
  - Avoid infinite loop if probing interval is less than guard size (#1469697)
  - Fix debug information for large probing interval on aarch64 (#1469697)
  - Fix ICE on ppc port with large probing interval (#1469697)

  - rebuild to remove static relocations not known to older linkers (#1508968)


author: Jeff Law <law@redhat.com> 4.8.5-26
changelog:
  - Avoid red zone probing for zero residual dynamic allocation (#1469697)
  - Avoid bogus CFIs for probes in noreturn fucntions on x86/x86_64 (#1469697)


author: Marek Polacek <polacek@redhat.com> 4.8.5-28
changelog:
  - Minor testsuite fixes to clean up test results (#1469697)
  - retpoline support for spectre mitigation (#1535655)


author: Andreas Schneider <asn@redhat.com> - 4.7.1-3
changelog:
  - resolves: #1498353 - Fix broken MacOSX client which can't handle file_ids
                         correctly
  - resolves: #1495490 - Fix client rename over SMB2
  - resolves: #1510598 - Fix client volume cmd over SMB2


author: Andreas Schneider <asn@redhat.com> - 4.7.1-5
changelog:
  - resolves: #1505940 - Fix 'net ads keytab list'
  - resolves: #1518732 - Enable AES-NI to make SMB3 encryption and signing
                         faster


author: Andreas Schneider <asn@redhat.com> - 4.7.1-6
changelog:
  - resolves: #1476153 - Handle SMB echo responses more gracefully
  - resolves: #1523212 - Fix SMB2 client read-after-free issue


author: Andreas Schneider <asn@redhat.com> - 4.7.1-7
changelog:
  - resolves: #1581369 - Fix segfault updating dns during 'net ads join'
  - resolves: #1581373 - Fix segfault during NT1 session setup
  - resolves: #1581376 - Fix segfault in keytab handling
  - resolves: #1581377 - Fix segfault in smbclient dfsgetinfo


author: Marek Kasik <mkasik@redhat.com> - 0.26.0-1
changelog:
  - Update to 0.26.0
  - Remove editor subpackage
  - Return libdbus-1 library (not header or pkgconfig files)
  - Resolves: #1386841


author: Marek Kasik <mkasik@redhat.com> - 0.26.0-3
changelog:
  - Check mtimes of files in /etc/dconf/db/*.d/ directories
  - when running "dconf update"
  - Resolves: #1626372


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.38-1
changelog:
  - ifdown-eth: we need to flush global scope as well
  - killproc/status: add missing '-b <binary>' option
  - specfile: mark 'rwtab' and 'statetab' as config files
  - spec: we need newer lvm
  - rwtab: add /var/lib/systemd/timers
  - ifup-eth: remove quote marks
  - 9.70-sync: Move everything to github
  - 9.70-sync: rwtab updated
  - 9.70-sync: service file updated
  - 9.70-sync: syconfig.txt updated
  - 9.70-sync: systemd/rhel-import-state updated
  - 9.70-sync: sysconfig/network-scripts/* updated - part 2
  - 9.70-sync: sysconfig/network-scripts/* updated - part 1
  - 9.70-sync: rc.d/init.d/network updated
  - 9.70-sync: rc.d/init.d/netconsole updated
  - 9.70-sync: rc.d/init.d/functions updated
  - 9.70-sync: ipv6-6to4.howto example updated
  - 9.70-sync: examples/networking/ifcfg-bridge updated
  - network: load NetworkManager connection via dbus
  - network: check for running NetworkManager via dbus


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.39-1
changelog:
  - sysconfig.txt: mention previously introduced NO_DHCP_HOSTNAME option
  - DHCP_FQDN and DHCP_SEND_HOSTNAME introduced
  - re-add missing $HOSTNAME initialization
  - ifup: add support for VLAN_EGRESS_PRIORITY_MAP
  - rhel-autorelabel: synchronize cached writes before reboot


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.40-1
changelog:
  - require 'redhat-release' instead of /etc/system-release & conflict with older versions
  - ifup-post: always update 'nameserver' & 'search' entries in /etc/resolv.conf
  - systemd/system: symlinks for initscripts' services removed
  - *.old extension added to list of ignored files
  - ifup-eth: wait for STP to complete setup on bridge if $DELAY is not set
  - init.d/functions: convert2sec() function added
  - init.d/functions: is_true() & is_false() extended by ON/OFF support
  - usleep(1) calls replaced with sleep(1) calls
  - network-scripts: DBus calls forwarded to /dev/null
  - network-scripts: firewall-cmd replaced with DBus calls
  - ARPUDATE option introduced


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.41-1
changelog:
  - ifdown-post: fix logical error in commit 5d61564
  - network-functions: use POSIX forwarding instead of bash-ism


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-111
changelog:
  - Remove 0217-RHBZ-1437329-blacklist-oracle-devs.patch
    * Incorrect change, and the bug is already fixed.
  - Move 0218-RHBZ-1448576-3PAR-config.patch to
    0217-RHBZ-1448576-3PAR-config.patch
  - Resolves: bz #1448576


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-112
changelog:
  - Modify 0191-RHBZ-1169168-disable-changed-paths.patch
    * man page fixup
  - Modfiy 0197-RHBZ-1394059-max-sectors-kb.patch
    * man page fixup
  - Modify 0205-RHBZ-1416569-reset-stats.patch
    * man page fixup
  - Add 0218-RHBZ-1459370-add-feature-fix.patch
    * handle null feature string
  - Add 0219-RHBZ-1448970-fix-resize.patch
    * if the resize fails, try to resume again with the old table.
  - Add 0220-RHBZ-1448223-fix-kpartx.patch
    * gracefully fail when run on something other than a file or block device
  - Add 0221-RH-harden-files.patch
    * change build parameters to use position independent code
  - Add 0222-RHBZ-1457288-fix-show-maps-json.patch
    * handle running "show maps json" with no multipath devices present
  - Add 0223-RHBZ-1452210-unpriv-sgio.patch
    * add unpriv_sgio configuration option to set unpriv_sgio on multipath device
      and paths
  - Add 0224-RHBZ-1452210-prkey.patch
    * allow setting reservation_key to "file" to set and read keys from
      prkey_file. Also add new multipathd commands to modify the prkey file.
  - Resolves: bz #1459370, #1448970, #1448223, #1457288, #1452210


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-113
changelog:
  - Modify 0224-RHBZ-1452210-prkey.patch
    * fix errow with telling multipathd to set prkeys
  - Add 0225-RH-udevdir.patch
    * fix rpmdiff complaint about udev rules installation
  - Resolves: bz #1452210


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-114
changelog:
  - Add 0226-RH-allow-overrides-section.patch
    * This is a dummy section that exists to help the transition to RHEL8
  - Add 0227-RHBZ-1465773-fix-path-delay-msg.patch
  - Add 0228-RHBZ-1464634-hauwei-config-update.patch
  - Add 0229-RHBZ-1467987-poll-on-udev-monitor.patch
    * Do poll first, so udev_monitor_receive_device doesn't return error when
      there is no uevent
  - Add 0230-UP-allow-invalid-creates.patch
    * Allow creation of devices with no valid paths.
  - Add 0231-RHBZ-1458852-delay-readying.patch
    * Add ghost_delay configuration option to delay device activation when only
      ghost paths exist.
  - Add 0232-RHBZ-1456955-property-blacklist.patch
    * Add the "property" blacklist type.
  - Resolves: bz #1456955, #1458852, #1464634, #1465773, #1467987


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-115
changelog:
  - Add 0233-RHBZ-1451852-1482629-nimble-config.patch
  - Add 0234-RHBZ-1500109-doc-typo.patch
  - Remove old triggerun scriptlet (bz1470384)
  - Resolves: bz #1451852, #1470384, #1482629, #1500109


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-116
changelog:
  - Add 0235-RHBZ-1480638-NVMe-support.patch
    * adds support for multipathing NVMe devices
  - Resolves: bz #1480638


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-117
changelog:
  - Modify 0235-RHBZ-1480638-NVMe-support.patch
    * remove overly-restrictive uevent filtering
  - Resolves: bz #1480638


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-118
changelog:
  - Modify 0224-RHBZ-1452210-prkey.patch
    * Improve error checking for mpathpersist
  - Resolves: bz #1452210


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-119.1
changelog:
  - Add 0237-RHBZ-1607749-add-transport-blacklist.patch
    * and new blacklist option, "protocol"
  - Resolves: bz #1607749


author: Lukáš Nykrýn <lnykryn@redhat.com> - 033-513
changelog:
  - spec: add missing modules
  - add 90multipath-hostonly module
  Resolves: #1457311
  - Add NTFS support to 90dmsquash-live module
  Resolves: #1449410
  - dracut.sh: gather host_modalias when "--no-hostonly-default-device" is set
  - rootfs-block/module-setup.sh: check root_dev in cmdline_rootfs()
  - dracut.sh: introduce "--no-hostonly-default-device" argument
  Resolves: #1483838
  - 10i18n/parse-i18n.sh: parse rd.vconsole and rd.locale
  Resolves: #1479325
  - dracut.cmdline: remove extra ":" from ip= doc
  Resolves: #1469997
  - Try BOOT_IMAGE and fallback to vmlinuz-${KERNEL}
  - fips: honor $BOOT_IMAGE variable for HMAC check of the kernel
  Resolves: #1415032


author: Lukáš Nykrýn <lnykryn@redhat.com> - 033-520
changelog:
  - network/ifup: don't arping for point-to-point connections
  Resolves: #1477339
  - network: Only bring up wired network interfaces
  Resolves: #1480246
  - dracut.sh: source dracut-version.sh earlier than dracut-functions.sh
  Resolves: #1490777
  - Fix MTU on bond interface.
  - add 'mtu' parameter for bond options
  Resolves: #1494265
  - fcoe: Allow more time for the bnx2x link negotiation before brining up fcoe interfaces.
  Resolves: #1378910
  - lvm_scan.sh: use -K when calling lvchange
  Resolves: #1489841


author: Lukas Nykryn <lnykryn@redhat.com> - 033-534
changelog:
  - base/dracut-lib.sh:dev_unit_name() guard against $dev beginning with "-"
  - base/dracut-lib.sh: remove bashism
  - Align dev_unit_name() with systemd's function.
  - dracut-lib.sh:dev_unit_name(): use systemd-escape, if available
  Resolves: #1306640
  - 90dmsquash-live-ntfs: fix depends()
  - 90dmsquash-live: we don't have find_binary inside initramdisk
  - dracut: Ajusting variables name for --include
  Resolves: #1489882


author: Lukas Czerner <lczerner@redhat.com> - 1.42.9-4
changelog:
  - Fix posisble use after free in some error paths (#997982)
  - Enable lazy_itable_init even if ext4 module is not loaded (#1071909)
  - Remove any ocurence of ext4dev and test_fs from e2fsprogs (#1063801)
  - Allow to resize ext4 file system past 16TB (#982871)
  - Disable altivec instructions for libext2fs on ppc (#1074604)


author: Eric Sandeen <sandeen@redhat.com> 1.42.9-5
changelog:
  - Various manpage updates for chattr and mount (#1053885)
  - Fix resize2fs -P hang on corrupted filesystems (#1104612)


author: Eric Sandeen <sandeen@redhat.com> 1.42.9-8
changelog:
  - e4defrag: backwards-allocated files should be defragmented (#1176785)
  - tune2fs: allow removal of dirty journal with two "-f" options (#1212376)
  - mke2fs: prevent creation of filesystem with unsupported revision (#1212378)
  - libext2fs: prevent buffer overflows (#1293677)


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-10
changelog:
  - libext2fs: don't ignore fsync errors (#1405049)
  - Fix nroff macro issue in chattr man page (#1429213)


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-11
changelog:
  - libext2fs: skip start_blk adjustment when stride and flex_bg is set (#1503969)
  - tune2fs: edit dire warning about check intervals (#1433233)


author: Petr Stodulka <pstodulk@redhat.com> -1.8.3.1-9
changelog:
  - add control of GSSAPI credential delegation to enable HTTP(S)-SSO
    authentication
    Resolves: #1369173


author: Petr Stodulka <pstodulk@redhat.com> - 1.8.3.1-13
changelog:
  - fall back to Basic auth if Negotiate fails
    Resolves: #1490998
  - handle request-pull when multiple tags point to the same commit
    Resolves: #1192146


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-14
changelog:
  - Backport fix for CVE-2018-1123
  - Thanks to Jonathan Nieder <jrnieder@gmail.com> for backporting to 2.1.x
    and to Steve Beattie <sbeattie@ubuntu.com> for backporting to 1.9.1


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.0.11-83
changelog:
  - fence_compute/fence_evacuate: add support for keystone v3 authentication
    Resolves: rhbz#1533170
  - fence_ilo3: default to onoff
    Resolves: rhbz#1519370


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.0.11-86
changelog:
  - fence-agents-all: remove fence-agents-aws and fence-agents-azure-arm
    dependencies
    Resolves: rhbz#1476009


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.0.11-86.1
changelog:
  - fence_azure_arm: add network-fencing
    Resolves: rhbz#1565670
  - fence_compute/fence_evacuate: fix parameters
    Resolves: rhbz#1565701


author: David King <dking@redhat.com> - 0.8.4-2
changelog:
  - Sync bzip2 dependency with Fedora package
  - Make the libs subpackage depend on the base package for libostree
  - Fix multilib issues with XML-based documentation


author: Colin Walters <walters@verbum.org> - 0.8.7-3
changelog:
  - Fix libostree bundling:
    Ensure we do not Provide or Require libostree.
    Move the shared library into flatpak-libs so flatpak always
    depends on it.
    Keep the shared library filename as libostree, but put it
    under a private directory.  Renaming the file on disk did not
    really do much since the dynamic linker and RPM work from the
    soname.
    Resolves: #1476905


author: Ray Strode <rstrode@redhat.com> - 0.8.8-2
changelog:
  - Fix crasher in xdg-desktop-portal
    Resolves: #1503579
  - Tweak spec file so it still builds even though we need to
    autoreconf.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.12-2
changelog:
  - Do not fail logrotate if radiusd is not running.
    Resolves: Bug#1365226 error running non-shared postrotate script for
                          /var/log/radius/radius.log of
                          '/var/log/radius/radius.log '
  - Fix output to log file specified with -l option.
    Resolves: Bug#1421207 radiusd does not work with log file specified by -l
                          option
  - Fix long hostnames interpreted as IP addresses.
    Resolves: Bug#1420359 radclient does not detect 4. level and higher domain
                          name as a domain name
  - Avoid clashes with libtool library symbols.
    Resolves: Bug#1391960 undefined symbol: get_vtable in
                          /usr/lib64/libtdsodbc.so.0 with freeradius-unixODBC
  - Remove mentions of Auth-Type = System from docs.
    Resolves: Bug#1420293 Freeradius does not know Auth-Type = System
  - Improve ip/v4/v6/addr documentation.
    Resolves: Bug#1179736 add description for ipaddr = hostname from DNS with A
                          and AAAA entries


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-1
changelog:
  - Upgrade to upstream v3.0.13 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release
    Resolves: Bug#1329181 freeradius-python fix libpython2.7.so dependency at
                          compile time
    Resolves: Bug#1425869 Radiusd does not trigger modules.sql.fail trap if it
                          can't connect to mysql server
    Resolves: Bug#1427829 Stack overflow when passing bare IPv6 to radclient


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-2
changelog:
  - Fix some issues found with static analyzers.
    Resolves: Bug#1432103 FreeRADIUS fails covscan checks
  - Revert rlm_eap_tnc removal, because the tncfhh package is still in RHEL.
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-3
changelog:
  - Explicitly disable rlm_cache_memcached to avoid error when the module's
    dependencies are installed, and it is built, but not packaged.
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release
  - Prevent segfaults by adding a missing handling of connection errors in
    rlm_ldap.
    Resolves: Bug#1437409 [abrt] freeradius: radiusd killed by SIGSEGV
  - Make radtest use Cleartext-Password for EAP, fixing its support for eap-md5.
    Resolves: Bug#1436619 radtest does not work with eap-md5


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-4
changelog:
  - Disable internal OpenSSL cache.
    Resolves: Bug#1458746 CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass
  - Check sizeof(*packet), not sizeof(packet) in EAP-PWD
    Resolves: Bug#1459073 Potential buffer overflow in FreeRADIUS EAP-PWD
  - Parse port as well as address for dhcpclient destination
    Resolves: Bug#1457825 dhcpclient does no accept IP:PORT


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-5
changelog:
  - Refer to correct package version in configuration comments for Bug#1458746
    (CVE-2017-9148) fix.
    Related: Bug#1458746  CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-6
changelog:
  - Avoid race condition when creating session cache file
    Resolves: Bug#1458746 CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-7
changelog:
  - Resolves: Bug#1469408 CVE-2017-10978 freeradius: Out-of-bounds read/write due
                          to improper output buffer size check in make_secret()
  - Resolves: Bug#1469412 CVE-2017-10983 freeradius: Out-of-bounds read in
                          fr_dhcp_decode() when decoding option 63
  - Resolves: Bug#1469415 CVE-2017-10984 freeradius: Out-of-bounds write in
                          data2vp_wimax()
  - Resolves: Bug#1469416 CVE-2017-10985 freeradius: Infinite loop and memory
                          exhaustion with 'concat' attributes
  - Resolves: Bug#1469419 CVE-2017-10986 freeradius: Infinite read in
                          dhcp_attr2vp()
  - Resolves: Bug#1469422 CVE-2017-10987 freeradius: Buffer over-read in
                          fr_dhcp_decode_suboptions()


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-8
changelog:
  - Avoid misinterpreting zero-size malloc in data2vp_extended() fix.
  - Related: Bug#1469415 CVE-2017-10984 freeradius: Out-of-bounds write in
                         data2vp_wimax()


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-9
changelog:
  - Fix double free in rlm_sql acct_redundant
    Resolves: Bug#1551069 Radius service crashes with "Bad talloc magic value -
                          unknown value" when using module sql rlm_sql


author: Tomáš Mráz <tmraz@redhat.com> - 2.0.22-4
changelog:
  - allow import of RSA-E and RSA-S keys (patch by Marcel Kolaja) (#1233182)
  - do not abort when missing hash algorithm in FIPS mode (#1078962)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-73
changelog:
  - Resolves: #1499253 - ProxyRemote with HTTPS backend sends requests
    with absoluteURI instead of abs_path


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-74
changelog:
  - Resolves: #1430640 - "ProxyAddHeaders Off" does not become effective
    when it's defined outside <Proxy> setting


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-75
changelog:
  - Resolves: #1448892 - Cannot override LD_LIBARY_PATH in Apache HTTPD
    using SetEnv or PassEnv. Needs documentation.


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-80.1
changelog:
  - Resolves: #1560609 - httpd: active connections being terminated when httpd
    gets gracefully stopped/restarted, GracefulShutdownTimeout is not being
    honored


author: CentOS Sources <bugs@centos.org> - 2.4.6-80.el7.centos.1
changelog:
  - Remove index.html, add centos-noindex.tar.gz
  - change vstring
  - change symlink for poweredby.png
  - update welcome.conf with proper aliases


author: Jarod Wilson <jarod@redhat.com> 13-6
changelog:
  - Clean up htonll/ntohll handling for opa-ff/infiniband-diags compile
  - Add necessary Provides/Obsoletes for old -static packages
  - Remove ibverbs providers that we aren't currently able to support
  - Resolves: rhbz#1453096, rhbz#1451607


author: Jarod Wilson <jarod@redhat.com> 15-2
changelog:
  - Fix ibacm segfault and improper multicast handling
  - Resolves: rhbz#1502745
  - Resolves: rhbz#1502759


author: Honggang Li <honli@redhat.com> 15-3
changelog:
  - srp_daemon: Don't create async_ev_thread if only run once
  - srp_daemon: Remove unsupported systemd configurations
  - srp_daemon: Start srp_daemon service after network target
  - Resolves: bz1525193
  - Resolves: bz1528671


author: Jarod Wilson <jarod@redhat.com> 15-4
changelog:
  - Add support for extended join multicast API in librdmacm
  - Add support for striding RQ on mlx5
  - Resolves: rhbz#1515487, rhbz#1516571


author: Jarod Wilson <jarod@redhat.com> 15-5
changelog:
  - libmlx4: report RSS caps for improved DPDK support
  - Fix double mutex unlock in iwpmd
  - Resolves: rhbz#1527350
  - Resolves: rhbz#1542362


author: Jarod Wilson <jarod@redhat.com> 15-7
changelog:
  - i40iw: revoke systemd udev rules auto-load on i40e hardware, due to
    causing problems with suspend and resume, and fall back to load via
    systemd rdma initscript.
  - Resolves: rhbz#1568325


author: Rob Crittenden <rcritten@redhat.com> - 4.5.4-3.el7
changelog:
  - Drop workaround for building on AArch64 (#1482244)
  - Temporarily reduce Requires on python-netaddr to 0.7.5-7 (#1506485)


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.4-4.el7
changelog:
  - Resolves: #1388135 [RFE] limit the retro changelog to dns subtree.
    - ldap: limit the retro changelog to dns subtree
  - Resolves: #1427798 Use X509v3 Basic Constraints "CA:TRUE" instead
    of "CA:FALSE" IPA CA CSR
    - Include the CA basic constraint in CSRs when renewing a CA
  - Resolves: #1493145 ipa-replica-install might fail because of an already
    existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
    - Checks if replica-s4u2proxy.ldif should be applied
  - Resolves: #1493150 [RFE] set nsslapd-ignore-time-skew: on by default
    - ds: ignore time skew during initial replication step
    - ipa-replica-manage: implicitly ignore initial time skew in force-sync 
  - Resolves: #1500218 Replica installation at domain-level 0 fails against
    upgraded ipa-server
    - Fix ipa-replica-conncheck when called with --principal
  - Resolves: #1506188 server-del doesn't remove dns-server configuration
    from ldap


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.5.4-5.el7
changelog:
  - Resolves: #1415162 ipa-exdom-extop plugin can exhaust DS worker threads
  - Resolves: #1378892 host-find slowness caused by missing host attributes in index


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-7.el7
changelog:
  - Resolves: #1421869 Unable to re-add broken AD trust - Unexpected Information received
    - adtrust: filter out subdomains when defining our topology to AD
  - Resolves: #1486286 IPA failing to authenticate via password+OTP on RHEL7.4 with fips enabled
    - Don't allow OTP or RADIUS in FIPS mode
  - Resolves: #1494226 IPA User Details not being displayed in WebUI
    - Fix cert-find for CA-less installations
  - Resolves: #1498387 389-ds-base crashed as part of ipa-server-intall in ipa-uuid
    - 389-ds-base crashed as part of ipa-server-intall in ipa-uuid
  - Resolves: #1503022 ipa-getkeytab man page should have more details about consequences of krb5 key renewal
    - ipa-getkeytab man page: add more details about the -r option
  - Resolves: #1509288 IPA trust-add internal error (expected security.dom_sid got None)
    - ipaserver/plugins/trust.py; fix some indenting issues
    - trust: detect and error out when non-AD trust with IPA domain name exists
    - ipaserver/plugins/trust.py: pep8 compliance
  - Resolves: #1511019 ipa-restore broken with python2
    - Fix ipa-restore (python2)
  - Resolves: #1511607 ipa-backup does not backup Custodia keys and files
    - Backup ipa-custodia conf and keys
  - Resolves: #1512482 kra install fails after ipa cert renewed
    - Don't use admin cert during KRA installation
    - Prevent set_directive from clobbering other keys
    - pep8: reduce line lengths in CAInstance.__enable_crl_publish
    - installutils: refactor set_directive
    - Add tests for installutils.set_directive
    - Add safe DirectiveSetter context manager
    - Old pylint doesn't support bad python3 option
  - Resolves: #1514163 CA less IPA install with external certificates fails on RHEL 7 in FIPS mode
    - Fix ca less IPA install on fips mode


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-8.el7
changelog:
  - Resolves: #1477531 Incorrect attribute level rights (ipaallowedtoperform) of service object
    - WebUI: make keytab tables on service and host pages writable
  - Resolves: #1529444 ObjectclassViolation seen while adding idview with domain-resolution-order option
    - Idviews: fix objectclass violation on idview-add
  - Resolves: #1451576 ipa cert-request failed to generate certificate from csr
    - Fixing the cert-request comparing whole email address case-sensitively.


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-9.el7
changelog:
  - Resolves: #1458169 --force-join option is not mentioned in ipa-replica-install man page
    - Add --force-join into ipa-replica-install manpage
  - Resolves: #1457876 ipa-backup fails silently
    - Changed ownership of ldiffile to DS_USER
  - Resolves: #1409786 Second phase of --external-ca ipa-server-install setup fails when dirsrv is not running
    - Checks if Dir Server is installed and running before IPA installation
  - Resolves: #1452086 Pagination Size under Customization in IPA WebUI accepts negative values
    - WebUI: Add positive number validator
    - WebUI: change validator of page size settings
    - WebUI: fix jslint error


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-11.el7
changelog:
  - Resolves: #1565519 Clarify the need to restart services in ipa-server-certinstall(1)
    - Add a notice to restart ipa services after certs are installed
  - Resolves: #1564390 OTP and Radius Authentication does not work in FIPS mode
    - Fix OTP validation in FIPS mode
    - Increase the default token key size
    - Revert "Don't allow OTP or RADIUS in FIPS mode"
    - Log errors from NSS during FIPS OTP key import
  - Resolves: #1565520 ipa client pointing to replica shows KDC has no support for encryption type
    - ipa-replica-install: make sure that certmonger picks the right master
  - Resolves: #1565605 DNS records updated with all IPAddresses of an interface when IPA server/replica try to install with Specific IP address of that interface
    - replica-install: pass --ip-address to client install


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-10.el7.2
changelog:
  - Resolves: #1579189 nsds5ReplicaReleaseTimeout should be set by default
    - Add nsds5ReplicaReleaseTimeout to replica config
    - Fix upgrade (update_replica_config) in single master mode
  - Resolves: #1579190 Improve Custodia client and key distribution handling
    - Use single Custodia instance in installers
  - Resolves: #1579203 4.5.0 -> 4.5.4 upgrade breaks in ipa-server-upgrade: No such file or directory: '/var/lib/pki/pki-tomcat/conf/ca/CS.cfg'
    - Don't try to backup CS.cfg during upgrade if CA is not configured


author: Rob Crittenden <rcritten@redhat.com> - 4.5.4-10.el7.3
changelog:
  - Resolves: #1579190 Improve Custodia client and key distribution handling
    - Use single Custodia instance in installers


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-10.el7.4
changelog:
  - Resolves: #1615983 ipa-restore fails on newly installed system.
    - Fix ipa-restore: create /var/run/ipa files
  - Resolves: #1615966 ipa-replica-manage re-initialize TypeError: 'NoneType' object does not support item assignment
    - Check if replication agreement exist before enable/disable it
  - Resolves: #1615984 ldapmodify userPassword reflects on krblastpwdchange on RHEL6 but not RHEL7
    - Tests: add integration test for password changes by dir mgr
    - In IPA 4.4 when updating userpassword with ldapmodify does not update krbPasswordExpiration nor krbLastPwdChange
  - Resolves: #1615893 nsds5ReplicaReleaseTimeout should be set by default.
    - Tune DS replication settings
  - Resolves: #1615964 Authn/TOTP defined users periodically prompt for just password credentials to access resources
    - Fix elements not being removed in otpd_queue_pop_msgid()


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-10.el7.4.2
changelog:
  - Resolves: #1623673 SRV lookup doesn't correctly sort results
    - Sort and shuffle SRV record by priority and weight
  - Resolves: #1623679 Installation of replica against a specific master
    - Always set ca_host when installing replica
    - Query for server role IPA master
    - Only create DNS SRV records for ready server
    - Delay enabling services until end of installer
    - replicainstall: DS SSL replica install pick right certmonger host
    - Fix race condition in get_locations_records()
    - Fix DNSSEC install regression
    - Handle races in replica config
    - Fix KRA replica installation from CA master
    - Do not set ca_host when --setup-ca is used
  - Resolves: #1623676 Replication races in DogtagInstance.setup_admin
    - Improve and fix timeout bug in wait_for_entry()
    - Use common replication wait timeout of 5min
    - Fix replication races in Dogtag admin code
    - Catch ACIError instead of invalid credentials
  - Resolves: #1623680 Increase WSGI worker process count
    - Increase WSGI process count to 5 on 64bit
    - Use 4 WSGI workers on 64bit systems
  - Resolves: #1623669 ipa-replica-install defines nsds5replicabinddngroup before the group contains the DN of the replication manager
    - DS replication settings: fix regression with <3.3 master
  - Resolves: #1623668 Replica install: certmonger sometimes fails
    - Auto-retry failed certmonger requests
    - Wait for client certificates


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-10.el7.4.3
changelog:
  - Resolves: #1624811 ipa-otpd: fix potential double-free and infinite loop in queue code
    - Clear next field when returnining list elements in queue.c
    - Add cmocka unit tests for ipa otpd queue code


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-10.el7_5.4.4
changelog:
  - Resolves: #1626379 PKINIT configuration did not succeed message is received during Replica-install
    - ipa-replica-install: fix pkinit setup


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-16
changelog:
  - Fix important coverity findings: missing include for flock and use bash for
    init script (RHBZ#1264399)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-17
changelog:
  - Fixed init script not to fail on missing restorecon (RHBZ#1246380)
  - Adapted man page snipplet for TRACE to use proper logging backend names
    (RHBZ#1261238)
  - Warn about use of DROP in nat table (RHBZ#1298879)
  - Fixed modules unload in init script (RHBZ#1324102)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-18
changelog:
  - Add support for --wait options to restore commands (RHBZ#1438597)
  - Do not set changed flag for rule check operations with module targets
    (RHBZ#1438597)
  - Add version option to restore commands (RHBZ#1438597)


author: Phil Sutter - 1.4.21-20
changelog:
  - Prevent iptables.service and ip6tables.service from running in parallel
    (RHBZ#1486803)
  - Don't restart services upon upgrade (RHBZ#1380141)


author: Phil Sutter - 1.4.21-24.1
changelog:
  - Fix for stopping iptables and ip6tables at the same time (RHBZ#1563168)
  - Propagate errors on service stop (RHBZ#1563168)
  - Avoid overwriting parent's return code (RHBZ#1563168)


author: Rafael Aquini <aquini@redhat.com> - 20170530-54.gitdf40d15
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - opa: HFI firmware problems with new OPA switch firmware (rhbz 1452253)


author: Rafael Aquini <aquini@redhat.com> - 20171011-57.gitbf04291
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - ath10k: Update to the latest firmware released version (rhbz 1457363)
  - opa: update Intel Omni-Path Architecture firmware (rhbz 1452785)
  - chelsio: Pull in the latest firmware 1.16.63.0 (rhbz 1458328)
  - qla2xxx: Update firmware version to 8.07.00 (rhbz 1427148)


author: Rafael Aquini <aquini@redhat.com> - 20171127-58.git17e6288
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - iwlwifi: Firmware update for 3160, 3168, 7260, 7265 and 7265D WIFI devices (rhbz 1508709)
  - iwlwifi: Firmware update for 8260 and 8265 WIFI devices (rhbz 1508711)
  - iwlwifi: Firmware update for 9260 and 9560 WIFI devices (rhbz 1501166)
  - Fixes CVE-2016-0801 CVE-2017-0561 CVE-2017-9417


author: Rafael Aquini <aquini@redhat.com> - 20180113-60.git65b1c68
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - netr: Add Netronome TC flower firmware (rhbz 1518900)
  - Revert amd-ucode for fam17h (rhbz 1533945)


author: Rafael Aquini <aquini@redhat.com> - 20180220-62.git6d51311
changelog:
  - nfp: NIC stops transmitting for small MSS values when TSO is enabled (rhbz 1542263)
  - chelsio: pull in latests firmware 1.17.14.0 (rhbz 1538590)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.0
changelog:
  - Bump to 2.6.14 and u181b00.
  - Drop 8197981 Zero 32-bit patch now applied upstream.
  - Update RC4 patch (8076221/PR2809) to apply after 8175075 (disable 3DES)
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.1
changelog:
  - Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add missing ones
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.3
changelog:
  - Bump release number to an unused one as rhel-7.5-z-java-unsafe-candidate wrongly using .el7
  - Resolves: rhbz#1559766


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.181-2.6.14.5
changelog:
  - added depndence on latest c-j-c who do not have the incorrect jre-abrt handling
  - Resolves: rhbz#1559766


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.181-2.6.14.10
changelog:
  - jsa files changed to 444 to pass rpm verification
  - Add reg-ex for filtering private libraries' provides/requires.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.10
changelog:
  - Cleanup RH1566890 patch and differentiate from java-1.8.0-openjdk version.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.191-2.6.15.0
changelog:
  - Bump to 2.6.15 and u191b00.
  - Drop PR3608/RH1566890/CVE-2018-3639 patch now applied upstream.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.162-0.b12
changelog:
  - Update to aarch64-jdk8u162-b12 and aarch64-shenandoah-jdk8u162-b12.
  - Remove upstreamed patches for 8181055/PR3394/RH1448880,
  -  8181419/PR3413/RH1463144, 8145913/PR3466/RH1498309,
  -  8168318/PR3466/RH1498320, 8170328/PR3466/RR1498321 and
  -  8181810/PR3466/RH1498319.
  - Resolves: rhbz#1559766


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.171-1.b10
changelog:
  - Backported from fedora: aarch64BuildFailure.patch, rhbz_1536622-JDK8197429-jdk8.patch, rhbz_1540242.patch
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-1.b10
changelog:
  - Cleanup from previous commit.
  - Remove unused upstream patch 8167200.hotspotAarch64.patch.
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-3.b10
changelog:
  - Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add misisng ones
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-3.b10
changelog:
  - Fix jconsole.desktop.in subcategory, replacing "Monitor" with "Profiling" (PR3550)
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-7.b10
changelog:
  - Bump release number to be greater than RHEL 7.6 package to allow build with .el7 suffix
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-4.b11
changelog:
  - Read jssecacerts file prior to trying either cacerts file (system or local) (PR3575)
  - Resolves: rhbz#1593737


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-0.b03
changelog:
  - Update to aarch64-jdk8u181-b03 and aarch64-shenandoah-jdk8u181-b03.
  - Remove AArch64 patch for PR3458/RH1540242 as applied upstream.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-1.b04
changelog:
  - Mark bugs that have been pushed to 8u upstream and are scheduled for a release.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-2.b04
changelog:
  - Add "8206406, PR3610, RH1597825: StubCodeDesc constructor publishes partially-constructed objects on StubCodeDesc::_list"
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-7.b13
changelog:
  - Update to aarch64-jdk8u181-b13 and aarch64-shenandoah-jdk8u181-b13.
  - Remove 8187577/PR3578 now applied upstream.
  - Resolves: rhbz#1594249


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-4
changelog:
  - Bugzilla Bug #1394414 - Rebase jss to 4.4.0 in RHEL 7.4
  - Updated build requirements for NSPR
  - Updated build and runtime requirements for NSS
  - ## 'jss-post-rebase.patch' resolves the following issues ported from
    - Mozilla Bugzilla #1337092 - CMC conformance update: Implement required ASN.1
    code for RFC5272+ (cfu)
  - Mozilla Bugzilla #1347394 - Eclipse project files for JSS (edewata)
  - Mozilla Bugzilla #1347429 - Deprecated SSL 3.0 cipher names in SSLSocket
    class. (edewata)
  - Mozilla Bugzilla #1348856 - SSL alert callback (edewata)
  - Mozilla Bugzilla #1349278 - SSL cipher enumeration (edewata)
  - Mozilla Bugzilla #1349349 - Problem with Password.readPasswordFromConsole().
    (edewata)
  - Mozilla Bugzilla #1349831 - Revise top-level README file (mharmsen)
  - Mozilla Bugzilla #1349836 - Changes to JSS Version Block (mharmsen)
  - Mozilla Bugzilla #1350130 - Missing
    CryptoManager.verifyCertificateNowCUNative() implementation. (emaldona)


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-5
changelog:
  - Mozilla Bugzilla #1355268 - JSS 4.4 is incompatible with versions of
    idm-console-framework < 1.1.17-4
  - Red Hat Bugzilla #1435076 - Remove unused legacy lines from JSS spec files


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-6
changelog:
  - Mozilla Bugzilla #1352476 - RFE: Document on the README how to create a
    release tag (mharmsen)
  - Mozilla Bugzilla #1355358 - CryptoStore: add methods for importing and
    exporting EncryptedPrivateKeyInfo (ftweedal)
  - Mozilla Bugzilla #1359731 - CryptoStore.importPrivateKey enhancements
    (ftweedal)


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-7
changelog:
  - Bump NSS dependencies from 4.28.3 to 4.28.4-6 to pick-up fix in
    Mozilla Bugzilla #1360207 - Fix incorrect if (ss->...) in SSL_ReconfigFD


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-8
changelog:
  - Bugzilla #1488846 - Fix HmacTest code for AES encrypt/unwrap [rhel-7.4.z]
    (jmagne)
  - Bugzilla #1490494 - PKCS12: (JSS) upgrade to at least AES and SHA2 (FIPS)
    [RHEL-7.4.z] (ftweedal)
  - Bugzilla #1490740 - PK11Store.getEncryptedPrivateKeyInfo() segfault if
    export fails [rhel-7.4.z] (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-9
changelog:
  - Bugzilla #1505690 - new JSS failures: HMAC Unwrap and KeyWrapping
    FIPSMODE [rhel-7.4.z] (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-10
changelog:
  - Bugzilla #1506710 - JSS throws ObjectNotFoundException without message
    (edewata)
  - Bugzilla #1506826 - org.mozilla.jss.pkix.cms.SignerInfo incorrectly
    producing signatures (especially for EC) (cfu,dstutzman)


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-11
changelog:
  - Bugzilla #1506826 - org.mozilla.jss.pkix.cms.SignerInfo incorrectly
    producing signatures (especially for EC) (cfu,dstutzman)
  - Bugzilla #1533667 - Add: standard algorithm names for all ECC signature
    types (cfu,dstutzman)
  - Bugzilla #1534761 - SignerInfo class inserts wrong version # into the
    resulting structure (cfu,dstutzman)


author: Dogtag Team <pki-devel@redhat.com> 4.4.2-12
changelog:
  - Bugzilla #1579202 - JSS has wrong encoding for ecdsa with sha*
    AlgorithmIdentifier [rhel-7.5.z] (cfu)


author: Dogtag Team <pki-devel@redhat.com> 4.4.2-13
changelog:
  - Bugzilla #1595759 - org.mozilla.jss.pkix.primitive.AlgorithmIdentifier
    decode/encode process alters original data [rhel-7.5.z] (cfu)
  - Bugzilla #1596552 - JSS: Add support for TLS_*_SHA384 ciphers
    [rhel-7.5.z] (cfu)


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.2.1.el7a]
changelog:
  - [pci] PCI: Remove redundant probes for device reset support (Robert Richter) [1564026 1553226]
  - [pci] PCI: Probe for device reset support during enumeration (Robert Richter) [1564026 1553226]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.3.1.el7a]
changelog:
  - [misc] cxl: Fix possible deadlock when processing page faults from cxllib (Gustavo Duarte) [1564420 1562957]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.4.1.el7a]
changelog:
  - [powerpc] watchdog: remove arch_trigger_cpumask_backtrace (Gustavo Duarte) [1566995 1562287]
  - [powerpc] 64s: return more carefully from sreset NMI (Gustavo Duarte) [1566995 1562287]
  - [perf] hwbp: Simplify the perf-hwbp code, fix documentation (Eugene Syromiatnikov) [1569877 1569875] {CVE-2018-1000199}


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.5.1.el7a]
changelog:
  - [powerpc] powerpc/powernv/npu: Do a PID GPU TLB flush when invalidating a large address range (Mauricio Oliveira) [1576515 1571167]
  - [powerpc] powernv/npu: Prevent overwriting of pnv_npu2_init_contex() callback parameters (Mauricio Oliveira) [1577757 1568164]
  - [powerpc] powernv/npu: Add lock to prevent race in concurrent context init/destroy (Mauricio Oliveira) [1577757 1568164]
  - [powerpc] powernv/memtrace: Let the arch hotunplug code flush cache (Mauricio Oliveira) [1575528 1571156]
  - [powerpc] mm: Flush cache on memory hot(un)plug (Mauricio Oliveira) [1575528 1571156]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.6.1.el7a]
changelog:
  - [fs] dcache: fix quadratic behavior with parallel shrinkers (Miklos Szeredi) [1577768 1565210]
  - [powerpc] revert "powernv: Increase memory block size to 1GB on radix" (Mauricio Oliveira) [1577766 1574524]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.7.1.el7a]
changelog:
  - [scsi] csiostor: add support for 32 bit port capabilities (Arjun Vynipadath) [1580276 1547715]
  - [md] dm btree: fix serious bug in btree_split_beneath() (Mike Snitzer) [1576514 1559487]
  - [arm64] Kill PSCI_GET_VERSION as a variant-2 workaround (Mark Langsdorf) [1574842 1543628] {CVE-2017-5715}
  - [arm64] Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support (Mark Langsdorf) [1574842 1543628] {CVE-2017-5715}
  - [firmware] firmware/psci: Expose SMCCC version through psci_ops (Mark Langsdorf) [1574842 1543628] {CVE-2017-5715}
  - [firmware] firmware/psci: Expose PSCI conduit (Mark Langsdorf) [1574842 1543628] {CVE-2017-5715}
  - [arm64] KVM: Add SMCCC_ARCH_WORKAROUND_1 fast handling (Mark Langsdorf) [1574842 1543628] {CVE-2017-5715}
  - [arm64] KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support (Mark Langsdorf) [1574842 1543628] {CVE-2017-5715}
  - [arm64] arm/arm64: KVM: Consolidate the PSCI include files (Mark Langsdorf) [1574842 1543628] {CVE-2017-5715}
  - [arm64] KVM: Increment PC after handling an SMC trap (Mark Langsdorf) [1574842 1543628] {CVE-2017-5715}
  - [arm64] entry: Apply BP hardening for suspicious interrupts from EL0 (Mark Langsdorf) [1574842 1543628] {CVE-2017-5715}
  - [fs] ovl: update ctx->pos on impure dir iteration (Thomas Huth) [1570546 1561534]
  - [scsi] megaraid_sas: driver version 07.702.06.00-rh2 (Tomas Henzl) [1569396 1553228]
  - [scsi] megaraid_sas: Do not use 32-bit atomic request descriptor for Ventura controllers (Tomas Henzl) [1569396 1553228]
  - [scsi] mpt3sas: Bump mpt3sas driver version to v15.100.01.00 (Tomas Henzl) [1569396 1553228]
  - [scsi] mpt3sas: Do not use 32-bit atomic request descriptor for Ventura controllers (Tomas Henzl) [1569396 1553228]
  - [powerpc] pseries: Restore default security feature flags on setup (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] Move default security feature flags (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] pseries: Fix clearing of security feature flags (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] 64s: Wire up cpu_show_spectre_v2() (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] 64s: Wire up cpu_show_spectre_v1() (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] pseries: Use the security flags in pseries_setup_rfi_flush() (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] powernv: Use the security flags in pnv_setup_rfi_flush() (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] 64s: Enhance the information in cpu_show_meltdown() (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] 64s: Move cpu_show_meltdown() (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] powernv: Set or clear security feature flags (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] pseries: Set or clear security feature flags (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] Add security feature flags for Spectre/Meltdown (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] pseries: Add new H_GET_CPU_CHARACTERISTICS flags (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] rfi-flush: Call setup_rfi_flush() after LPM migration (Mauricio Oliveira) [1567002 1561783]
  - [powerpc] rfi-flush: Differentiate enabled and patched flush types (Mauricio Oliveira) [1567002 1561783]
  - [powerpc] rfi-flush: Always enable fallback flush on pseries (Mauricio Oliveira) [1567002 1561783]
  - [powerpc] rfi-flush: Make it possible to call setup_rfi_flush() again (Mauricio Oliveira) [1567002 1561783]
  - [powerpc] rfi-flush: Move the logic to avoid a redo into the debugfs code (Mauricio Oliveira) [1567002 1561783]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.8.1.el7a]
changelog:
  - [powerpc] powerpc/64s: Add support for a store forwarding barrier at kernel entry/exit (Mauricio Oliveira) [1566912 1566913] {CVE-2018-3639}


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.9.1.el7a]
changelog:
  - [powerpc] mm/radix: Change pte relax sequence to handle nest MMU hang (Desnes Augusto Nunes do Rosario) [1592769 1582537]
  - [powerpc] mm: Change function prototype (Desnes Augusto Nunes do Rosario) [1592769 1582537]
  - [powerpc] mm/radix: Move function from radix.h to pgtable-radix.c (Desnes Augusto Nunes do Rosario) [1592769 1582537]
  - [powerpc] mm/hugetlb: Update huge_ptep_set_access_flags to call __ptep_set_access_flags directly (Desnes Augusto Nunes do Rosario) [1592769 1582537]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.10.1.el7a]
changelog:
  - [powerpc] rtc: opal: Fix OPAL RTC driver OPAL_BUSY loops (Steve Best) [1596614 1593301]
  - [powerpc] rtc-opal: Fix handling of firmware error codes, prevent busy loops (Steve Best) [1596614 1593301]
  - [powerpc] powernv: define a standard delay for OPAL_BUSY type retry loops (Steve Best) [1596614 1593301]
  - [powerpc] stf-barrier: update (static) rfi_flush_enable as in upstream (Gustavo Duarte) [1596287 1585298]
  - [powerpc] stf-barrier: update (rfi_)enabled_flush_types as in upstream (Gustavo Duarte) [1596287 1585298]
  - [powerpc] stf-barrier: update debugfs as in upstream (Gustavo Duarte) [1596287 1585298]
  - [powerpc] stf-barrier: update handle_ssbd() as in upstream (Gustavo Duarte) [1596287 1585298]
  - [powerpc] stf-barrier: update stf_barrier_enable() as in upstream (Gustavo Duarte) [1596287 1585298]
  - [powerpc] stf-barrier: add cpu_show_spec_store_bypass() as in upstream (Gustavo Duarte) [1596287 1585298]
  - [powerpc] stf-barrier: add comment as in upstream (Gustavo Duarte) [1596287 1585298]
  - [powerpc] stf-barrier: move code from setup_64.c to security.c as in upstream (Gustavo Duarte) [1596287 1585298]
  - [powerpc] stf-barrier: move code from setup.h to security_features.h as in upstream (Gustavo Duarte) [1596287 1585298]
  - [powerpc] stf-barrier: update entry barrier slot as in upstream (Gustavo Duarte) [1596287 1585298]
  - [netdrv] ixgbevf: Free IRQ when PCI error recovery removes the device (Ken Cox) [1595738 1586016]
  - [cpufreq] powernv: Fix hardlockup due to synchronous smp_call in timer interrupt (Gustavo Duarte) [1593278 1574857]
  - [powerpc] mce: Fix a bug where mce loops on memory UE (Desnes Augusto Nunes do Rosario) [1583071 1571178]
  - [scsi] cxlflash: Handle spurious interrupts (Steve Best) [1579687 1520410]
  - [scsi] cxlflash: Remove commmands from pending list on timeout (Steve Best) [1579687 1520410]
  - [scsi] cxlflash: Synchronize reset and remove ops (Steve Best) [1579687 1520410]
  - [scsi] cxlflash: Reset command ioasc (Steve Best) [1579687 1520410]
  - [i2c] ipmi_ssif: Fix kernel panic at msg_done_handler (Robert Richter) [1563569 1555339]
  - [i2c] xlp9xx: Handle NACK on DATA properly (Robert Richter) [1563569 1555339]
  - [i2c] xlp9xx: Check for Bus state before every transfer (Robert Richter) [1563569 1555339]
  - [i2c] revert "xlp9xx: Check for Bus state after every transfer" (Robert Richter) [1563569 1555339]


author: Johnny Hughes <johnny@centos.org> [4.14.0-49.10.1.el7a]
changelog:
  - Rolled in CentOS certificates and signed modules with a CentOS certificate.
  - Turned off CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND and turned on CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE
  - added git as buildrequirement to do patches (if/when required)


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.11.1.el7a]
changelog:
  - [powerpc] powernv: Fix concurrency issue with npu->mmio_atsd_usage (Desnes Augusto Nunes do Rosario) [1614292 1611676]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.12.1.el7a]
changelog:
  - [arm64] aarch64: support meltdown/spectre status in sysfs (Mark Salter) [1609160 1555408]
  - [kernel] x86/bugs: Expose /sys/../spec_store_bypass (Gustavo Duarte) [1602340 1597392]
  - [scsi] aacraid: Correct hba_send to include iu_type (Raghava Aditya Renukunta) [1597190 1525240]
  - [mm] oom_reaper: gather each vma to prevent leaking TLB entry (Chris von Recklinghausen) [1554356 1554355] {CVE-2017-18202}


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.13.1.el7a]
changelog:
  - [s390] use expoline thunks in the BPF JIT (Hendrik Brueckner) [1619667 1588933]
  - [s390] extend expoline to BC instructions (Hendrik Brueckner) [1619667 1588933]
  - [s390] move spectre sysfs attribute code (Hendrik Brueckner) [1619667 1588933]
  - [s390] kernel: use expoline for indirect branches (Hendrik Brueckner) [1619667 1588933]
  - [s390] ftrace: use expoline for indirect branches (Hendrik Brueckner) [1619667 1588933]
  - [s390] lib: use expoline for indirect branches (Hendrik Brueckner) [1619667 1588933]
  - [s390] crc32-vx: use expoline for indirect branches (Hendrik Brueckner) [1619667 1588933]
  - [s390] move expoline assembler macros to a header (Hendrik Brueckner) [1619667 1588933]
  - [s390] add assembler macros for CPU alternatives (Hendrik Brueckner) [1619667 1588933]
  - [redhat] spec: add gcc with expoline support (Hendrik Brueckner) [1619667 1578285]
  - [redhat] configs: enable s390 auto expoline support (Hendrik Brueckner) [1619667 1578285]
  - [s390] correct nospec auto detection init order (Hendrik Brueckner) [1619667 1578285]
  - [s390] add sysfs attributes for spectre (Hendrik Brueckner) [1619667 1578285]
  - [s390] report spectre mitigation via syslog (Hendrik Brueckner) [1619667 1578285]
  - [s390] add automatic detection of the spectre defense (Hendrik Brueckner) [1619667 1578285]
  - [s390] move nobp parameter functions to nospec-branch.c (Hendrik Brueckner) [1619667 1578285]
  - [s390] do not bypass BPENTER for interrupt system calls (Hendrik Brueckner) [1619667 1578285]


author: Johnny Hughes <johnny@centos.org> [4.14.0-49.13.1.el7a]
changelog:
  - Rolled in CentOS certificates and signed modules with a CentOS certificate.
  - Turned off CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND and turned on CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE on aarch64
  - added git as buildrequirement to do patches (if/when required)
  - added 46 MVPP2 patches
  - set CONFIG_ARCH_MVEBU=y, CONFIG_MVPP2=m, CONFIG_MARVELL_10G_PHY=m on aarch64


author: Herton R. Krzesinski <herton@redhat.com> [4.14.0-44.el7a]
changelog:
  - [powerpc] powerpc/mm: Flush radix process translations when setting MMU type (Laurent Vivier) [1533718]
  - [powerpc] powerpc/mm/radix: Split linear mapping on hot-unplug (Suraj Jitindar Singh) [1516201]
  - [powerpc] KVM: PPC: Book3S: Add MMIO emulation for VMX instructions (Laurent Vivier) [1537935]
  - [powerpc] KVM: PPC: Book3S HV: Make HPT resizing work on POWER9 (Laurent Vivier) [1535789]
  - [powerpc] KVM: PPC: Book3S HV: Fix handling of secondary HPTEG in HPT resizing code (Laurent Vivier) [1535789]
  - [powerpc] KVM: PPC: Book3S HV: Drop locks before reading guest memory (Laurent Vivier) [1540077]
  - [powerpc] powerpc/64s/radix: Boot-time NULL pointer protection using a guard-PID (Mauricio Oliveira) [1539109]
  - [block] blk-mq-debugfs: don't allow write on attributes with seq_operations set (Ming Lei) [1543463]
  - [fs] dcache: Revert manually unpoison dname after allocation to shut up kasan's reports (Joe Lawrence) [1539609]
  - [fs] fs/dcache: Use read_word_at_a_time() in dentry_string_cmp() (Joe Lawrence) [1539609]
  - [lib] lib/strscpy: Shut up KASAN false-positives in strscpy() (Joe Lawrence) [1539609]
  - [kernel] compiler.h: Add read_word_at_a_time() function (Joe Lawrence) [1539609]
  - [kernel] compiler.h, kasan: Avoid duplicating __read_once_size_nocheck() (Joe Lawrence) [1539609]
  - [redhat] update handling for our additional certificates ("Herton R. Krzesinski") [1539015]
  - [redhat] make CONFIG_MODULE_SIG_SHA* common through all architectures ("Herton R. Krzesinski") [1539015]
  - [redhat] remove extra_certificates file ("Herton R. Krzesinski") [1539015]
  - [fs] xfs: truncate pagecache before writeback in xfs_setattr_size() (Bill O'Donnell) [1518553]
  - [fs] autofs: revert autofs: take more care to not update last_used on path walk (Ian Kent) [1535760]


author: Herton R. Krzesinski <herton@redhat.com> [4.14.0-45.el7a]
changelog:
  - [netdrv] tg3: APE heartbeat changes (Jonathan Toppins) [1545870]
  - [redhat] fix rh_get_maintainer.pl (Andrew Jones)
  - [scsi] lpfc Fix SCSI io host reset causing kernel crash (Dick Kennedy) [1540693]


author: Herton R. Krzesinski <herton@redhat.com> [4.14.0-46.el7a]
changelog:
  - [powerpc] ppc needs macro for spectre v1 mitigation (Christoph von Recklinghausen) [1538186]
  - [arm64] Add missing Falkor part number for branch predictor hardening (Spectre/Meltdown) (Steve Ulrich) [1545916]
  - [s390] kernel: fix rwlock implementation (Hendrik Brueckner) [1547423]
  - [redhat] s390/configs: enable KERNEL_NOBP for s390 (Hendrik Brueckner) [1532726]
  - [s390] spinlock: add __nospec_barrier memory barrier (Hendrik Brueckner) [1532726]
  - [s390] Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*) (Hendrik Brueckner) [1532726]
  - [s390] introduce execute-trampolines for branches (Hendrik Brueckner) [1532726]
  - [s390] run user space and KVM guests with modified branch prediction (Hendrik Brueckner) [1532726]
  - [s390] add options to change branch prediction behaviour for the kernel (Hendrik Brueckner) [1532726]
  - [s390] s390/alternative: use a copy of the facility bit mask (Hendrik Brueckner) [1532726]
  - [s390] add optimized array_index_mask_nospec (Hendrik Brueckner) [1532726]
  - [s390] scrub registers on kernel entry and KVM exit (Hendrik Brueckner) [1532726]
  - [s390] enable CPU alternatives unconditionally (Hendrik Brueckner) [1532726]
  - [s390] introduce CPU alternatives (Hendrik Brueckner) [1532726]
  - [security] KEYS: Use individual pages in big_key for crypto buffers (David Howells) [1510601]
  - [powerpc] powerpc/eeh: Fix crashes in eeh_report_resume() (Gustavo Duarte) [1546028]
  - [redhat] switch secureboot kernel image signing to release keys ("Herton R. Krzesinski")
  - [redhat] RHMAINTAINERS: update power management sections (Al Stone)
  - [fs] xfs: validate sb_logsunit is a multiple of the fs blocksize (Bill O'Donnell) [1538496]
  - [kernel] bpf: prevent out-of-bounds speculation (Mark Langsdorf) [1536036]
  - [arm64] kpti: Fix the interaction between ASID switching and software PAN (Mark Langsdorf) [1536036]
  - [arm64] SW PAN: Point saved ttbr0 at the zero page when switching to init_mm (Mark Langsdorf) [1536036]
  - [arm64] Re-order reserved_ttbr0 in linker script (Mark Langsdorf) [1536036]
  - [arm64] capabilities: Handle duplicate entries for a capability (Mark Langsdorf) [1536036]


author: Herton R. Krzesinski <herton@redhat.com> [4.14.0-47.el7a]
changelog:
  - [kernel] futex: Prevent overflow by strengthen input validation (Joe Lawrence) [1547583] {CVE-2018-6927}


author: Herton R. Krzesinski <herton@redhat.com> [4.14.0-49.el7a]
changelog:
  - [netdrv] tg3: prevent scheduling while atomic splat (Jonathan Toppins) [1555032]
  - [powerpc] KVM: PPC: Book3S HV: Fix guest time accounting with VIRT_CPU_ACCOUNTING_GEN (Laurent Vivier) [1541614]
  - [powerpc] KVM: PPC: Book3S HV: Improve handling of debug-trigger HMIs on POWER9 (Gustavo Duarte) [1548423]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.1.1.el7a]
changelog:
  - [watchdog] sbsa: use 32-bit read for WCV (Robert Richter) [1564025 1553237]
  - [nvme] nvme-pci: Fix EEH failure on ppc (David Milburn) [1563570 1554747]
  - [nvme] nvme-pci: Fix queue double allocations (David Milburn) [1561916 1555296]
  - [powerpc] mm: Fixup tlbie vs store ordering issue on POWER9 (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] mm/radix: Move the functions that does the actual tlbie closer (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] mm/radix: Remove unused code (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] powernv: Fix kexec crashes caused by tlbie tracing (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] 64s/radix: Optimize TLB range flush barriers (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] npu-dma.c: Fix crash after __mmu_notifier_register failure (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] powernv/npu: Fix deadlock in mmio_invalidate() (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] mm: Workaround Nest MMU bug with TLB invalidations (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] mm: Add tracking of the number of coprocessors using a context (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] powernv/npu: Don't explicitly flush nmmu tlb (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] powernv/npu: Use flush_all_mm() instead of flush_tlb_mm() (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] kvm: ppc: book3s hv: Fix duplication of host SLB entries (Gustavo Duarte) [1561914 1559812]
  - [powerpc] 64s: Fix lost pending interrupt due to race causing lost update to irq_happened (Steve Best) [1561913 1558661]
  - [redhat] fix NVMe hotplug failure on some platforms (Steve Ulrich) [1561464 1557004]
  - [powerpc] powerpc/powernv: Support firmware disable of RFI flush (Mauricio Oliveira) [1561463 1554920]
  - [powerpc] powerpc/pseries: Support firmware disable of RFI flush (Mauricio Oliveira) [1561463 1554920]
  - [powerpc] cxl: read PHB indications from the device tree (Steve Best) [1560901 1563111 1558675 1553205]
  - [powerpc] powerpc/powernv: Enable tunneled operations (Steve Best) [1560901 1563111 1558675 1553205]
  - [misc] cxl: Fix timebase synchronization status on P9 (Steve Best) [1560901 1558675]
  - [powerpc] Fix DABR match on hash based systems (Steve Best) [1560900 1552080]
  - [powerpc] KVM: PPC: Book3S HV: Fix handling of large pages in radix page fault handler (Laurent Vivier) [1560899 1549933]
  - [powerpc] powerpc/64s: Fix NULL AT_BASE_PLATFORM when using DT CPU features (Steve Best) [1560897 1555236]
  - [powerpc] KVM: PPC: Book3S HV: Fix VRMA initialization with 2MB or 1GB memory backing (Laurent Vivier) [1559874 1552768]
  - [s390] KVM: s390: take care of clock-comparator sign control (Thomas Huth) [1559871 1555263]
  - [s390] KVM: s390: consider epoch index on hotplugged CPUs (Thomas Huth) [1559871 1555263]
  - [s390] KVM: s390: consider epoch index on TOD clock syncs (Thomas Huth) [1559871 1555263]
  - [s390] KVM: s390: provide only a single function for setting the tod (fix SCK) (Thomas Huth) [1559871 1555263]
  - [powerpc] KVM: PPC: Book3S HV: Fix trap number return from __kvmppc_vcore_entry (Laurent Vivier) [1559870 1555068]
  - [fs] NFS: Fix unstable write completion (Scott Mayhew) [1559869 1552471]
  - [redhat] hardcode .el7a dist tag (Frantisek Hrbata)


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.2.2.el7a]
changelog:
  - [perf] hwbp: Simplify the perf-hwbp code, fix documentation (Eugene Syromiatnikov) [1569877 1569875] {CVE-2018-1000199}


author: Pingfan Liu <piliu@redhat.com> 2.0.15-3
changelog:
  - makedumpfile: x86_64: Take care of init_level4_pgt rename in kernel
  - makedumpfile: ppc64: get the info of mem reserved for crashkernel
  - makedumpfile: Fix SECTION_MAP_MASK for kernel >= v.13


author: Pingfan Liu <piliu@redhat.com> 2.0.15-5
changelog:
  - Revert "Update kdump anaconda addon"
  - Revert "Update kdump anaconda addon: fix the md5sum in source file"


author: Pingfan Liu <piliu@redhat.com> 2.0.15-7
changelog:
  - mkdumprd: apply dracut "--hostonly-cmdline" and "--no-hostonly-default-device"
  - Change dump_to_rootfs to use "--mount" instead of "root=X"
  - kdumpctl: move is_fadump_capable() to kdump-lib.sh
  - module-setup: fix 99kdumpbase network dependency
  - mkdumprd: change for_each_block_target() to use get_kdump_targets()
  - kdump-lib.sh: introduce get_kdump_targets()
  - kdump-lib.sh: fix improper get_block_dump_target()
  - kdumpctl: remove "root=X" for kdump boot
  - kdumpctl: fix a bug in remove_cmdline_param()


author: Pingfan Liu <piliu@redhat.com> 2.0.15-9
changelog:
  - makedumpfile: Fix 'kernel_version' variable being uninitialized & introduce minor reorganization
  - makedumpfile: Fix segmentation fault when using --split on a vmcore
  - dracut-module-setup.sh: check whether to include multipath-hostonly or not


author: Pingfan Liu <piliu@redhat.com> 2.0.15-10
changelog:
  - kexec-tools.spec: require dracut >= 033-522 to make 99kdump module installed correctly
  - kdump.sysconfig.ppc64(le): remove "root=" param from ppc64(le) 2nd kernel's command line
  - Revert "kdumpctl: sanity check of nr_cpus for x86_64 in case running out of vectors"


author: Pingfan Liu <piliu@redhat.com> 2.0.15-11
changelog:
  - dracut-module-setup.sh: temporary install /bin/grep to work around dracut's bug
  - kdump.sysconfig/x86_64: Add nokaslr to kdump kernel cmdline
  - kdumpctl: skip selinux-relabel for dracut_args --mount dump target


author: Pingfan Liu <piliu@redhat.com> 2.0.15-13
changelog:
  * Thu Feb 1 2018 Pingfan Liu <piliu@redhat.com> 2.0.15-12
  - makedumpfile/sadump: Fix a problem of PTI enabled kernel
  - makedumpfile: Fix physical-to-virtual conversion in 'exclude_segment()'


author: Karel Zak <kzak@redhat.com> 2.23.2-44
changelog:
  - fix #1478002 - systemd read-only container produces errors
  - fix #1499760 - gvfs-udisks2-volume-monitor generates huge amount of audit log with access denied messages
  - fix #1498462 - agetty not parsing /etc/os-release correctly when processing /etc/issue
  - fix #1490984 - Please update fdisk's manual page
  - fix #1487031 - [GSS][RFE]The Ceph disk type is unknown then we run the command "fdisk -l"
  - fix #1468646 - lscpu output missing Hypervisor
  - fix #1455398 - flock --timeout=0 doesn't work on RHEL7
  - fix #1336432 - journald: SYSLOG_IDENTIFIER is invalid when running logger
  - fix #1427500 - util-linux: script does not retry on EINTR when logging command output
  - fix #1336432 - journald: SYSLOG_IDENTIFIER is invalid when running logger
  - fix #1296233 - login(1) writes 0.0.0.0 IP address to wtmp when executed with "-h <ipv4-mapping-to-ipv6>" hostname


author: Karel Zak <kzak@redhat.com> 2.23.2-45
changelog:
  - fix #1501953 - blkid shows wrong return code on failure with ambivalent results
  - fix #1486777 - wipefs printing duplicate gpt clear messages
  - fix #1454652 - fix test suite


author: Karel Zak <kzak@redhat.com> 2.23.2-49
changelog:
  - fix #1520906 - make hostname in login(1) prompt optional
  - fix #1521163 - [RFE] blkid can identify magic number and UUID of VDO volume


author: Lukas Nykryn <lnykryn@redhat.com> - 219-50
changelog:
  - core: fix the reversed sanity check when setting StartupBlockIOWeight over dbus (#1302305)
  - shared/dropin: ignore ENAMETOOLONG when checking drop-in directories (#7525) (#1489095)
  - enable display manager only on systemd installation (#1464893)
  - remove unnecessary dependency on dracut (#1466676)
  - substitute PACKAGE_STRING with the actual package NVR (#1453153)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-52
changelog:
  - cryptsetup: when unlocking always put path to the object into Id (#1511043)
  - cryptsetup: use more descriptive name for the variable and drop redundant function (#1511043)
  - cryptsetup-generator: do not bind to the decrypted device unit (#6538) (#1511043)
  - introduce naming based on phys_port_name for nfp via udev rule (#1516283)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-54
changelog:
  - automount: ack automount requests even when already mounted (#1535135)
  - udev: net_id add support for platform bus (ACPI, mostly arm64) devices (#1529633)
  - journald-native: Fix typo in MANDLOCK message (#1501017)
  - process-util: make our freeze() routine do something useful (#1540941)
  - dbus: propagate errors from bus_init_system() and bus_init_api() (#1541061)
  - bus-util.c: fix TasksMax= property assignment (#1537147)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-55
changelog:
  - sparse: avoid clash with __bitwise and __force from 4.10 linux/types.h (#5061) (#1447937)
  - core: Let two more booleans survive a daemon-reload (#1542391)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-57
changelog:
  - sd-journal: properly handle inotify queue overflow (#1540538)
  - sd-journal: make sure it's safe to call sd_journal_process() before the first sd_journal_wait() (#1540538)
  - journalctl: Periodically call sd_journal_process in journalctl (#1540538)
  - sd-journal: when picking up a new file, compare inode/device info with previous open file by same name (#1540538)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-57.1
changelog:
  - umount: always use MNT_FORCE in umount_all() (#7213) (#1571098)
  - core: Implement timeout based umount/remount limit (#1571098)
  - core: Implement sync_with_progress() (#1571098)


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.32.7-3
changelog:
  - Rebase to libguestfs 1.32 in RHEL 7.3
    resolves: rhbz#1218766
  - The full tests are now run after the package has been built.
  - New tool and subpackage: virt-dib (safe diskimage-builder replacement).
  - New subpackage libguestfs-inspect-icons to reduce dependencies of main pkg
    (see https://bugzilla.redhat.com/1194158).
  - New tool: virt-get-kernel.
  - Depend on java-headless instead of full java.
  - New tool: virt-v2v-copy-to-local.
  - Disable virt-v2v subpackage on ppc64 etc
    resolves: rhbz#1287826
  - v2v: Remove VirtualBox Additions correctly
    resolves: rhbz#1296606
  - Add clearer warnings sections to all man pages
    resolves: rhbz#1293527
  - v2v: Disable the --in-place option.
  - v2v: Support conversion of Windows > 7
    resolves: rhbz#1190669
  - Add code to verify tarball signatures.
  - General performance improvements.
  - v2v: Prevent duplicate -b, -n, -oa options
    resolves: rhbz#1326266
    resolves: rhbz#1325825
  - v2v: Unquote UUID and LABEL in fstab (util-linux 1335671)
  - v2v: Fix alignment issues in treeviews in conversion dialog
    resolves: rhbz#1340407
  - p2v: spinner should be hidden when it stops spinning
    resolves: rhbz#1341564
  - p2v: ethtool command is not supported on p2v client
    resolves: rhbz#1341608
  - p2v: Add ifconfig command to ISO
    resolves: rhbz#1342447
  - p2v: Warn if virt-p2v-make-disk used on a partition
    resolves: rhbz#1342337
  - Build using OCaml with fix for CVE-2015-8869.
    resolves: rhbz#1343101
  - customize: Add --uninstall option (upstream 1343375)
  - p2v: Document permissions on id_rsa file
    resolves: rhbz#1343414
  - p2v: Print full curl error message
    resolves: rhbz#1343423
  - get-kernel: Fix --format auto
    resolves: rhbz#1341984
  - v2v: Provide better <Origin/> information to RHEV-M
    resolves: rhbz#1342398
  - customize: Give an error if --truncate-recursive path does not exist
    resolves: rhbz#1345809
  - sysprep: Add --network option so that --install option can be used
    resolves: rhbz#1345813
  - p2v: Print proper error if incorrect password is given
    resolves: rhbz#1227599
  - p2v: Print ssh error if incorrect hostname is given
    resolves: rhbz#1167916
  - p2v: Display progress of operation in non-GUI mode
    resolves: rhbz#1229386
  - p2v: Add a dialog confirming the user really means to cancel
    resolves: rhbz#1340464
  - p2v: log window should process colour escapes and backspaces
    resolves: rhbz#1314244
  - v2v: Fix installation of virtio drivers with *.dll files
    resolves: rhbz#1311373
  - p2v: Improve error message when ssh login to conversion server fails
    resolves: rhbz#1348900
  - v2v: Remove --dcpath parameter from manual
    resolves: rhbz#1315237
  - v2v: Fix conversion of guests with floppy drives
    resolves: rhbz#1309706
  - p2v: Better error when sudo requires a password
    resolves: rhbz#1340809
  - v2v: Refuse to convert if there is < 1GB free in temporary directory
    resolves: rhbz#1316479
  - inspection: Get Windows drive letters for GPT disks
    resolves: rhbz#1349237
  - p2v: Add disk utils and display serial number of disks
    resolves: rhbz#855058
  - p2v: Fix timeout error when connecting to unresponsive ssh server
    resolves: rhbz#1350363
  - Remove external dependency generator.  Use supermin RPM deps instead.
    related: rhbz#1309796
  - p2v: Flush messages to the journal immediately
    resolves: rhbz#1229386
  - customize: Fix --install on ppc64le
    resolves: rhbz#1264835
  - lib: Fix finding icons in Windows 7 64 bit guests
    resolevs: rhbz#1352761
  - v2v: Add virsh --quiet flag when running virt-v2v --quiet
    resolves: rhbz#1358142
  - lib: Fix inspection of ISOs with latest libosinfo
    resolves: rhbz#1359652
  - dib: Fix run_command exit handlers on failure
    resolves: rhbz#1362357
  - dib: Rework run of extra-data.d hooks
    resolves: rhbz#1362354
  - Miscellaneous fixes to man pages and --help output
    resolves: rhbz#1362668
  - lib: Specify backing format for read-only files
    resolves: rhbz#1354335
  - Fix --selinux-relabel option
    resolves: rhbz#1362669
  - sparsify: Fix --in-place option with UEFI guest
    resolves: rhbz#1364347
  - p2v: Use latest linux-firmware in ISO
    resolves: rhbz#1364419
  - v2v: Fix guest name when using -i disk
    resolves: rhbz#1365005
  - p2v: Fix GUI message.
  - v2v: Make fstrim message clearer
    resolves: rhbz#1366456
  - v2v: Fix conversion of UEFI guests when Secure Boot OVMF installed
    resolves: rhbz#1367615
  - lib: Fix assert-fail if port is missing in libvirt XML
    resolves: rhbz#1370424


author: Pino Toscano <ptoscano@redhat.com> - 1:1.36.3-6
changelog:
  - Rebase to libguestfs 1.36 in RHEL 7.4.
    resolves: rhbz#1359086
  - v2v: always use names for libvirt pools
    resolves: rhbz#1141631
  - v2v: correctly find GRUB in RHEL UEFI guests
  - v2v: uninstall VMware tools packages from guests
    resolves: rhbz#1155150
  - v2v: install RHEV-APT only when using -o rhev/-o vdsm
    resolves: rhbz#1161019
  - New API: btrfs-filesystem-show
    resolves: rhbz#1164765
  - p2v: always enable debugging when running virt-v2v
    resolves: rhbz#1167623
  - libguestfs prefers virtio-pci on aarch64
    resolves: rhbz#1237250
  - v2v: make sure to copy all the driver files on Windows
    resolves: rhbz#1255610
  - Better tolerate corrupted Windows hivex; bump the hivex BuildRequires and
    Requires to >= 1.3.10-5.8.el7
    resolves: rhbz#1311890
  - v2v: ignore all the environment variables for proxy when exporting from
    vCenter
    resolves: rhbz#1354507
  - virt-sysprep can deal with full-LUKS encrypted guests
    resolves: rhbz#1362649
  - All the tools have bash completion scripts.
    resolves: rhbz#1367738
  - v2v: do not remove Processor and Intelppm nodes in Windows guests
    resolves: rhbz#1372668
  - Fix SELinux relabelling in old RHEL 6 guests, by adjusting a broken
    regular expression in file_contexts file
    resolves: rhbz#1374232
  - v2v: set all the properties on creation when exporting to Glance
    resolves: rhbz#1374405
  - v2v: set hw_video_model when exporting to Glance
    resolves: rhbz#1374651
  - v2v: fix OVA conversion as root using the libvirt backend
    resolves: rhbz#1375157
  - Various improvements and fixes to the documentation
    resolves: rhbz#1377081
    resolves: rhbz#1390876
    resolves: rhbz#1398070
    resolves: rhbz#1425306
  - v2v: support <listen type='socket'> and <listen type='none'>
    resolves: rhbz#1378022
  - v2v: allow libvirt >= 2.1.0 for vCenter conversions
    resolves: rhbz#1379240
  - p2v: enable mnemonics in the GUI
    resolves: rhbz#1379289
  - Split virt-p2v, and the tools for it, in an own package: virt-p2v-maker
    resolves: rhbz#1382275
  - Correctly parse mount options in btrfs entries in /etc/fstab.
    resolves: rhbz#1383517
  - Read secrets from libvirt domains, when inspecting them
    resolves: rhbz#1392798
  - v2v: add --vdsm-compat=1.1 flag for VDSM
    resolves: rhbz#1400205
  - Fix inspection with UsrMove and /usr in a separate partition
    resolves: rhbz#1401474
  - v2v: improve import compatibility with OVAs produced by AWS
    resolves: rhbz#1402301
  - resize: allow URIs for the output disk
    resolves: rhbz#1404182
  - Disable EDD when launching the appliance
    resolves: rhbz#1404287
  - v2v: increase the memory allocated to the appliance
    resolves: rhbz#1418283
  - p2v: switch from GTK+ 2 to GTK+ 3
  - p2v: add dbus-devel as BuildRequires to disable suspension during the
    conversion
  - libguestfs-java: bump the java-headless Require to >= 1.7.0, matching the
    Build-Require, and the generated bytecode
    resolves: rhbz#1364518
  - Do not try to use/write to /var/cache/yum & /var/log/yum.log
  - Bump ocaml-findlib-devel BuildRequires to >= 1.3.3-7.el7, because of
    RHBZ#1403897
  - v2v: remove --dcpath & --dcPath from --help output too
    resolves: rhbz#1429430
  - v2v: force VNC as display for -i disk, as SDL is not supported
    resolves: rhbz#1372671
  - v2v, p2v: rename rhvm network to ovirtmgmt
    resolves: rhbz#1429491
  - v2v: when exporting to local disk, check that UEFI firmware is installed
    before conversion
    resolves: rhbz#1429506
  - dib: actually generate SHA256 checksums when using --checksum
    resolves: rhbz#1430184
  - v2v: do not mention SUSE Xen hosts as supported
    resolves: rhbz#1430203
  - v2v: depend on OVMF/AAVMF, for converting EFI guests
    resolves: rhbz#1429643
  - v2v: use absolute path when using an OVA as backing file
    resolves: rhbz#1430680
  - v2v: support Debian/Ubuntu guests
    resolves: rhbz#1387213
  - sysprep: remove DHCP_HOSTNAME entries
    resolves: rhbz#1427529
  - v2v: avoid repeated "run virt-v2v -v -x" message on error
    resolves: rhbz#1167623
  - bash-completion: add script for virt-v2v-copy-to-local
    resolves: rhbz#1367738
  - v2v: fix virtio block driver installation for Windows 10 and Windows 2016
    resolves: rhbz#1434737
  - Replace the libosinfo dependency with osinfo-db, since we are only using
    the osinfo database.
  - v2v: fix virtio driver installation for Windows 8 UEFI
    resolves: rhbz#1431579
  - v2v: new 'vmx' import method
    resolves: rhbz#1441197
  - v2v: properly identify Windows 2016 guests when exporting them to RHV-M
    resolves: rhbz#1447202
  - Run pvresize in non-interactive mode
    resolves: rhbz#1460692
  - resize: make sure the input disk is read-only
    resolves: rhbz#1463714
  - Switch qemu-kvm-rhev dependency to qemu-kvm on aarch64
    resolves: rhbz#1463646


author: Pino Toscano <ptoscano@redhat.com> - 1:1.36.10-6
changelog:
  - Rebase to libguestfs 1.36.10 in RHEL 7.5.
    resolves: rhbz#1472272
  - Build against OCaml 4.05
    resolves: rhbz#1447981
  - Enable the copyonread flag when running the appliance using libvirt.
    resolves: rhbz#1466563
  - Make sure kernel-rt is never used as Requires.
    resolves: rhbz#1471651
  - v2v: disable unconfiguration of manually installed VMware tools.
    resolves: rhbz#1477905
  - v2v: prefer pigz or pxz for uncompressing OVA files, if available
    resolves: rhbz#1448739
  - resize: handle empty UUIDs for swap partitions
    resolves: rhbz#1482737
  - v2v: remove mention of --dcpath in an error message
    resolves: rhbz#1486197
  - Disables the QEMU image file locking when opening disks as read-only
    resolves: rhbz#1417306
    resolves: rhbz#1503497
  - Briefly document the format used for URIs
    resolves: rhbz#1450325
  - v2v: deal with grub2 configurations without a default set
    resolves: rhbz#1472288
  - v2v: warn when a guest has passthrough devices
    resolves: rhbz#1472719
  - v2v: fix three regular expressions
    resolves: rhbz#1494555
  - v2v: enable conversion of full-disk LUKS-encrypted Linux guests
    resolves: rhbz#1451665
  - v2v: new 'vddk' import method
    resolves: rhbz#1477912
    resolves: rhbz#1513884
  - Enable libguestfs to work on z Systems
    resolves: rhbz#1479526
  - p2v: fx check for sudo requiring a password
    resolves: rhbz#1500673
  - v2v: handle disks with snapshots in vCenter
    resolves: rhbz#1172425
  - rescue: backport improved version
    resolves: rhbz#1438710
  - v2v: improve bootloader detection
    resolves: rhbz#1508299
  - v2v: parse MAC address of network interfaces in OVF files
    resolves: rhbz#1506572
  - Unconditionally depend on libvirt-daemon-kvm >= 3.9.0-1, which will always
    pull the right qemu-kvm too, and thus remove the unversioned dependencies
    on it
    resolves: rhbz#1500870
  - v2v: fix RPM file owned test
    resolves: rhbz#1503958
  - Do not open read-only disks using <shareable/> in the libvirt backend
    resolves: rhbz#1518517
  - v2v: handle better when grubby does not report any default kernel
    resolves: rhbz#1519204
  - v2v: enhance vmx import method to access via SSH
    resolves: rhbz#1523767
  - builder: fix caching of templates when using --cache-all-templates
    resolves: rhbz#1523650


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-15
changelog:
  - Resolves: rhbz#1517971 - AD Domain goes offline immediately during
                             subdomain initialization - IPA AD Trust
  - Related: rhbz#1482555 - sysdb index improvements - missing ghost
                            attribute indexing, unneeded objectclass index
                            etc..
  - Related: rhbz#1327705 - [RFE] Automatic creation of user private groups
                            on RHEL clients joined to AD via sssd [RHEL 7]
  - Resolves: rhbz#1527149 - AD provider - AD BUILTIN groups are cached with
                             gidNumber = 0
  - Related: rhbz#1461899 - Loading enterprise principals doesn't work with
                            a primed cache
  - Related: rhbz#1473571 - ipa-extdom-extop plugin can exhaust DS worker
                            threads


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-16
changelog:
  - Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
                             with no specific host/hostgroup set
  - Related: rhbz#1441908 - SELINUX: Use getseuserbyname to get IPA seuser
  - Related: rhbz#1327705 - [RFE] Automatic creation of user private groups
                            on RHEL clients joined to AD via sssd [RHEL 7]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-17
changelog:
  - Resolves: rhbz#1523282 - sssd used wrong search base with wrong AD
                             server


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-18
changelog:
  - Resolves: rhbz#1543348 - sssd_be consumes more memory on RHEL 7.4 systems.
  - Resolves: rhbz#1544943 - sssd goes offline when renewing expired ticket


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-19.1
changelog:
  - Resolves: rhbz#1570527 - memory management issue in the sssd_nss_ex interface can cause the ns-slapd process on IPA server to crash [rhel-7.5.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-19.2
changelog:
  - Resolves: rhbz#1579703 - crash in nss_protocol_fill_netgrent. sssd_nss[19234]: segfault at 80 ip 000055612688c2a0 sp 00007ffddf9b9cd0 error 4 in sssd_nss[55612687e000+39000] [rhel-7.5.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-19.4
changelog:
  - Resolves: rhbz#1580281 - Samba can not register sss idmap module because it's using an outdated SMB_IDMAP_INTERFACE_VERSION [rhel-7.5.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-19.5
changelog:
  - Resolves: rhbz#1583746 - The SSSD IPA provider allocates information about external groups on a long lived memory context, causing memory growth of the sssd_be process [rhel-7.5.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.0-19.6
changelog:
  - Resolves: rhbz#1594178 - Login with sshkeys stored in ipa not working after update to RHEL-7.5 [rhel-7.5.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.0-19.7
changelog:
  - Resolves: rhbz#1596292 - home dir disappear in sssd cache on the IPA master for AD users [rhel-7.5.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.0-19.8
changelog:
  - Resolves: rhbz#1601360 - SSSD bails out saving desktop profiles in case an invalid profile is found [rhel-7.5.z]


author: Paul Wouters <pwouters@redhat.com> - 3.22-2
changelog:
  - Resolves: rhbz#1471763 RFE: libreswan MOBIKE support (RFC-4555)
  - Resolves: rhbz#1372050 RFE: Support IKE and ESP over TCP: RFC 8229


author: Paul Wouters <pwouters@redhat.com> - 3.22-3
changelog:
  - Resolves: rhbz#1475434 Add support for AES-GMAC for ESP (RFC-4543) to libreswan
  - Resolves: rhbz#1300759 Implement RFC-7427 Digital Signature authentication


author: Paul Wouters <pwouters@redhat.com> - 3.22-5
changelog:
  - Resolves: rhbz#1471763 RFE: libreswan MOBIKE support (RFC-4555) [updated]
  - Resolves: rhbz#1471553 libreswan postquantum preshared key (PPK) support
  - Resolves: rhbz#1375776 [IKEv2 Conformance] Test IKEv2.EN.R.1.2.2.1: Receipt of retransmitted CREATE_CHILD_SA reques failed
  - Resolves: rhbz#1375750 SECCOMP support for libreswan [updated for libunbound syscalls]
  - Resolves: rhbz#1300763 Implement draft-ietf-ipsecme-split-dns for libreswan


author: Paul Wouters <pwouters@redhat.com> - 3.23-0.1.rc4
changelog:
  - Resolves: rhbz#1471763 RFE: libreswan MOBIKE support (RFC-4555) [client support]
  - Resolves: rhbz#1457904 rebase libreswan to 3.23 [updated]
  - Resolves: rhbz#1471553 libreswan postquantum preshared key (PPK) support
  - Resolves: rhbz#1492501 Reboot or 'systemctl stop ipsec' brings down _ethernet_ interfaces on _both_ ends of ipv4 ipsec tunnel
  - Resolves: rhbz#1324421 libreswan works not well when setting leftid field to be email address
  - Resolves: rhbz#1136076 After IKE rekeying Pluto sends DPD even if there is active SA


author: Paul Wouters <pwouters@redhat.com> - 3.23-2
changelog:
  - Resolves: rhbz#1457904 rebase libreswan to 3.23 [updated]
  - Resolves: rhbz#1375750 SECCOMP support for libreswan [updated]


author: Paul Wouters <pwouters@redhat.com> - 3.23-4
changelog:
  - Resolves: rhbz#1573949 ipsec newhostkey fails in FIPS mode when RSA key is generated
  - Resolves: rhbz#1574456 Shared IKE SA leads to rekey interop issues
  - Resolves: rhbz#1574457 IKEv2 liveness false positive on IKEv2 idle connections causes tunnel to be restarted


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-9
changelog:
  - qemu: Fix crash in offline migration (rhbz#1536351)
  - Revert "qemu: monitor: do not report error on shutdown" (rhbz#1536461)
  - qemu: Refresh caps cache after booting a different kernel (rhbz#1525182)
  - qemu: Don't initialize struct utsname (rhbz#1525182)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-10
changelog:
  - storage: util: Properly ignore errors when backing volume is inaccessible (rhbz#1540022)
  - util: json: Add helper to return string or number properties as string (rhbz#1540290)
  - util: storage: Parse 'lun' for iSCSI protocol from JSON as string or number (rhbz#1540290)
  - util: Introduce virFormatIntPretty (rhbz#1289368)
  - util: Make prefix optional in virBitampString (rhbz#1289368)
  - util: Rename virBitmapString to virBitmapToString (rhbz#1289368)
  - util: Rename virBitmapDataToString to virBitmapDataFormat (rhbz#1289368)
  - util: Don't output too many zeros from virBitmapToString (rhbz#1289368)
  - util: Introduce virBitmapNewString (rhbz#1289368)
  - util: Reintroduce virBitmapSubtract (rhbz#1289368)
  - util: Introduce virBitmapShrink (rhbz#1289368)
  - conf: Sort cache banks in capabilities XML (rhbz#1289368)
  - conf: Format cache banks in capabilities with virFormatIntPretty (rhbz#1289368)
  - tests: Remove executable bits on plain data files (rhbz#1289368)
  - tests: Minor adjustments for test data (rhbz#1289368)
  - tests: Add resctrl-skx-twocaches test case to vircaps2xmltest (rhbz#1289368)
  - util: Fix leak in virStringTrimOptionalNewline (rhbz#1289368)
  - Rename virResctrlInfo to virResctrlInfoPerCache (rhbz#1289368)
  - util: Add virResctrlInfo (rhbz#1289368)
  - conf: Use virResctrlInfo in capabilities (rhbz#1289368)
  - util: Remove now-unneeded resctrl functions (rhbz#1289368)
  - fixup_resctrlinfo (rhbz#1289368)
  - resctrl: Add functions to work with resctrl allocations (rhbz#1289368)
  - conf: Add support for cputune/cachetune (rhbz#1289368)
  - tests: Add virresctrltest (rhbz#1289368)
  - qemu: Add support for resctrl (rhbz#1289368)
  - tests: Clean up and modify some vircaps2xmldata (rhbz#1289368)
  - resctl: stub out functions with Linux-only APIs used (rhbz#1289368)
  - util: Check for empty allocation instead of just NULL pointer (rhbz#1289368)
  - util: Use "resctrl" instead of "resctrlfs" spelling (rhbz#1289368)
  - util: Make it possible for virResctrlAllocSetMask to replace existing mask (rhbz#1289368)
  - util: Remove unused variable in virResctrlGetInfo (rhbz#1289368)
  - util: Don't check if entries under /sys/fs/resctrl/(info/) are directories (rhbz#1289368)
  - util: Add helpers for getting resctrl group allocs (rhbz#1289368)
  - util: Use default group's mask for unspecified resctrl allocations (rhbz#1289368)
  - util: Don't overwrite mask in virResctrlAllocFindUnused (rhbz#1289368)
  - qemu: Restore machinename even without cgroups (rhbz#1289368)
  - util: Extract path formatting into virResctrlAllocDeterminePath (rhbz#1289368)
  - qemu: Restore resctrl alloc data after restart (rhbz#1289368)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-11
changelog:
  - qemu: migration: Refresh device information after transferring state (rhbz#1463168)
  - qemuDomainRemoveMemoryDevice: unlink() memory backing file (rhbz#1461214)
  - util: Fix possible leak in virResctrlAllocMasksAssign (rhbz#1540817)
  - util: Clear unused part of the map in virBitmapShrink (rhbz#1540817)
  - tests: Add test for properly removing cachetune entries (rhbz#1540817)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-12
changelog:
  - util: Check if kernel-provided info is consistent with itself (rhbz#1540780)
  - qemu: Refresh capabilities when creating resctrl allocation (rhbz#1540780)
  - qemu: Expose rx/tx_queue_size in qemu.conf too (rhbz#1541960)
  - util: bitmap: Fix value of 'map_alloc' when shrinking bitmap (rhbz#1540817)
  - qemu: driver: Extract vcpu halted state directly (rhbz#1534585)
  - qemu: Remove unused 'cpuhalted' argument from qemuDomainHelperGetVcpus (rhbz#1534585)
  - qemu: domain: Store vcpu halted state as a tristate (rhbz#1534585)
  - qemu: Limit refresh of CPU halted state to s390 (rhbz#1534585)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.1
changelog:
  - virDomainDeviceValidateAliasForHotplug: Use correct domain defintion (rhbz#1554928)
  - conf: Check for user aliases duplicates only (rhbz#1554962)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.3
changelog:
  - qemu_cgroup: Fix 'rc' argument on virDomainAuditCgroupPath() calls (rhbz#1564996)
  - util: Introduce virStringListMerge (rhbz#1564996)
  - util: Introduce virDevMapperGetTargets (rhbz#1564996)
  - qemu_cgroup: Handle device mapper targets properly (rhbz#1564996)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.4
changelog:
  - lxc: Drop useless check in live device update (rhbz#1557922)
  - Pass oldDev to virDomainDefCompatibleDevice on device update (rhbz#1557922)
  - qemu: Fix updating device with boot order (rhbz#1557922)
  - conf: Fix crash in virDomainDefCompatibleDevice (rhbz#1557922)
  - vmx: check for present/enabled devices earlier (rhbz#1566524)
  - vmx: allocate space for network interfaces if needed (rhbz#1566524)
  - internal: add STRCASEPREFIX (rhbz#1566524)
  - vmx: convert any amount of NICs (rhbz#1566524)
  - qemu: Use dynamic buffer for storing PTY aliases (rhbz#1566525)
  - qemu: avoid denial of service reading from QEMU monitor (CVE-2018-5748) (CVE-2018-5748)
  - qemu: avoid denial of service reading from QEMU guest agent (CVE-2018-1064) (CVE-2018-1064)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.6
changelog:
  - logging: Don't inhibit shutdown in system daemon (rhbz#1573268)
  - util: don't check for parallel iteration in hash-related functions (rhbz#1581364)
  - cpu: define the 'virt-ssbd' CPUID feature bit (CVE-2018-3639)
  - virNumaGetHugePageInfo: Return page_avail and page_free as ULL (rhbz#1582418)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.8
changelog:
  - remote: Extract common clearing of event callbacks of client private data (rhbz#1619206)
  - remote: Move the call to remoteClientFreePrivateCallbacks from FreeFunc to CloseFunc (rhbz#1619206)


author: Jan Synáček <jsynacek@redhat.com> - 7.4.0-29.20130522svn140
changelog:
  - Fix disrupted sentence in default logwatch.conf file (#1126848)
  - Fix smartd copyright message needs to be suppressed again (#1162741)
  - Fix Logwatch cron files not marked correctly as %config(noreplace) (#1221903)
  - Fix When filesystem name is long, the disk full check fails to work (#1293360)
  - Fix Should not change the case of $logdir (#1293624)
  - Fix logwatch --service sshd --detail 8 does not print Kerberos summary (#1295888)
  - Fix logwatch puppet-agent unknown entries (#1299181)
  - Fix logwatch fails with argument list too long (#1300170)


author: Jan Synáček <jsynacek@redhat.com> - 7.4.0-32.20130522svn140
changelog:
  - Refix logwatch fails with argument list too long (#1300170)
  - Fix Typos in sshd service script output (#1335493)


author: Jan Synáček <jsynacek@redhat.com> - 7.4.0-33.20130522svn140
changelog:
  - SSHD log format is going to change (#1422797)
  - logwatch encode=base64 generates invalid mime block (#1123093)


author: Michal Schorm <mschorm@redhat.com> - 5.5.52-2
changelog:
  - Extension of mariadb-prepare-db-dir script
  - Resolves: #1356897

  - Rebase to 5.5.52, that also include fix for CVE-2016-6662
    Resolves: #1377974


author: Honza Horak <hhorak@redhat.com> - 1:5.5.56-1
changelog:
  - Rebase to 5.5.56
    That release also fixes the following security issues:
    CVE-2016-5617/CVE-2016-6664 CVE-2017-3312 CVE-2017-3238 CVE-2017-3243
    CVE-2017-3244 CVE-2017-3258 CVE-2017-3313 CVE-2017-3317 CVE-2017-3318
    CVE-2017-3291 CVE-2017-3302 CVE-2016-5483/CVE-2017-3600 CVE-2017-3308
    CVE-2017-3309 CVE-2017-3453 CVE-2017-3456 CVE-2017-3464
    Resolves: #1458933
    New deps required by upstream: checkpolicy and policycoreutils-python
    License text removed by upstream: COPYING.LESSER
    Do not ignore test-suite failure
    Downstream script mariadb-prepare-db-dir fixed for CVE-2017-3265
    Resolves: #1458940


author: Honza Horak <hhorak@redhat.com> - 1:5.5.56-2
changelog:
  - Do not fix context and change owner if run by root in mariadb-prepare-db-dir
    Related: #1458940
  - Check properly that datadir includes only expected files
    Related: #1356897


author: Michal Schorm <mschorm@redhat.com> - 1:5.5.60-1
changelog:
  - Rebase to 5.5.60
  - CVE's fixed: #1558256, #1558260, #1559060
    CVE-2017-3636 CVE-2017-3641 CVE-2017-3653 CVE-2017-10379
    CVE-2017-10384 CVE-2017-10378 CVE-2017-10268 CVE-2018-2562
    CVE-2018-2622 CVE-2018-2640 CVE-2018-2665 CVE-2018-2668
    CVE-2018-2755 CVE-2018-2819 CVE-2018-2817 CVE-2018-2761
    CVE-2018-2781 CVE-2018-2771 CVE-2018-2813
  - Resolves: #1535217, #1491833, #1511982, #1145455, #1461692


author: John Dennis <jdennis@redhat.com> - 0.10.0-1
changelog:
  - Rebase to upstream 0.10.0 release
  - Apply upstream commits post 0.10.0 release
  - Apply ECP pending patches
  - Resolves: #1205345


author: John Dennis <jdennis@redhat.com> - 0.10.0-2
changelog:
  - Rebase to upstream 0.10.0 release
  - Apply upstream commits post 0.10.0 release
  - Apply revised ECP pending patches
  - Resolves: #1205345


author: John Dennis <jdennis@redhat.com> - 0.10.0-3
changelog:
  - Rebase to upstream 0.10.0 release
  - Apply upstream commits post 0.10.0 release
  - Apply revised ECP pending patches,
    fix patch to pickup change in configure script that causes
    HAVE_ECP to be defined
  - Resolves: #1205345


author: John Dennis <jdennis@redhat.com> - 0.11.0-1
changelog:
  - Upgrade to upstream 0.11.0 release.
  - Includes ECP support, see NEWS for all changes.
  - Update mellon_create_metadata.sh to match internally generated metadata,
    includes AssertionConsumerService for postResponse, artifactResponse &
    paosResponse.
  - Add lasso 2.5.0 version dependency
  - Resolves: #1205345


author: John Dennis <jdennis@redhat.com> - 0.11.0-2
changelog:
  - Resolves: bug #1296286
    mod_auth_mellon emits CRITICAL warning message in Apache log when doing ECP
  - Resolves: bug #1324536
    Installing mod_auth_mellon causes working Kerberos authentication
    to start failing
  - Add ECP.rst documentation file that was erroneously omitted


author: John Dennis <jdennis@redhat.com> - 0.11.0-4
changelog:
  - Resolves: rhbz#1414021 - Incorrect Content-Type header in ECP PAOS
    Rebuilding due to missing comment in Changelog


author: John Dennis <jdennis@redhat.com> - 0.13.1-1
changelog:
  - Resolves: rhbz#1481332 Upgrade to current upstream 0.13.1
  - Adds the following upstream bug fixes on top of 0.13.1:
    * ee97812 Add Mellon User Guide
    * daa5d1e If no IdP's are defined explicitly log that fact
    * c291232 Make MellonUser case-insensitive.
    * 2c2e19d Fix incorrect error check for many `lasso_*`-functions.
    * 5c5ed1d Fix segmentation fault with POST field without a value.
    * 4c924d9 Fix some log message typos
    * 93faba4 Update log msg for Invalid Destination and Invalid Audience to
      show both the expected and received values.
  - Add new mellon user guide to installed docdir


author: John Dennis <jdennis@redhat.com> - 0.13.1-2
changelog:
  - Resolves: rhbz#1553854 Add diagnostic logging
  - Add MellonSignatureMethod config option to set signature method used
    to sign SAML messages sent by Mellon. Defaults to original sha1.


author: John Dennis <jdennis@redhat.com> - 0.13.1-3
changelog:
  - Resolves: rhbz#1553854 Add diagnostic logging
  - Add README.redhat.rst doc, explains how to enable diagnostic logging


author: Jan Kaluza <jkaluza@redhat.com> - 3.4-7
changelog:
  - compile with -fno-strict-aliasing to workaround Python
    bug http://www.python.org/dev/peps/pep-3123/


author: Thomas Woerner <twoerner@redhat.com> - 2.3.4-8
changelog:
  - mwm: do not see outline of window when moving (RHBZ#1080548)
    Clone of RHBZ#997241
  - Fixed rendering issues seen while scrolling window (RHBZ#1134365)
    (MotifZone bug #1654)


author: Thomas Woerner <twoerner@redhat.com> - 2.3.4-9
changelog:
  - Fixed motif issue while navigating drop down menus with arrow keys
    (RHBZ#1396514) (MotifZone bug #1564)


author: Carlos Soriano <csoriano@redhat.com> - 2.3.4-10
changelog:
  - Fix last commit that is actually MotifZone#1565 and removes that patch since
    it was causing more problems. Fixes MotifZone#1576.
    Resolves: rhbz#1448509


author: Carlos Soriano <csoriano@redhat.com> - 2.3.4-13
changelog:
  - Fix motifzone 1665. Motif was deactivating shorcuts in cascade menus when
    closing them by mouse.
    Resolves: RHBZ#1467303


author: Matej Muzila <mmuzila@redhat.com> - 5:1.5.21-27
changelog:
  - Resolves #1388511 (System default CA bundle not set as default in compiled-in
    default or config)
  - Resolves #1388512 (mutt sends e-mail with broken "From" header, which has no
    host part)


author: Florian Müllner <fmuellner@redhat.com> - 3.26.2-7
changelog:
  - Fix crash during session saving
    Resolves: #1535080
  - Fix XWayland prevented from starting
    Resolves: #1540986


author: Carlos Garnacho <cgarnach@redhat.com> - 3.26.2-10
changelog:
  - Detect CLUTTER_TOUCHPAD_DEVICE on all Synaptics devices
    Resolves: #1499788
  - Fix tablet pressure curve configuration not being applied
    Resolves: #1543693


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-27
changelog:
  - Allow clients to use UDPv6 addresses without 'udp6:' prefix (#1326850)
  - snmpd: Speed up ipAddressTable loading. (#1327240)
  - Fixed net-snmp segfault in netsnmp_copy_fd_set_to_large_fd_set (#1327200)
  - Fixed issue with net-snmp-perl dependency on net-snmp-devel (#1438875)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-29
changelog:
  - Move net-snmp-config from devel package to general package (#1486733)
  - Fix SCTP parser (#1329338)
  - Fix strstr() crash (#1428609)
  - Add support for TCP and UDP 64 bit counters (#1448082)
  - Fix documentation lack for includeFile, includeDir and includeSearch options (#1464485)
  - Fix wrong usage of structure iterator (#1461666)
  - Fix issue with statistics from autofs (#1501144)


author: Elio Maldonado <emaldona@redhat.com> 4.10.6-2
changelog:
  - Generic 32/64 bit platform detection (fix ppc64le build)
  - Resolves: Bug 1126243 - Ensure nspr is built for 64 bit on ppc64le


author: Elio Maldonado <emaldona@redhat.com> - 4.10.6-3
changelog:
  - Restore s390x related patch as it hasn't been applied upstream yet
  - Resolves: Bug 1103250 - Rebase RHEL 7.1 to NSPR 4.10.6 (for FF 31)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269363 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Elio Maldonado <emaldona@redhat.com> - 4.11.0-1
changelog:
  - Rebase to NSPR 4.11
  - Resolves: Bug 1297941 - Rebase RHEL 7.3 to NSS 3.21 in preparation for Firefox 45


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-3
changelog:
  - Decrease the iteration count of PKCS#12 for compatibility with Windows
  - Fix deadlock when a token is re-inserted while a client process is running


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-7
changelog:
  - Backport upstream fix for CVE-2018-12384
  - Remove nss-lockcert-api-change.patch, which turned out to be a
    mistake (the symbol was not exported from libnss)


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-0.1.beta
changelog:
  - Update to NSS 3.36 BETA
  - Remove upstreamed nss-softokn-3.16-add_encrypt_derive.patch
  - Remove upstreamed nss-softokn-3.28-fix-fips-login.patch
  - Remove upstreamed nss-softokn-fix-ecc-post.patch


author: Matus Honek <mhonek@redhat.com> - 2.4.44-10
changelog:
  - Drop update-ppolicy-schema.sh scriptlet's output (#1487857)
  - Fix issues in MozNSS compatibility layer (#1400578)
    + Force write file with fsync to avoid race conditions
    + Always filestamp both sql and dbm NSS DB variants to not rely on default DB type prefix
    + Allow missing cert and key which is a valid usecase
    + Create extraction folder only in /tmp to simplify selinux rules
    + Fix Covscan issues


author: Matus Honek <mhonek@redhat.com> - 2.4.44-11
changelog:
  - MozNSS Compat. Layer: Enable usage of NSS DB with PEM cert/key (#1525485)
    + Fix a possible invalid dereference (covscan)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-12
changelog:
  - MozNSS Compat. Layer: Ensure consistency of a PEM dir before usage (#1516409)
    + Warn just before use of a PIN about key file extraction


author: Matus Honek <mhonek@redhat.com> - 2.4.44-13
changelog:
  - MozNSS Compat. Layer: fix recursive directory deletion (#1516409)
  - MozNSS Compat. Layer: fix PIN disclaimer not always shown (#1516409)
  - MozNSS Compat. Layer: fix incorrect parsing of CACertDir (#1533955)


author: Martin Preisler <mpreisle@redhat.com> - 1.2.14-2
changelog:
  - RPM probes to return not applicable on non-rpm systems (#1447629)
  - fixed sysctl tests on s390x architecture (#1447649)
  - Revert warning by default in oscap tool, our message categories are not ready for it (#1447341)


author: Jan Černý <jcerny@redhat.com> - 1.2.15-1
changelog:
  - upgrade to the latest upstream release
  - short profile names can be used instead of long IDs
  - new option --rule allows to evaluate only a single rule
  - new option --fix-type in "oscap xccdf generate fix" allows choosing
    remediation script type without typing long URL
  - "oscap info" shows profile titles
  - OVAL details in HTML report are easier to read
  - HTML report is smaller because unselected rules are removed
  - HTML report supports NIST 800-171 and CJIS
  - remediation scripts contain headers with useful information (#1439813)
  - remediation scripts report progress when they run
  - basic support for Oracle Linux (CPEs, runlevels)
  - remediation scripts can be generated from datastreams that contain
    multiple XCCDF benchmarks
  - basic support for OVAL 5.11.2 (only schemas, no features)
  - enabled offline RPM database in rpminfo probe
  - added Fedora 28 CPE
  - fixed oscap-docker with Docker >= 2.0
  - fixed behavior of sysctl probe to be consistent with sysctl tool
  - fixed generating remediation scripts
  - severity of tailored rules is not discarded
  - fixed errors in RPM probes initialization
  - oscap-docker shows all warnings reported by oscap
  - fixed pkgconfig file


author: Matěj Týč <matyc@redhat.com> - 1.2.16-1
changelog:
  - upgrade to the latest upstream release
  - moved oscap-chroot to openscap-scanner because it's a thin wrapper script with no dependencies


author: Matěj Týč <matyc@redhat.com> - 1.2.16-2
changelog:
  - moved oscap-docker to newly created openscap-containers.
  - moved man of oscap-chroot to oscap-scanner.


author: William Cohen <wcohen@redhat.com> - 0.9.9-17
changelog:
  - Define some  Intel broadwell default unit masks by names
  - Add support for Harrisonville (Denverton SoC)
  - Add support for Skylake-SP server
  - Add support for Kabylake-U/Y
  - Add support for Kabylake-H/S
  - Make Nehalem, Westmere, and Haswell event names unique.


author: William Cohen <wcohen@redhat.com> - 0.9.9-22
changelog:
  - Update ppc64/ppc64le support. rhbz1385007
  - Add recognition check for POWER8NV and POWER8NVL. rhbz1426426


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-4
changelog:
  - Rebase to upstream 1a4ef7d180e77bcd6423f342d62e05e516c4e852 (1.1.18-rc4)
  - Resolves: rhbz#1381754
  - Resolves: rhbz#1474428
  - Resolves: rhbz#1499217
  - Resolves: rhbz#1508373


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-5
changelog:
  - Properly clean up primitive inside bundle
  - Scalability improvements
  - Resolves: rhbz#1499217
  - Resolves: rhbz#1508373


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-6
changelog:
  - Rebase to upstream 2b07d5c5a908998891c3317faa30328c108d3a91 (1.1.18)
  - If on-fail=ignore, migration-threshold should also be ignored
  - Resolves: rhbz#1474428
  - Resolves: rhbz#1507344


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-7
changelog:
  - Avoid node attribute write delay when corosync.conf has only IP addresses
  - Fix regressions in "pcs resource cleanup" behavior
  - Restore ordering of unfencing before fence device starts
  - Ensure --wait options work when bundles are in use
  - Fix possible invalid transition with bundle ordering constraints
  - Resolves: rhbz#1454960
  - Resolves: rhbz#1508350
  - Resolves: rhbz#1517796
  - Resolves: rhbz#1519812
  - Resolves: rhbz#1522822


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-10
changelog:
  - Always trigger transition when quorum changes
  - Match clone names correctly with crm_resource --cleanup
  - Fix pcs resource --wait timeout when bundles are used
  - Observe colocation constraints correctly with bundles in master role
  - Resolves: rhbz#1464068
  - Resolves: rhbz#1508350
  - Resolves: rhbz#1519812
  - Resolves: rhbz#1527072


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-11.1
changelog:
  - Do not schedule notifications for unrunnable actions
  - Do not expire remote failures if fencing is pending
  - Do not consider attribute order difference as CIB change in crm_diff
  - Resolves: rhbz#1563345
  - Resolves: rhbz#1566533
  - Resolves: rhbz#1568720


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-11.3
changelog:
  - Fix regression in handling of mixed-case node names
  - Avoid multiple recovery of stonith devices
  - Resolves: rhbz#1583747
  - Resolves: rhbz#1585741


author: Ivan Devat <idevat@redhat.com> - 0.9.158-6
changelog:
  - It is now possible to disable, enable, unmanage and manage bundle resources and set their meta attributes
  - Fixed timeout when cluster setup takes long time in web UI
  - It is now mandatory to specify container type in the "resource bundle create" command
  - Resolves: rhbz#1447910 rhbz#1284404


author: Ivan Devat <idevat@redhat.com> - 0.9.160-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1499749 rhbz#1443647 rhbz#1432283 rhbz#1421702 rhbz#1443418 rhbz#1464781 rhbz#1435697 rhbz#1441673 rhbz#1420437 rhbz#1388783 rhbz#1463327 rhbz#1418199 rhbz#1341582 rhbz#1489682 rhbz#1491631 rhbz#1213946


author: Ivan Devat <idevat@redhat.com> - 0.9.161-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1499749 rhbz#1415197 rhbz#1501274 rhbz#1502715 rhbz#1230919 rhbz#1503110


author: Ondrej Mular <omular@redhat.com> - 0.9.162-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1389943 rhbz#1389209 rhbz#1506220 rhbz#1508351 rhbz#1415197 rhbz#1506864 rhbz#1367808 rhbz#1499749


author: Ivan Devat <idevat@redhat.com> - 0.9.162-2
changelog:
  - Changed snmp agent logfile path
  - It is now possible to set the `action` option of stonith devices in GUI by using force
  - Do not crash when `--wait` is used in `pcs stonith create`
  - A warning is displayed in `pcs status` and a stonith device detail in web UI  when a stonith device has its `method` option set to `cycle`
  - Resolves: rhbz#1367808 rhbz#1421702 rhbz#1522813 rhbz#1523378


author: Ivan Devat <idevat@redhat.com> - 0.9.162-3
changelog:
  - Pcs now properly exits with code 1 when an error occurs in pcs cluster node add-remote and pcs cluster node add-guest commands
  - Fixed a crash in the pcs booth sync command
  - Resolves: rhbz#1464781 rhbz#1527530


author: Ondrej Mular <omular@redhat.com> - 0.9.162-5
changelog:
  - Fixed `pcs cluster auth` in a cluster when not authenticated and using a non-default port
  - Fixed `pcs cluster auth` in a cluster when previously authenticated using a non-default port and reauthenticating using an implicit default port
  - Resolves: rhbz#1415197


author: Ondrej Mular <omular@redhat.com> - 0.9.162-5.el7_5.1
changelog:
  - Fixed CVE-2018-1086 pcs: Debug parameter removal bypass, allowing information disclosure
  - Fixed CVE-2018-1079 pcs: Privilege escalation via authorized user malicious REST call
  - Fixed CVE-2018-1000119 rack-protection: Timing attack in authenticity_token.rb
  - Resolves: rhbz#1557253


author: Ondrej Mular <omular@redhat.com> - 0.9.162-5.el7_5.2
changelog:
  - Fix instance attributes setting for fence agents `fence_compute` and `fence_evacuate`
  - Resolves: rhbz#1628070


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-5
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    (RHEL)
  - Bugzilla Bug #1466066 - CC: Secure removal of secret data storage
    (jmagne)
  - Bugzilla Bug #1518096 - ExternalCA: Failures in ExternalCA when tried to
    setup with CMC signed certificates (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-6
changelog:
  - Updated jss, nuxwdog, and openssl dependencies
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    (RHEL)
  - Bugzilla Bug #1402280 - CA Cloning: Failed to update number range in
    few cases (ftweedal)
  - Bugzilla Bug #1428021 - CC: shared token storage and retrieval
    mechanism (cfu)
  - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false
    would cause error (cfu)
  - Bugzilla Bug #1498957 - pkidestroy does not work with nuxwdog
     (alee)
  - Bugzilla Bug #1520277 - PR_FILE_NOT_FOUND_ERROR during
    pkispawn (alee)
  - Bugzilla Bug #1520526 - p12 admin certificate is missing when
    certificate is signed Externally (edewata)
  - Bugzilla Bug #1523410 - Unable to have non "pkiuser" owned CA
     instance (alee)
  - Bugzilla Bug #1523443 - HAProxy rejects OCSP responses due to
    missing nextupdate field (ftweedal)
  - Bugzilla Bug #1526881 - Not able to setup CA with ECC (mharmsen)
  - Bugzilla Bug #1532759 - pkispawn seems to be leaving our passwords
    in several different files after installation completes (alee)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-7
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event
    set (RHEL) (edewata)
  - Bugzilla Bug #1522938 - CC: Missing faillure resumption detection and
    audit event logging at startup (jmagne)
  - Bugzilla Bug #1523410 -  Unable to have non "pkiuser" owned CA instance
    (alee)
  - Bugzilla Bug #1525306 - CC: missing CMC request and response record
    (cfu)
  - Bugzilla Bug #1532933 - Installing subsystems with external CMC
    certificates in HSM environment shows import error (edewata)
  - Bugzilla Bug #1535797 - ExternalCA: Failures when installed with hsm
    (edewata)
  - Bugzilla Bug #1539125 - restrict default cipher suite to those ciphers
    permitted in fips mode (mharmsen)
  - Bugzilla Bug #1539198 - Inconsistent CERT_REQUEST_PROCESSED
    outcomes. (edewata)
  - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in
    SharedToken scenario's (cfu)
  - Bugzilla Bug #1541526 - CMC: Revocation works with an unknown
    revRequest.issuer (cfu)
  - Bugzilla Bug #1541853 - ProfileService: config values with
    backslashes have backslashes removed (ftweedal)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,
    - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit
    - # Bugzilla Bug #1501436 - TPS CS.cfg should be reflected with the


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-8
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1542210 - pki console configurations that involves ldap
    passwords leave the plain text password in debug logs (jmagne)
  - Bugzilla Bug #1543242 - Regression in lightweight CA key replication
    (ftweedal)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-9
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event
    set (RHEL) (edewata)
  - Bugzilla Bug #1532867 - Inconsistent key ID encoding (edewata)
  - Bugzilla Bug #1540687 - CC: External OCSP Installation failure with HSM
    and FIPS (edewata)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,
    - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit event


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-10
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1550581 - CMCAuth throws
    org.mozilla.jss.crypto.TokenException: Unable to insert certificate into
    temporary database [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1551067 - [MAN] Add --skip-configuration
    and --skip-installation into pkispawn man page. [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1552241 - Make sslget aware of TLSv1_2 ciphers
    [rhel-7.5.z] (cheimes, mharmsen)
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry
    in a certifcate [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for
    standard conformance [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1554727 - Permit additional FIPS ciphers to be enabled
    by default for RSA . . . [rhel-7.5.z] (mharmsen, cfu)
  - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools
    CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1557883 - Console: Adding ACL from pki-console gives
    StringIndexOutOfBoundsException [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1558919 - Not able to generate certificate request
    with ECC using pki client-cert-request [rhel-7.5.z] (akahat)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1560233 - libtps does not directly depend on libz


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-11
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for
    standard conformance [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools
    CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1560233 - libtps does not directly depend on libz


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-12
changelog:
  - Updated "jss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1571582 - [MAN] Missing Man pages for tools CMCRequest,
    CMCResponse, CMCSharedToken (typos) [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1572548 - IPA install with external-CA is failing when
    FIPS mode enabled. [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1575521 - subsystem -> subsystem SSL handshake issue
    with TLS_ECDHE_RSA_* on Thales HSM [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581134 - ECC installation for non CA subsystems needs
    improvement [rhel-7.5.z] (jmagne)
  - Bugzilla Bug #1581135 - SAN in internal SSL server certificate in
    pkispawn configuration step [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581167 - CC: CMC profiles: Some CMC profiles have wrong
    input class_id [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581382 - ECDSA Certificates Generated by Certificate System
    9.3 fail NIST validation test with parameter field. [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-13
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd
    entry in a certifcate [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1585945 - CMC CRMF requests result in
    InvalidKeyFormatException when signing algorithm is ECC
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1587826 - ExternalCA: Installation failed during
    csr generation with ecc [rhel-7.5.z] (rrelyea, gkapoor)
  - Bugzilla Bug #1588944 - Cert validation for installation with
    external CA cert [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1588945 - CRMFPopClient tool - should allow
    option to do no key archival (cfu)
  - Bugzilla Bug #1589307 - CVE-2018-1080 pki-core: Mishandled
    ACL configuration in AAclAuthz.java reverses rules that allow
    and deny access [rhel-7.5.z] (ftweedal, cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-14
changelog:
  - Updated "jss" build and runtime requirements (mharmsen)
  - Updated "tomcatjss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1593585 - Need proper default subjectDN for CMC request
    authenticated through SharedToken [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1594128 - CMC: Audit Events needed for failures in
    SharedToken scenario's [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1595606 - AuditVerify failure due to line breaks
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1596525 - Address ECC profile overrides [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1596551 - X500Name.directoryStringEncodingOrder overridden
    by CSR encoding [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry in a
    certifcate [rhel-7.5.z] (ftweedal)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-15
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1600905 - pki console configurations that involves ldap
    passwords leave the plain text password in signed audit logs
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1611245 - Certificate generation happens with partial
    attributes in CMCRequest file [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1611250 - Better understanding of
    NSS_USE_DECODED_CKA_EC_POINT for ECC [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1612880 - CMC Revocations throws exception with
    same reqIssuer & certissuer [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1614837 - ipa-replica-install --setup-kra broken on
    DL0 with latest version [rhel-7.5.z] (abokovoy)
  - Bugzilla Bug #1614839 - CC: Enable all config audit events
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1615266 - ECC keys not supported for signing audit
    logs [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1539933 - keyGen fails when only Identity


author: Java SIG <java-devel@lists.fedoraproject.org> - 0:2.2-5
changelog:
  - Update for https://fedoraproject.org/wiki/Fedora_19_Maven_Rebuild
  - Replace maven BuildRequires with maven-local


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 0:2.3-1
changelog:
  - Update to upstream version 2.3
  - Use apache-commons-compress for bzip2 (de)compression
  - Resolves: CVE-2012-2098


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 0:2.4.2-2
changelog:
  - Update to latest packaging guidelines
  - Remove MIT license (only applies to test cases not binary rpm)


author: Pavel Kajaba <pkajaba@redhat.com> - 9.2.15-1
changelog:
  - update to 9.2.15 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-15.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.18-1
changelog:
  - update to 9.2.18 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-18.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-17.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-16.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.21-1
changelog:
  - update to 9.2.21 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-21.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-20.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-19.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.22-1
changelog:
  - update to 9.2.22 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-22.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.23-1
changelog:
  - update to 9.2.23 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-23.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.1002-4
changelog:
  - don't use removed macro %add_to_maven_depmap (#992816)
  - lint: trim-lines, reuse %{name} macro, fedora-review fixes
  - merge cleanup changes by Stano Ochotnicky


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.1002-6
changelog:
  - fix incompatibility with 9.6+ (rhbz#1547424)
  - it's unnecessary to depend on whole java (rhbz#1406931)


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-10
changelog:
  - Fixes sysinfo - devices with name longer than 20 chars are mistaken for partitions
  - Resolves: rhbz#1169349


author: Petr Viktorin <pviktori@redhat.com> - 2.7.5-63
changelog:
  - Make it more likely for the system allocator to release free()d memory arenas
  Resolves: rhbz#1468410


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-65
changelog:
  - Fix hanging of all threads when trying to access an inaccessible NFS server.
  Resolves: rhbz#1520068


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-68
changelog:
  - Add Conflicts tag with old virtualenv versions due to new behaviour of
    httplib (patch 295)
  Resolves: rhbz#1483438


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 1.4.6-4
changelog:
  - Append python-botocore and python-jmespath bundled directories to
    search path where needed

    Resolves: rhbz#1509439


author: Andy Grover <agrover@redhat.com> - 1:1.1.fb9-1
changelog:
  - New upstream release
  - Remove dependency on python-simpleparse in favor of pyparsing
  - Remove BuildRequires


author: Maurizio Lombardi <mlombard@redhat.com> - 1:1.1.fb23-4
changelog:
  - Fix failure when parsing parameters
  - Add 0003-Fix-failing-to-pasre-par-val-parameters.patch
  - Add 0004-Fix-failing-to-pasre-param-like-cfgstr-par-val.patch


author: Maurizio Lombardi <mlombard@redhat.com> - 2.1.fb63-5
changelog:
  - rtslib never creates hba directories without a storage object within it,
    but if under some circumstance these existed then we should remove them.


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.3.0-2.el7
changelog:
  - synchronized with qemu-kvm-rhev-2.3.0-9.el7
  - qemuga-Change-fsreeze-hook-default-location.patch [bz#1210707]
  - qemuga-qga-commands-posix-Fix-bug-in-guest-fstrim.patch [bz#1211973]
  - Resolves: bz#1210707
    (The default path '/etc/qemu/fsfreeze-hook' for 'fsfreeze-hook' script doesn't exist)
  - Resolves: bz#1211973
    ('guest-fstrim' failed for guest with os on spapr-vscsi disk)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.3.0-3.el7
changelog:
  - qemuga-Do-not-stop-qemu-guest-agent-service-on-target-switc.patch [bz#1160930]
  - Resolves: bz#1160930
    (The guest agent service in rhel7 guest will be stopped after run the init command)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.5.0-2.el7
changelog:
  - qemuga-redhat-blacklist-guest-exec-commands.patch [bz#1340346]
  - Resolves: bz#1340346
    (blacklist guest-exec in newer version of qemu-guest-agent)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.5.0-3.el7
changelog:
  - qemuga-spec-add-qemu-ga-man-page.patch [bz#1101556]
  - Resolves: bz#1101556
    ([RFE] qemu-ga should have a config file)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.8.0-1.el7
changelog:
  - Rebase to 2.8.0 base [bz#1414676]
  - Resolves: bz#1414676
    (Rebase qemu-guest-agent to 2.8.0 base)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.8.0-2.el7
changelog:
  - qemuga-Remove-unnecessary-dependencies.patch [bz#1441999]
  - Resolves: bz#1441999
    (Clean qemu-ga dependencies)


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 2.8.0-3.el7
changelog:
  - qemuga-qga-Add-guest-get-host-name-command.patch [bz#1598210]
  - qemuga-qga-Add-guest-get-users-command.patch [bz#1598210]
  - qemuga-qga-Add-guest-get-timezone-command.patch [bz#1598210]
  - qemuga-qemu-ga-check-if-utmpx.h-is-available-on-the-system.patch [bz#1598210]
  - qemuga-qemu-ga-add-guest-get-osinfo-command.patch [bz#1598210]
  - qemuga-test-qga-pass-environemnt-to-qemu-ga.patch [bz#1598210]
  - qemuga-test-qga-add-test-for-guest-get-osinfo.patch [bz#1598210]
  - Resolves: bz#1598210
    (Backport some features to 2.8 in RHEL 7.5 [rhel-7.5.z])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 2.8.0-2.el7_5.1
changelog:
  - Corrected the package version from 2.8.0-3.el7 to 2.8.0-2.el7_5.1
  - Resolves: bz#1598210
    (Backport some features to 2.8 in RHEL 7.5 [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-14.el7
changelog:
  - kvm-spapr-don-t-initialize-PATB-entry-if-max-cpu-compat-.patch [bz#1525866]
  - kvm-block-avoid-recursive-AioContext-acquire-in-bdrv_ina.patch [bz#1520824]
  - kvm-io-send-proper-HTTP-response-for-websocket-errors.patch [bz#1518649]
  - kvm-io-include-full-error-message-in-websocket-handshake.patch [bz#1518649]
  - kvm-io-use-case-insensitive-check-for-Connection-Upgrade.patch [bz#1518649]
  - kvm-ui-Always-remove-an-old-VNC-channel-watch-before-add.patch [bz#1518649]
  - kvm-io-Small-updates-in-preparation-for-websocket-change.patch [bz#1518649]
  - kvm-io-Add-support-for-fragmented-websocket-binary-frame.patch [bz#1518649]
  - kvm-io-Allow-empty-websocket-payload.patch [bz#1518649]
  - kvm-io-Ignore-websocket-PING-and-PONG-frames.patch [bz#1518649]
  - kvm-io-Reply-to-ping-frames.patch [bz#1518649]
  - kvm-io-Attempt-to-send-websocket-close-messages-to-clien.patch [bz#1518649]
  - kvm-io-add-trace-events-for-websockets-frame-handling.patch [bz#1518649]
  - kvm-io-monitor-encoutput-buffer-size-from-websocket-GSou.patch [bz#1518650]
  - kvm-io-simplify-websocket-ping-reply-handling.patch [bz#1518649]
  - kvm-io-get-rid-of-qio_channel_websock_encode-helper-meth.patch [bz#1518649]
  - kvm-io-pass-a-struct-iovec-into-qio_channel_websock_enco.patch [bz#1518649]
  - kvm-io-get-rid-of-bounce-buffering-in-websock-write-path.patch [bz#1518649]
  - kvm-io-cope-with-websock-Connection-header-having-multip.patch [bz#1518649]
  - kvm-io-add-trace-points-for-websocket-HTTP-protocol-head.patch [bz#1518649]
  - kvm-io-fix-mem-leak-in-websock-error-path.patch [bz#1518649]
  - kvm-io-Add-missing-GCC_FMT_ATTR-fix-Werror-suggest-attri.patch [bz#1518649]
  - kvm-qemu.py-make-VM-a-context-manager.patch [bz#1519721]
  - kvm-iotests.py-add-FilePath-context-manager.patch [bz#1519721]
  - kvm-qemu-iothread-IOThread-supports-the-GMainContext-eve.patch [bz#1519721]
  - kvm-qom-provide-root-container-for-internal-objs.patch [bz#1519721]
  - kvm-iothread-provide-helpers-for-internal-use.patch [bz#1519721]
  - kvm-iothread-export-iothread_stop.patch [bz#1519721]
  - kvm-iothread-delay-the-context-release-to-finalize.patch [bz#1519721]
  - kvm-aio-fix-assert-when-remove-poll-during-destroy.patch [bz#1519721]
  - kvm-blockdev-hold-AioContext-for-bdrv_unref-in-external_.patch [bz#1519721]
  - kvm-block-don-t-keep-AioContext-acquired-after-external_.patch [bz#1519721]
  - kvm-block-don-t-keep-AioContext-acquired-after-drive_bac.patch [bz#1519721]
  - kvm-block-don-t-keep-AioContext-acquired-after-blockdev_.patch [bz#1519721]
  - kvm-block-don-t-keep-AioContext-acquired-after-internal_.patch [bz#1519721]
  - kvm-iothread-add-iothread_by_id-API.patch [bz#1519721]
  - kvm-blockdev-add-x-blockdev-set-iothread-testing-command.patch [bz#1519721]
  - kvm-qemu-iotests-add-202-external-snapshots-IOThread-tes.patch [bz#1519721]
  - kvm-blockdev-add-x-blockdev-set-iothread-force-boolean.patch [bz#1519721]
  - kvm-iotests-add-VM.add_object.patch [bz#1519721]
  - kvm-iothread-fix-iothread_stop-race-condition.patch [bz#1519721]
  - kvm-qemu-iotests-add-203-savevm-with-IOThreads-test.patch [bz#1519721]
  - Resolves: bz#1518649
    (Client compatibility flaws in VNC websockets server)
  - Resolves: bz#1518650
    (CVE-2017-15268 qemu-kvm-rhev: Qemu: I/O: potential memory exhaustion via websock connection to VNC [rhel-7.5])
  - Resolves: bz#1519721
    (Both qemu and guest hang when performing live snapshot transaction with data-plane)
  - Resolves: bz#1520824
    (Migration with dataplane, qemu processor hang, vm hang and migration can't finish)
  - Resolves: bz#1525866
    (P9 to P8 guest migration fails when kernel is not started)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-15.el7
changelog:
  - kvm-target-i386-add-support-for-SPEC_CTRL-MSR.patch [CVE-2017-5715]
  - kvm-target-i386-cpu-add-new-CPUID-bits-for-indirect-bran.patch [CVE-2017-5715]
  - kvm-target-i386-cpu-add-new-CPU-models-for-indirect-bran.patch [CVE-2017-5715]


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-16.el7
changelog:
  - kvm-gicv3-Convert-to-DEFINE_PROP_LINK.patch [bz#1513323]
  - kvm-hw-intc-arm_gicv3_its-Fix-the-VM-termination-in-vm_c.patch [bz#1513323]
  - kvm-hw-intc-arm_gicv3_its-Don-t-abort-on-table-save-fail.patch [bz#1513323]
  - kvm-hw-intc-arm_gicv3_its-Don-t-call-post_load-on-reset.patch [bz#1513323]
  - kvm-hw-intc-arm_gicv3_its-Implement-a-minimalist-reset.patch [bz#1513323]
  - kvm-linux-headers-Partial-header-update-against-v4.15-rc.patch [bz#1513323]
  - kvm-hw-intc-arm_gicv3_its-Implement-full-reset.patch [bz#1513323]
  - kvm-block-throttle-groups.c-allocate-RestartData-on-the-.patch [bz#1525868]
  - kvm-redhat-Fix-permissions-of-dev-kvm-on-a-freshly-boote.patch [bz#1527947]
  - Resolves: bz#1513323
    (vITS reset)
  - Resolves: bz#1525868
    (Guest hit core dump with both IO throttling and data plane)
  - Resolves: bz#1527947
    (Pegas1.1 - virsh domcapabilities doesn't report KVM capabilities on s390x)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-17.el7
changelog:
  - kvm-tools-kvm_stat-fix-command-line-option-g.patch [bz#1529676]
  - kvm-redhat-globally-limit-the-maximum-number-of-CPUs.patch [bz#1527449]
  - kvm-redhat-remove-manual-max_cpus-limitations-for-ppc.patch [bz#1527449]
  - kvm-dump-guest-memory.py-fix-You-can-t-do-that-without-a.patch [bz#1398633]
  - kvm-hw-ppc-spapr.c-abort-unplug_request-if-previous-unpl.patch [bz#1528173]
  - kvm-spapr-Correct-compatibility-mode-setting-for-hotplug.patch [bz#1528234]
  - kvm-ui-fix-dcl-unregister.patch [bz#1510809]
  - kvm-block-Open-backing-image-in-force-share-mode-for-siz.patch [bz#1526212]
  - kvm-fw_cfg-fix-memory-corruption-when-all-fw_cfg-slots-a.patch [bz#1462145]
  - kvm-block-Don-t-use-BLK_PERM_CONSISTENT_READ-for-format-.patch [bz#1515604]
  - kvm-block-Don-t-request-I-O-permission-with-BDRV_O_NO_IO.patch [bz#1515604]
  - kvm-block-Formats-don-t-need-CONSISTENT_READ-with-NO_IO.patch [bz#1515604]
  - Resolves: bz#1398633
    ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm-rhev))
  - Resolves: bz#1462145
    (Qemu crashes when all fw_cfg slots are used)
  - Resolves: bz#1510809
    (qemu-kvm core dumped when booting up guest using both virtio-vga and VGA)
  - Resolves: bz#1515604
    (qemu-img info: failed to get "consistent read" lock on a mirroring image)
  - Resolves: bz#1526212
    (qemu-img should not need a write lock for creating the overlay image)
  - Resolves: bz#1527449
    (qemu-kvm-ma: vCPU count should be limited to 240 on all arches)
  - Resolves: bz#1528173
    (Hot-unplug memory  during booting early stage induced qemu-kvm coredump)
  - Resolves: bz#1528234
    (Pegas1.1 Alpha: Hotplugged vcpu does not guarantee CPU P8compat mode on POWER9 host (qemu-kvm))
  - Resolves: bz#1529676
    (kvm_stat: option '--guest' doesn't work)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-18.el7
changelog:
  - kvm-serial-always-transmit-send-receive-buffers-on-migra.patch [bz#1459945]
  - kvm-hw-acpi-Move-acpi_set_pci_info-to-pcihp.patch [bz#1507693]
  - kvm-scsi-block-Add-share-rw-option.patch [bz#1518482]
  - kvm-scsi-generic-Add-share-rw-option.patch [bz#1518482]
  - kvm-target-i386-sanitize-x86-MSR_PAT-loaded-from-another.patch [bz#1529461]
  - kvm-scsi-disk-release-AioContext-in-unaligned-WRITE-SAME.patch [bz#1526423]
  - kvm-hw-pci-bridge-fix-QEMU-crash-because-of-pcie-root-po.patch [bz#1520858]
  - kvm-spapr-Capabilities-infrastructure.patch [bz#1523414]
  - kvm-spapr-Treat-Hardware-Transactional-Memory-HTM-as-an-.patch [bz#1523414]
  - kvm-spapr-Validate-capabilities-on-migration.patch [bz#1523414]
  - kvm-spapr-Handle-VMX-VSX-presence-as-an-spapr-capability.patch [bz#1523414]
  - kvm-spapr-Handle-Decimal-Floating-Point-DFP-as-an-option.patch [bz#1523414]
  - kvm-hw-ppc-spapr_caps-Rework-spapr_caps-to-use-uint8-int.patch [bz#1523414]
  - kvm-spapr-Remove-unnecessary-options-field-from-sPAPRCap.patch [bz#1523414]
  - kvm-ppc-Change-Power9-compat-table-to-support-at-most-8-.patch [bz#1529243]
  - kvm-target-ppc-Clarify-compat-mode-max_threads-value.patch [bz#1529243]
  - kvm-spapr-Allow-some-cases-where-we-can-t-set-VSMT-mode-.patch [bz#1529243]
  - kvm-spapr-Adjust-default-VSMT-value-for-better-migration.patch [bz#1529243]
  - kvm-qemu-img-info-Force-U-downstream.patch [bz#1535992]
  - kvm-dump-guest-memory.py-fix-python-2-support.patch [bz#1398633]
  - kvm-spapr-fix-device-tree-properties-when-using-compatib.patch [bz#1535752]
  - Resolves: bz#1398633
    ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm-rhev))
  - Resolves: bz#1459945
    (migration fails with hungup serial console reader on -M pc-i440fx-rhel7.0.0 and pc-i440fx-rhel7.1.0)
  - Resolves: bz#1507693
    (Unable to hot plug device to VM reporting libvirt errors.)
  - Resolves: bz#1518482
    ("share-rw" property is unavailable on scsi passthrough devices)
  - Resolves: bz#1520858
    (qemu-kvm core dumped when booting guest with more pcie-root-ports than available slots and io-reserve=0)
  - Resolves: bz#1523414
    ([POWER guests] Verify compatible CPU & hypervisor capabilities across migration)
  - Resolves: bz#1526423
    (QEMU hang with data plane enabled after some sg_write_same operations in guest)
  - Resolves: bz#1529243
    (Migration from P9 to P8, migration failed and qemu quit on dst end with "error while loading state for instance 0x0 of device 'ics'")
  - Resolves: bz#1529461
    (On amd hosts, after migration from rhel6.9.z to rhel7.5, CPU utilization of qemu-kvm is always more than 100% on destination rhel7.5 host)
  - Resolves: bz#1535752
    (Device tree incorrectly advertises compatibility modes for secondary CPUs)
  - Resolves: bz#1535992
    (Set force shared option "-U" as default option for "qemu-img info")


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-19.el7
changelog:
  - kvm-Drop-105th-key-from-en-us-keymap.patch [bz#1513870]
  - kvm-linux-headers-update.patch [bz#1535606]
  - kvm-s390x-kvm-Handle-bpb-feature.patch [bz#1535606]
  - kvm-s390x-kvm-provide-stfle.81.patch [bz#1535606]
  - kvm-osdep-Retry-SETLK-upon-EINTR.patch [bz#1529053]
  - kvm-vga-check-the-validation-of-memory-addr-when-draw-te.patch [bz#1534682]
  - kvm-usb-storage-Fix-share-rw-option-parsing.patch [bz#1525324]
  - kvm-spapr-disable-memory-hotplug.patch [bz#1535952]
  - Resolves: bz#1513870
    (For VNC connection, characters '|' and '<' are both recognized as '>' in linux guests, while '<' and '>' are both recognized as '|' in windows guest)
  - Resolves: bz#1525324
    (2 VMs both with 'share-rw=on' appending on '-device usb-storage' for the same source image can not be started at the same time)
  - Resolves: bz#1529053
    (Miss the handling of EINTR in the fcntl calls made by QEMU)
  - Resolves: bz#1534682
    (CVE-2018-5683 qemu-kvm-rhev: Qemu: Out-of-bounds read in vga_draw_text routine [rhel-7.5])
  - Resolves: bz#1535606
    (Spectre mitigation patches for qemu-kvm-ma on z Systems)
  - Resolves: bz#1535952
    (qemu-kvm-ma differentiation - memory hotplug)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-20.el7
changelog:
  - kvm-console-fix-dpy_gfx_replace_surface-assert.patch [bz#1505696]
  - kvm-ui-add-tracing-of-VNC-operations-related-to-QIOChann.patch [bz#1527404]
  - kvm-ui-add-tracing-of-VNC-authentication-process.patch [bz#1527404]
  - kvm-ui-remove-sync-parameter-from-vnc_update_client.patch [bz#1527404]
  - kvm-ui-remove-unreachable-code-in-vnc_update_client.patch [bz#1527404]
  - kvm-ui-remove-redundant-indentation-in-vnc_client_update.patch [bz#1527404]
  - kvm-ui-avoid-pointless-VNC-updates-if-framebuffer-isn-t-.patch [bz#1527404]
  - kvm-ui-track-how-much-decoded-data-we-consumed-when-doin.patch [bz#1527404]
  - kvm-ui-introduce-enum-to-track-VNC-client-framebuffer-up.patch [bz#1527404]
  - kvm-ui-correctly-reset-framebuffer-update-state-after-pr.patch [bz#1527404]
  - kvm-ui-refactor-code-for-determining-if-an-update-should.patch [bz#1527404]
  - kvm-ui-fix-VNC-client-throttling-when-audio-capture-is-a.patch [bz#1527404]
  - kvm-ui-fix-VNC-client-throttling-when-forced-update-is-r.patch [bz#1527404]
  - kvm-ui-place-a-hard-cap-on-VNC-server-output-buffer-size.patch [bz#1527404]
  - kvm-ui-add-trace-events-related-to-VNC-client-throttling.patch [bz#1527404]
  - kvm-ui-mix-misleading-comments-return-types-of-VNC-I-O-h.patch [bz#1527404]
  - kvm-ui-avoid-sign-extension-using-client-width-height.patch [bz#1527404]
  - kvm-ui-correctly-advance-output-buffer-when-writing-SASL.patch [bz#1527404]
  - kvm-dump-guest-memory.py-skip-vmcoreinfo-section-if-not-.patch [bz#1398633]
  - kvm-virtio-gpu-disallow-vIOMMU.patch [bz#1540182]
  - Resolves: bz#1398633
    ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm-rhev))
  - Resolves: bz#1505696
    (Qemu crashed when open the second display of virtio video)
  - Resolves: bz#1527404
    (CVE-2017-15124 qemu-kvm-rhev: Qemu: memory exhaustion through framebuffer update request message in VNC server [rhel-7.5])
  - Resolves: bz#1540182
    (QEMU: disallow virtio-gpu to boot with vIOMMU)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-21.el7
changelog:
  - kvm-migration-Recover-block-devices-if-failure-in-device.patch [bz#1538494]
  - kvm-migration-savevm.c-set-MAX_VM_CMD_PACKAGED_SIZE-to-1.patch [bz#1540003]
  - kvm-pci-bus-let-it-has-higher-migration-priority.patch [bz#1538953]
  - kvm-spapr-set-vsmt-to-MAX-8-smp_threads.patch [bz#1542421]
  - kvm-target-ppc-spapr_caps-Add-macro-to-generate-spapr_ca.patch [bz#1532050]
  - kvm-target-ppc-kvm-Add-cap_ppc_safe_-cache-bounds_check-.patch [bz#1532050]
  - kvm-target-ppc-spapr_caps-Add-support-for-tristate-spapr.patch [bz#1532050]
  - kvm-target-ppc-spapr_caps-Add-new-tristate-cap-safe_cach.patch [bz#1532050]
  - kvm-target-ppc-spapr_caps-Add-new-tristate-cap-safe_boun.patch [bz#1532050]
  - kvm-target-ppc-spapr_caps-Add-new-tristate-cap-safe_indi.patch [bz#1532050]
  - kvm-target-ppc-introduce-the-PPC_BIT-macro.patch [bz#1532050]
  - kvm-target-ppc-spapr-Add-H-Call-H_GET_CPU_CHARACTERISTIC.patch [bz#1532050]
  - kvm-spapr-add-missing-break-in-h_get_cpu_characteristics.patch [bz#1532050]
  - kvm-vfio-pci-Add-option-to-disable-GeForce-quirks.patch [bz#1508330]
  - kvm-Disable-GeForce-quirks-in-vfio-pci-for-RHEL-machines.patch [bz#1508330]
  - Resolves: bz#1508330
    (Interrupt latency issues with vGPU on KVM hypervisor.)
  - Resolves: bz#1532050
    ([CVE-2017-5754] Variant3: POWER {qemu-kvm-rhev} (rhel 7.5))
  - Resolves: bz#1538494
    (Guest crashed on the source host when cancel migration by virDomainMigrateBegin3Params sometimes)
  - Resolves: bz#1538953
    (IOTLB entry size mismatch before/after migration during DPDK PVP testing)
  - Resolves: bz#1540003
    (Postcopy migration failed with "Unreasonably large packaged state")
  - Resolves: bz#1542421
    (Pegas1.1 Snapshot1 [4.14.0-35.el7a.ppc64le] [qemu-kvm-ma-2.10.0-18.el7.ppc64le] qemu-kvm behaves incorrectly for guest boot with invalid threads)


author: Miroslav Rezanina <mrezanin@redhat.com> - ma-2.10.0-21.el7_5.1
changelog:
  - kvm-memory-inline-some-performance-sensitive-accessors.patch [bz#1554930]
  - kvm-address_space_write-address_space_to_flatview-needs-.patch [bz#1554930]
  - kvm-address_space_read-address_space_to_flatview-needs-R.patch [bz#1554930]
  - kvm-address_space_access_valid-address_space_to_flatview.patch [bz#1554930]
  - kvm-address_space_map-address_space_to_flatview-needs-RC.patch [bz#1554930]
  - kvm-address_space_rw-address_space_to_flatview-needs-RCU.patch [bz#1554930]
  - kvm-ppc-spapr-caps-Change-migration-macro-to-take-full-s.patch [bz#1554957]
  - kvm-ppc-spapr-caps-Disallow-setting-workaround-for-spapr.patch [bz#1554957]
  - kvm-target-ppc-Check-mask-when-setting-cap_ppc_safe_indi.patch [bz#1554957]
  - kvm-ppc-spapr-caps-Add-support-for-custom-spapr_capabili.patch [bz#1554957]
  - kvm-ppc-spapr-caps-Convert-cap-cfpc-to-custom-spapr-cap.patch [bz#1554957]
  - kvm-ppc-spapr-caps-Convert-cap-sbbc-to-custom-spapr-cap.patch [bz#1554957]
  - kvm-ppc-spapr-caps-Convert-cap-ibs-to-custom-spapr-cap.patch [bz#1554957]
  - kvm-ppc-spapr-caps-Define-the-pseries-2.12-sxxm-machine-.patch [bz#1554957]
  - kvm-redhat-Define-the-pseries-rhel7.5-sxxm-machine-type.patch [bz#1554957]
  - kvm-redhat-Define-the-pseries-rhel7.4-sxxm-machine-type.patch [bz#1554957]
  - kvm-redhat-Define-the-pseries-rhel7.3-sxxm-machine-type.patch [bz#1554957]
  - Resolves: bz#1554930
    (incorrect locking (possible use-after-free) with bug 1481593 fix [rhel-7.5.z])
  - Resolves: bz#1554957
    ([CVE-2017-5754] Variant3: POWER {qemu-kvm-ma} Add machine type variants [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - ma-2.10.0-21.el7_5.2
changelog:
  - kvm-block-Fix-flags-in-reopen-queue.patch [bz#1557206]
  - kvm-iotests-Add-regression-test-for-commit-base-locking.patch [bz#1557206]
  - kvm-vga-add-ram_addr_t-cast.patch [bz#1566878]
  - kvm-vga-fix-region-calculation.patch [bz#1566878]
  - Resolves: bz#1557206
    ([Regression] Cannot delete VM's snapshot [rhel-7.5.z])
  - Resolves: bz#1566878
    (CVE-2018-7858 qemu-kvm-ma: Qemu: cirrus: OOB access when updating vga display [rhel-7] [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - ma-2.10.0-21.el7_5.3
changelog:
  - kvm-scsi-disk-allow-customizing-the-SCSI-version.patch [bz#1593193]
  - kvm-hw-scsi-support-SCSI-2-passthrough-without-PI.patch [bz#1593193]
  - kvm-s390x-fix-storage-attributes-migration-for-non-small.patch [bz#1596553]
  - Resolves: bz#1593193
    (Pegas1.1 - SCSI pass-thru of aacraid RAID1 is inaccessible (qemu-kvm-ma) [rhel-7.5.z])
  - Resolves: bz#1596553
    (RHEL-Alt-7.5 - qemu has error during migration of larger guests [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - ma-2.10.0-21.el7_5.4
changelog:
  - kvm-slirp-correct-size-computation-while-concatenating-m.patch [bz#1586247]
  - kvm-slirp-reformat-m_inc-routine.patch [bz#1586247]
  - kvm-slirp-Correct-size-check-in-m_inc.patch [bz#1586247]
  - Resolves: bz#1586247
    (CVE-2018-11806 qemu-kvm-ma: QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams [rhel-7.5.z])


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-5
changelog:
  - cd to the correct directory before md5sum to fix BACKUP_INTEGRITY_CHECK.
    Upstream PR#1685, bz1532676


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-6
changelog:
  - Ensure that NetBackup is started automatically upon recovery (PR#1544)
    Also do not kill daemons spawned by sysinit.service at the service's end
    (PR#1610, applies to NetBackup and also to dhclient)
    Resolves #1506231
  - Print a warning if grub2-mkimage is about to fail and suggest what to do.
    bz#1492177
  - Update the patch for #1388653 to the one actually merged upstream (PR1418)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-7
changelog:
  - Backport upstream PR1383: Allow backup to be stored in ISO for ppc64/ppc64le
    Includes also commit 30099a98fdc1eab6373bc3682929bc4b9c09b54b.
    Resolves: #1596182


author: Radovan Sroka <rsroka@redhat.com> - 8.24.0-8
changelog:
  RHEL 7.4 ERRATUM
  - added dependency automake autoconf libtool due to yum-builddep
  - reenable omruleset module
    resolves: rhbz#1431615
    resolves: rhbz#1428403
    resolves: rhbz#1427821(fix regression, failed QA)
    resolves: rhbz#1432069
  - resolves: rhbz#1165236
    resolves: rhbz#1419228
    resolves: rhbz#1431616 
    resolves: rhbz#1196230(failed QA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-9
changelog:
  RHEL 7.4 ERRATUM
  - added autoreconf call
  - added patch to replace gethostbyname with getaddrinfo call
    resolves: rhbz#1056548(failed QA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-10
changelog:
  RHEL 7.4 ERRATUM
  - edited patches Patch19 and Patch21
    resolves: rhbz#1419228(coverity scan problems)
    resolves: rhbz#1056548(failed QA, coverity scan problems)


author: Radovan Sroka <rsroka@redhat.com> - 8.24.0-11
changelog:
  RHEL 7.4 ERRATUM
  - added new patch that backports num2ipv4 due to rhbz#1427821
    resolves: rhbz#1427821
  - enable pmrfc3164sd module
    resolves: rhbz#1431616


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-13
changelog:
  RHEL 7.5 ERRATUM
  - added patch to properly resolve FQDN
    resolves: rhbz#1401456
  - added documentation patch correcting qeues default values
    resolves: rhbz#1459896
  - added patch adjusting log level of journal reloaded msg
    resolves: rhbz#1497985 
  - added patch to prevent crash with invalid set statement
    this also obsoletes patch2 (for 1188503) 
    resolves: rhbz#1462160
  - added patch with nullptr check to prevent ABRT
    resolves: rhbz#1488186


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-14
changelog:
  RHEL 7.5 ERRATUM
  - renamed patch for undocumented recover_qi script to correct bz number
    resolves: rhbz#1507028
  - added patch ensuring relp conneciton is active before closing it
    resolves: rhbz#1505103


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-15
changelog:
  RHEL 7.5 ERRATUM
  - made rsyslog-doc noarch and fixed search on doc regeneration
    resolves: rhbz#1507028


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-16
changelog:
  RHEL 7.5 ERRATUM
  - edited the patch to conform to latest upstream doc
    resolves: rhbz#1459896 (failedQA)
  - disabled 32-bit builds on all arches as they are not shipped
    anymore in RHEL7


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-16.5
changelog:
  RHEL 7.5.z ERRATUM
  - fixed imjournal duplicating msgs under some conditions
    resolves: rhbz#1545582


author: Matěj Týč <matyc@redhat.com> - 0.1.36-5
changelog:
  - Patched not to check library ownership in libexec.
  - Patched to fix title of DISA STIG profile.
  - Patched to deprecate RhostsRSAAuthentication.
  - Patched to fix umask_for_daemons.


author: Watson Yuuma Sato <wsato@redhat.com> - 0.1.36-7
changelog:
  - Fix sshd_required unset (RHBZ#1522956)
  - Fix missing bash remediation functions include (RHBZ#1524738)
  - Fix empty columns in SRG HTML Table (RHBZ#1531105)
  - Fix reference to oudated PAM config manual (RHBZ#1447760)


author: Watson Yuuma Sato <wsato@redhat.com> - 0.1.36-8
changelog:
  - Allow AIDE to notify other emails than only root (RHBZ#1571315)
  - Fix some failing rules from profiles PCI-DSS, DISA STIG and USGCB (RHBZ#1571312)
  - Fix kernel module loading rules (RHBZ#1571319)


author: Matěj Týč <matyc@redhat.com> - 0.1.36-10
changelog:
  - Fix local/d typos in Ansible remediation (RHBZ#1592887)
  - Fix Ansible remediation of SELinux policies (RHBZ#1592970)
  - Fix Ansible remediation of login.defs umask (RHBZ#1592957)


author: Watson Yuuma Sato <wsato@redhat.com> - 0.1.36-1
changelog:
  - Update to upstream release 0.1.36
  - Introduction of SCAP Security Guide Test Suite
  - Better alignment of RHEL6 and RHEL7 with DISA STIG
  - Remove JBoss EAP5 content due to being End-of-Life
  - New STIG Profile for JBOSS EAP 6
  - Updates in C2S Profile for RHEL 7
  - Variables can be directly tailored in Ansible roles
  - Content presents less false positives in containers
  - Changes in directory layout


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-187
changelog:
  - Allow openvswitch_t domain to read cpuid, write to sysfs files and creating openvswitch_tmp_t sockets
  Resolves: rhbz#1535196
  - Add new interface ppp_filetrans_named_content()
  Resolves: rhbz#1530601
  - Allow keepalived_t read sysctl_net_t files
  Resolves: rhbz#1477542
  - Allow puppetmaster_t domtran to puppetagent_t
  Resolves: rhbz#1376893
  - Allow kdump_t domain to read kernel ring buffer
  Resolves: rhbz#1540004
  - Allow ipsec_t domain to exec ifconfig_exec_t binaries.
  Resolves: rhbz#1539416
  - Allow unconfined_domain_typ to create pppd_lock_t directory in /var/lock
  Resolves: rhbz#1530601
  - Allow updpwd_t domain to create files in /etc with shadow_t label
  Resolves: rhbz#1412838
  - Allow iptables sysctl load list support with SELinux enforced
  Resolves: rhbz#1535572


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-188
changelog:
  - Allow svirt_domain to create socket files in /tmp with label svirt_tmp_t
  Resolves: rhbz#1540702
  - Allow keepalived_t domain getattr proc filesystem
  Resolves: rhbz#1477542
  - Rename svirt_sandbox_file_t to container_file_t and svirt_lxc_net_t to container_t
  Resolves: rhbz#1538544
  - Allow ipsec_t nnp transistions to domains ipsec_mgmt_t and ifconfig_t
  Resolves: rhbz:#1539416
  - Allow systemd_logind_t domain to bind on dhcpd_port_t,pki_ca_port_t,flash_port_t
  Resolves: rhbz#1479350


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-189
changelog:
  - Allow dirsrv_t domain to create tmp link files
  Resolves: rhbz#1536011
  - Label /usr/sbin/ldap-agent as dirsrv_snmp_exec_t
  Resolves: rhbz#1428568
  - Allow ipsec_mgmt_t execute ifconfig_exec_t binaries
  - Allow ipsec_mgmt_t nnp domain transition to ifconfig_t
  Resolves: rhbz#1539416


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-190
changelog:
  - Allow openvswitch domain to manage svirt_tmp_t sock files
  Resolves: rhbz#1540702
  - Fix broken systemd_tmpfiles_run() interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-192
changelog:
  - Label /usr/libexec/dbus-1/dbus-daemon-launch-helper  as dbusd_exec_t to have systemd dbus services running in the correct domain instead of unconfined_service_t if unconfined.pp module is enabled.
  Resolves: rhbz#1546721


author: Pavel Moravec <pmoravec@redhat.com> = 3.4-7
changelog:
  - [openstack plugins] Tripleo specific containerized services
    Resolves: bz1463635
  - [jars] Scan only /usr/{share,lib}/java by default
    Resolves: bz1482574
  - [gluster_block] Added new plugin gluster_block
    Resolves: bz1491964


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-2
changelog:
  - [vdo] revise collected files
    Resolves: bz1509079
  - further updates to OSP plugins in containerized environment
    Resolves: bz1506908
  - [opendaylight] new plugin
    Resolves: bz1483414
  - collect all keystone domains
    Resolves: bz1491042
  - haproxy, etcd and docker tracebacks
    Resolves: bz1519267
  - [origin] fix typo in oc adm diagnostics
    Resolves: bz1463509
  - [postgresql] Call SCL pg_dump with proper path
    Resolves: bz1494420


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-4
changelog:
  - [pcp] really apply sizelimit to logs collected
    Resolves: bz1353873
  - [opendaylight] collect more logs and puppet config
    Resolves: bz1483414
  - [plugins] allow add_cmd_output to collect binary output
    Resolves: bz1494420
  - [openstack_ironic] collect drivers, ports and much more
    Resolves: bz1517767
  - [openstack_cinder] check for api service running
    Resolves: bz1506908


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-5
changelog:
  - [rabbitmq] Log collection when run in containerized OSP
    Resolves: bz1525620
  - [ipa] add KRA logs and correct PKI directories
    Resolves: bz1535390
  - [opendaylight] Enable plugin by puppet-opendaylight package
    Resolves: bz1483414
  - [etcd] Do not collect private etcd keys
    Resolves: bz1539038


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-7
changelog:
  - [kernel] Disable gathering /proc/timer* statistics
    Resolves: bz1568884
  - [openstack_octavia] Add new plugin
    Resolves: bz1568882
  - [ovirt-provider-ovn] A new plugin
    Resolves: bz1568960


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-8
changelog:
  - [docker] backport three container related patches
    Resolves: bz1580526
  - [ovn] add two OpenVSwitch plugins
    Resoles: bz1580525


author: Pavel Grunt <pgrunt@redhat.com> - 0.33-2
changelog:
  - Add missing patch for rebase
    Resolves: rhbz#1402474
  - Add obsoletes to the spec file to ease updates
    Resolves: rhbz#1432776
  - Fix black screen in virt-manager
    Resolves: rhbz#1433242
  - Make connection error message more clear
    Resolves: rhbz#1365736


author: Victor Toso <victortoso@redhat.com> - 0.33-3
changelog:
  - Avoid CRITICALs on copy-paste
    Resolves: rhbz#1440096
  - Avoid assertions on file-xfer while agent disconnects
    Related: rhbz#1440096


author: Pavel Grunt <pgrunt@redhat.com> - 0.33-4
changelog:
  - Make connection error message more clear
    Resolves: rhbz#1365736
  - Improve audio debug
    Resolves: rhbz#1436249
  - Fix wrong encoding of transferred files
    Resolves: rhbz#1440206


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-5
changelog:
  - RHEL 7.4 erratum
  - added doc patch about sudo lookup issue
    Resolves: rhbz#1293306
  - added test suite patch
    Resolves: rhbz#1360687
  - fixed use after free fqdn problem
    Resolves: rhbz#1360687


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.19p2-7
changelog:
  - RHEL 7.4 erratum
  - added patch to fix output truncation (in some cases) when log_output
    option is enabled
    Resolves: rhbz#1454571


author: Jakub Jelen <jjelen@redhat.com> - 1.8.19p2-8
changelog:
  - RHEL 7.4 erratum
  - Fixes CVE-2017-1000367: Privilege escalation in via improper get_process_ttyname() parsing
    Resolves: rhbz#1455402


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-9
changelog:
  - RHEL 7.4 erratum
  - removed patch for output truncation (1454571) which introduced regression
    Resolves: rhbz#1360687


author: Radovan Sroka <rsroka@redhat.com> 1.8.19p2-12
changelog:
  - RHEL 7.5 erratum
  - Fixed exit codes for `sudo -l -U <user>`
  - Fixed truncated output when log_output is enabled
  - Updated use_pty and IO logging manpage

    Resolves: rhbz#1458696
    Resolves: rhbz#1454571
    Resolves: rhbz#1490358

  - Fixed second pass LDAP filter expression in the sudoers ldap backend
    - inclomplete patch for rhbz#1485397


author: Radovan Sroka <rsroka@redhat.com> 1.8.19p2-13
changelog:
  - RHEL 7.5 erratum
  - Fixed sudo -l checking results whether user should be authenticated
  - Enabled LDAP filter patch
  - Fixed double free in sssd

    Resolves: rhbz#1505409
    Resolves: rhbz#1511850
    Resolves: rhbz#1518104


author: David Smith <dsmith@redhat.com> - 3.1-3
changelog:
  - Added patches for:
  - rhbz1425568 task_dentry_path() fix
  - rhbz1431263 arm64 hardware breakpoint crash fix
  - rhbz1430828 replace task_exe_file() with current_exe_file()
  - rhbz1436845 adapt stapdyn to the dyninst 9.3.1 library search model
  - rhbz1433391 workaround parser issue in nfs_proc.stp
  - rhbz1428120 update lookup_bad_addr()


author: Frank Ch. Eigler <fche@redhat.com> - 3.2-3
changelog:
  - rhbz1506230 (netif_receive_skb_internal probing)
  - rhbz1490862 (f2fs tracepoint header workarounds)


author: Maurizio Lombardi <mlombard@redhat.com> - 2.1.fb46-4
changelog:
  - Properly detect errors when writing backup files. (Closes: #80) (#81)
  - Read number of backup files to keep from file
  - config: defend on '/etc/target/backup' directory
  - config: backup when current config is different from recent backup copy
  - config: rename key 'kept_backups' as 'max_backup_files'
  - backup: global option to tune max no. of backup conf files


author: Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-9
changelog:
  - Resolves: rhbz#1362213 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
  - Resolves: rhbz#1368122


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-2
changelog:
  - Resolves: rhbz#1459747 CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism
  - Resolves: rhbz#1441481 CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-3
changelog:
  - Resolves: rhbz#1498343 CVE-2017-12615 CVE-2017-12617 tomcat: various flaws
  - Resolves: rhbz#1495655 CVE-2017-7674 tomcat: Vary header not added by CORS filter leading to cache poisoning
  - Resolves: rhbz#1470597 CVE-2017-5647 Add follow up revision


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-5
changelog:
  - Resolves: rhbz#1485453 man page uid and gid mismatch for service accounts
  - Resolves: rhbz#1505762 Problem to start tomcat with a user whose group has a name different to the user


author: Matthew Harmsen <mharmsen@redhat.com> 7.2.0-1
changelog:
  - tomcatjss Pagure Issue #6 - Rebase tomcatjss to 7.2.0 in Fedora 25+ (mharmsen)
  - Bugzilla Bug #1394416 - Rebase tomcatjss to 7.2.0 in RHEL 7.4 (mharmsen)


author: Matthew Harmsen <mharmsen@redhat.com> 7.2.0-2
changelog:
  - Changed build so that it did not package and depend upon the specfile being
    included inside the tarball


author: Matthew Harmsen <mharmsen@redhat.com> - 7.2.1-3
changelog:
  - Bugzilla Bug #1394416 - Rebase tomcatjss to 7.2.x in RHEL 7.4 (mharmsen)
  - ## 'tomcatjss-support-for-event-API.patch' resolves the following issues
    - tomcatjss Pagure Issue #4 - Support for Event API (edewata)


author: Matthew Harmsen <mharmsen@redhat.com> 7.2.1-7
changelog:
  - Updated jss build and runtime dependencies
  - Bugzilla Bug #1597180 - Tomcatjss: Add support for TLS_*_SHA384 ciphers
    [rhel-7.5.z] (cfu)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.8.0-1
changelog:
  - new release
    - rebase tuned to latest upstream
      resolves: rhbz#1388454
    - cpu-partitioning: enabled timer migration
      resolves: rhbz#1408308
    - cpu-partitioning: disabled kvmclock sync and ple
      resolves: rhbz#1395855
    - spec: muted error if there is no selinux support
      resolves: rhbz#1404214
    - units: implemented instance priority
      resolves: rhbz#1246172
    - bootloader: added support for initrd overlays
      resolves: rhbz#1414098
    - cpu-partitioning: set CPUAffinity early in initrd image
      resolves: rhbz#1394965
    - cpu-partitioning: set workqueue affinity early
      resolves: rhbz#1395899
    - scsi_host: fixed probing of ALPM, missing ALPM logged as info
      resolves: rhbz#1416712
    - added new profile cpu-partitioning
      resolves: rhbz#1359956
    - bootloader: improved inheritance
      resolves: rhbz#1274464
    - units: mplemented udev-based regexp device matching
      resolves: rhbz#1251240
    - units: introduced pre_script, post_script
      resolves: rhbz#1246176
    - realtime-virtual-host: accommodate new ktimersoftd thread
      resolves: rhbz#1332563
    - defirqaffinity: fixed traceback due to syntax error
      resolves: rhbz#1369791
    - variables: support inheritance of variables
      resolves: rhbz#1433496
    - scheduler: added support for cores isolation
      resolves: rhbz#1403309
    - tuned-profiles-nfv splitted to host/guest and dropped unneeded dependency
      resolves: rhbz#1413111
    - desktop: fixed typo in profile summary
      resolves: rhbz#1421238
    - with systemd don't do full rollback on shutdown / reboot
      resolves: rhbz#1421286
    - builtin functions: added virt_check function and support to include
      resolves: rhbz#1426654
    - cpulist_present: explicitly sorted present CPUs
      resolves: rhbz#1432240
    - plugin_scheduler: fixed initialization
      resolves: rhbz#1433496
    - log errors when applying a profile fails
      resolves: rhbz#1434360


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.8.0-2
changelog:
  - respin
    related: rhbz#1388454
  - systemd: added support for older systemd CPUAffinity syntax
    resolves: rhbz#1441791
  - scheduler: added workarounds for low level exceptions from
    python-linux-procfs
    resolves: rhbz#1441792
  - bootloader: workaround for adding tuned_initrd to new kernels on restart
    resolves: rhbz#1441797
  - cpu-partitioning: use tuna for cores isolation
    related: rhbz#1403309


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.9.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1467576
    - added recommend.d functionality
      resolves: rhbz#1459146
    - recommend: added support for matching of processes
      resolves: rhbz#1461838
    - cpu-partitioning: used tuned instead of tuna for cores isolation
      resolves: rhbz#1442229
    - bootloader: splitted string for removal from cmdline
      resolves: rhbz#1461279
    - network-latency: added skew_tick=1 kernel command line parameter
      resolves: rhbz#1451073
    - bootloader: accepted only certain values for initrd_remove_dir
      resolves: rhbz#1455161
    - increased udev monitor buffer size, made it configurable
      resolves: rhbz#1442306
    - bootloader: don't add nonexistent overlay image to grub.cfg
      resolves: rhbz#1454340
    - plugin_cpu: don't log error in execute() if EPB is not supported
      resolves: rhbz#1443182
    - sap-hana: fixed description of the sap-hana profiles
      resolves: rhbz#1482005
    - plugin_systemd: on full_rollback notify about need of initrd regeneration
      resolves: rhbz#1469258
    - don't log errors about missing files on verify with ignore_missing set
      resolves: rhbz#1451435
    - plugin_scheduler: improved logging
      resolves: rhbz#1474961
    - improved checking if we are rebooting or not
      resolves: rhbz#1475571
    - started dbus exports after a profile is applied
      resolves: rhbz#1443142
    - sap-hana: changed force_latency to 70
      resolves: rhbz#1501252
    - plugin_video: added support for the 'dpm' power method
    - list available profiles on 'tuned-adm profile'


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.9.0-0.2.rc2
changelog:
  - new release
    - rebased tuned to latest upstream
      related: rhbz#1467576
    - fixed expansion of the variables in the 'devices' section
      related: rhbz#1490399
    - cpu-partitioning: add no_rebalance_cores= option
      resolves: rhbz#1497182


author: Christopher Snyder <csnyder@redhat.com> 0.20-1
changelog:
  - 1389729: Add missing xml section for test (fran@caosdigital.com)
  - 1389729: virt-who incorrectly reports 'name' instead of 'hostname' for RHEV
    hosts (fran@caosdigital.com)
  - 1450747: Continue running destination threads on internal failure
    (csnyder@redhat.com)
  - 1444718: Log name of config when duplicate reports are retrieved
    (csnyder@redhat.com)
  - 1447264: Keep running on InvalidPasswordFormat given other valid configs
    (csnyder@redhat.com)
  - 1448267: Fix polling behavior for oneshot, CTRL-C, 429 responses
    (csnyder@redhat.com)
  - 1369107: Update docs and log messages to show the *.conf requirement
    (csnyder@redhat.com)
  - 1436517: Fix api base detection for rhevm version 3 and 4
    (csnyder@redhat.com)
  - 1442337: Send updates immediately the first run (csnyder@redhat.com)
  - Do not join threads not started, fix up fake backend (csnyder@redhat.com)
  - 1439317: Ensure reports are still sent despite duplicate configurations
    (csnyder@redhat.com)
  - DestinationThreads now send all reports (csnyder@redhat.com)
  - Adds IntervalThread base class and refactors Virt classes
    (csnyder@redhat.com)
  - Remove reference to nonexistant method _set_option (csnyder@redhat.com)
  - Update ConfigManager to produce destination and source mappings.
    (csnyder@redhat.com)
  - Implemements a threadsafe datastore (csnyder@redhat.com)
  - Move from using processes to threads (csnyder@redhat.com)
  - 1436517: Set Version header for version detect (pcreech@redhat.com)
  - 1403640: Fix syntax error in exception handling (pcreech@redhat.com)
  - Update the spec file for builds on more downstream platforms
    (csnyder@redhat.com)
  - Add releaser for rhel-7.4 (khowell@redhat.com)
  - 1391512: Handle utf-8 within Xmlrpc transport (pcreech@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 0.20.2-1
changelog:
  - 1458184: better reading of environment variables (jhnidek@redhat.com)
  - 1401867: Enable logging of rhsm module to rhsm.log (jhnidek@redhat.com)
  - 1404117: Check parameter consistency and refactoring (jhnidek@redhat.com)
  - Adds a patch number to virt-who versioning (csnyder@redhat.com)
  - 1401420: xen supports only uuid/hostname as hypervisor_id
    (jhnidek@redhat.com)
  - 1458674: Update use of result data to match the new async api
    (csnyder@redhat.com)
  - 1452436: virt-who prints host-to-quest mapping everytime (jhnidek@redhat.com)
  - 1357761: Do not check passwords to be in latin1 encoding (jhnidek@redhat.com)
  - 1457101: Continue running despite malformed configs (csnyder@redhat.com)
  - 1409984: Retry initial report retrieval on connection timeout
    (csnyder@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 0.21.0-1
changelog:
  - Update hypervisorCheckInAsync test for new config sections
    (csnyder@redhat.com)
  - Update Config Refactor with changes from master (csnyder@redhat.com)
  - Removed usage of old Config (not unit tests) (jhnidek@redhat.com)
  - Further clean up of unit tests (jhnidek@redhat.com)
  - Create Xen Config Subclass (jhnidek@redhat.com)
  - Create Rhevm Config Subclass (jhnidek@redhat.com)
  - Create VDSM config subclass (wpoteat@redhat.com)
  - Clean up ConfigSection Unit tests (jhnidek@redhat.com)
  - Adds FakeVirtConfigSection (csnyder@redhat.com)
  - Configuration subclass for hyperv (wpoteat@redhat.com)
  - Implement EsxConfigSection (khowell@redhat.com)
  - Libvirtd ConfigSection Subclass (jhnidek@redhat.com)
  - Adds EffectiveConfig, ConfigSection (csnyder@redhat.com)
  - Adds warning message for deprecated env vars (csnyder@redhat.com)
  - 1503700: Updates to the job polling frequency (csnyder@redhat.com)
  - 1502821: Remove undocumented, broken env var "VIRTWHO_DISABLE_ASYNC"
    (csnyder@redhat.com)
  - 1466015: Warn of deprecation of command line options in next release
    (wpoteat@redhat.com)
  - remove non-existant variable fake_is_hypervisor (adarshvritant@gmail.com)
  - 1485865: Do not replace /etc/virt-who.conf on rpm upgrade
    (csnyder@redhat.com)
  - Utilize the owner from the first report seen, if we do not know the owner
    (csnyder@redhat.com)
  - Updates based on review (use str.format) (csnyder@redhat.com)
  - Fix example fake config in man docs (adarshvritant@gmail.com)
  - Add m2crypto dependency (adarshvritant@gmail.com)
  - 1211435: Don't send host-to-geust mapping, when env, owner are wrong
    (jhnidek@redhat.com)
  - 1408556: Log which owner updated mappings are being sent to
    (csnyder@redhat.com)


author: Kevin Howell <khowell@redhat.com> 0.21.1-1
changelog:
  - 1511308: Only ESX supports: exclude_host_parents and filter_host_parents.
    (jhnidek@redhat.com)
  - 1509596: Use qemu+ssh transport if not provided (libvirt)
    (csnyder@redhat.com)
  - 1511308: Xen and Hyper-V do not support some filter options
    (jhnidek@redhat.com)
  - 1510760: Ensure virt-who exits properly (w/ no good conf)
    (csnyder@redhat.com)
  - 1509606: Remove duplicate output of validation messages (csnyder@redhat.com)
  - 1509597: Fix issue with cli consistancy check for vdsm (csnyder@redhat.com)
  - 1509595: Only expect owner on HostGuestAssociationReports
    (csnyder@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 0.21.2-1
changelog:
  - 1510310: Ensure that owner and env are required where necessary
    (csnyder@redhat.com)
  - 1512778: ESX should require username, password, and server values
    (csnyder@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 0.21.4-1
changelog:
  - 1353119: Add JSON-RPC support for VDSM (khowell@redhat.com)
  - 1509597: Enable to use virt-who with VDSM again (jhnidek@redhat.com)


author: Alexander Kurtakov <akurtako@redhat.com> 1:3.1.3-5
changelog:
  - Remove javax.xml.bind from osgi imports - it's part of the JVM now.
  - Drop the ws-jaxme dependency for the same reason.


author: Peter Hutterer <peter.hutterer@redhat.com> 0.34.2-2
changelog:
  - Add Pressure2K option for backwards-compatibility with applications that
    hardcode the previous pressure range (#1457024)


author: Peter Hutterer <peter.hutterer@redhat.com> 0.34.2-3
changelog:
  - Fix hang after unplugging a device (#1496650)
  - Correct device flags for some Cintiqs and Intuos pros (#1496659)


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-37
changelog:
  - needs-restarting: add option for reboot hint.
  - Resolves: bug#1192946
  - needs-restarting: add option to list services.
  - Resolves: bug#1335587
  - reposync: add --download-metadata to the man page.
  - Resolves: bug#1329649
  - debuginfo-install: also respect provides when testing for installonly.
  - Related: bug#1293707


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-40
changelog:
  - needs-restarting: rework reboothint logic.
  - Related: bug#1192946
  - needs-restarting: rebase patch for 1335587.
  - Related: bug#1335587


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-41
changelog:
  - yum-config-manager: only select exact matches from --setopt.
  - Resolves: bug#1403015
  - yum-plugin-verify: set exit status to 1 in case of problems.
  - Resolves: bug#1406891


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-43
changelog:
  - yumdownloader: fix crash on broken srpm metadata.
  - Resolves: bug#1458098
  - package-cleanup: don't remove required dupes.
  - Resolves: bug#1455318
  - fastestmirror: move the logic before MD retrieval.
  - Resolves: bug#1428210
  - yum-debug-dump: improve repo failure handling.
  - Resolves: bug#1445751


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-44
changelog:
  - Add pre-transaction-actions plugin.
  - Resolves: bug#1470647
  - yum-builddep: add --define option.
  - Resolves: bug#1437636
  - verifytree: handle no @core group gracefully.
  - Resolves: bug#1349433
  - verifytree: fix handling of missing comps.
  - Resolves: bug#1333353


