# changelog

author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 6.9.10.68-7.tuxcare.els1
changelog:
- Fix CVE-2022-32546 integer overflow at at coders/pcl.c.
- Fix CVE-2022-32545 outside the range of representable values at coders/psd.c.
- Fix CVE-2022-32547 misaligned address at MagickCore/property.c.
- Fix CVE-2021-20312 integer overflow in WriteTHUMBNAILImage of
  coders/thumbnail.c
- Fix CVE-2021-20313 cipher leak when the calculate signatures in
  TransformSignature
- Fix CVE-2021-20309 division by zero in WaveImage() of
  MagickCore/visual-effects.c


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 6.9.10.68-7.tuxcare.els2
changelog:
- CVE-2020-27751: fix undefined behavior due to an overly large shift exponent
  in quantum-export.c
- CVE-2020-27768: fix NaN being outside the range of representable values issue
  in quantum-private.h


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 6.9.10.68-7.tuxcare.els4
changelog:
- CVE-2025-53101: fix heap OOB write in BlobStream
- CVE-2025-57807: fix stack overflow through vsnprintf()


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 6.9.10.68-7.tuxcare.els5
changelog:
- CVE-2025-55154: fix integer overflows in MNG magnification
- CVE-2025-55212: fix division by zero in ThumbnailImage
- CVE-2025-57803: fix 32-bit integer overflow when writing BMP scanline stride
- CVE-2025-55298: fix format string bug leading to RCE or heap overflow


author: Scott Lampert <fortunato@heavymetal.org>
changelog:
- Used buildroot
- patched bin/named/ns_udp.c to use <libelf/nlist.h> for include
  on Redhat 5.0 instead of <nlist.h>


author: Manuel J. Galan <manolow@step.es>
changelog:
- Several essential modifications to build and install correctly.
- Modified 'ndc' to avoid deprecated use of '-'


author: Stepan Kasal <kasal@math.cas.cz>
changelog:
- nslookup patched:
  to count numRecords properly
  to fix subsequent calls to ls -d
  to parse "view" and "finger" commands properly
  the view hack updated for bind-8 (using sed)


author: Jeff Johnson <jbj@redhat.com>
changelog:
- update to 8.2.1.
- add named.logrotate (#3571).
- hack around egcs-1.1.2 -m486 bug (#3413, #3485).
- vet file list.


author: Preston Brown <pbrown@redhat.com>
changelog:
- use real stop and start in named.init for restart, not ndc restart, it has
  problems when named has changed during a package update... (# 4890)


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
- Fix up location of named-bootconf.pl and make it executable
  (Bug #8028)
- bind-devel requires bind


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- provide /var/named (fix for bugs #9847, #10205)
- preserve args when restarted via ndc(8) (bug #10227)
- make resolv.conf(5) a link to resolver(5) (bug #10245)
- fix SYSTYPE bug in all makefiles
- move creation of named user from %post into %pre


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- modify logrotate setup to use PID file
- temporarily disable optimization by unsetting $RPM_OPT_FLAGS at build-time
- actually bump the release this time


author: Bernhard Rosenkranzer <bero@redhat.com>
changelog:
- Fix up the initscript (Bug #13033)
- Fix build with current glibc (Bug #12755)
- /etc/rc.d/init.d -> /etc/init.d
- use %{_mandir} rather than /usr/share/man


author: Karsten Hopp <karsten@redhat.de>
changelog:
- fixed logrotate script (wrong path to kill)
- include header files in -devel package
- bugzilla #22049, #19147, 21606


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
- Move run files to /var/run/named/ - /var/run isn't writable
  by the user we're running as. (Bug #20665)


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
- Make /etc/rndc.conf and /etc/sysconfig/named noreplace
- Make devel require bind = %{version} rather than just bind


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
- Update to 9.1.1rc1; fixes 17 bugs (14 of them affecting us;
  1 was fixed in a Red Hat patch already, 2 others are portability
  improvements)


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
- 9.1.1 probably won't be out in time, revert to 9.1.0 and apply fixes
  from 9.1.1rc2
- bind requires bind-utils (#28317)


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
- Don't use the standard rndc key from the documentation, instead, create a random one
  at installation time (#26358)
- Make /etc/rndc.conf readable by user named only, it contains secret keys


author: Bernhard Rosenkraenzer <bero@redhat.com> 9.1.0-9
changelog:
- Work around bind 8 -> bind 9 migration problem when using buggy zone files:
  accept zones without a TTL, but spew out a big fat warning. (#31393)


author: Bernhard Rosenkraenzer <bero@redhat.com> 9.1.2-1
changelog:
- 9.1.2 final. No changes between 9.1.2-0.rc1.1 and this one, except for
  the version number, though.


author: Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-0.rc1.2
changelog:
- Add named.conf man page from bind 8.x (outdated, but better than nothing,
  - Rename the rndc key (#42895)
- Add dnssec* man pages


author: Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-3
changelog:
- Add build dependencies (#49368)
- Make sure running service named start several times doesn't create
  useless processes (#47596)
- Work around the named parent process returning 0 even if the config
  file is broken (it's parsed later by the child processes) (#45484)


author: Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-4
changelog:
- Make sure /etc/rndc.conf isn't world-readable even after the
  %post script inserted a random key (#53009)


author: Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-0.rc3.1
changelog:
- 9.2.0rc3
- remove ttl patch, I don't think we need this for 8.0.
- remove dig.1.bz2 from the bind8-manpages tar file, 9.2 has a new dig man page
- add lwres* man pages to -devel


author: Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-7
changelog:
- Don't exit if /etc/named.conf doesn't exist if we're running
  chroot (#60868)
- Revert Elliot's changes, we do require specific glibc/glibc-kernheaders
  versions or bug #58335 will be back. "It compiles, therefore it works"
  isn't always true.


author: Bernhard Rosenkraenzer <bero@redhat.com> 9.2.1-2
changelog:
- Move libisccc, lib isccfg and liblwres from bind-utils to bind,
  they're not required if you aren't running a nameserver.


author: Karsten Hopp <karsten@redhat.de> 9.2.1-7
changelog:
- fix name of pidfine in logrotate script (#68842)
- fix owner of logfile in logrotate script (#41391)
- fix nslookup and named.conf man pages (output on stderr)
  (#63553, #63560, #63561, #54889, #57457)
- add rfc1912 (#50005)
- gzip all rfc's
- fix typo in keygen.c (#54870)
- added missing manpages (#64065)
- shutdown named properly with rndc stop (#62492)
- /sbin/nologin instead of /bin/false (#68607)
- move nsupdate to bind-utils (where the manpage already was) (#66209, #66381)
- don't kill initscript when rndc fails (reload)    (#58750)


author: Daniel Walsh <dwalsh@redhat.com> 9.2.1-12
changelog:
- Fix log rotate to use service named reload
- Change service named reload to give success/failure message [73770]
- Fix File checking [75710]
- Begin change to automatically run in CHROOT environment


author: Daniel Walsh <dwalsh@redhat.com> 9.2.2-13
changelog:
- Fix config description of named.conf in chroot
- Change named.init script to check for existence of /etc/sysconfig/network


author: Jason Vas Dias <jvdias@redhat.com>
changelog:
- Fixed named.init generation of error messages on
- 'service named stop' and 'service named reload'
- as per bug 127775


author: Jason Vas Dias <jvdias@redhat.com>
changelog:
- Fixed bug 129289: bind-chroot install / deinstall
- on install, existing config files 'safe_replace'd
- with links to chroot copies; on uninstall, moved back.


author: Jason Vas Dias <jvdias@redhat.com>
changelog:
- Remove resolver(5) manpage now in man-pages (bug 130792);
- Don't create /dev/ entries in bind-chroot if already there (bug 127556);
- fix bind-devel Requires (bug 130919)
- Set default location for dumpdb & stats files to /var/named/data


author: Jason Vas Dias <jvdias@redhat.com>
changelog:
- Fix bug 130981: add '-t' option to named-checkconf invocation in
- named.init if chroot installed.


author: Jason Vas Dias <jvdias@redhat.com> - 10:9.2.4rc7-10
changelog:
- Fix bug 130121: add '%ghost' entries for files included in previous
- bind-chroot & not in current - ie. named.conf, rndc.key, dev/* -
- that RPM removed after upgrade .


author: Jason Vas Dias <jvdias@redhat.com> - 10:9.2.4rc7-11_EL3
changelog:
- Fix bug 131803: replace ROOTDIR line removed by broken
- bind-chroot 9.2.2-21's '%postun'; added %triggerpostun for bind-chroot


author: Jason Vas Dias <jvdias@redhat.com> - 10:9.2.4rc7-12_EL3
changelog:
- Fix bug 132303: if ROOTDIR line was replaced after upgrade from
- bind-chroot-9.2.2-21, restart named


author: Jason Vas Dias <jvdias@redhat.com> - 10:9.2.4rc8-14
changelog:
- Upgrade to upstream bind-9.2.4rc8 .
- Progress: Finally! Hooray! ISC bind now distributes:
- o named.conf(5) and nslookup(8) manpages
-    'bind-manpages.bz2' source can now disappear
-    (could this have something to do with ISC bug I raised about this?)
- o 'deprecation_msg' global has vanished
-     bind-9.2.3rc3-deprecation_msg_shut_up.diff.bz2 can disappear


author: Jason Vas Dias <jvdias@redhat.com> - 20:9.2.4-1
changelog:
- BIND 9.2.4 (final release) released - source code actually
- identical to 9.2.4rc8, with only version number change.


author: Jason Vas Dias <jvdias@redhat.com> - 20:9.2.4-2
changelog:
- Fix bug 136243: bind-chroot %post must run restorecon -R %{prefix}
- Fix bug 135175: named.init must return non-zero if named is not run
- Fix bug 134060: bind-chroot %post must use mktemp, not /tmp/named
- Fix bug 133423: bind-chroot %files entries should have been %dirs


author: Jason Vas Dias <jvdias@redhat.com> - 20:9.2.4-4
changelog:
- Fix bugs 140528 and 141113:
- 2 second timeouts when IPv6 not configured and root nameserver's
- AAAA addresses are queried


author: Jason Vas Dias <jvdias@redhat.com> - 22:9.3.0-2
changelog:
- Fix bug 143438: named.init will now make correct ownership of $ROOTDIR/var/named
-                 based on 'named_write_master_zones' SELinux boolean.
- Fix bug 143744: dig & nsupdate IPv6 timeout  (dup of 140528)


author: Jason Vas Dias <jvdias@redhat.com> - 22:9.3.1rc1-1
changelog:
- Upgrade to 9.3.1rc1
- Add Simplified Database Backend (SDB) sub-package ( bind-sdb )
-     add named_sdb - ldap + pgsql + dir database backend support with
-     'ENABLE_SDB' named.sysconfig option
- Add BIND resolver library & includes sub-package ( libbind-devel)
- fix bug 147824 / 147073 / 145664: ENABLE_ZONE_WRITE in named.init
- fix bug 146084 : shutup restorecon


author: Jason Vas Dias <jvdias@redhat.com> - 22.9.3.1rc1-5
changelog:
- fix bug 150288: h_errno not being accessed / set correctly in libbind
- add libbind man-pages from bind-8.4.6


author: Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-2_FC4
changelog:
- Rebuild for bind-sdb libpq.so.3 dependency
- fix bug 150981: don't install libbind man-pages if no libbind
- fix bug 151852: mount proc on $ROOTDIR/proc to allow sysconf(...)
  to work and correct number of CPUs to be determined


author: Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-4_dbus
changelog:
- Enhancement to allow dynamic forwarder table management and
- DHCP forwarder auto-configuration with D-BUS


author: Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-4
changelog:
- Fix bug 157601: give named.init a configtest function
- Fix bug 156797: named.init should check SELinux booleans.local before booleans
- Fix bug 154335: if no controls in named.conf, stop named with -TERM sig, not rndc
- Fix bug 155848: add NOTES section to named.8 man-page with info on all Red Hat
                  BIND quirks and SELinux DDNS / slave zone file configuration
- D-BUS patches NOT applied until dhcdbd is in FC


author: Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-6
changelog:
- fix bug 157950: dig / host / nslookup should reject invalid resolv.conf
                  files and not use uninitialized garbage nameserver values
                  (ISC bug 14841 raised).


author: Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-7
changelog:
- fix bug 160914: resolver utilities should try next server on empty referral
                  (now that glibc bug 162625 is fixed)
                  host and nslookup now by default try next server on SERVFAIL
                  (host now has '-s' option to disable, and nslookup given
                   '[no]fail' option similar to dig's [no]fail option).
- rebuild and re-test with new glibc & gcc (all tests passed).


author: Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-10
changelog:
- Build with D-BUS patch by default; D-BUS support enabled with named -D option
- Enable D-BUS for named_sdb also
- fix sdb pgsql's zonetodb.c: must use isc_hash_create() before dns_db_create()
- update fix for bug 160914 : test for RD=1 and ARCOUNT=0 also before trying next server
- fix named.init script to handle named_sdb properly
- fix named.init script checkconfig() to handle named '-c' option
  and make configtest, test, check configcheck synonyms


author: Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-12
changelog:
- fix bug 168302: use %{__cc} for compiling dns-keygen
- fix bug 167682: bind-chroot directory permissions
- fix issues with -D dbus option when dbus service not running or disabled


author: Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-18
changelog:
- fix bug 169969: do NOT call dbus_svc_dispatch() in dbus_mgr_init_dbus() -
      task->state != task_ready and will cause Abort in task.c if process
      is waiting for NameOwnerChanged to do a SetForwarders


author: Jason Vas Dias <jvdias@redhat.com> - 24.9.3.1-20
changelog:
- Allow the -D enable D-BUS option to be used within bind-chroot .
- fix bug 171226: supply some documentation for pgsql SDB .


author: Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-22
changelog:
- fix bug 172632 - remove .la files
- ship namedGetForwarders and namedSetForwarders scripts
- fix detection of -D option in chroot


author: Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-24
changelog:
- allow D-BUS support to work in bind-chroot environment:
  workaround latest selinux policy by mounting /var/run/dbus/
  under chroot instead of /var/run/dbus/system-bus-socket


author: Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-4
changelog:
- regenerate redhat_doc patch for non-DBUS builds
- allow dbus builds to work with dbus version < 0.6 (bz #179816)


author: Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-6
changelog:
- replace caching-nameserver with bind-config sub-package
- fix bug 177595: handle case where $ROOTDIR is a link in initscript
- fix bug 177001: bind-config creates symlinks OK now
- fix bug 176388: named.conf is now never replaced by any RPM
- fix bug 176248: remove unecessary creation of rpmsave links
- fix bug 174925: no replacement of named.conf
- fix bug 173963: existing named.conf never modified
- major .spec file cleanup


author: Jason Vas Dias <jvdias@redhat.com> - 30.9.3.2-8
changelog:
- Do not allow package to be installed if named:25 userid creation fails
- Give libbind a pkg-config file
- remove restorecon from bind-chroot-admin (not required).
- fix named.caching-nameserver.conf (listen-on-v6 port 53 { ::1 };)


author: Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-14
changelog:
- fix bug 186577: remove -L/usr/lib from libbind.pc and more .spec file cleanup
- add '%doc' sample configuration files in /usr/share/doc/bind*/sample
- rebuild with new gcc and glibc


author: Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-16
changelog:
- fix bug 187286: 
     prevent host(1) printing duplicate 'is an alias for' messages
     for the default AAAA and MX lookups as well as for the A lookup
     (it now uses the CNAME returned for the A lookup for the AAAA and MX lookups).
     This is upstream bug #15702 fixed in the unreleased bind-9.3.3
- fix bug 187333: fix SOURCE24 and SOURCE25 transposition


author: Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-20
changelog:
- fix resolver.c ncache_adderesult segfault reported in addenda to bug 173961 
  (upstream bugs #15642, #15528 ?)
- allow named ability to generate core dumps after setuid (upstream bug #15753)


author: Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-22
changelog:
- apply upstream patch for ncache_adderesult segfault bug 173961 addenda
- fix bug 188382: rpm --verify permissions inconsistencies
- fix bug 189186: use /sbin/service instead of initscript
- rebuild for new gcc, glibc-kernheaders


author: Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-26.FC6
changelog:
- fix bugs 191093, 189789
- backport selected fixes from upstream bind9 'v9_3_3b1' CVS version:
  ( see http://www.isc.org/sw/bind9.3.php "Fixes" ): 
  o change 2024 / bug 16027:
    named emitted spurious "zone serial unchanged" messages on reload
  o change 2013 / bug 15941:
    handle unexpected TSIGs on unsigned AXFR/IXFR responses more gracefully
  o change 2009 / bug 15808: coverity fixes
  o change 1997 / bug 15818: 
    named was failing to replace negative cache entries when a positive one
    for the type was learnt
  o change 1994 / bug 15694: OpenSSL 0.9.8 support
  o change 1991 / bug 15813:
    The configuration data, once read, should be treated as readonly.
  o misc. validator fixes 
  o misc. resolver fixes
  o misc. dns fixes
  o misc. isc fixes
  o misc. libbind fixes
  o misc. isccfg fix
  o misc. lwres fix
  o misc. named fixes
  o misc. dig fixes
  o misc. nsupdate fix
  o misc. tests fixes


author: Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-30
changelog:
- fix bug 196398 - Enable -D option automatically in initscript
  if NetworkManager enabled in any runlevel.
- fix namedGetForwarders for new dbus
- fix bug 195881 - libbind.so should be owned by bind-libbind-devel


author: Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-32
changelog:
- fix addenda to bug 189789: 
  determination of selinux enabled was still not 100% correct in bind-chroot-admin
- fix addenda to bug 196398:
  make named.init test for NetworkManager being enabled AFTER testing for -D absence;
  named.init now supports a 'DISABLE_NAMED_DBUS' /etc/sysconfig/named setting to disable
  auto-enable of named dbus support if NetworkManager enabled.


author: Martin Stransky <stransky@redhat.com> - 30:9.3.2-37
changelog:
- fix for #202542 - /usr/sbin/bind-chroot-admin: No such file or directory
- fix for #202547 - file_contexts: invalid context


author: Martin Stransky <stransky@redhat.com> - 30:9.3.3-3
changelog:
- added fix from #209400 - Bind Init Script does not create 
  the PID file always, created by Jeff Means
- added timeout to stop section of init script. 
  The default is 100 sec. and can be adjusted by NAMED_SHUTDOWN_TIMEOUT
  shell variable.


author: Martin Stransky <stransky@redhat.com> - 30:9.3.3-6
changelog:
- fix for #200465: named-checkzone and co. cannot be run as non-root user
- fix for #212348: chroot'd named causes df permission denied error
- fix for #211249, #211083 - problems with stopping named
- fix for #212549: init script does not unmount /proc filesystem
- fix for #211282: EDNS is globally enabled, crashing CheckPoint FW-1,
    added edns-enable options to named configuration file which can suppress
    EDNS in queries to DNS servers (see /usr/share/doc/bind-9.3.3/misc/options)
- fix for #212961: bind-chroot doesn't clean up its mess on %preun
- update to 9.3.3rc3, removed already merged patches


author: Martin Stransky <stransky@redhat.com> - 31:9.3.3-0.1.rc3
changelog:
- added back an interval to restart
- renamed package, it should meet the N-V-R criteria
- fix for #216185: bind-chroot-admin able to change root mode 750
- added fix from #215997: incorrect permissions on dnszone.schema
- added a notice to init script when /etc/named.conf doesn't exist (#216075)


author: Martin Stransky <stransky@redhat.com> - 31:9.3.3-2
changelog:
- added namedGetForwarders written in shell (#176100),
  created by Baris Cicek <baris@nerd.com.tr>.


author: Adam Tkac <atkac@redhat.com> 31:9.3.3-4.fc7
changelog:
- package bind-libbind-devel has beed removed (libs has been moved to bind-devel & bind-libs)
- Resolves: #214208


author: Adam Tkac <atkac@redhat.com> 31:9.3.4-3.fc7
changelog:
- fixed building without libbind
- fixed post section (selinux commands is now in if-endif statement)
- prever macro has been removed from version


author: Adam Tkac <atkac@redhat.com> 31:9.4.0-1.fc7
changelog:
- updated to 9.4.0
- bind-chroot-admin now sets EAs correctly (#213926)
- throw away next_server_on_referral and no_servfail_stops patches (fixed in 9.4.0)


author: Adam Tkac <atkac redhat com> 31:9.4.0-2.fc7
changelog:
- added experimental SQLite support (written by John Boyd <jaboydjr@netwalk.com>)
- moved bind-chroot-admin script to chroot package
- bind-9.3.2-redhat_doc.patch is always applied (#231738)


author: Adam Tkac <atkac redhat com> 31:9.4.0-3.fc7
changelog:
- prepared bind to merge review
- added experimental idn support to bind-utils utils (not enabled by default yet)
- change chroot policy in caching-nameserver post section
- fixed bug in bind-chroot-admin - rootdir function is called properly now


author: Adam Tkac <atkac redhat com> 31:9.4.0-4.fc7
changelog:
- removed query-source[-v6] options from caching-nameserver config
  (#209954, increase security)
- throw away idn. It won't be ready in fc7


author: Adam Tkac <atkac redhat com> 31:9.4.0-7.fc7
changelog:
- removed DEBUGINFO option because with this option (default) was bind
  builded with -O0 and without this flag no debuginfo package was produced.
  (I want faster bind => -O2 + debuginfo)
- fixed zone finding (#236426)


author: Adam Tkac <atkac redhat com> 31:9.4.0-8.fc7
changelog:
- improved "zone freeze patch" - if multiple zone with same name exists
  no zone is freezed
- minor cleanup in caching-nameserver's config file
- fixed race-condition in dbus code (#235809)
- added forgotten restorecon statement in bind-chroot-admin


author: Adam Tkac <atkac redhat com> 31:9.4.1-3
changelog:
- fixed bind-chroot-admin dynamic DNS handling (#239149)
- updated zone-freeze patch to latest upstream
- ldap sdb has been rewriten to latest api (#239802)


author: Adam Tkac <atkac redhat com> 31:9.4.1-4
changelog:
- removed ldap-api patch and start using deprecated API
- fixed minor problem in bind-chroot-admin script (#241103)


author: Adam Tkac <atkac redhat com> 31:9.4.1-5
changelog:
- very minor compatibility change in bind-chroot-admin (line 215)
- enabled IDN support by default and don't distribute IDN libraries
- specfile cleanup
- add dynamic directory to /var/named. This directory will be primarily used for
  dynamic DNS zones. ENABLE_ZONE_WRITE and SELinux's named_write_master_zones no longer exist


author: Adam Tkac <atkac redhat com> 31:9.4.1-6
changelog:
- major changes in initscript. Could be LSB compatible now
- removed caching-nameserver subpackage. Move configs from this
  package to main bind package as default configuration and major
  configuration cleanup


author: Adam Tkac <atkac redhat com> 31:9.4.1-7
changelog:
- marked caching-nameserver as obsolete (#244604)
- fixed typo in initscript (causes that named doesn't detect NetworkManager
  correctly)
- next cleanup in configuration - moved configfiles into config.tar
- removed delay between start & stop in restart function in named.init


author: Adam Tkac <atkac redhat com> 31:9.5.0a5-2
changelog:
- minor changes in default configuration
- fix h_errno assigment during resolver initialization (unbounded recursion, #245857)
- removed wrong patch to #150288


author: Adam Tkac <atkac redhat com> 31:9.5.0a5-3.9
changelog:
- removed bind-sdb package (default named has compiled SDB backend now)
- integrated DLZ (Dynamically loadable zones) drivers
- integrated GSS-TSIG support (RFC 3645)
- build with -O0 (many new features, potential core dumps will be more useful)


author: Adam Tkac <atkac redhat com> 31:9.5.0a5-5
changelog:
- integrated "autotools" patch for testing purposes (upstream will
  accept it in future, for easier building)


author: Adam Tkac <atkac redhat com> 32:9.5.0-6.a6
changelog:
- updated to 9.5.0a6 which contains fixes for CVE-2007-2925 and
  CVE-2007-2926
- fixed building on 64bits


author: Adam Tkac <atkac redhat com> 32:9.5.0-8.a6
changelog:
- minor next improvements on autotools patch
- dig and host utilities now using libidn instead idnkit for
  IDN support


author: Adam Tkac <atkac redhat com> 32:9.5.0-9.a6
changelog:
- disable 64bit dlz driver patch on alpha and ia64 (#251298)
- remove wrong malloc functions from lib/dns/spnego.c (#251853)


author: Adam Tkac <atkac redhat com> 32:9.5.0-10.a6
changelog:
- dropped direct dependency to /etc/openldap/schema directory
- changed hardcoded paths to macros
- fired away code which configure LDAP server


author: Adam Tkac <atkac redhat com> 32:9.5.0-10.2.a6
changelog:
- added new initscript option KEYTAB_FILE which specified where
  is located kerberos .keytab file for named service
- obsolete temporary bind-9.5-spnego-memory_management.patch by
  bind-9.5-gssapictx-free.patch which conforms BIND coding standards
  (#251853)


author: Adam Tkac <atkac redhat com> 32:9.5.0-11.a6
changelog:
- start using --disable-isc-spnego configure option
  - remove bind-9.5-spnego-memory_management.patch (source isn't
    compiled)


author: Adam Tkac <atkac redhat com> 32:9.5.0-11.1.a6
changelog:
- removed end dots from Summary sections (skasal@redhat.com)
- fixed wrong file creation by autotools patch (skasal@redhat.com)


author: Adam Tkac <atkac redhat com> 32:9.5.0-11.3.a6
changelog:
- initscript failure message is now printed correctly (#277981,
  Quentin Armitage (quentin armitage org uk) )


author: Adam Tkac <atkac redhat com> 32:9.5.0-12.a6
changelog:
- bind-9.5-2119_revert.patch and bind-9.5-fix_h_errno.patch are
  obsoleted by upstream bind-9.5-_res_errno.patch


author: Adam Tkac <atkac redhat com> 32:9.5.0-16.5.a6
changelog:
- added bind-sdb again, contains SDB modules and DLZ modules
- bind-9.3.1rc1-sdb.patch replaced by bind-9.5-sdb.patch


author: Adam Tkac <atkac redhat com> 32:9.5.0-17.a7
changelog:
- 9.5.0a7
- dropped patches (upstream)
  - bind-9.5-update.patch
  - bind-9.5-pool_badfree.patch
  - bind-9.5-_res_errno.patch


author: Adam Tkac <atkac redhat com> 32:9.5.0-18.4.a7
changelog:
- bind-9.5-random_ports.patch was removed because upstream doesn't
  like it. query-source{,v6} options are sufficient (#391931)
- bind-chroot-admin called restorecon on /proc filesystem (#405281)


author: Adam Tkac <atkac redhat com> 32:9.5.0-23.b1
changelog:
- fixed initscript wait loop (#426382)
- removed dependency on policycoreutils and libselinux (#426515)


author: Adam Tkac <atkac redhat com> 32:9.5.0-24.b1
changelog:
- removed bind-9.3.2-prctl_set_dumpable.patch (upstream)
- allow parallel building of libdns library
- CVE-2008-0122


author: Adam Tkac <atkac redhat com> 32:9.5.0-26.b2
changelog:
- build with -D_GNU_SOURCE (#431734)
- improved fix for #253537, posttrans script is now used
- improved fix for #400461
- 9.5.0b2
  - bind-9.3.2b1-PIE.patch replaced by bind-9.5-PIE.patch
    - only named, named-sdb and lwresd are PIE
  - bind-9.5-sdb.patch has been updated
  - bind-9.5-libidn.patch has been updated
  - bind-9.4.0-sdb-sqlite-bld.patch replaced by bind-9.5-sdb-sqlite-bld.patch
  - removed bind-9.5-gssapi-header.patch (upstream)
  - removed bind-9.5-CVE-2008-0122.patch (upstream)
- removed bind-9.2.2-nsl.patch
- improved sdb_tools Makefile.in


author: Adam Tkac <atkac redhat com> 32:9.5.0-27.b2
changelog:
- removed conditional build with libefence (use -fmudflapth instead)
- fixed building of DLZ stuff (#432497)
- do not build Berkeley DB DLZ backend
- temporary build with --disable-linux-caps and without threads (#433102)
- update named.ca file to affect IPv6 changes in root zone


author: Adam Tkac <atkac redhat com> 32:9.5.0-30.b3
changelog:
- 9.5.0b3 release
- dropped patches (upstream)
  - bind-9.5-transfer-segv.patch
  - bind-9.5-mudflap.patch
  - bind-9.5.0-generate-xml.patch
  - bind-9.5-libcap.patch


author: Adam Tkac <atkac redhat com> 32:9.5.0-32.b3
changelog:
- reverted "any" patch, upstream says not needed
- log EDNS failure only when we really switch to plain EDNS (#275091)
- detect configuration file better


author: Adam Tkac <atkac redhat com> 32:9.5.0-33.rc1
changelog:
- updated to 9.5.0rc1
- merged patches
  - bind-9.5-libcap.patch
- make binaries readable by others (#427826)


author: Adam Tkac <atkac redhat com> 32:9.5.0-36.1
changelog:
- removed dns-keygen utility in favour of rndc-confgen -a (#449287)
- some minor sample fixes (#449274)


author: Adam Tkac <atkac redhat com> 32:9.5.1-0.1.b1
changelog:
- 9.5.1b1 release (CVE-2008-1447)
- dropped bind-9.5-recv-race.patch because upstream doesn't want it


author: Adam Tkac <atkac redhat com> 32:9.5.1-0.3.b1
changelog:
- static libraries are no longer supported
- IP acls weren't merged correctly (#457175)
- use fPIE on sparcv9/sparc64 (Dennis Gilmore)
- add sparc64 to list of 64bit arches in spec (Dennis Gilmore)


author: Adam Tkac <atkac redhat com> 32:9.5.1-0.7.b2
changelog:
- 9.5.1b2 release
- patches merged
  - bind95-rh454783.patch
  - bind-9.5-edns.patch
  - bind95-rh450995.patch
  - bind95-rh457175.patch


author: Adam Tkac <atkac redhat com> 32:9.6.0-0.1.b1
changelog:
- 9.6.0b1 release
- don't build ODBC and Berkeley DB DLZ drivers
- end of bind-chroot-admin script, copy config files to chroot manually
- /proc doesn't have to be mounted to chroot
- temporary use libbind from 9.5 series, noone has been released for 9.6 yet


author: Adam Tkac <atkac redhat com> 32:9.6.0-0.5.rc1
changelog:
- 9.6.0rc1 release
- patches merged
  - bind-9.2.0rc3-varrun.patch
  - bind-95-sdlz-include.patch
  - bind-96-libxml2.patch
- fixed rare use-after-free problem in host utility (#452060)
- enabled chase of DNSSEC signature chains in dig


author: Adam Tkac <atkac redhat com> 32:9.6.0-11.P1
changelog:
- fall back to insecure mode when no supported DNSSEC algorithm is found
  instead of SERVFAIL
- don't fall back to non-EDNS0 queries when DO bit is set


author: Adam Tkac <atkac redhat com> 32:9.6.1-0.1.b1
changelog:
- 9.6.1b1 release
- patches merged
  - bind-96-isc_header.patch
  - bind-95-rh469440.patch
  - bind-96-realloc.patch
  - bind9-fedora-0001.diff
- use -version-number instead of -version-info libtool param


author: Martin Nagy <mnagy redhat com> 32:9.6.1-0.2.b1
changelog:
- update the patch for dynamic loading of database backends
- fix dns_db_unregister()
- useradd now takes "-N" instead of "-n" (atkac, #495726)
- print nicer error msg when zone file is actually a directory (atkac, #490837)


author: Martin Nagy <mnagy redhat com> 32:9.6.1-0.3.b1
changelog:
- update the patch for dynamic loading of database backends
- create %{_libdir}/bind directory
- copy default named.conf to doc directory, shared with s-c-bind (atkac)


author: Adam Tkac <atkac redhat com> 32:9.6.1-1
changelog:
- 9.6.1 release
- simplify chroot maintenance. Important files and directories are mounted into
  chroot (see /etc/sysconfig/named for more info, #504596)
- fix doc/named.conf.default perms


author: Adam Tkac <atkac redhat com> 32:9.6.1-2
changelog:
- improved "chroot automount" patches (#504596)
- host should fail if specified server doesn't respond (#507469)


author: Adam Tkac <atkac redhat com> 32:9.6.1-3
changelog:
- fix broken symlinks in bind-libs (#509635)
- fix typos in /etc/sysconfig/named (#509650)
- add DEBUG option to /etc/sysconfig/named (#510283)


author: Adam Tkac <atkac redhat com> 32:9.6.1-9.P1
changelog:
- next attempt to fix the postun trigger (#520385)
- remove obsolete bind-9.3.1rc1-fix_libbind_includedir.patch


author: Adam Tkac <atkac redhat com> 32:9.7.0-0.2.a2
changelog:
- improve chroot related documentation (#507795)
- add NetworkManager dispatcher script to reload named when network interface is
  activated/deactivated (#490275)
- don't set/unset named_write_master_zones SELinux boolean every time in
  initscript, modify it only when it's actually needed


author: Adam Tkac <atkac redhat com> 32:9.7.0-0.6.b1
changelog:
- update to 9.7.0b1
- add bind-pkcs11 subpackage to support PKCS11 compatible keystores for DNSSEC
  keys


author: Adam Tkac <atkac redhat com> 32:9.7.0-0.14.rc2
changelog:
- obsolete dnssec-conf
- automatically update configuration from old dnssec-conf based
- improve default configuration; enable DLV by default
- remove obsolete triggerpostun from bind-libs subpackage


author: Adam Tkac <atkac redhat com> 32:9.7.0-2
changelog:
- improve automatic DNSSEC reconfiguration trigger
- initscript now returns 2 in case that action doesn't exist (#523435)
- enable/disable chroot when bind-chroot is installed/uninstalled


author: Adam Tkac <atkac redhat com> 32:9.7.1-0.1.b1
changelog:
- update to 9.7.1b1
- make /var/named/dynamic as a default directory for managed DNSSEC keys
- add patch to get "managed-keys-directory" option working
- patches merged
  - bind97-managed-keyfile.patch
  - bind97-rh554316.patch


author: Adam Tkac <atkac redhat com> 32:9.7.1-3.P1
changelog:
- remove outdated Copyright.caching-nameserver file
- remove rfc1912.txt, it is already located in %doc/rfc directory
- move COPYRIGHT to the bind-libs subpkg
- add COPYRIGHT to the -pkcs11 subpkg


author: Adam Tkac <atkac redhat com> 32:9.7.2-3.P2
changelog:
- new bind-libs-lite and bind-lite-devel subpkgs which contain
  public version of BIND 9 libraries
- don't ship devel files for internal version of BIND 9 libraries


author: Adam Tkac <atkac redhat com> 32:9.7.2-5.P2
changelog:
- move BIND9 internal libs back to %{_libdir}
- add "-export" suffix to public libraries (-lite subpkg)


author: Adam Tkac <atkac redhat com> 32:9.7.3-0.3.b1
changelog:
- fix "service named status" when used with named-sdb
- don't check MD5, size and mtime of sysconfig/named


author: Adam Tkac <atkac redhat com> 32:9.7.3-1
changelog:
- update to 9.7.3
- fix dig +trace on dualstack systems (#674334)
- fix linkage order when building on system with older BIND (#665971)
- reduce number of gcc warnings


author: Adam Tkac <atkac redhat com> 32:9.8.1-0.1.rc1
changelog:
- update to 9.8.1rc1
- patches merged
  - bind97-rh674334.patch
  - bind97-cleanup.patch
  - bind98-includes.patch


author: Adam Tkac <atkac redhat com> 32:9.8.1-0.2.rc1
changelog:
- fix rare race condition in request.c
- print "the working directory is not writable" as debug message
- re-add configtest target to initscript
- initscript: sybsys name is always named, not named-sdb
- nsupdate returned zero when target zone didn't exist (#700097)
- nsupdate could have failed if server has multiple IPs and the first
  was unreachable (#714049)


author: Adam Tkac <atkac redhat com> 32:9.8.1-0.3.rc1
changelog:
- fix DLZ related compilation issues
- make /etc/named.{root,iscdlv}.key world-readable
- add bind-libs versioned requires to bind pkg


author: Adam Tkac <atkac redhat com> 32:9.8.1-1
changelog:
- update to 9.8.1
- ship /etc/trusted-key.key (needed by dig)
- use select instead of epoll in export libs (#735103)


author: Adam Tkac <atkac redhat com> 32:9.9.0-0.3.b2
changelog:
- update to 9.9.0b2 (CVE-2011-4313)
- patches merged
  - bind97-rh700097.patch
  - bind99-cinfo.patch


author: Adam Tkac <atkac redhat com> 32:9.9.0-1
changelog:
- update to 9.9.0
- load dynamic DBs later (and update dyndb patch)
- fix memory leak in named during processing of rndc command
- don't call `rndc-confgen -a` in "post" section
- fix some packaging bugs in bind-chroot


author: Tomas Hozza <thozza@redhat.com> 32:9.9.1-6.P2
changelog:
- Fixed bad path to systemctl in /etc/NetworkManager/dispatcher.d/13-named (#844047)
- Fixed path to libdb.so in config.dlz.in


author: Tomas Hozza <thozza@redhat.com> 32:9.9.1-9.P2
changelog:
- fixed SPEC file so it comply with new systemd-rpm macros guidelines (#850045)
- changed %define macros to %global and fixed several rpmlint warnings


author: Adam Tkac <atkac redhat com> 32:9.9.2-1
changelog:
- update to 9.9.2
- bind97-rh714049.patch has been dropped
- patches merged
  - bind98-rh816164.patch


author: Adam Tkac <atkac redhat com> 32:9.9.2-6.P1
changelog:
- generate /etc/rndc.key during named service startup if doesn't exist
- increase startup timeout in systemd units to 90sec (default)
- fix IDN related statement in dig.1 manpage


author: Tomas Hozza <thozza@redhat.com> 32:9.9.2-7.P1
changelog:
- Corrected IP addresses in named.ca (#901741)
- mount/umount /var/named in setup-named-chroot.sh as the last one (#904666)


author: Adam Tkac <atkac redhat com> 32:9.9.3-0.1.rc1
changelog:
- update to 9.9.3rc1
- bind-96-libtool2.patch has been merged
- fix bind tmpfiles.d for named.pid /run migration (#920713)


author: Tomas Hozza <thozza@redhat.com> 32:9.9.3-0.5.rc1
changelog:
- Include recursion Warning in named.conf and named.conf.sample (#740894)
- Include managed-keys-directory statement in named.conf.sample (#948026)


author: Tomas Hozza <thozza@redhat.com> 32:9.9.3-0.6.rc2
changelog:
- update to 9.9.3rc2
- part of bind97-exportlib.patch not needed any more
- bind-9.9.1-P2-multlib-conflict.patch modified to reflect latest source
- rl-9.9.3rc1.patch -> rl-9.9.3rc2.patch
- bind99-opts.patch merged


author: Tomas Hozza <thozza@redhat.com> 32:9.9.3-1
changelog:
- update to 9.9.3
- install dns/update.h header
- update RRL patch to the latest version 9.9.3-rl.150.20


author: Tomas Hozza <thozza@redhat.com> 32:9.9.3-5.P2
changelog:
- update to 9.9.3-P2 (fix for CVE-2013-4854)
- update RRL patch to 9.9.3-P2-rl.13207.22
- Fix script for setting up chroot so it unmounts everything successfully


author: Tomas Hozza <thozza@redhat.com> 32:9.9.4-5
changelog:
- Install configuration for rwtab and fix chroot setup script (#1028189)
- use --enable-filter-aaaa when building bind to enable filter-aaaa-on-v4 option (#1025245)


author: Tomas Hozza <thozza@redhat.com> 32:9.9.4-7
changelog:
- Create symlink /var/named/chroot/var/run -> /var/named/chroot/run (#1024384)
- Added session-keyfile statement into default named.conf since we use /run/named (#1024384)


author: Tomas Hozza <thozza@redhat.com> 32:9.9.4-8
changelog:
- Split chroot package for named and named-sdb
- Extract setting-up/destroying of chroot to a separate systemd service (#1004300)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-15
changelog:
- Use /dev/urandom when generating rndc.key file (#1107568)
- Allow authentication using TSIG in allow-notify configuration statement (#1067424)
- Fix race condition when destroying a resolver fetch object (#1072379)
- Increase defaults for lwresd workers and make workers and client objects number configurable (#1098959)
- Configure BIND with --with-dlopen=yes to support dynamically loadable DLZ drivers (#1096688)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-17
changelog:
- Fix error in dyndb API that can cause named to freeze on shutdown (#1142150)
- Fix error in triggerun scriptlet (#1143033)
- Remove /var/named/chroot/var/run on bind-chroot update if it is a directory (#1091341)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-19
changelog:
- Install config for tmpfiles under %{_tmpfilesdir} (#1180976)
- Fixed systemctl path in logrotate configuration (#1164264)
- remove information about system-config-bind from named.8 man page (#1152066)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-20
changelog:
- DNS resolution failure in high load environment with SERVFAIL and "out of memory/success" in the log (#1221180)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-22
changelog:
- Add version specific requires on bind for bind-pkcs11 (Related: #1097753)
- Resolve issues found by static analysis (Related: #1097753)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-23
changelog:
- Don't copy /etc/localtime on -chroot package installation (#1186773)
- Fix SPF resource records check to comply with RFC7208 (#1215164)
- Don't use ISC's DLV by default (#1223336)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-33
changelog:
- Fix excessive queries caused by DS chasing with stub zones when DNSSEC is not used (#1291185)
- Fix error in internal test suite (#1259514)
- Fix named-checkconf call in *-chroot.service files (#1278082)
- Fix incorrect path in BIND sample configuration and added comment to default configuration (#1247502)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-34
changelog:
- Added support for CAA records (#1306610)
- Use HTTPS URL instead of FTP for upstream sources (#1319280)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-36
changelog:
- Added automatic interface scan functionality (#1294506)
- Removed NetworkManager dispatcher script since it is not needed any more (#1294506)


author: Petr Menšík <pemensik@redhat.com> - 32:9.9.4-39
changelog:
- Fix CVE-2016-9131 (ISC change 4508)
- Fix CVE-2016-9147 (ISC change 4510)
- Fix regression introduced by CVE-2016-8864 (ISC change 4530)
- Fix CVE-2016-9444 (ISC change 4517)


author: Petr Menšík <pemensik@redhat.com> - 32:9.9.4-40
changelog:
- Fix possible infinite loop in start_lookup (CVE-2016-2775)
- Do not change lib permissions in chroot (#1392531)


author: Petr Menšík <pemensik@redhat.com> - 32:9.9.4-59
changelog:
- Support for additional signing algorithms in rndc (#1501531)
- New autogenerated rndc keys will use hmac-sha256 algorithm


author: Petr Menšík <pemensik@redhat.com> - 32:9.9.4-72
changelog:
- Fix automatic selinux boolean named_write_master_zones (#1569466)
- Allow starting named with readonly home again


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-1.P2
changelog:
- Rebase features patches
- Disable autodetected eddsa algorithm ED448
- Add versioned depends to all library subpackages
- Fix multilib conflict of devel packages


author: Tomas Korbar <tkorbar@redhat.com> - 32:9.11.4-17.P2
changelog:
- Prevent deadlock on reload (#1781576)
- Disable unit test timer_test on ppc64le because of its instability


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-23.P2
changelog:
- Limit number of queries triggered by a request (CVE-2020-8616)
- Fix invalid tsig request (CVE-2020-8617)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-26.P2.1
changelog:
- Fix tsig-request verify (CVE-2020-8622)
- Prevent PKCS11 daemon crash on crafted packet (CVE-2020-8623)
- Correct update-policy type subdomain to match documentation (CVE-2020-8624)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-26.P2.10
changelog:
- Fix memory leak in ECDSA verify processing (CVE-2022-38177)
- Fix memory leak in EdDSA verify processing (CVE-2022-38178)


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 2:9.11.4-26.P2.14.tuxcare.els2
changelog:
- CVE-2023-50387: Resolved CPU exhaustion from specially crafted DNSSEC-signed
  zone responses
- CVE-2023-50868: Resolved CPU exhaustion from DNSSEC-signed zones using NSEC3


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 32:9.11.4-26.P2.15.tuxcare.els1
changelog:
- Moved tuxcare patches from 32:9.11.4-26.P2.14
- CVE-2023-50387: Resolved CPU exhaustion from specially crafted DNSSEC-signed
  zone responses
- CVE-2023-50868: Resolved CPU exhaustion from DNSSEC-signed zones using NSEC3


author: Stepan Broz <sbroz@redhat.com> - 32:9.11.4-26.P2.16
changelog:
- Prevent increased CPU consumption in DNSSEC validator (CVE-2023-50387
  CVE-2023-50868)
- Add missing design by contract tests to dns_catz*
- Speed up parsing of DNS messages with many different names (CVE-2023-4408)
- Do not use header_prev in expire_lru_headers


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 33:9.11.4-26.P2.16.tuxcare.els2
changelog:
- CVE-2024-1737: add a limit to the number of RRs in RRSets
  and RR types for single name
- CVE-2024-1975: remove support for SIG(0) message verification
- Fix the SYSTEMTEST section in the spec file


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 33:9.11.4-26.P2.16.tuxcare.els4
changelog:
- CVE-2024-1737: add environment variable DNS_RDATASET_MAX_RECORDS, DNS_RBTDB_MAX_RTYPES to
  override hardcoded limits DDNS_RDATASET_MAX_RECORDS and DDNS_RBTDB_MAX_RTYPES
- Fix man8 pages for dnssec utils


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 33:9.11.4-26.P2.16.tuxcare.els8
changelog:
- Remove bind-9.11.4-CVE-2023-4408.patch which introduces an ABI change that
  breaks bind-dyndb-ldap
- Enforce that bind-dyndb-ldap is updated after ABI changes introduced in 9.11.4-26.P2.15
  update


author: Cristian Gafton <gafton@redhat.com>
changelog:
- upgraded again to 2.8.1.0.28 (at least on alpha now egcs will compile)
- added info packages handling


author: Cristian Gafton <gafton@redhat.com>
changelog:
- updated to 2.8.1.0.29 (HJ warned me that this thing is a moving target...
  :-)
- "fixed" the damn make install command so that all tools get installed


author: Cristian Gafton <gafton@redhat.com>
changelog:
- added ARM patch from philb
- version 2.9.1.0.19a
- added a patch to allow arm* arch to be identified as an ARM


author: Cristian Gafton <gafton@redhat.com>
changelog:
- version  2.9.1.0.23
- patch to make texinfo documentation compile
- auto rebuild in the new build environment (release 2)


author: Cristian Gafton <gafton@redhat.com>
changelog:
- back out very *stupid* sparc patch done by HJLu. People, keep out of
  things you don't understand.
- add alpha relax patch from rth


author: Jim Kingdon
changelog:
- No source/spec changes, just rebuilding with egcs-1.1.2-18 because
  the older egcs was miscompling gprof.


author: Jakub Jelinek <jakub@redhat.com>
changelog:
- 2.11.90.0.8
  - some SHF_MERGE suport fixes
- don't build with tooldir /usrusr instead of /usr (#40937)
- reserve few .dynamic entries for prelinking


author: Jakub Jelinek <jakub@redhat.com> 2.11.90.0.8-6
changelog:
- support for -z combreloc
- remove .dynamic patch, -z combreloc patch does this better
- set STT_FUNC default symbol sizes in .endp directive on IA-64


author: Jakub Jelinek <jakub@redhat.com> 2.11.90.0.8-8
changelog:
- on IA-64, put crtend{,S}.o's .IA_64.unwind section last in
  .IA_64.unwind output section (for compatibility with 7.1 eh)


author: Jakub Jelinek <jakub@redhat.com> 2.11.90.0.8-11
changelog:
- add iplt support for IA-64 (Richard Henderson)
- switch to new section flags for SHF_MERGE and SHF_STRINGS, put
  in compatibility code
- "s" section flag for small data sections on IA-64 and Alpha
  (Richard Henderson)
- fix sparc64 .plt[32768+] handling
- don't emit .rela.stab on sparc


author: Jakub Jelinek <jakub@redhat.com> 2.11.92.0.5-1
changelog:
- update to 2.11.92.0.5
  - binutils localization (#45148)
  - fix typo in REPORT_BUGS_TO (#54325)
- support files bigger than 2GB in strings (#54406)


author: Jakub Jelinek <jakub@redhat.com> 2.11.92.0.12-1
changelog:
- update to 2.11.92.0.12
  - optimize .dynstr and .shstrtab sections (#55524)
  - fix ld.1 glitch (#55459)
- turn relocs against SHF_MERGE local symbols with zero addend
  into STT_SECTION + addend
- remove man pages for programs not included (nlmconv, windres, dlltool;
  - add BuildRequires for texinfo


author: Jakub Jelinek <jakub@redhat.com> 2.11.92.0.12-3
changelog:
- H.J.'s patch to avoid crash if input files are not ELF
- don't crash if a SHF_MERGE for some reason could not be merged
- fix objcopy/strip to preserve SHF_MERGE sh_entsize
- optimize .eh_frame sections, add PT_GNU_EH_FRAME support
- support anonymous version tags in version script


author: Jakub Jelinek <jakub@redhat.com> 2.11.92.0.12-7
changelog:
- as ld is currently not able to shrink input sections to zero size
  during discard_info, build a fake minimal CIE in that case
- update elf-strtab patch to what was commited


author: Jakub Jelinek <jakub@redhat.com> 2.11.93.0.2-2
changelog:
- trade one saved runtime page for data segment (=almost always not shared)
  for up to one page of disk space where possible


author: Jakub Jelinek <jakub@redhat.com> 2.11.93.0.2-4
changelog:
- add DW_EH_PE_absptr -> DW_EH_PE_pcrel optimization for shared libs,
  if DW_EH_PE_absptr cannot be converted that way, don't build the
  .eh_frame_hdr search table


author: Jakub Jelinek <jakub@redhat.com> 2.11.93.0.2-12
changelog:
- fix .hidden handling on SPARC (Richard Henderson)
- don't crash when linking -shared non-pic code with SHF_MERGE
- fix .eh_frame_hdr for DW_EH_PE_aligned
- correctly adjust DW_EH_PE_pcrel encoded personalities in CIEs


author: Jakub Jelinek <jakub@redhat.com> 2.12.90.0.15-1
changelog:
- update to 2.12.90.0.15
- TLS .tbss fix
- don't use rpm %configure macro, it is broken too often (#69366)


author: Jakub Jelinek <jakub@redhat.com> 2.13.90.0.2-1
changelog:
- update to 2.13.90.0.2
  - fix ld TLS assertion failure (#70084)
  - fix readelf --debug-dump= handling to match man page and --help
    (#68997)
- fix _GLOBAL_OFFSET_TABLE gas handling (#70241)


author: Jakub Jelinek <jakub@redhat.com> 2.13.90.0.2-3
changelog:
- allow addends for IA-32 TLS @tpoff, @ntpoff and @dtpoff
- clear memory at *r_offset of dynamic relocs on PPC
- avoid ld crash if accessing non-local symbols through LE relocs
- new IA-32 TLS relocs, bugfixes and testcases
- use brl insn on IA-64 (Richard Henderson)
- fix R_IA64_PCREL21{M,F} handling (Richard Henderson)
- build in separate builddir, so that gasp tests don't fail
- include localization


author: Jakub Jelinek <jakub@redhat.com> 2.13.90.0.4-1
changelog:
- update to 2.13.90.0.4
- x86-64 TLS support
- some IA-32 TLS fixes
- some backported patches from trunk
- include opcodes, ld, gas and bfd l10n too


author: Jakub Jelinek <jakub@redhat.com> 2.13.90.0.4-2
changelog:
- fix orphan .rel and .rela section placement with -z combreloc (Alan Modra)
- skip incompatible linker scripts when searching for libraries


author: Jakub Jelinek <jakub@redhat.com> 2.13.90.0.10-1
changelog:
- update to 2.13.90.0.10
- add a bi-arch patch for sparc/s390/x86_64
- add --enable-64-bit-bfd on sparc, s390 and ppc


author: Jakub Jelinek <jakub@redhat.com> 2.13.90.0.10-3
changelog:
- fix names and content of alpha non-alloced .rela.* sections (#76583)
- delete unpackaged files from the buildroot


author: Jakub Jelinek <jakub@redhat.com> 2.13.90.0.10-4
changelog:
- pad .rodata.cstNN sections at the end if they aren't sized to multiple
  of sh_entsize
- temporary patch to make .eh_frame and .gcc_except_table sections
  readonly if possible (should be removed when AUTO_PLACE is implemented)
- fix .PPC.EMB.apuinfo section flags


author: Jakub Jelinek <jakub@redhat.com> 2.13.90.0.16-8
changelog:
- alpha TLS fixes
- use .debug_line directory table to make the section tiny bit smaller
- libtool fix from Jens Petersen


author: Jakub Jelinek <jakub@redhat.com> 2.13.90.0.18-2
changelog:
- fix SEARCH_DIR on x86_64/s390x
- fix Alpha --relax
- create DT_RELA{,SZ,ENT} on s390 even if there is just .rela.plt
  and no .rela.dyn section
- support IA-32 on IA-64 (#83752)
- .eh_frame_hdr fix (Andreas Schwab)


author: Jakub Jelinek <jakub@redhat.com> 2.13.90.0.18-3
changelog:
- handle .symver x, x@FOO in ld such that relocs against x become
  dynamic relocations against x@FOO (#83325)
- two PPC64 TLS patches (Alan Modra)


author: Jakub Jelinek <jakub@redhat.com> 2.13.90.0.18-5
changelog:
- fix the previous .symver change
- remove libbfd.so and libopcodes.so symlinks, so that other packages
  link statically, not dynamically against libbfd and libopcodes
  whose ABI is everything but stable


author: Jakub Jelinek <jakub@redhat.com> 2.13.90.0.18-6
changelog:
- don't clear elf_link_hash_flags in the .symver patch
- only use TC_FORCE_RELOCATION in s390's TC_FORCE_RELOCATION_SUB_SAME
  (Alan Modra)


author: Jakub Jelinek <jakub@redhat.com> 2.13.90.0.20-4
changelog:
- fix ppc32 plt reference counting
- don't include %{_prefix}/%{_lib}/debug in the non-debuginfo package
  (#87729)


author: Jakub Jelinek <jakub@redhat.com> 2.14.90.0.4-1
changelog:
- update to 2.14.90.0.4-1
- gas CFI updates (Richard Henderson)
- dynamic executables (Ulrich Drepper)


author: Jakub Jelinek <jakub@redhat.com> 2.14.90.0.4-2
changelog:
- rename ld --dynamic option to --pic-executable or --pie
- fix ld --help output
- document --pie/--pic-executable in ld.info and ld.1


author: Jakub Jelinek <jakub@redhat.com> 2.14.90.0.4-7
changelog:
- some CFI updates/fixes
- don't create dynamic relocations against symbols defined in PIE
  exported from its .dynsym


author: Jakub Jelinek <jakub@redhat.com> 2.14.90.0.4-8
changelog:
- remove some unnecessary provides in ppc64 linker script
  which were causing e.g. empty .ctors/.dtors section creation


author: Jakub Jelinek <jakub@redhat.com> 2.14.90.0.4-9
changelog:
- ensure R_PPC64_{RELATIVE,ADDR64} have *r_offset == r_addend
  and the other relocs have *r_offset == 0


author: Jakub Jelinek <jakub@redhat.com> 2.14.90.0.4-13
changelog:
- update CFI stuff to 2003-06-18
- make sure .eh_frame is aligned to 8 bytes on 64-bit arches,
  remove padding within one .eh_frame section


author: Jakub Jelinek <jakub@redhat.com> 2.14.90.0.4-14
changelog:
- added support for Intel Prescott instructions
- fix hint@pause for ia64
- add workaround for LTP sillyness (#97934)


author: Jakub Jelinek <jakub@redhat.com> 2.14.90.0.4-16
changelog:
- fix readelf -d on IA-64
- build libiberty.a with -fPIC, so that it can be lined into shared
  libraries


author: Jakub Jelinek <jakub@redhat.com> 2.14.90.0.4-17
changelog:
- fix ia64 -pie support
- require no undefined non-weak symbols in PIEs like required for normal
  binaries


author: Jakub Jelinek <jakub@redhat.com> 2.14.90.0.4-19
changelog:
- fix -pie support on amd64, s390, s390x and ppc64
- issue relocation overflow errors for s390/s390x -fpic code when
  accessing .got slots above 4096 bytes from .got start


author: Jakub Jelinek <jakub@redhat.com> 2.14.90.0.4-22
changelog:
- fix elfNN_ia64_dynamic_symbol_p (Richard Henderson, #86661)
- don't access memory beyond what was allocated in readelf
  (Richard Henderson)


author: Jakub Jelinek <jakub@redhat.com> 2.14.90.0.5-4
changelog:
- fix ppc64 elfvsb linker tests
- some more 64-bit cleanliness fixes, give ppc64 fdesc symbols
  type and size (Alan Modra)


author: Jakub Jelinek <jakub@redhat.com> 2.14.90.0.6-1
changelog:
- update to 2.14.90.0.6
- speed up string merging (Lars Knoll, Michael Matz, Alan Modra)
- speed up IA-64 local symbol handling during linking


author: Jakub Jelinek <jakub@redhat.com> 2.14.90.0.6-4
changelog:
- fix assembly parsing of foo=(.-bar)/4 (Alan Modra)
- fix IA-64 assembly parsing of (p7) hint @pause


author: Jakub Jelinek <jakub@redhat.com> 2.14.90.0.8-2
changelog:
- fix testcases on AMD64
- fix .got's sh_entsize on IA32/AMD64
- set COMMONPAGESIZE on s390/s390x
- set COMMONPAGESIZE on ppc32 (Alan Modra)


author: Jakub Jelinek <jakub@redhat.com> 2.14.90.0.8-8
changelog:
- with -z now without --enable-new-dtags create DT_BIND_NOW
  dynamic entry in addition to DT_FLAGS_1 with DF_1_NOW bit set


author: Jakub Jelinek <jakub@redhat.com> 2.15.90.0.1.1-2
changelog:
- update to 20040326 CVS
  - fix ppc64 weak .opd symbol handling (Alan Modra, #119086)
- fix .tbss handling bug introduced


author: Jakub Jelinek <jakub@redhat.com> 2.15.90.0.3-4
changelog:
- -z relro ppc/ppc64/ia64 fixes
- change x86-64 .plt symbol st_size handling to match ia32
- prettify objdump -d output


author: Jakub Jelinek <jakub@redhat.com> 2.15.91.0.2-4
changelog:
- kill ppc64 dot symbols (Alan Modra)
- objdump -d support for objects without dot symbols
- support for overlapping ppc64 .opd entries


author: Jakub Jelinek <jakub@redhat.com> 2.15.91.0.2-5
changelog:
- various ppc64 make check fixes when using non-dot-syms gcc (Alan Modra)
- fix --gc-sections
- on ia64 create empty .gnu.linkonce.ia64unw*.* sections for
  .gnu.linkonce.t.* function doesn't need unwind info


author: Jakub Jelinek <jakub@redhat.com> 2.15.91.0.2-7
changelog:
- resolve all undefined ppc64 .* syms to the function bodies through
  .opd, not just those used in brach instructions (Alan Modra)


author: Jakub Jelinek <jakub@redhat.com> 2.15.91.0.2-8
changelog:
- fix linker segfaults on input objects with SHF_LINK_ORDER with
  incorrect sh_link (H.J.Lu, Nick Clifton, #130198, BZ #290)


author: Jakub Jelinek <jakub@redhat.com> 2.15.91.0.2-9
changelog:
- avoid almost 1MB (sparse) gaps in the middle of -z relro
  libraries on x86-64 (Andreas Schwab)
- fix -z relro to make sure end of PT_GNU_RELRO segment is always
  COMMONPAGESIZE aligned


author: Jakub Jelinek <jakub@redhat.com> 2.15.92.0.2-3
changelog:
- revert Sep 09 change to make ppc L second argument e.g. for tlbie
  non-optional
- fix stripping of prelinked binaries and libraries (#133734)
- allow strings(1) on 32-bit arches to be used again with > 2GB
  files (#133555)


author: Jakub Jelinek <jakub@redhat.com> 2.15.92.0.2-10
changelog:
- avoid unnecessary gap with -z relro showing on i686 libc.so
- ppc64 --emit-relocs fix (Alan Modra)
- don't crash if STT_SECTION symbol has incorrect st_shndx (e.g. SHN_ABS,
  as created by nasm; #142181)
- don't try to make absptr LSDAs relative if they don't have relocations
  against them (Alan Modra, #141162)


author: Jakub Jelinek <jakub@redhat.com> 2.15.94.0.2-1
changelog:
- update to 2.15.94.0.2
- fix .note.GNU-stack/PT_GNU_STACK computation in linker on ppc64 (#147296)
- fix stripping of binaries/libraries that have empty sections right before
  .dynamic section (with the same starting address; #144038)
- handle AS_NEEDED (...) in linker script INPUT/GROUP


author: Jakub Jelinek <jakub@redhat.com> 2.15.94.0.2-3
changelog:
- fix buffer overflows in readelf (#149506)
- move c++filt to binutils from gcc-c++, conflict with gcc-c++ < 4.0 (#86333)


author: Jakub Jelinek <jakub@redhat.com> 2.16.90.0.3-1
changelog:
- update to 2.16.90.0.3
- update to 20050615 CVS
  - ppc32 secure PLT support (Alan Modra)
- further bfd/readelf robustification


author: Jakub Jelinek <jakub@redhat.com> 2.16.91.0.1-3
changelog:
- fix buffer overflow in readelf ia64 unwind printing code
- use vsnprintf rather than vsprintf in gas diagnostics (Tavis Ormandy)
- fix ld-cdtest when CFLAGS contains -fexceptions


author: Jakub Jelinek <jakub@redhat.com> 2.16.91.0.2-2
changelog:
- don't complain about relocs to discarded sections in ppc32
  .got2 sections (Alan Modra, PR target/17828)


author: Jakub Jelinek <jakub@redhat.com> 2.16.91.0.5-1
changelog:
- update to 2.16.91.0.5
- don't error about .toc1 references to discarded sectiosn on ppc64
  (#175944)


author: Jakub Jelinek <jakub@redhat.com> 2.16.91.0.6-1
changelog:
- update to 2.16.91.0.6
  - fix ppc64 --gc-sections
  - disassembler fixes for x86_64 cr/debug regs
  - fix linker search order for DT_NEEDED libs


author: Jakub Jelinek <jakub@redhat.com> 2.16.91.0.6-2
changelog:
- add MNI support on i?86/x86_64 (#183080)
- support S signal frame augmentation flag in .eh_frame,
  add .cfi_signal_frame support (#175951, PR other/26208, BZ#300)


author: Jakub Jelinek <jakub@redhat.com> 2.16.91.0.6-6
changelog:
- fix ld error message formatting, so that collect2 parser can
  parse it again for g++ -frepo (#187142)


author: Jakub Jelinek <jakub@redhat.com> 2.17.50.0.2-1
changelog:
- update to 2.17.50.0.2
- update from CVS to 20060601
- speed up the ELF linker by caching the result of kept section check
  (H.J. Lu)


author: Jakub Jelinek <jakub@redhat.com> 2.17.50.0.2-3
changelog:
- fix two places in ld that misbehaved with MALLOC_PERTURB_=N
- fix .tls_common handling in relocatable linking


author: Jakub Jelinek <jakub@redhat.com> 2.17.50.0.2-8
changelog:
- add support for new AMDFAM10 instructions (#198281, IT#97662)
- add -march=/-mtune= gas support on x86/x86-64
- x86/x86-64 nop insn improvements
- fix DT_GNU_HASH shift count value computation


author: Jakub Jelinek <jakub@redhat.com> 2.17.50.0.6-2
changelog:
- update to 2.17.50.0.6
  - fix for section relative linker script defined symbols in
    empty sections (#207598, BZ#3267)
  - fix handling of DW_CFA_set_loc in .eh_frame optimizations
  - fix R_PPC_{PLT,GOT{,_TLSGD,_TLSLD,_TPREL,_DTPREL}}16_HA relocation
    handling with weak undefined symbols (Alan Modra, #211094)


author: Jakub Jelinek <jakub@redhat.com> 2.17.50.0.7-1
changelog:
- update to 2.17.50.0.7
  - .cfi_personality and .cfi_lsda directives, per subsection .cfi_*
    directives, better .eh_frame CIE merging


author: Jakub Jelinek <jakub@redhat.com> 2.17.50.0.12-1
changelog:
- update to 2.17.50.0.12
- revert the misdesigned LD_SYMBOLIC{,_FUNCTIONS} env var support,
  only support -Bsymbolic/-Bsymbolic-functions/--dynamic-list*


author: Jakub Jelinek <jakub@redhat.com> 2.17.50.0.12-3
changelog:
- don't require matching ELF_OSABI for target vecs with ELFOSABI_NONE,
  only prefer specific osabi target vecs over the generic ones
  (H.J.Lu, #230964, BZ#3826)
- build libbfd.so and libopcodes.so with -Bsymbolic-functions


author: Jakub Jelinek <jakub@redhat.com> 2.17.50.0.17-4
changelog:
- don't kill the %{_gnu} part of target name on arm
  (Lennert Buytenhek, #243516)
- create just one PT_NOTE segment header for all consecutive SHT_NOTE
  sections


author: Jakub Jelinek <jakub@redhat.com> 2.17.50.0.18-1
changelog:
- update to 2.17.50.0.18
  - GPLv3+
  - preserve .note.gnu.build-id in objcopy --only-keep-debug (#251935)
  - fix sparc64/alpha broken by --build-id patch (#252936)
- update License tag
- fix ld crash with --build-id and non-ELF output format (Alan Modra, BZ#4923)


author: Jakub Jelinek <jakub@redhat.com> 2.18.50.0.4-2
changelog:
- revert aranges optimization (Alan Modra, BZ#5303, BZ#5755)
- fix ld-shared testcase for GCC 4.3 (H.J. Lu)


author: Jan Kratochvil <jan.kratochvil@redhat.com> 2.18.50.0.6-4
changelog:
- include the `dist' tag in the Release number
- libbfd.a symbols visibility is now hidden (for #447426, suggested by Jakub)


author: Jan Kratochvil <jan.kratochvil@redhat.com> 2.18.50.0.8-1
changelog:
- Update to 2.18.50.0.8.
  - Drop the .clmul -> .pclmul renaming backport.
- Add %{binutils_target} macro to support building cross-binutils.
  (David Woodhouse)
- Support `--without testsuite' to suppress the testsuite run.
- Support `--with debug' to build without optimizations.
- Refresh the patchset with fuzz 0 (for new rpmbuild).
- Enable the spu target on ppc/ppc64 (BZ 455242).


author: Jan Kratochvil <jan.kratochvil@redhat.com> 2.18.50.0.8-2
changelog:
- Fix parsing elf64-i386 files for kdump PAE vmcore dumps (BZ 457189).
- Turn on 64-bit BFD support for i386, globally enable AC_SYS_LARGEFILE.
- `--with debug' builds now with --disable-shared.
- Removed a forgotten unused ld/eelf32_spu.c workaround from 2.18.50.0.8-1.


author: Jan Kratochvil <jan.kratochvil@redhat.com> 2.18.50.0.9-1
changelog:
- Update to 2.18.50.0.9.
  - Drop the ppc-only spu target pre-build stage (BZ 455242).
  - Drop parsing elf64-i386 files for kdump PAE vmcore dumps (BZ 457189).
- New .spec BuildRequires zlib-devel (/-static) for compressed sections.
- Update .spec Buildroot to be more unique.


author: Jan Kratochvil <jan.kratochvil@redhat.com> 2.18.50.0.9-2
changelog:
- Package review, analysed by Jon Ciesla and Patrice Dumas (BZ 225615).
 - build back in the sourcedir without problems as gasp is no longer included.
 - Fix the install-info requirement.
 - Drop the needless gzipping of the info files.
 - Provide Obsoletes versions.
 - Use the %configure macro.


author: Jan Kratochvil <jan.kratochvil@redhat.com> 2.18.50.0.9-3
changelog:
- Provide libbfd.so and libopcodes.so for automatic dependencies (BZ 463101).
- Fix .eh_frame_hdr build on C++ files with discarded common groups (BZ 458950).
- Provide --build and --host to fix `rpmbuild --target' biarch builds.
- Include %{binutils_target}- filename prefix for binaries for cross builds.
- Fix multilib conflict on %{_prefix}/include/bfd.h's BFD_HOST_64BIT_LONG_LONG.


author: Jan Kratochvil <jan.kratochvil@redhat.com> 2.18.50.0.9-6
changelog:
- binutils-devel now requires zlib-devel (BZ 463101 comment 5).
- Fix complains on .gnu.linkonce.r relocations to their discarded
  .gnu.linkonce.t counterparts.


author: Jan Kratochvil <jan.kratochvil@redhat.com> 2.18.50.0.9-7
changelog:
- Fix %{_prefix}/include/bfd.h on 32-bit hosts due the 64-bit BFD target
  support from 2.18.50.0.8-2 (BZ 468495).


author: Nick Clifton <nickc@redhat.com> 2.19.50.0.1
changelog:
- Rebase sources on 2.19.50.0.1 tarball.  Update all patches, trimming
  those that are no longer needed.


author: Nick Clifton <nickc@redhat.com> 2.19.50.0.1-8
changelog:
- Add build-id patch to ensure that section contents are incorporated
  into a build id.  (BZ 472152)


author: Nick Clifton <nickc@redhat.com> 2.19.51.0.11-28
changelog:
- Rebase sources on 2.19.51.0.13 tarball.  Remove redundant orphan section placement patch. (BZ 512937)


author: Nick Clifton <nickc@redhat.com> 2.20.51.0.2-1
changelog:
- Rebase on 2.20 tarball.
- Remove redundant moxie patch.
- Remove redundant unique is global patch.
- Remove redundant cxxfilt java doc patch.


author: Jan Kratochvil <jan.kratochvil@redhat.com> 2.20.51.0.2-2
changelog:
- Fix rpm --excludedocs (BZ 515922).
- Fix spurious scriplet errors by `exit 0'. (BZ 517979, Nick Clifton)


author: Nick CLifton <nickc@redhat.com> 2.20.51.0.2-3
changelog:
- Rename --add-needed to --copy-dt-needed-entries and improve error message about unresolved symbols in DT_NEEDED DSOs.


author: Jakub Jelinek <jakub@redhat.com> 2.20.51.0.2-4
changelog:
- Fix ld -s with IRELATIVE relocations.  (BZ 533321, PR ld/10911)
- Add AMD Orochi LWP support, fix FMA4 support.


author: Nick Clifton <nickc@redhat.com> - 2.20.51.0.7-1
changelog:
- Rebase on 2.20.51.0.7 tarball.
- Delete redundant patches:
  binutils-2.20.51.0.2-add-needed.patch,
  binutils-2.20.51.0.2-do-not-set-ifunc.patch,
  binutils-2.20.51.0.2-enable-gold.patch,
  binutils-2.20.51.0.2-gas-expr.patch,
  binutils-2.20.51.0.2-ifunc-ld-s.patch,
  binutils-2.20.51.0.2-lwp.patch,
  binutils-2.20.51.0.2-ppc-hidden-plt-relocs.patch,
  binutils-2.20.51.0.2-x86-hash-table.patch,
- Do not allow unique symbols to be bound locally.  (PR ld/11434)
- Add support for DWARF4 debug information.


author: Nick Clifton <nickc@redhat.com> - 2.20.51.0.7-4
changelog:
- Allow GOLD linker to parse "-l<name>" directives inside INPUT statements in linker scripts. (BZ 600553)


author: Nick Clifton <nickc@redhat.com> - 2.20.51.0.7-5
changelog:
- Rename the binutils-static package to binutils-devel in line with the Fedora packaging guidelines.


author: Nick Clifton <nickc@redhat.com> - 2.21.51.0.5-1
changelog:
- Rebase on 2.21.51.0.5 tarball.
- Delete redundant patches.
- Fix gold+ld configure command line option.


author: Nick Clifton <nickc@redhat.com> - 2.22.52.0.1-1
changelog:
- Rebase on 2.22.52 release.
- Remove build-id.patch and gold-casts.patch as they are included in the 2.22.52 sources.


author: Nick Clifton <nickc@redhat.com> - 2.22.52.0.2-1
changelog:
- Rebase on 2.22.52.0.2 release.  (#816514)
- Retire binutils-2.22.52.0.1-weakdef.patch, binutils-2.22.52.0.1-ld-13621.patch, binutils-rh797752.patch, binutils-2.22.52.0.1-x86_64-hidden-ifunc.patch, binutils-2.22.52.0.1-tsx.patch and binutils-2.22.52.0.1-hidden-ifunc.patch.
- Update binutils-2.22.52.0.1-reloc-on-by-default.patch.


author: Nick Clifton <nickc@redhat.com> - 2.23.51.0.1-1
changelog:
- Rebase on 2.23.51.0.1 release.  (#846433)
- Retire binutils-2.22.52.0.4-dwz.patch, binutils-2.22.52.0.4-ar-4Gb.patch, binutils-2.22.52.0.4-arm-plt-refcount.patch, binutils-2.22.52.0.4-s390-64bit-archive.patch.


author: Nick Clifton <nickc@redhat.com> - 2.23.51.0.2-1
changelog:
- Rebase on 2.23.51.0.2 release.  (#856119)
- Retire binutils-2.23.51.0.1-gold-keep.patch and binutils-rh805974.patch.


author: Jeff Law <law@redhat.com> - 2.23.52.0.1-10
changelog:
- Add libstdc++-static as a build requirement when running
  the testsuite.
- Add remaining power8 support (#731883)


author: Jeff Law <law@redhat.com> - 2.23.52.0.1-11
changelog:
- Add support for TDB notes section (#805115)
- Fix length operands for cdzt, cxzt czdt and czxt (#805115)


author: Jakub Jelinek <jakub@redhat.com> - 2.23.52.0.1-12
changelog:
- Add Intel AVX3, MPX and SHA support.
- Add support for x86-64 -mcmodel=large -fpic TLS transitions.  (#994244)


author: Jeff Law <law@redhat.com> - 2.23.52.0.1-14
changelog:
- Fix two may-be-uninitialized issues exposed by changes in
  compiler flags used to build binutils (#1048848).


author: Kyle McMartin <kyle@redhat.com> - 2.23.52.0.1-16.4
changelog:
- AArch64: Backport two fixes from upstream and add a draft patch to
  set DF_STATIC_TLS when emitting IE relocs. Also increase
  ELF_COMMONPAGESIZE to 64K to match the kernel.


author: Patsy Franklin <pfrankli@redhat.com> - 2.23.52.0.1-21.9
changelog:
- This fixes a problem seen on powerpc64le ELFv2 when creating a
  function symbol alias with ld --defsym.  st_other needs to be copied
  from the source symbol to the alias in order to set up the local entry
  offset for the alias.


author: Patsy Franklin <pfrankli@redhat.com> - 2.23.52.0.1-22.9
changelog:
- Reduce the size of aarch64 .debug_line; fix cfi encoding of fp registers;
  add register names to dumping of aarch64 cfi data. Patch provided by rth.
  Resolves: #1132641


author: Jeff Law <law@redhat.com> - 2.23.52.0.1-25.9
changelog:
Revert this change (handled elsewhere):
- Additional patch from Alan to fix problems with ld --defsym.
  (#1132732)


author: Jeff Law <law@redhat.com> - 2.23.52.0.1-33
changelog:
- Do not replace R_390_TLS_LE{32,64} with R_390_TLS_TPOFF for PIE
  (#872148)
- Enable relro by default for arm and aarch64 (#1203449)
- Backport 3 RELRO improvements for ppc64/ppc64le from upstream
  (#1175624)


author: Jeff Law <law@redhat.com> - 2.23.52.0.1-37
changelog:
- Andreas's backport of z13 and dependent fixes for s390,
  including tesetcase fix from Apr 27, 2015.'  (#1182153)


author: Jeff Law <law@redhat.com> - 2.23.52.0.1-40
changelog:
- Minor testsuite adjustments for PPC changes in -38/-39.
  (#1183838)
  Fix md_assemble for PPC to handle arithmetic involving the TOC
  better.  (#1183838)


author: Martin Sebor <msebor@redhat.com> - 2.23.52.0.1-41
changelog:
- Fixup bfd elf_link_add_object_symbols for ppc64 to prevent subsequent
  uninitialized accesses elsewhere. (#1172766)


author: Jeff Law <law@redhat.com> - 2.23.52.0.1-42
changelog:
- Clamp maxpagesize at 1 (rather than 0) to avoid segfaults
  in the linker when passed a bogus max-page-size argument.
  (#1203449)


author: Jeff Law <law@redhat.com> - 2.23.52.0.1-44
changelog:
- Avoid reading beyond function boundary when disassembling.
  (#1060282)

- For binary ouput, we don't have an ELF bfd output so can't access
  elf_elfheader.  (#1226864)


author: Nick Clifton <nickc@redhat.com> - 2.23.52.0.1-45
changelog:
- Change strings program to default to -a.  Fix problems parsing
  files containg corrupt ELF group sections.  (#1157276)


author: Nick Clifton <nickc@redhat.com> 2.25.1-3
changelog:
- Experimental rebase on FSF 2.25.1 sources.
  (#1341730)
- Retire: patch11, patch12, patch13, patch14, patch15,
  patch16, patch17, patch18, patch19, patch20, patch21,
  patch22, patch23, patch24, patch25, patch26, patch27,
  patch28, patch29, patch30, patch32, patch100, patch101,
  patch102, patch110, patch111, patch112, patch113, patch114,
  patch115, patch116, patch117, patch118, patch119, patch120,
  patch121, patch201, patch202, patch203, patch204, patch205,
  patch206, patch207, patch208, patch209, patch210, patch211,
  patch212, patch300, patch301, patch302, patch303, patch304,
  patch305, patch306, patch307, patch308, patch309, patch400,
  patch401, patch402, patch403, patch404, patch405, patch406,
  patch407, patch501
- Add patch to suppress checking of PPC64 TLBIE instruction.  [TEMPORARY]
- Add fix for FSF PR 18879
- Add fix for s390x linker testsuite failure.
  (#1276755)
  (#1260158)
  (#1300734)
  (#1288068)


author: Nick Clifton <nickc@redhat.com> 2.25.1-4
changelog:
- Improve warning message for overflowing AArch64 relocs.
- Import patch to fix PR18668.
- Ignore warning messages about duplicate FDE entries
  (#1300543)
  (#1300603)
  (#1285614)
  (#1243559)


author: Nick Clifton <nickc@redhat.com> 2.25.1-13
changelog:
- Add support for Zeppelin x86 extensions.
- Add support for the AMD MWAITX extension.
- Add support for the PowerPC Power9 architecture.
- Remove spurious binutils document references.
  (#1335313)
  (#1335684)
  (#1333305)


author: Nick Clifton <nickc@redhat.com> 2.25.1-14-base
changelog:
- Extend Release string to include ".base" thus ensuring that it
  will not collide with a DTS release which might otherwise have
  the same name.
  (#1337617)


author: Nick Clifton <nickc@redhat.com> 2.25.1-17-base
changelog:
- Close memory leak in "ar" archiver program.
  (#1162655)
- Retire the copy-osabi patch.
  (#1252066)


author: Nick Clifton <nickc@redhat.com> 2.25.1-25-base
changelog:
- Fix GOLD so that it will not warn about references to hidden symbols in shared objects.
  (#1326710)


author: Nick Clifton <nickc@redhat.com> 2.27-10.base
changelog:
- Rebase to binutils 2.27
+ Retire: binutils-2.20.51.0.2-ia64-lib64.patch
+ Retire: binutils-2.20.51.0.10-copy-osabi.patch
+ Retire: binutils-rh1260158.patch
+ Retire: binutils-rh1300734.patch
+ Retire: binutils-2.25.1-aarch64-overflow-warnings.patch
+ Retire: binutils-2.25-aarch64-pr18668.patch
+ Retire: binutils-2.25.1-aarch64-pagesize.patch
+ Retire: binutils-rh1304451.patch
+ Retire: binutils-2.25.1-x86-Zepplin.patch
+ Retire: binutils-2.25.1-power9.patch
+ Retire: binutils-2.25.1-x86-mwaitx.patch
+ Retire: binutils-rh1162655.patch
+ Retire: binutils-2.25.1-aarch64-arch-extension.patch
+ Retire: binutils-2.25.1-s390-z13.patch
+ Retire: binutils-2.25.1-gold-resolving-to-hidden-symbols.patch
- Sync with Pegas 1.1 binutils.
- Import patch to add support for DWARF5 tags.
  (#1472955)
- Import patch to fix converting addresses into function names.
  (#1465318)(#1452170)
- Add support for ARMv8.2 ISA extensions.
  (#1385959)


author: Nick Clifton <nickc@redhat.com> 2.27-19.base
changelog:
- Suppress the generation of R_X86_64_GOTPCRELX, R_X86_64_REX_GETPCRELX and R_386_GOT32X relocations.
  (#1506004)


author: Nick Clifton <nickc@redhat.com> 2.27-20.base
changelog:
- Bump NVR so that the binutils rpms will be rebuilt, since they also have files that contain the offending relocs.
  (#1508954)


author: Nick Clifton <nickc@redhat.com> 2.27-21.base
changelog:
- Prevent the PowerPC64 linker from triggering a seg-fault when discarding dynamic sections.
  (#1513014)


author: Nick Clifton <nickc@redhat.com> 2.27-28.base
changelog:
- Stop the x86_64 linker from crashing when asked to convert a reloc against the ABS section.
  (#1557346)
- Stop strip from replacing unknown relocs with null relocs.
  (#1545386)


author: Nick Clifton <nickc@redhat.com> 2.27-30.base
changelog:
- Version bump in order to allow a rebuild, in order to work around a transient problem with the compose database.


author: Nick Clifton <nickc@redhat.com> 2.27-32.base
changelog:
- Fix seg-fault parsing DWARF-1 information.  (#1569580)
- Fix seg-fault parsing DWARF-2 information.  (#1569891)
- Fix seg-fault parsing COFF files.  (#1571917)


author: Nick Clifton <nickc@redhat.com> 2.27-33.base
changelog:
- Fix seg-fault parsing ELF files.  (#1578979)
- Fix seg-fault parsing DWARF-2 information.  (#1579065)
- Fix seg-fault parsing DWARF-2 information.  (#1579051)
- Fix seg-fault parsing a PE format file.  (#1579019)


author: Nick Clifton <nickc@redhat.com> 2.27-34.base
changelog:
- Fix seg-fault parsing corrupt AOUT format files.  (#1579799)
- Fix seg-fault parsing corrupt DWARF2 debug information.  (#1579802)
- Fix seg-fault parsing corrupt ELF format files.  (#1579801)


author: Nick Clifton <nickc@redhat.com> 2.27-42.base
changelog:
- Stop the BFD library from complaining about sections with multiple sets of relocations.  (#1749085)


author: Nick Clifton <nickc@redhat.com> 2.27-44.base
changelog:
- Allow the BFD library to handle the copying of files which contain secondary reloc sections.  (#1785294)
- Implement assembler workaround for Intel JCC microcode bug.  (#1778892)


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> 2.27-44.base.1.tuxcare.els1
changelog:
- CVE-2017-16831: Fix excessive memory allocation attempts and possible integer
  overflows when attempting to read a COFF binary with a corrupt symbol count
- CVE-2020-19726: Fix parsing a corrupt PE format file
- CVE-2021-45078: Fix out-of-bounds write in stab_xcoff_builtin_type
- CVE-2021-46174: Fix buffer overflow in read_section_stabs_debugging_info
- CVE-2022-44840: Fix possible heap buffer overflow in find_section_in_set() in readelf.c
- CVE-2022-45703: Combine sanity checks, calculate element counts, not word
  counts, fix typo
- CVE-2022-47695: Test symbol flags to exclude section and synthetic symbols
  before attempting to check flavour
- CVE-2022-47696: Fix uninitialised field `the_bfd` of `asymbol`
- CVE-2022-47673: Fix lack of bounds checking in vms-alpha.c


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.111.1.el7]
changelog:
- redhat: rewrite genlog and support Y- tags (Jan Stancek)
- scsi: zfcp: Fix double free of FSF request when qdio send fails (Tobias Huschle) [RHEL-16335]
- fbcon: set_con2fb_map needs to set con2fb_map! (Jocelyn Falempe) [RHEL-1204] {CVE-2023-38409}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.112.1.el7]
changelog:
- net: sched: sch_qfq: Use non-work-conserving warning handler (Davide Caratti) [RHEL-14397]
- net: sched: sch_qfq: Fix UAF in qfq_dequeue() (Davide Caratti) [RHEL-14397] {CVE-2023-4921}
- cpufreq: Initialize policy->kobj while allocating policy (Waiman Long) [2161654]
- net: bonding: fix possible NULL deref in rlb code (Hangbin Liu) [RHEL-17227]
- net: bonding: fix use-after-free after 802.3ad slave unbind (Hangbin Liu) [RHEL-17227]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.113.1.el7]
changelog:
- igb: set max size RX buffer when store bad packet is enabled (Wander Lairson Costa) [RHEL-15181] {CVE-2023-45871}
- Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm (David Marlin) [RHEL-2742] {CVE-2022-42896}
- Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM (David Marlin) [RHEL-2742] {CVE-2022-42896}
- Bluetooth: Use separate L2CAP LE credit based connection result values (David Marlin) [RHEL-2742] {CVE-2022-42896}
- Bluetooth: L2CAP: Fix L2CAP_CR_SCID_IN_USE value (David Marlin) [RHEL-2742] {CVE-2022-42896}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.114.1.el7]
changelog:
- netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [RHEL-23500] {CVE-2024-1086}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.115.1.el7]
changelog:
- af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Guillaume Nault) [RHEL-16144] {CVE-2023-4622}
- NFS: Set the stable writes BDI capability (Benjamin Coddington) [RHEL-22193]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.116.1.el7]
changelog:
- bluetooth: Add cmd validity checks at the start of hci_sock_ioctl() (David Marlin) [RHEL-3682] {CVE-2023-2002}
- bluetooth: Perform careful capability checks in hci_sock_ioctl() (David Marlin) [RHEL-3682] {CVE-2023-2002}
- cifs: fix panic in smb2_reconnect (Jay Shin) [RHEL-26301]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.117.1.el7]
changelog:
- tracing/perf: Fix double put of trace event when init fails (Michael Petlan) [RHEL-18052]
- tracing: Fix race in perf_trace_buf initialization (Michael Petlan) [RHEL-18052]
- net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve (Davide Caratti) [RHEL-16458] {CVE-2023-4623}
- net/sched: sch_hfsc: Ensure inner classes have fsc curve (Davide Caratti) [RHEL-16458] {CVE-2023-4623}
- gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28785]
- vt: vt_ioctl: fix race in VT_RESIZEX (Jay Shin) [RHEL-28639] {CVE-2020-36558}
- selinux: cleanup and consolidate the XFRM alloc/clone/delete/free code (Ondrej Mosnacek) [RHEL-27751]
- bluetooth: Add cmd validity checks at the start of hci_sock_ioctl() (David Marlin) [RHEL-3682] {CVE-2023-2002}
- bluetooth: Perform careful capability checks in hci_sock_ioctl() (David Marlin) [RHEL-3682] {CVE-2023-2002}
- cifs: fix panic in smb2_reconnect (Jay Shin) [RHEL-26301]
- af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Guillaume Nault) [RHEL-16144] {CVE-2023-4622}
- NFS: Set the stable writes BDI capability (Benjamin Coddington) [RHEL-22193]
- RDMA/i40iw: Prevent zero-length STAG registration (Kamal Heib) [RHEL-6299] {CVE-2023-25775}
- sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-26402] {CVE-2024-26602}


author: Vadim Panov <vpanov@cloudlinux.com> - 3.10.0-1160.119.1.el7.tuxcare.els1
changelog:
- kvm: initialize all of the kvm_debugregs structure before sending it to userspace {CVE-2023-1513}
- wifi: mac80211: fix MBSSID parsing use-after-free {CVE-2022-42719}
- mac80211: always allocate struct ieee802_11_elems {CVE-2022-42719}
- netfilter: nf_tables: initialize registers in nft_do_chain() {CVE-2022-1016}
- xprtrdma: fix incorrect header size calculations {CVE-2022-0812}
- net: usb: fix memory leak in smsc75xx_bind {CVE-2021-47171}
- i2c: i801: Don't generate an interrupt on bus reset {CVE-2021-47153}
- pid: take a reference when initializing `cad_pid` {CVE-2021-47118}
- Input: appletouch - initialize work before device registration {CVE-2021-46932}
- HID: usbhid: fix info leak in hid_submit_ctrl {CVE-2021-46906}
- quota: check block number when reading the block in quota file {CVE-2021-45868}
- mwifiex: Fix skb_over_panic in mwifiex_usb_recv() {CVE-2021-43976}
- atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait {CVE-2021-43975}
- isdn: cpai: check ctr->cnr to avoid array index out of bound {CVE-2021-43389}
- usb: hso: fix error handling code of hso_create_net_device {CVE-2021-37159}
- can: bcm: fix infoleak in struct bcm_msg_head {CVE-2021-34693}
- dm ioctl: fix out of bounds array access when no devices {CVE-2021-31916}
- KVM: x86: hyper-v: Fix Hyper-V context null-ptr-deref {CVE-2021-30178}
- perf/x86/intel: Fix a crash caused by zero PEBS status {CVE-2021-28971}
- btrfs: fix race when cloning extent buffer during rewind of an old root {CVE-2021-28964}
- ovl: fix missing negative dentry check in ovl_rename() {CVE-2021-20321}
- drm/ttm/nouveau: don't call tt destroy callback on alloc failure. {CVE-2021-20292}
- bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() {CVE-2021-4159}
- btrfs: unlock newly allocated extent buffer after error {CVE-2021-4149}
- tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop. {CVE-2021-3679}
- net: mac802154: Fix general protection fault {CVE-2021-3659}
- nfsd4: readdirplus shouldn't return parent of export {CVE-2021-3178}
- Bluetooth: SMP: Fail if remote and local public keys are identical {CVE-2021-0129}
- drm/nouveau: clean up all clients on device removal {CVE-2020-27820}
- drm/nouveau: Add a dedicated mutex for the clients list {CVE-2020-27820}
- drm/nouveau: use drm_dev_unplug() during device removal {CVE-2020-27820}
- Bluetooth: SMP: Fail if remote and local public keys are identical {CVE-2020-26555}
- vsock: Fix memory leak in vsock_connect() {CVE-2022-3629}
- RDMA/core: Don't infoleak GRH fields {CVE-2021-3923}
- xen/netfront: force data bouncing when backend is untrusted {CVE-2022-33741}
- net: Rename and export copy_skb_header
- floppy: use a statically allocated error counter {CVE-2022-1652}
- fuse: fix pipe buffer lifetime for direct_io {CVE-2022-1011}
- aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts {CVE-2024-26898}
- smb: client: fix use-after-free bug in cifs_debug_data_proc_show() {CVE-2023-52752}
- media: pvrusb2: fix use after free on context disconnection {CVE-2023-52445}
- media: dm1105: Fix use after free bug in dm1105_remove due to race condition {CVE-2023-35824}
- perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
- perf: Fix perf_event_validate_size() {CVE-2023-6931}
- net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
- relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
- xfs: verify buffer contents when we skip log replay {CVE-2023-2124}
- Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition {CVE-2023-1989}
- Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
- net/sched: cls_tcindex: downgrade to imperfect hash {CVE-2023-1829}
- xen/netfront: fix leaking data in shared pages {CVE-2022-33740}
- can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path {CVE-2022-28390}
- xen/blkfront: fix leaking data in shared pages {CVE-2022-26365}
- mISDN: fix use-after-free bugs in l1oip timer handlers {CVE-2022-3565}
- drm/vgem: Close use-after-free race in vgem_gem_create {CVE-2022-1419}
- cfg80211: call cfg80211_stop_ap when switch from P2P_GO type {CVE-2021-47194}
- net: fix use-after-free in tw_timer_handler {CVE-2021-46936}
- ext4: fix race writing to an inline_data file while its xattrs are changing {CVE-2021-40490}
- virtio_console: Assure used length from device is limited {CVE-2021-38160}
- pNFS/flexfiles: fix incorrect size check in decode_nfs_fh() {CVE-2021-4157}
- Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() {CVE-2021-3640}
- Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl {CVE-2021-3612}
- Input: joydev - prevent potential read overflow in ioctl {CVE-2021-3612}
- can: bcm: delay release of struct bcm_op after synchronize_rcu() {CVE-2021-3609}
- vt: keyboard: avoid signed integer overflow in k_ascii {CVE-2020-13974}
- i2c: Fix a potential use after free {CVE-2019-25162}
- drivers: net: slip: fix NPD bug in sl_tx_timeout() {CVE-2022-41858}
- Bluetooth: L2CAP: Fix u8 overflow {CVE-2022-45934}
- btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() {CVE-2023-3111}
- memstick: r592: Fix UAF bug in r592_remove due to race condition {CVE-2023-3141}
- media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() {CVE-2023-1118}
- vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
- wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
- tcp: Fix data races around icsk->icsk_af_ops. {CVE-2022-3566}
- staging: rtl8712: fix use after free bugs {CVE-2022-4095}
- ext4: fix kernel infoleak via ext4_extent_header {CVE-2022-0850}
- af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register {CVE-2022-1353}
- misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os {CVE-2022-3424}
- x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit {CVE-2022-25265}
- x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK {CVE-2022-25265}
- x86/elf: Add table to document READ_IMPLIES_EXEC {CVE-2022-25265}
- ipv6: use prandom_u32() for ID generation {CVE-2021-45485}
- bpf: Fix integer overflow in prealloc_elems_and_freelist() {CVE-2021-41864}
- ipv4: make exception cache less predictible {CVE-2021-20322}
- ipv4: use siphash instead of Jenkins in fnhe_hashfun() {CVE-2021-20322}
- net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() {CVE-2023-4387}
- netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one {CVE-2023-39197}
- ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
- smb: client: fix potential OOB in smb2_dump_detail() {CVE-2023-6610}
- smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
- atm: Fix Use-After-Free in do_vcc_ioctl {CVE-2023-51780}
- drm/amdgpu: Fix potential fence use-after-free v2 {CVE-2023-51042}
- sched/rt: pick_next_rt_entity(): check list_entry {CVE-2023-1077}
- ath9k: fix use-after-free in ath9k_hif_usb_rx_cb {CVE-2022-1679}
- net: prevent mss overflow in skb_segment() {CVE-2023-52435}
- drm/atomic: Fix potential use-after-free in nonblocking commits {CVE-2023-42753}
- debug: Lock down kgdb {CVE-2022-21499}


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els3]
changelog:
- net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() {CVE-2024-26855}
- tty: Fix out-of-bound vmalloc access in imageblit {CVE-2021-47383}
- drm/vmwgfx: Fix invalid reads in fence signaled events {CVE-2024-36960}
- Revert: GFS2: Skip dlm_unlock calls during unmount {CVE-2024-38570}
- Revert: GFS2: ignore unlock failures after withdraw {CVE-2024-38570}
- Revert: GFS2: fix skip unlock condition {CVE-2024-38570}
- ima: Fix use-after-free on a dentry's dname.name {CVE-2024-39494}
- netfilter: nft_limit: reject configurations that cause integer overflow {CVE-2024-26668}
- ipv6: remove max_size check inline with ipv4 {CVE-2023-52340}
- USB: core: Fix deadlock in usb_deauthorize_interface() {CVE-2024-26934}
- net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() {CVE-2024-26882}
- ip: validate header length on virtual device xmit
- ext4: improve error recovery code paths in __ext4_remount() {CVE-2024-0775}
- drivers/amd/pm: fix a use-after-free in kv_parse_power_table {CVE-2023-52469}
- drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc {CVE-2024-42228}
- netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() {CVE-2024-27020}
- af_unix: Fix garbage collector racing against connect() {CVE-2024-26923}
- md/raid5: fix atomicity violation in raid5_cache_count {CVE-2024-23307}


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els4]
changelog:
- xen/blkfront: force data bouncing when backend is untrusted {CVE-2022-33742}
- ALSA: Fix deadlocks with kctl removals at disconnection {CVE-2024-38600}
- net: fix out-of-bounds access in ops_init {CVE-2024-36883}


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els5]
changelog:
- media: dvb-core: Fix use-after-free due on race condition at dvb_net {CVE-2022-45886}
- media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 {CVE-2022-45919}
- bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() {CVE-2024-39487}
- net: fix __dst_negative_advice() race {CVE-2024-36971}


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els6]
changelog:
- drm/vmwgfx: Validate the box size for the snooped cursor {CVE-2022-36280}
- USB: ene_usb6250: Allocate enough memory for full object {CVE-2023-45862}
- Bluetooth: L2CAP: Fix attempting to access uninitialized memory {CVE-2022-42895}
- stm class: Fix a double free in stm_register_device() {CVE-2024-38627}


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els7]
changelog:
- wifi: mac80211: Avoid address calculations via out of bounds array indexing {CVE-2024-41071}
- bnx2x: Fix multiple UBSAN array-index-out-of-bounds {CVE-2024-42148}
- exec: Fix ToCToU between perm check and set-uid/gid usage {CVE-2024-43882}
- scsi: aacraid: Fix double-free on probe failure {CVE-2024-46673}
- ipv6: prevent UAF in ip6_send_skb() {CVE-2024-44987}
- fou: remove warn in gue_gro_receive on unsupported protocol {CVE-2024-44940}
- media: xc2028: avoid use-after-free in load_firmware_cb() {CVE-2024-43900}
- dev/parport: fix the array out-of-bounds risk {CVE-2024-42301}
- mISDN: Fix a use after free in hfcmulti_tx() {CVE-2024-42280}
- netfilter: nftables: exthdr: fix 4-byte stack OOB write {CVE-2023-52628}
- Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els8]
changelog:
- sch/netem: fix use after free in netem_dequeue {CVE-2024-46800}
- VMCI: Fix use-after-free when removing resource in vmci_resource_remove() {CVE-2024-46738}
- drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number {CVE-2024-46724}
- drm/amdgpu: fix ucode out-of-bounds read warning {CVE-2024-46723}
- drm/amdgpu: fix mc_data out-of-bounds read warning {CVE-2024-46722}


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els9]
changelog:
- drm/amd/pm: fix the Out-of-bounds read warning {CVE-2024-46731}
- hwmon: (w83627ehf) Fix underflows seen when writing limit attributes {CVE-2024-46756}
- hwmon: (lm95234) Fix underflows seen when writing limit attributes {CVE-2024-46758}
- hwmon: (nct6775-core) Fix underflows seen when writing limit attributes {CVE-2024-46757}
- kernel/exit.c: avoid undefined behaviour when calling wait4() {CVE-2018-10087}


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els10]
changelog:
- xfs: don't walk off the end of a directory data block {CVE-2024-41013}
- net/sched: cls_u32: fix netns refcount changes in u32_change() {CVE-2022-29581}
- net/packet: fix slab-out-of-bounds access in packet_recvmsg() {CVE-2022-20368}
- openvswitch: fix OOB access in reserve_sfa_size() {CVE-2022-2639}
- net: sched: fix use-after-free in tc_new_tfilter() {CVE-2022-1055}
- wifi: cfg80211: fix BSS refcounting bugs {CVE-2022-42720}
- wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() {CVE-2022-41674}
- igmp: Add ip_mc_list lock in ip_check_mc_rcu {CVE-2022-20141}
- af_key: Do not call xfrm_probe_algs in parallel {CVE-2022-3028}
- drm/amd/display: Check gpio_id before used as array index {CVE-2024-46818}
- drm/amd/display: Check link_index before accessing dc->links[] {CVE-2024-46813}
- Squashfs: sanity check symbolic link size {CVE-2024-46744}


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els11]
changelog:
- net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink {CVE-2024-44970}
- PCI: Add missing bridge lock to pci_bus_lock() {CVE-2024-46750}
- net/mlx5: Discard command completions in internal error {CVE-2024-38555}
- ALSA: pcm: Fix races among concurrent prealloc proc writes {CVE-2022-1048}
- ALSA: pcm: Add debug print on memory allocation failure {CVE-2022-1048}
- ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls {CVE-2022-1048}
- ALSA: pcm: Fix races among concurrent read/write and buffer changes {CVE-2022-1048}
- ALSA: pcm: Fix races among concurrent hw_params and hw_free calls {CVE-2022-1048}
- net/packet: fix slab-out-of-bounds access in packet_recvmsg() {CVE-2022-20368}
- packet: in recvmsg msg_name return at least sizeof sockaddr_ll {CVE-2022-20368}
- Revert "net/packet: fix slab-out-of-bounds access in packet_recvmsg()"
- KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS {CVE-2022-2196}


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els12]
changelog:
- mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
- slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
- drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
- firmware_loader: Block path traversal {CVE-2024-47742}
- ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
- tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
- Bluetooth: L2CAP: Fix uaf in l2cap_connect {CVE-2024-49950}
- ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
- driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
- ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
- smack: tcp: ipv4, fix incorrect labeling {CVE-2024-47659}
- ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
- ALSA: asihpi: Fix potential OOB array access {CVE-2024-50007}
- ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
- drm/amd/display: Fix index out of bounds in degamma hardware format translation {CVE-2024-49894}
- ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
- ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
- bna: adjust 'name' buf size of bna_tcb and bna_ccb structures {CVE-2024-43839}


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els13]
changelog:
- net: bridge: xmit: make sure we have at least eth header len bytes {CVE-2024-38538}
- SUNRPC: Fix UAF in svc_tcp_listen_data_ready() {CVE-2023-52885}
- Fix: Revert "smb: client: fix use-after-free bug in cifs_debug_data_proc_show()" double lock


author: Vadim Panov <vadim.panov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els14]
changelog:
- media: edia: dvbdev: fix a use-after-free {CVE-2024-27043}
- btrfs: dev-replace: properly validate device names {CVE-2024-26791}
- KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory {CVE-2024-50115}
- net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT {CVE-2024-53057}
- ipc/sem.c: bugfix for semctl(,,GETZCNT)
- Increase KEXEC_AUTO_RESERVED_SIZE to 256M
- x86/apic/x2apic: set affinity of a single interrupt to one cpu
- bonding:avoid repeated display of same link status change
- xen/netfront: stop tx queues during live migration
- xen/balloon: Support xend-based toolstack
- md/raid5: fix oops during stripe resizing
- block: fix null pointer dereference in blk_mq_rq_timed_out()
- block: init flush rq ref count to 1
- blk-mq: Remove generation seqeunce
- Revert "driver core: bus: Fix double free in driver API bus_register()"


author: Vadim Panov <vadim.panov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els15]
changelog:
- drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() {CVE-2024-50282}
- drm/amdgpu: fix usage slab after free {CVE-2024-56551}
- Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() {CVE-2022-3640}
- netfilter: ipset: add missing range check in bitmap_ip_uadt {CVE-2024-53141}
- ceph: prevent use-after-free in encode_cap_msg() {CVE-2024-26689}
- net: af_can: do not leave a dangling sk pointer in can_create() {CVE-2024-56603}
- NFSv4.0: Fix a use-after-free problem in the asynchronous open() {CVE-2024-53173}
- netfilter: x_tables: fix LED ID check in led_tg_check() {CVE-2024-56650}
- scsi: bfa: Fix use-after-free in bfad_im_module_exit() {CVE-2024-53227}
- af_packet: avoid erroring out after sock_init_data() in packet_create() {CVE-2024-56606}
- Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() {CVE-2024-56605}
- wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() {CVE-2024-53156}
- Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() {CVE-2024-56604}
- initramfs: avoid filename buffer overrun {CVE-2024-53142}
- hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer {CVE-2024-53103}


author: Vadim Panov <vadim.panov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els16]
changelog:
- media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format {CVE-2024-53104}
- ALSA: 6fire: Release resources at card release {CVE-2024-53239}
- btrfs: fix information leak in btrfs_ioctl_logical_to_ino() {CVE-2024-35849}
- btrfs: fix use-after-free when COWing tree bock and tracing is enabled {CVE-2024-56759}


author: Vadim Panov <vadim.panov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els17]
changelog:
- ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
- drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() {CVE-2024-57798}
- els15 crashes accessing CephFS storage from a cluster {CVE-2024-26689}


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els18]
changelog:
- HID: core: zero-initialize the report buffer {CVE-2024-50302}
- Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()"
- drm/amd/amdgpu: Fix GPR read from debugfs (v2) {CVE-2024-50282}
- USB: serial: io_edgeport: fix use after free in debug printk {CVE-2024-50267}
- wifi: iwlegacy: Clear stale interrupts before resuming device {CVE-2024-50234}
- udf: fix uninit-value use in udf_get_fileshortad {CVE-2024-50143}
- Update dependency for shim and signing key


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els19]
changelog:
- drm: nv04: Fix out of bounds access {CVE-2024-27008}
- media: uvcvideo: Fix double free in error path {CVE-2024-57980}


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els20]
changelog:
- ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices {CVE-2024-53197}
- Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd {CVE-2025-21969}
- ext4: fix OOB read when checking dotdot dir {CVE-2025-37785}
- iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() {CVE-2025-21993}
- vlan: enforce underlying device type {CVE-2025-21920}


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els21]
changelog:
- pfifo_tail_enqueue: Drop new packet when sch->limit == 0 {CVE-2025-21702}
- xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014}
- netfilter: validate user input for expected length {CVE-2024-35896}
- nfs: fix UAF in direct writes {CVE-2024-26958}
- Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
- RDMA/srpt: Do not register event handler until srpt device is fully setup {CVE-2024-26872}


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els22]
changelog:
- can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
- udmabuf: fix a buf size overflow issue during udmabuf creation {CVE-2025-37803}


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els24]
changelog:
- x86/kvm: Disable kvmclock on all CPUs on shutdown {CVE-2021-47110}
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
- cifs: fix double free race when mount fails in cifs_get_root() {CVE-2022-48919}
- aio: mark AIO pseudo-fs noexec {CVE-2016-10044}
- cifs: potential buffer overflow in handling symlinks {CVE-2022-49058}
- NFSD: fix race between nfsd registration and exports_proc {CVE-2025-38232}
- nfsd: register pernet ops last, unregister first {CVE-2025-38232}
- net: atm: fix use after free in lec_send() {CVE-2025-22004}
- net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
- do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
- net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
- net: atm: add lec_mutex {CVE-2025-38180}
- SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() {CVE-2025-38399}
- scsi: target: Fix crash during SPEC_I_PT handling {CVE-2025-38399}
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
- drivers:md:fix a potential use-after-free bug {CVE-2022-50022}
- ext4: avoid resizing to a partial cluster size {CVE-2022-50020}
- HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist {CVE-2025-38457}
- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() {CVE-2022-49788}
- dlm: fix plock invalid read {CVE-2022-49407}
- net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
- scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
- crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
- HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
- HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
- ext4: Fix possible corruption when moving a directory {CVE-2023-53137}
- ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}
- vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
- HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
- sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
- ext4: check dot and dotdot of dx_root before making dir indexed {CVE-2024-42305}
- ALSA: bcd2000: Fix a UAF bug on the error path of probing {CVE-2022-50229}
- dm ioctl: prevent potential spectre v1 gadget {CVE-2022-49122}
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
- md-raid10: fix KASAN warning {CVE-2022-50211}
- scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
- ACPICA: Refuse to evaluate a method if arguments are missing {CVE-2025-38386}
- media: cxusb: no longer judge rbuf when the write fails {CVE-2025-38229}
- ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212}
- ext4: fix off-by-one error in do_split {CVE-2025-23150}
- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init {CVE-2025-37878}
- sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els25]
changelog:
- ASoC: topology: Clean up route loading {CVE-2024-41069}
- ASoC: topology: Fix references to freed memory {CVE-2024-41069}
- drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
- Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
- Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt() {CVE-2024-35965}
- usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
- igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
- vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
- Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
- Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35966}
- media: stk1160: fix bounds checking in stk1160_copy_video() {CVE-2024-38621}
- net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350}
- sch_htb: make htb_qlen_notify() idempotent {CVE-2025-37932}
- codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-37798}
- sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38350}
- sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38350}
- sch_htb: make htb_deactivate() idempotent {CVE-2025-38350}
- sch_cbq: make cbq_qlen_notify() idempotent {CVE-2025-38000}
- inet: fully convert sk->sk_rx_dst to RCU rules {CVE-2021-47103}
- scsi: mpt3sas: Fix use-after-free warning {CVE-2022-48695}
- scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory {CVE-2024-40901}
- vmci: prevent speculation leaks by sanitizing event in event_deliver() {CVE-2024-39499}
- USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
- nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
- virtio-net: Add validation for used length {CVE-2021-47352}
- watchdog: Fix possible use-after-free by calling del_timer_sync() {CVE-2021-47321}
- scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978}
- wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
- wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921}
- mac802154: fix llsec key resources release in mac802154_llsec_key_del {CVE-2024-26961}
- platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
- media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764}
- wifi: mac80211: fix potential key use-after-free {CVE-2023-52530}
- net: fix information leakage in /proc/net/ptype {CVE-2022-48757}
- crypto: qat - resolve race condition during AER recovery {CVE-2024-26974}
- perf/core: Bail out early if the request AUX area is out of bound {CVE-2023-52835}
- net: ti: fix UAF in tlan_remove_one {CVE-2021-47310}
- wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
- net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
- net: add atomic_long_t to net_device_stats fields {CVE-2023-52578}
- media: dvb-core: Fix use-after-free due to race at dvb_register_device() {CVE-2022-45884}
- media: dvb-core: Fix use-after-free on race condition at dvb_frontend {CVE-2022-45885}
- xen/gntalloc: don't use gnttab_query_foreign_access() {CVE-2022-23039}
- xen/netfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23037}
- xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23038}
- ovl: fail on invalid uid/gid mapping at copy up {CVE-2023-0386}
- ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292}
- gfs2: Fix length of holes reported at end-of-file
- gfs2: Only do glock put in gfs2_create_inode for free inodes
- gfs2: Fix use-after-free in gfs2_logd after withdraw
- gfs2: fix use-after-free in trans_drain
- gfs2: Clean up revokes on normal withdraws
- GFS2: gfs2_free_extlen can return an extent that is too long
- gfs2: Wipe jdata and ail1 in gfs2_journal_wipe, formerly gfs2_meta_wipe
- GFS2: Refactor gfs2_remove_from_journal
- GFS2: Only set PageChecked for jdata pages
- gfs2: keep bios separate for each journal
- gfs2: Remove active journal side effect from gfs2_write_log_header
- gfs2: clean_journal improperly set sd_log_flush_head
- partial "GFS2: Introduce new gfs2_log_header_v2"
- gfs2: change from write to read lock for sd_log_flush_lock in journal replay
- GFS2: Reduce code redundancy writing log headers
- gfs2: Grab glock reference sooner in gfs2_add_revoke
- gfs2: fix glock reference problem in gfs2_trans_remove_revoke
- gfs2: Fix occasional glock use-after-free
- gfs2: Make sure we don't miss any delayed withdraws
- gfs2: Fix bad comment for trans_drain
- gfs2: add some much needed cleanup for log flushes that fail
- gfs2: fix trans slab error when withdraw occurs inside log_flush
- gfs2: initialize transaction tr_ailX_lists earlier
- GFS2: Remove extra "if" in gfs2_log_flush()
- gfs2: fix use-after-free on transaction ail lists
- gfs2: Trim the ordered write list in gfs2_ordered_write()
- GFS2: Clean up releasepage
- gfs2: Only set PageChecked if we have a transaction
- gfs2: Fix case in which ail writes are done to jdata holes
- gfs2: simplify gfs2_block_map
- gfs2: Remove unused gfs2_iomap_alloc argument
- gfs2: Be more careful with the quota sync generation
- gfs2: Get rid of some unnecessary quota locking
- gfs2: Add some missing quota locking
- gfs2: Fold qd_fish into gfs2_quota_sync
- gfs2: quota need_sync cleanup
- gfs2: Fix and clean up function do_qc
- gfs2: Revert "Add quota_change type"
- gfs2: Revert "ignore negated quota changes"
- gfs2: qd_check_sync cleanups
- gfs2: Check quota consistency on mount
- gfs2: Minor gfs2_quota_init error path cleanup
- gfs2: fix kernel BUG in gfs2_quota_cleanup
- gfs2: Clean up quota.c:print_message
- gfs2: Clean up gfs2_alloc_parms initializers
- gfs2: Two quota=account mode fixes
- gfs2: Remove useless assignment
- gfs2: simplify slot_get
- gfs2: Simplify qd2offset
- gfs2: Remove quota allocation info from quota file
- gfs2: use constant for array size
- gfs2: Set qd_sync_gen in do_sync
- gfs2: Remove useless err set
- gfs2: Small gfs2_quota_lock cleanup
- gfs2: move qdsb_put and reduce redundancy
- gfs2: Don't try to sync non-changes
- gfs2: Simplify function need_sync
- gfs2: remove unneeded pg_oflow variable
- gfs2: remove unneeded variable done
- gfs2: pass sdp to gfs2_write_buf_to_page
- gfs2: pass sdp in to gfs2_write_disk_quota
- gfs2: Pass sdp to gfs2_adjust_quota
- gfs2: remove dead code for quota writes
- gfs2: Use qd_sbd more consequently
- gfs2: replace 'found' with dedicated list iterator variable
- gfs2: Some whitespace cleanups
- gfs2: Fix gfs2_qa_get imbalance in gfs2_quota_hold


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.136.1.el7.tuxcare.els23]
changelog:
- spec: up spec/misc to 1160.136.1, spectre mitigation is off by default
- hugetlb, mempolicy: fix the mbind hugetlb migration
- net: atm: fix use after free in lec_send()
- net: atlantic: fix aq_vec index out of range error
- block: initialize flush request via blk_mq_rq_ctx_init()
- ALSA: usb-audio: Fix a DMA to stack memory bug
- namei: ->d_inode of a pinned dentry is stable only for positives
- namei: results of d_is_negative() should be checked after dentry revalidation
- namei: d_is_negative() should be checked before ->d_seq validation
- VFS: Combine inode checks with d_is_negative() and d_is_positive() in pathwalk
- scsi: smartpqi: Fix DMA direction for RAID requests
- scsi: smartpqi: Fix duplicate device nodes for tape changers
- VFS: Impose ordering on accesses of d_inode and d_flags
- neighbour: fix data-races around n->output
- cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options
- cipso: fix total option length computation
- proc: Use new_inode not new_inode_pseudo
- lockd: skip shutdown of rpc clients with outstanding notifications
- SUNRPC: ECONNRESET might require a rebind
- SUNRPC: ECONNREFUSED should cause a rebind.
- x86/fpu: Prevent FPU state corruption
- x86, fpu: Introduce per-cpu in_kernel_fpu state
- x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI {CVE-2024-2201}
- x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto {CVE-2024-2201}
- x86/bugs: Fix BHI handling of RRSBA {CVE-2024-2201}
- x86/bugs: Fix BHI documentation {CVE-2024-2201}
- x86/bugs: Fix return type of spectre_bhi_state() {CVE-2024-2201}
- x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default {CVE-2024-2201}
- x86/bhi: Add BHI mitigation knob {CVE-2024-2201}
- x86/bhi: Enumerate Branch History Injection (BHI) bug {CVE-2024-2201}
- x86/bhi: Define SPEC_CTRL_BHI_DIS_S {CVE-2024-2201}
- x86/bhi: Add support for clearing branch history at syscall entry {CVE-2024-2201}
- Documentation/hw-vuln: Document the interaction between IBRS and STIBP {CVE-2024-2201}
- x86/bugs: Add X86_FEATURE_RETPOLINE {CVE-2024-2201}
- x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs {CVE-2024-2201}
- netfilter: ipset: fix ip_set_list allocation failure
- gfs2: Fix length of holes reported at end-of-file
- gfs2: Only do glock put in gfs2_create_inode for free inodes
- gfs2: Fix use-after-free in gfs2_logd after withdraw
- gfs2: fix use-after-free in trans_drain
- gfs2: Clean up revokes on normal withdraws
- GFS2: gfs2_free_extlen can return an extent that is too long
- gfs2: Wipe jdata and ail1 in gfs2_journal_wipe, formerly gfs2_meta_wipe
- GFS2: Refactor gfs2_remove_from_journal
- GFS2: Only set PageChecked for jdata pages
- gfs2: keep bios separate for each journal
- gfs2: Remove active journal side effect from gfs2_write_log_header
- gfs2: clean_journal improperly set sd_log_flush_head
- partial "GFS2: Introduce new gfs2_log_header_v2"
- gfs2: change from write to read lock for sd_log_flush_lock in journal replay
- GFS2: Reduce code redundancy writing log headers
- gfs2: Grab glock reference sooner in gfs2_add_revoke
- gfs2: fix glock reference problem in gfs2_trans_remove_revoke
- gfs2: Fix occasional glock use-after-free
- gfs2: Make sure we don't miss any delayed withdraws
- gfs2: Fix bad comment for trans_drain
- gfs2: add some much needed cleanup for log flushes that fail
- gfs2: fix trans slab error when withdraw occurs inside log_flush
- gfs2: initialize transaction tr_ailX_lists earlier
- GFS2: Remove extra "if" in gfs2_log_flush()
- gfs2: fix use-after-free on transaction ail lists
- gfs2: Trim the ordered write list in gfs2_ordered_write()
- GFS2: Clean up releasepage
- gfs2: Only set PageChecked if we have a transaction
- gfs2: Fix case in which ail writes are done to jdata holes
- gfs2: simplify gfs2_block_map
- gfs2: Remove unused gfs2_iomap_alloc argument
- gfs2: Be more careful with the quota sync generation
- gfs2: Get rid of some unnecessary quota locking
- gfs2: Add some missing quota locking
- gfs2: Fold qd_fish into gfs2_quota_sync
- gfs2: quota need_sync cleanup
- gfs2: Fix and clean up function do_qc
- gfs2: Revert "Add quota_change type"
- gfs2: Revert "ignore negated quota changes"
- gfs2: qd_check_sync cleanups
- gfs2: Check quota consistency on mount
- gfs2: Minor gfs2_quota_init error path cleanup
- gfs2: fix kernel BUG in gfs2_quota_cleanup
- gfs2: Clean up quota.c:print_message
- gfs2: Clean up gfs2_alloc_parms initializers
- gfs2: Two quota=account mode fixes
- gfs2: Remove useless assignment
- gfs2: simplify slot_get
- gfs2: Simplify qd2offset
- gfs2: Remove quota allocation info from quota file
- gfs2: use constant for array size
- gfs2: Set qd_sync_gen in do_sync
- gfs2: Remove useless err set
- gfs2: Small gfs2_quota_lock cleanup
- gfs2: move qdsb_put and reduce redundancy
- gfs2: Don't try to sync non-changes
- gfs2: Simplify function need_sync
- gfs2: remove unneeded pg_oflow variable
- gfs2: remove unneeded variable done
- gfs2: pass sdp to gfs2_write_buf_to_page
- gfs2: pass sdp in to gfs2_write_disk_quota
- gfs2: Pass sdp to gfs2_adjust_quota
- gfs2: remove dead code for quota writes
- gfs2: Use qd_sbd more consequently
- gfs2: replace 'found' with dedicated list iterator variable
- gfs2: Some whitespace cleanups
- gfs2: Fix gfs2_qa_get imbalance in gfs2_quota_hold
- tcp: fix zero cwnd in tcp_cwnd_reduction
- epoll: fix use-after-free in eventpoll_release_file
- kernel.spec: run initramfs generation in %post (not only in %posttrans)


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.136.1.el7.tuxcare.els24]
changelog:
- x86/kvm: Disable kvmclock on all CPUs on shutdown {CVE-2021-47110}
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
- cifs: fix double free race when mount fails in cifs_get_root() {CVE-2022-48919}
- aio: mark AIO pseudo-fs noexec {CVE-2016-10044}
- cifs: potential buffer overflow in handling symlinks {CVE-2022-49058}
- NFSD: fix race between nfsd registration and exports_proc {CVE-2025-38232}
- nfsd: register pernet ops last, unregister first {CVE-2025-38232}
- do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
- net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
- net: atm: add lec_mutex {CVE-2025-38180}
- SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() {CVE-2025-38399}
- scsi: target: Fix crash during SPEC_I_PT handling {CVE-2025-38399}
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
- drivers:md:fix a potential use-after-free bug {CVE-2022-50022}
- ext4: avoid resizing to a partial cluster size {CVE-2022-50020}
- HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist {CVE-2025-38457}
- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() {CVE-2022-49788}
- dlm: fix plock invalid read {CVE-2022-49407}
- net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
- scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
- crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
- HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
- HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
- ext4: Fix possible corruption when moving a directory {CVE-2023-53137}
- ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}
- vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
- HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
- sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
- ext4: check dot and dotdot of dx_root before making dir indexed {CVE-2024-42305}
- ALSA: bcd2000: Fix a UAF bug on the error path of probing {CVE-2022-50229}
- dm ioctl: prevent potential spectre v1 gadget {CVE-2022-49122}
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
- md-raid10: fix KASAN warning {CVE-2022-50211}
- scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
- ACPICA: Refuse to evaluate a method if arguments are missing {CVE-2025-38386}
- media: cxusb: no longer judge rbuf when the write fails {CVE-2025-38229}
- ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212}
- ext4: fix off-by-one error in do_split {CVE-2025-23150}
- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init {CVE-2025-37878}
- sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.137.1.el7.tuxcare.els24]
changelog:
- net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350}
- sch_cbq: make cbq_qlen_notify() idempotent {CVE-2025-38000}
- sch_htb: make htb_qlen_notify() idempotent {CVE-2025-37932}
- codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-37798}
- sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38350}
- sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38350}
- sch_htb: make htb_deactivate() idempotent {CVE-2025-38350}


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.137.1.el7.tuxcare.els25]
changelog:
- ASoC: topology: Clean up route loading {CVE-2024-41069}
- ASoC: topology: Fix references to freed memory {CVE-2024-41069}
- drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
- Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
- Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt() {CVE-2024-35965}
- usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
- igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
- vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
- Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
- Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35966}
- media: stk1160: fix bounds checking in stk1160_copy_video() {CVE-2024-38621}
- inet: fully convert sk->sk_rx_dst to RCU rules {CVE-2021-47103}
- scsi: mpt3sas: Fix use-after-free warning {CVE-2022-48695}
- scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory {CVE-2024-40901}
- vmci: prevent speculation leaks by sanitizing event in event_deliver() {CVE-2024-39499}
- USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
- nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
- virtio-net: Add validation for used length {CVE-2021-47352}
- watchdog: Fix possible use-after-free by calling del_timer_sync() {CVE-2021-47321}
- scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978}
- wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
- wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921}
- mac802154: fix llsec key resources release in mac802154_llsec_key_del {CVE-2024-26961}
- platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
- media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764}
- wifi: mac80211: fix potential key use-after-free {CVE-2023-52530}
- net: fix information leakage in /proc/net/ptype {CVE-2022-48757}
- crypto: qat - resolve race condition during AER recovery {CVE-2024-26974}
- perf/core: Bail out early if the request AUX area is out of bound {CVE-2023-52835}
- net: ti: fix UAF in tlan_remove_one {CVE-2021-47310}
- wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
- net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
- net: add atomic_long_t to net_device_stats fields {CVE-2023-52578}
- media: dvb-core: Fix use-after-free due to race at dvb_register_device() {CVE-2022-45884}
- media: dvb-core: Fix use-after-free on race condition at dvb_frontend {CVE-2022-45885}
- xen/gntalloc: don't use gnttab_query_foreign_access() {CVE-2022-23039}
- xen/netfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23037}
- xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23038}
- ovl: fail on invalid uid/gid mapping at copy up {CVE-2023-0386}
- ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292}


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els26]
changelog:
- hugetlb, mempolicy: fix the mbind hugetlb migration
- block: initialize flush request via blk_mq_rq_ctx_init()
- ALSA: usb-audio: Fix a DMA to stack memory bug
- namei: ->d_inode of a pinned dentry is stable only for positives
- namei: results of d_is_negative() should be checked after dentry revalidation
- namei: d_is_negative() should be checked before ->d_seq validation
- VFS: Combine inode checks with d_is_negative() and d_is_positive() in pathwalk
- scsi: smartpqi: Fix DMA direction for RAID requests
- scsi: smartpqi: Fix duplicate device nodes for tape changers
- VFS: Impose ordering on accesses of d_inode and d_flags
- neighbour: fix data-races around n->output
- cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options
- cipso: fix total option length computation
- proc: Use new_inode not new_inode_pseudo
- lockd: skip shutdown of rpc clients with outstanding notifications
- SUNRPC: ECONNRESET might require a rebind
- SUNRPC: ECONNREFUSED should cause a rebind.
- x86/fpu: Prevent FPU state corruption
- x86, fpu: Introduce per-cpu in_kernel_fpu state
- x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI {CVE-2024-2201}
- x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto {CVE-2024-2201}
- x86/bugs: Fix BHI handling of RRSBA {CVE-2024-2201}
- x86/bugs: Fix BHI documentation {CVE-2024-2201}
- x86/bugs: Fix return type of spectre_bhi_state() {CVE-2024-2201}
- x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default {CVE-2024-2201}
- x86/bhi: Add BHI mitigation knob {CVE-2024-2201}
- x86/bhi: Enumerate Branch History Injection (BHI) bug {CVE-2024-2201}
- x86/bhi: Define SPEC_CTRL_BHI_DIS_S {CVE-2024-2201}
- x86/bhi: Add support for clearing branch history at syscall entry {CVE-2024-2201}
- Documentation/hw-vuln: Document the interaction between IBRS and STIBP {CVE-2024-2201}
- x86/bugs: Add X86_FEATURE_RETPOLINE {CVE-2024-2201}
- x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs {CVE-2024-2201}
- netfilter: ipset: fix ip_set_list allocation failure
- tcp: fix zero cwnd in tcp_cwnd_reduction {CVE-2016-2070}
- epoll: fix use-after-free in eventpoll_release_file
- kernel.spec: run initramfs generation in %post (not only in %posttrans)
- NFSD: Fix the behavior of READ near OFFSET_MAX {CVE-2022-48827}
- ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() {CVE-2022-48738}
- ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() {CVE-2022-48738}
- enic: Validate length of nl attributes in enic_set_vf_port {CVE-2024-38659}
- thermal: core: prevent potential string overflow {CVE-2023-52868}
- RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests {CVE-2021-47391}
- fix: virtio-net: Add validation for used length


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.119.1.el7.tuxcare.els26]
changelog:
- Update version to 3.10.0-1160.139.1.el7.tuxcare.els1 (includes fully 3.10.0-1160.139.1.el7 and 3.10.0-1160.119.1.0.12.el7)


author: Vadim Panov <vpanov@cloudlinux.com> [3.10.0-1160.139.1.el7.tuxcare.els2]
changelog:
- ext4: fix possible UAF when remounting r/o a mmp-protected file system {CVE-2021-47342}
- ext4: fix memory leak in ext4_fill_super
- net: defer final 'struct net' free in netns dismantle {CVE-2024-56658}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate {CVE-2025-38477}
- ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() {CVE-2022-48701}
- fix: virtio-net: Add validation for used length {CVE-2021-47352}


author: Pavel Raiskup <praiskup@redhat.com> - 3.1.2-11
changelog:
- fix out-of-bounds read within lha_read_data_none() (CVE-2017-14503)
- fix crash on crafted 7zip archives (CVE-2019-1000019)
- fix infinite loop in ISO9660 (CVE-2019-1000020)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.1-5
changelog:
- Apply a patch by Stephen Gallagher to patch autoconf, not configure to
  allow optflags to be passed in by build environment
- Run autoreconf before configure
- git rm obsolete patches
- Apply upstream patch to stop overriding AC_CONFIG_MACRO_DIR


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-1
changelog:
- New upstream release 1.10
- Obsolete upstreamed patches
- Amend the multilib patch, there's no need to patch configure since we
  are running autoreconf anyways
- https://raw.github.com/bagder/c-ares/cares-1_10_0/RELEASE-NOTES


author: Joe Orton <jorton@redhat.com> 2008-2
changelog:
- add (but don't use) mkcabundle.pl
- tweak description
- use /usr/bin/keytool directly; BR java-openjdk


author: Joe Orton <jorton@redhat.com> - 2010-2
changelog:
- fix Java cacert database generation: use Subject rather than Issuer
  for alias name; add diagnostics; fix some alias names.


author: Joe Orton <jorton@redhat.com> - 2010-3
changelog:
- update to certdata.txt r1.58
- add /etc/pki/tls/certs/ca-bundle.trust.crt using 'TRUSTED CERTICATE' format
- exclude ECC certs from the Java cacerts database
- catch keytool failures
- fail parsing certdata.txt on finding untrusted but not blacklisted cert


author: Paul Wouters <pwouters@redhat.com> - 2012.86-2
changelog:
- Updated blacklist with 20 entries (Diginotar, Trustwave, Comodo(?)
- Fix to certdata2pem.py to also check for CKT_NSS_NOT_TRUSTED


author: Kai Engert <kaie@redhat.com> - 2012.87-2.fc19.1
changelog:
- Ship trust bundle file in /usr/share/pki/ca-trust-source/, temporarily in addition.
  This location will soon become the only place containing this file.


author: Kai Engert <kaie@redhat.com> - 2012.87-9
changelog:
- Major rework for the Fedora SharedSystemCertificates feature.
- Only ship a PEM bundle file using the BEGIN TRUSTED CERTIFICATE file format.
- Require the p11-kit package that contains tools to automatically create
  other file format bundles.
- Convert old file locations to symbolic links that point to dynamically
  generated files.
- Old files, which might have been locally modified, will be saved in backup 
  files with .rpmsave extension.
- Added a update-ca-certificates script which can be used to regenerate
  the merged trusted output.
- Refer to the various README files that have been added for more detailed
  explanation of the new system.
- No longer require rsc for building.
- Add explanation for the future version numbering scheme,
  because the old numbering scheme was based on upstream using cvs,
  which is no longer true, and therefore can no longer be used.
- Includes changes from rhbz#873369.


author: Kai Engert <kaie@redhat.com> - 2012.87-9.fc19.1
changelog:
- adjust to changed and new functionality provided by p11-kit 0.17.3
- updated READMEs to describe the new directory-specific treatment of files
- ship a new file that contains certificates with neutral trust
- ship a new file that contains distrust objects, and also staple a 
  basic constraint extension to one legacy root contained in the
  Mozilla CA list
- adjust the build script to dynamically produce most of above files
- add and own the anchors and blacklist subdirectories
- file generate-cacerts.pl is no longer required


author: Kai Engert <kaie@redhat.com> - 2012.87-10.1
changelog:
- Add myself as contributor to certdata2.pem.py and remove use of rcs/ident.
  (thanks to Michael Shuler for suggesting to do so)
- Update source URLs and comments, add source file for version information.


author: Kai Engert <kaie@redhat.com> - 2012.87-10.3
changelog:
- added a manual page and related build requirements
- simplify the README files now that we have a manual page
- set a certificate alias in trusted bundle (thanks to Ludwig Nussel)


author: Kai Engert <kaie@redhat.com> - 2014.1.98-71
changelog:
- Update to CKBI 1.98 from NSS 3.16.1
- building on RHEL 7 no longer requires java-openjdk
- added more detailed instructions for release numbers on RHEL branches,
  to avoid problems when rebasing on both z- and y-stream branches.


author: Stef Walter <stefw@redhat.com> - 2014.1.98-72
changelog:
- The BasicConstraints fix for Entrust Root is no longer necessary.
  In addition it was invalid for p11-kit 0.20.x. rhbz#1130485


author: Kai Engert <kaie@redhat.com> - 2015.2.3-71
changelog:
- Update to CKBI 2.3 from NSS 3.18 with legacy modifications.
- Add an alternative version of the "Thawte Premium Server CA" root,
  which carries a SHA1-RSA signature, to allow OpenJDK to verify applets
  which contain that version of the root certificate.
  This change doesn't add trust for another key, because both versions
  of the certificate use the same public key (rhbz#1170982).
- Add a patch to the source RPM that documents the changes from the
  upstream version.
- Introduce the ca-legacy utility, a manual page, and the ca-legacy.conf
  configuration file.
- The new scriptlets require the coreutils package.
- Remove the obsolete blacklist.txt file.


author: Kai Engert <kaie@redhat.com> - 2017.2.11-71
changelog:
- Update to CKBI 2.11 from NSS 3.28.1 with legacy modifications.
- Use comments in extracted bundle files.
- Change packaging script to support empty legacy bundles.


author: Kai Engert <kaie@redhat.com> - 2017.2.11-72
changelog:
- Changed the packaged bundle to use the flexible p11-kit-object-v1 file format,
  as a preparation to fix bugs in the interaction between p11-kit-trust and
  Mozilla applications, such as Firefox, Thunderbird etc.
- For CAs trusted by Mozilla, set attribute nss-mozilla-ca-policy: true
- Require p11-kit 0.23.5
- Added an utility to help with comparing output of the trust dump command.


author: Kai Engert <kaie@redhat.com> - 2017.2.16-71
changelog:
- Update to CKBI 2.16 from NSS 3.32. In addition to removals/additions,
  Mozilla removed code signing trust from all CAs (rhbz#1472933)


author: Bob Relyea <rrelyea@redhat.com> - 2019.2.32-76
changelog:
- Update to CKBI 2.32 from NSS 3.44
-   Removing:
-   # Certificate "Visa eCommerce Root"
-   # Certificate "AC Raiz Certicamara S.A."
-   # Certificate "TC TrustCenter Class 3 CA II"
-   # Certificate "ComSign CA"
-   # Certificate "S-TRUST Universal Root CA"
-   # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5"
-   # Certificate "Certplus Root CA G1"
-   # Certificate "Certplus Root CA G2"
-   # Certificate "OpenTrust Root CA G1"
-   # Certificate "OpenTrust Root CA G2"
-   # Certificate "OpenTrust Root CA G3"
-  Adding:
-   # Certificate "GlobalSign Root CA - R6"
-   # Certificate "OISTE WISeKey Global Root GC CA"
-   # Certificate "GTS Root R1"
-   # Certificate "GTS Root R2"
-   # Certificate "GTS Root R3"
-   # Certificate "GTS Root R4"
-   # Certificate "UCA Global G2 Root"
-   # Certificate "UCA Extended Validation Root"
-   # Certificate "Certigna Root CA"
-   # Certificate "emSign Root CA - G1"
-   # Certificate "emSign ECC Root CA - G3"
-   # Certificate "emSign Root CA - C1"
-   # Certificate "emSign ECC Root CA - C3"
-   # Certificate "Hongkong Post Root CA 3"


author: Bob Relyea <rrelyea@redhat.com> - 2020.2.41-79
changelog:
- Update to CKBI 2.41 from NSS 3.53.0
-    Removing:
-     # Certificate "AddTrust Low-Value Services Root"
-     # Certificate "AddTrust External Root"
-     # Certificate "UTN USERFirst Email Root CA"
-     # Certificate "Certplus Class 2 Primary CA"
-     # Certificate "Deutsche Telekom Root CA 2"
-     # Certificate "Staat der Nederlanden Root CA - G2"
-     # Certificate "Swisscom Root CA 2"
-     # Certificate "Certinomis - Root CA"
-    Adding:
-     # Certificate "Entrust Root Certification Authority - G4"
- fix permissions on ghosted files.


author: Bob Relyea <rrelyea@redhat.com> - 2021.2.48-71
changelog:
- Update to CKBI 2.48 from NSS 3.66
-    Removing:
-     # Certificate "Verisign Class 3 Public Primary Certification Authority - G3"
-     # Certificate "GeoTrust Global CA"
-     # Certificate "GeoTrust Universal CA"
-     # Certificate "GeoTrust Universal CA 2"
-     # Certificate "QuoVadis Root CA"
-     # Certificate "Sonera Class 2 Root CA"
-     # Certificate "Taiwan GRCA"
-     # Certificate "GeoTrust Primary Certification Authority"
-     # Certificate "thawte Primary Root CA"
-     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
-     # Certificate "GeoTrust Primary Certification Authority - G3"
-     # Certificate "thawte Primary Root CA - G2"
-     # Certificate "thawte Primary Root CA - G3"
-     # Certificate "GeoTrust Primary Certification Authority - G2"
-     # Certificate "VeriSign Universal Root Certification Authority"
-     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
-     # Certificate "Trustis FPS Root CA"
-     # Certificate "EE Certification Centre Root CA"
-     # Certificate "LuxTrust Global Root 2"
-     # Certificate "Symantec Class 1 Public Primary Certification Authority - G4"
-     # Certificate "Symantec Class 2 Public Primary Certification Authority - G4"
-    Adding:
-     # Certificate "Microsoft ECC Root Certificate Authority 2017"
-     # Certificate "Microsoft RSA Root Certificate Authority 2017"
-     # Certificate "e-Szigno Root CA 2017"
-     # Certificate "certSIGN Root CA G2"
-     # Certificate "Trustwave Global Certification Authority"
-     # Certificate "Trustwave Global ECC P256 Certification Authority"
-     # Certificate "Trustwave Global ECC P384 Certification Authority"
-     # Certificate "NAVER Global Root Certification Authority"
-     # Certificate "AC RAIZ FNMT-RCM SERVIDORES SEGUROS"
-     # Certificate "GlobalSign Secure Mail Root R45"
-     # Certificate "GlobalSign Secure Mail Root E45"
-     # Certificate "GlobalSign Root R46"
-     # Certificate "GlobalSign Root E46"
-     # Certificate "GLOBALTRUST 2020"
-     # Certificate "ANF Secure Server Root CA"
-     # Certificate "Certum EC-384 CA"
-     # Certificate "Certum Trusted Root CA"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-71
changelog:
- Update to CKBI 2.54 from NSS 3.79
-    Removing:
-     # Certificate "GlobalSign Root CA - R2"
-     # Certificate "Cybertrust Global Root"
-     # Certificate "Explicitly Distrusted DigiNotar PKIoverheid G2"
-    Adding:
-     # Certificate "TunTrust Root CA"
-     # Certificate "HARICA TLS RSA Root CA 2021"
-     # Certificate "HARICA TLS ECC Root CA 2021"
-     # Certificate "HARICA Client RSA Root CA 2021"
-     # Certificate "HARICA Client ECC Root CA 2021"
-     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
-     # Certificate "vTrus ECC Root CA"
-     # Certificate "vTrus Root CA"
-     # Certificate "ISRG Root X2"
-     # Certificate "HiPKI Root CA - G1"
-     # Certificate "Telia Root CA v2"
-     # Certificate "D-TRUST BR Root CA 1 2020"
-     # Certificate "D-TRUST EV Root CA 1 2020"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-72
changelog:
- Update to CKBI 2.54 from NSS 3.79
-    Adding:
-     # Certificate "CAEDICOM Root"
-     # Certificate "I.CA Root CA/RSA"
-     # Certificate "MULTICERT Root Certification Authority 01"
-     # Certificate "Certification Authority of WoSign G2"
-     # Certificate "CA WoSign ECC Root"
-     # Certificate "CCA India 2015 SPL"
-     # Certificate "Swedish Government Root Authority v3"
-     # Certificate "Swedish Government Root Authority v2"
-     # Certificate "Tunisian Root Certificate Authority - TunRootCA2"
-     # Certificate "OpenTrust Root CA G1"
-     # Certificate "OpenTrust Root CA G2"
-     # Certificate "OpenTrust Root CA G3"
-     # Certificate "Certplus Root CA G1"
-     # Certificate "Certplus Root CA G2"
-     # Certificate "Government Root Certification Authority"
-     # Certificate "A-Trust-Qual-02"
-     # Certificate "Thailand National Root Certification Authority - G1"
-     # Certificate "TrustCor ECA-1"
-     # Certificate "TrustCor RootCert CA-2"
-     # Certificate "TrustCor RootCert CA-1"
-     # Certificate "Certification Authority of WoSign"
-     # Certificate "CA 沃通根证书"
-     # Certificate "SSC GDL CA Root B"
-     # Certificate "SAPO Class 2 Root CA"
-     # Certificate "SAPO Class 3 Root CA"
-     # Certificate "SAPO Class 4 Root CA"
-     # Certificate "CA Disig Root R1"
-     # Certificate "Autoridad Certificadora Raíz Nacional de Uruguay"
-     # Certificate "ApplicationCA2 Root"
-     # Certificate "GlobalSign"
-     # Certificate "Symantec Class 3 Public Primary Certification Authority - G6"
-     # Certificate "Symantec Class 3 Public Primary Certification Authority - G4"
-     # Certificate "Halcom Root CA"
-     # Certificate "Swisscom Root EV CA 2"
-     # Certificate "CFCA GT CA"
-     # Certificate "Digidentity L3 Root CA - G2"
-     # Certificate "SITHS Root CA v1"
-     # Certificate "Macao Post eSignTrust Root Certification Authority (G02)"
-     # Certificate "Autoridade Certificadora Raiz Brasileira v2"
-     # Certificate "Swisscom Root CA 2"
-     # Certificate "IGC/A AC racine Etat francais"
-     # Certificate "PersonalID Trustworthy RootCA 2011"
-     # Certificate "Swedish Government Root Authority v1"
-     # Certificate "Swiss Government Root CA II"
-     # Certificate "Swiss Government Root CA I"
-     # Certificate "Network Solutions Certificate Authority"
-     # Certificate "COMODO Certification Authority"
-     # Certificate "LuxTrust Global Root"
-     # Certificate "AC1 RAIZ MTIN"
-     # Certificate "Microsoft Root Certificate Authority 2011"
-     # Certificate "CCA India 2011"
-     # Certificate "ANCERT Certificados Notariales V2"
-     # Certificate "ANCERT Certificados CGN V2"
-     # Certificate "EE Certification Centre Root CA"
-     # Certificate "DigiNotar Root CA G2"
-     # Certificate "Federal Common Policy CA"
-     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
-     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
-     # Certificate "China Internet Network Information Center EV Certificates Root"
-     # Certificate "Verizon Global Root CA"
-     # Certificate "SwissSign Silver Root CA - G3"
-     # Certificate "SwissSign Platinum Root CA - G3"
-     # Certificate "SwissSign Gold Root CA - G3"
-     # Certificate "Microsec e-Szigno Root CA 2009"
-     # Certificate "SITHS CA v3"
-     # Certificate "Certinomis - Autorité Racine"
-     # Certificate "ANF Server CA"
-     # Certificate "Thawte Premium Server CA"
-     # Certificate "Thawte Server CA"
-     # Certificate "TC TrustCenter Universal CA III"
-     # Certificate "KEYNECTIS ROOT CA"
-     # Certificate "I.CA - Standard Certification Authority, 09/2009"
-     # Certificate "I.CA - Qualified Certification Authority, 09/2009"
-     # Certificate "VI Registru Centras RCSC (RootCA)"
-     # Certificate "CCA India 2007"
-     # Certificate "Autoridade Certificadora Raiz Brasileira v1"
-     # Certificate "ipsCA Global CA Root"
-     # Certificate "ipsCA Main CA Root"
-     # Certificate "Actalis Authentication CA G1"
-     # Certificate "A-Trust-Qual-03"
-     # Certificate "AddTrust External CA Root"
-     # Certificate "ECRaizEstado"
-     # Certificate "Configuration"
-     # Certificate "FNMT-RCM"
-     # Certificate "StartCom Certification Authority"
-     # Certificate "TWCA Root Certification Authority"
-     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
-     # Certificate "thawte Primary Root CA - G2"
-     # Certificate "GeoTrust Primary Certification Authority - G2"
-     # Certificate "VeriSign Universal Root Certification Authority"
-     # Certificate "thawte Primary Root CA - G3"
-     # Certificate "GeoTrust Primary Certification Authority - G3"
-     # Certificate "E-ME SSI (RCA)"
-     # Certificate "ACEDICOM Root"
-     # Certificate "Autoridad Certificadora Raiz de la Secretaria de Economia"
-     # Certificate "Correo Uruguayo - Root CA"
-     # Certificate "CNNIC ROOT"
-     # Certificate "Common Policy"
-     # Certificate "Macao Post eSignTrust Root Certification Authority"
-     # Certificate "Staat der Nederlanden Root CA - G2"
-     # Certificate "NetLock Platina (Class Platinum) Főtanúsítvány"
-     # Certificate "AC Raíz Certicámara S.A."
-     # Certificate "Cisco Root CA 2048"
-     # Certificate "CA Disig"
-     # Certificate "InfoNotary CSP Root"
-     # Certificate "UCA Global Root"
-     # Certificate "UCA Root"
-     # Certificate "DigiNotar Root CA"
-     # Certificate "Starfield Services Root Certificate Authority"
-     # Certificate "I.CA - Qualified root certificate"
-     # Certificate "I.CA - Standard root certificate"
-     # Certificate "e-Guven Kok Elektronik Sertifika Hizmet Saglayicisi"
-     # Certificate "Japanese Government"
-     # Certificate "AdminCA-CD-T01"
-     # Certificate "Admin-Root-CA"
-     # Certificate "Izenpe.com"
-     # Certificate "TÜBİTAK UEKAE Kök Sertifika Hizmet Sağlayıcısı - Sürüm 3"
-     # Certificate "Halcom CA FO"
-     # Certificate "Halcom CA PO 2"
-     # Certificate "Root CA"
-     # Certificate "GPKIRootCA"
-     # Certificate "ACNLB"
-     # Certificate "state-institutions"
-     # Certificate "state-institutions"
-     # Certificate "SECOM Trust Systems CO.,LTD."
-     # Certificate "D-TRUST Qualified Root CA 1 2007:PN"
-     # Certificate "D-TRUST Root Class 2 CA 2007"
-     # Certificate "D-TRUST Root Class 3 CA 2007"
-     # Certificate "SSC Root CA A"
-     # Certificate "SSC Root CA B"
-     # Certificate "SSC Root CA C"
-     # Certificate "Autoridad de Certificacion de la Abogacia"
-     # Certificate "Root CA Generalitat Valenciana"
-     # Certificate "VAS Latvijas Pasts SSI(RCA)"
-     # Certificate "ANCERT Certificados CGN"
-     # Certificate "ANCERT Certificados Notariales"
-     # Certificate "ANCERT Corporaciones de Derecho Publico"
-     # Certificate "GLOBALTRUST"
-     # Certificate "Certipost E-Trust TOP Root CA"
-     # Certificate "Certipost E-Trust Primary Qualified CA"
-     # Certificate "Certipost E-Trust Primary Normalised CA"
-     # Certificate "Cybertrust Global Root"
-     # Certificate "GlobalSign"
-     # Certificate "IGC/A"
-     # Certificate "S-TRUST Authentication and Encryption Root CA 2005:PN"
-     # Certificate "TC TrustCenter Universal CA I"
-     # Certificate "TC TrustCenter Universal CA II"
-     # Certificate "TC TrustCenter Class 2 CA II"
-     # Certificate "TC TrustCenter Class 4 CA II"
-     # Certificate "Swisscom Root CA 1"
-     # Certificate "Microsec e-Szigno Root CA"
-     # Certificate "LGPKI"
-     # Certificate "AC RAIZ DNIE"
-     # Certificate "Common Policy"
-     # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı"
-     # Certificate "A-Trust-nQual-03"
-     # Certificate "A-Trust-nQual-03"
-     # Certificate "CertRSA01"
-     # Certificate "KISA RootCA 1"
-     # Certificate "KISA RootCA 3"
-     # Certificate "NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado"
-     # Certificate "A-CERT ADVANCED"
-     # Certificate "A-Trust-Qual-01"
-     # Certificate "A-Trust-nQual-01"
-     # Certificate "A-Trust-Qual-02"
-     # Certificate "Staat der Nederlanden Root CA"
-     # Certificate "Serasa Certificate Authority II"
-     # Certificate "TDC Internet"
-     # Certificate "America Online Root Certification Authority 2"
-     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
-     # Certificate "Government Root Certification Authority"
-     # Certificate "RSA Security Inc"
-     # Certificate "Public Notary Root"
-     # Certificate "GeoTrust Global CA"
-     # Certificate "GeoTrust Global CA 2"
-     # Certificate "GeoTrust Universal CA"
-     # Certificate "GeoTrust Universal CA 2"
-     # Certificate "QuoVadis Root Certification Authority"
-     # Certificate "Autoridade Certificadora Raiz Brasileira"
-     # Certificate "Post.Trust Root CA"
-     # Certificate "Microsoft Root Authority"
-     # Certificate "Microsoft Root Certificate Authority"
-     # Certificate "Microsoft Root Certificate Authority 2010"
-     # Certificate "Entrust.net Secure Server Certification Authority"
-     # Certificate "UTN-USERFirst-Object"
-     # Certificate "BYTE Root Certification Authority 001"
-     # Certificate "CISRCA1"
-     # Certificate "ePKI Root Certification Authority - G2"
-     # Certificate "ePKI EV SSL Certification Authority - G1"
-     # Certificate "AC Raíz Certicámara S.A."
-     # Certificate "SSL.com EV Root Certification Authority RSA"
-     # Certificate "LuxTrust Global Root 2"
-     # Certificate "ACA ROOT"
-     # Certificate "Security Communication ECC RootCA1"
-     # Certificate "Security Communication RootCA3"
-     # Certificate "CHAMBERS OF COMMERCE ROOT - 2016"
-     # Certificate "Network Solutions RSA Certificate Authority"
-     # Certificate "Network Solutions ECC Certificate Authority"
-     # Certificate "Australian Defence Public Root CA"
-     # Certificate "SI-TRUST Root"
-     # Certificate "Halcom Root Certificate Authority"
-     # Certificate "Application CA G3 Root"
-     # Certificate "GLOBALTRUST 2015"
-     # Certificate "Microsoft ECC Product Root Certificate Authority 2018"
-     # Certificate "emSign Root CA - G2"
-     # Certificate "emSign Root CA - C2"
-     # Certificate "Microsoft ECC TS Root Certificate Authority 2018"
-     # Certificate "DigiCert CS ECC P384 Root G5"
-     # Certificate "DigiCert CS RSA4096 Root G5"
-     # Certificate "DigiCert RSA4096 Root G5"
-     # Certificate "DigiCert ECC P384 Root G5"
-     # Certificate "HARICA Code Signing RSA Root CA 2021"
-     # Certificate "HARICA Code Signing ECC Root CA 2021"
-     # Certificate "Microsoft Identity Verification Root Certificate Authority 2020"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-74
changelog:
- Update to CKBI 2.54 from NSS 3.79
-    Removing:
-     # Certificate "TrustCor ECA-1"
-     # Certificate "TrustCor RootCert CA-2"
-     # Certificate "TrustCor RootCert CA-1"
-     # Certificate "Network Solutions Certificate Authority"
-     # Certificate "COMODO Certification Authority"
-     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
-     # Certificate "Microsec e-Szigno Root CA 2009"
-     # Certificate "TWCA Root Certification Authority"
-     # Certificate "Izenpe.com"
-     # Certificate "state-institutions"
-     # Certificate "GlobalSign"
-     # Certificate "Common Policy"
-     # Certificate "A-Trust-nQual-03"
-     # Certificate "A-Trust-Qual-02"
-     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
-     # Certificate "Government Root Certification Authority"
-     # Certificate "AC Raíz Certicámara S.A."


author: Robert Relyea <rrelyea@redhat.com> - 2023.2.60_v7.0.306-71
changelog:
- Update to CKBI 2.60_v7.0.306 from NSS 3.91
-    Removing:
-     # Certificate "Camerfirma Global Chambersign Root"
-     # Certificate "Staat der Nederlanden EV Root CA"
-     # Certificate "OpenTrust Root CA G1"
-     # Certificate "Swedish Government Root Authority v1"
-     # Certificate "DigiNotar Root CA G2"
-     # Certificate "Federal Common Policy CA"
-     # Certificate "TC TrustCenter Universal CA III"
-     # Certificate "CCA India 2007"
-     # Certificate "ipsCA Global CA Root"
-     # Certificate "ipsCA Main CA Root"
-     # Certificate "Macao Post eSignTrust Root Certification Authority"
-     # Certificate "InfoNotary CSP Root"
-     # Certificate "DigiNotar Root CA"
-     # Certificate "Root CA"
-     # Certificate "GPKIRootCA"
-     # Certificate "D-TRUST Qualified Root CA 1 2007:PN"
-     # Certificate "TC TrustCenter Universal CA I"
-     # Certificate "TC TrustCenter Universal CA II"
-     # Certificate "TC TrustCenter Class 2 CA II"
-     # Certificate "TC TrustCenter Class 4 CA II"
-     # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı"
-     # Certificate "CertRSA01"
-     # Certificate "KISA RootCA 3"
-     # Certificate "A-CERT ADVANCED"
-     # Certificate "A-Trust-Qual-01"
-     # Certificate "A-Trust-nQual-01"
-     # Certificate "Serasa Certificate Authority II"
-     # Certificate "TDC Internet"
-     # Certificate "America Online Root Certification Authority 2"
-     # Certificate "RSA Security Inc"
-     # Certificate "Public Notary Root"
-     # Certificate "Autoridade Certificadora Raiz Brasileira"
-     # Certificate "Post.Trust Root CA"
-     # Certificate "Entrust.net Secure Server Certification Authority"
-     # Certificate "ePKI EV SSL Certification Authority - G1"
-    Adding:
-     # Certificate "DigiCert TLS ECC P384 Root G5"
-     # Certificate "DigiCert TLS RSA4096 Root G5"
-     # Certificate "DigiCert SMIME ECC P384 Root G5"
-     # Certificate "DigiCert SMIME RSA4096 Root G5"
-     # Certificate "Certainly Root R1"
-     # Certificate "Certainly Root E1"
-     # Certificate "E-Tugra Global Root CA RSA v3"
-     # Certificate "E-Tugra Global Root CA ECC v3"
-     # Certificate "DIGITALSIGN GLOBAL ROOT RSA CA"
-     # Certificate "DIGITALSIGN GLOBAL ROOT ECDSA CA"
-     # Certificate "BJCA Global Root CA1"
-     # Certificate "BJCA Global Root CA2"
-     # Certificate "Symantec Enterprise Mobile Root for Microsoft"
-     # Certificate "A-Trust-Root-05"
-     # Certificate "ADOCA02"
-     # Certificate "StartCom Certification Authority G2"
-     # Certificate "ATHEX Root CA"
-     # Certificate "EBG Elektronik Sertifika Hizmet Sağlayıcısı"
-     # Certificate "GeoTrust Primary Certification Authority"
-     # Certificate "thawte Primary Root CA"
-     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
-     # Certificate "America Online Root Certification Authority 1"
-     # Certificate "Juur-SK"
-     # Certificate "ComSign CA"
-     # Certificate "ComSign Secured CA"
-     # Certificate "ComSign Advanced Security CA"
-     # Certificate "Global Chambersign Root"
-     # Certificate "Sonera Class2 CA"
-     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G3"
-     # Certificate "VeriSign, Inc."
-     # Certificate "GTE CyberTrust Global Root"
-     # Certificate "Equifax Secure Global eBusiness CA-1"
-     # Certificate "Equifax"
-     # Certificate "Class 1 Primary CA"
-     # Certificate "Swiss Government Root CA III"
-     # Certificate "Application CA G4 Root"
-     # Certificate "SSC GDL CA Root A"
-     # Certificate "GlobalSign Code Signing Root E45"
-     # Certificate "GlobalSign Code Signing Root R45"
-     # Certificate "Entrust Code Signing Root Certification Authority - CSBR1"


author: Robert Relyea <rrelyea@redhat.com> - 2023.2.60_v7.0.306-72
changelog:
- hand merge the two 'GlobalSign ECC Root CA R4' certs together and the two 'AC RAIZ FNMT-RCM' certs together to keep p11kit from getting confused.


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2023.2.64_v7.0.306-72.tuxcare.els1
changelog:
- Update to CKBI 2.64_v7.0.306 from NSS 3.95
- Removing:
-     # Certificate "AC1 RAIZ MTIN"
-     # Certificate "ACNLB"
-     # Certificate "Actalis Authentication CA G1"
-     # Certificate "AddTrust External CA Root"
-     # Certificate "AdminCA-CD-T01"
-     # Certificate "Admin-Root-CA"
-     # Certificate "ADOCA02"
-     # Certificate "ANF Server CA"
-     # Certificate "A-Trust-Qual-03"
-     # Certificate "A-Trust-Root-05"
-     # Certificate "Autoridade Certificadora Raiz Brasileira v1"
-     # Certificate "Autoridade Certificadora Raiz Brasileira v2"
-     # Certificate "CA Disig"
-     # Certificate "CCA India 2011"
-     # Certificate "Certipost E-Trust Primary Normalised CA"
-     # Certificate "Certipost E-Trust Primary Qualified CA"
-     # Certificate "Class 1 Primary CA"
-     # Certificate "Cybertrust Global Root"
-     # Certificate "D-TRUST Root Class 2 CA 2007"
-     # Certificate "D-TRUST Root Class 3 CA 2007"
-     # Certificate "EBG Elektronik Sertifika Hizmet Sağlayıcısı"
-     # Certificate "e-Guven Kok Elektronik Sertifika Hizmet Saglayicisi"
-     # Certificate "Equifax"
-     # Certificate "Equifax Secure Global eBusiness CA-1"
-     # Certificate "E-Tugra Certification Authority"
-     # Certificate "GeoTrust Global CA"
-     # Certificate "GeoTrust Global CA 2"
-     # Certificate "GTE CyberTrust Global Root"
-     # Certificate "Halcom CA FO"
-     # Certificate "Halcom CA PO 2"
-     # Certificate "Hongkong Post Root CA 1"
-     # Certificate "I.CA - Qualified Certification Authority, 09/2009"
-     # Certificate "I.CA - Qualified root certificate"
-     # Certificate "I.CA - Standard Certification Authority, 09/2009"
-     # Certificate "I.CA - Standard root certificate"
-     # Certificate "IGC/A"
-     # Certificate "Japanese Government"
-     # Certificate "Juur-SK"
-     # Certificate "KEYNECTIS ROOT CA"
-     # Certificate "LGPKI"
-     # Certificate "LuxTrust Global Root"
-     # Certificate "Macao Post eSignTrust Root Certification Authority (G02)"
-     # Certificate "Microsec e-Szigno Root CA"
-     # Certificate "Microsoft Root Authority"
-     # Certificate "Microsoft Root Certificate Authority"
-     # Certificate "NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado"
-     # Certificate "QuoVadis Root Certification Authority"
-     # Certificate "Root CA Generalitat Valenciana"
-     # Certificate "SITHS CA v3"
-     # Certificate "Sonera Class2 CA"
-     # Certificate "Staat der Nederlanden Root CA"
-     # Certificate "Staat der Nederlanden Root CA - G2"
-     # Certificate "state-institutions"
-     # Certificate "Symantec Class 1 Public Primary Certification Authority - G6"
-     # Certificate "Symantec Class 2 Public Primary Certification Authority - G6"
-     # Certificate "Thawte Premium Server CA"
-     # Certificate "Thawte Server CA"
-     # Certificate "TrustCor ECA-1"
-     # Certificate "TrustCor RootCert CA-1"
-     # Certificate "TrustCor RootCert CA-2"
-     # Certificate "TÜBİTAK UEKAE Kök Sertifika Hizmet Sağlayıcısı - Sürüm 3"
-     # Certificate "UTN-USERFirst-Object"
-     # Certificate "Verisign Class 1 Public Primary Certification Authority - G3"
-     # Certificate "Verisign Class 2 Public Primary Certification Authority - G3"
-     # Certificate "VeriSign, Inc."
-    Adding:
-     # Certificate "Atos TrustedRoot Root CA ECC G2 2020"
-     # Certificate "Atos TrustedRoot Root CA ECC TLS 2021"
-     # Certificate "Atos TrustedRoot Root CA RSA G2 2020"
-     # Certificate "Atos TrustedRoot Root CA RSA TLS 2021"
-     # Certificate "CommScope Public Trust ECC Root-01"
-     # Certificate "CommScope Public Trust ECC Root-02"
-     # Certificate "CommScope Public Trust RSA Root-01"
-     # Certificate "CommScope Public Trust RSA Root-02"
-     # Certificate "LAWtrust Root CA2 (4096)"
-     # Certificate "Sectigo Public Email Protection Root E46"
-     # Certificate "Sectigo Public Email Protection Root R46"
-     # Certificate "Sectigo Public Server Authentication Root E46"
-     # Certificate "Sectigo Public Server Authentication Root R46"
-     # Certificate "SSL.com Client ECC Root CA 2022"
-     # Certificate "SSL.com Client RSA Root CA 2022"
-     # Certificate "SSL.com TLS ECC Root CA 2022"
-     # Certificate "SSL.com TLS RSA Root CA 2022"
-     # Certificate "TrustAsia Global Root CA G3"
-     # Certificate "TrustAsia Global Root CA G4"


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2024.2.69_v7.0.306-72.tuxcare.els1
changelog:
- update to CKBI 2.69 from NSS 3.103
- updated certificates:
-     # Certificate "GLOBALTRUST 2020"
-     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
-     # Certificate "Entrust.net Premium 2048 Secure Server CA"
-     # Certificate "Baltimore CyberTrust Root"
-     # Certificate "Entrust Root Certification Authority"
-     # Certificate "Certum Root CA"
-     # Certificate "Comodo AAA Services root"
-     # Certificate "QuoVadis Root CA 2"
-     # Certificate "QuoVadis Root CA 3"
-     # Certificate "XRamp Global CA Root"
-     # Certificate "Go Daddy Class 2 CA"
-     # Certificate "Starfield Class 2 CA"
-     # Certificate "DigiCert Assured ID Root CA"
-     # Certificate "DigiCert Global Root CA"
-     # Certificate "DigiCert High Assurance EV Root CA"
-     # Certificate "SwissSign Gold CA - G2"
-     # Certificate "SwissSign Silver CA - G2"
-     # Certificate "SecureTrust CA"
-     # Certificate "Secure Global CA"
-     # Certificate "COMODO ECC Certification Authority"
-     # Certificate "OISTE WISeKey Global Root GA CA"
-     # Certificate "Certigna"
-     # Certificate "ePKI Root Certification Authority"
-     # Certificate "certSIGN ROOT CA"
-     # Certificate "SecureSign RootCA11"
-     # Certificate "Microsec e-Szigno Root CA 2009"
-     # Certificate "GlobalSign Root CA - R3"
-     # Certificate "Go Daddy Root Certificate Authority - G2"
-     # Certificate "Starfield Root Certificate Authority - G2"
-     # Certificate "Starfield Services Root Certificate Authority - G2"
-     # Certificate "AffirmTrust Commercial"
-     # Certificate "AffirmTrust Networking"
-     # Certificate "AffirmTrust Premium"
-     # Certificate "AffirmTrust Premium ECC"
-     # Certificate "Certum Trusted Network CA"
-     # Certificate "TWCA Root Certification Authority"
-     # Certificate "Security Communication RootCA2"
-     # Certificate "Actalis Authentication Root CA"
-     # Certificate "D-TRUST Root Class 3 CA 2 2009"
-     # Certificate "D-TRUST Root Class 3 CA 2 EV 2009"
-     # Certificate "CA Disig Root R2"
-     # Certificate "ACCVRAIZ1"
-     # Certificate "TWCA Global Root CA"
-     # Certificate "Atos TrustedRoot 2011"
-     # Certificate "QuoVadis Root CA 1 G3"
-     # Certificate "QuoVadis Root CA 2 G3"
-     # Certificate "QuoVadis Root CA 3 G3"
-     # Certificate "DigiCert Assured ID Root G2"
-     # Certificate "DigiCert Assured ID Root G3"
-     # Certificate "DigiCert Global Root G2"
-     # Certificate "DigiCert Global Root G3"
-     # Certificate "DigiCert Trusted Root G4"
-     # Certificate "COMODO RSA Certification Authority"
-     # Certificate "USERTrust RSA Certification Authority"
-     # Certificate "USERTrust ECC Certification Authority"
-     # Certificate "GlobalSign ECC Root CA - R5"
-     # Certificate "IdenTrust Commercial Root CA 1"
-     # Certificate "Entrust Root Certification Authority - G2"
-     # Certificate "Entrust Root Certification Authority - EC1"
-     # Certificate "CFCA EV ROOT"
-     # Certificate "OISTE WISeKey Global Root GB CA"
-     # Certificate "Certum Trusted Network CA 2"
-     # Certificate "Hellenic Academic and Research Institutions RootCA 2015"
-     # Certificate "Hellenic Academic and Research Institutions ECC RootCA 2015"
-     # Certificate "AC RAIZ FNMT-RCM"
-     # Certificate "Amazon Root CA 2"
-     # Certificate "SSL.com Root Certification Authority RSA"
-     # Certificate "SSL.com Root Certification Authority ECC"
-     # Certificate "SSL.com EV Root Certification Authority RSA R2"
-     # Certificate "SSL.com EV Root Certification Authority ECC"
-     # Certificate "GlobalSign Root CA - R6"
-     # Certificate "OISTE WISeKey Global Root GC CA"
-     # Certificate "UCA Global G2 Root"
-     # Certificate "UCA Extended Validation Root"
-     # Certificate "Certigna Root CA"
-     # Certificate "emSign ECC Root CA - G3"
-     # Certificate "emSign ECC Root CA - C3"
-     # Certificate "Entrust Root Certification Authority - G4"
-     # Certificate "e-Szigno Root CA 2017"
-     # Certificate "Trustwave Global Certification Authority"
-     # Certificate "Trustwave Global ECC P256 Certification Authority"
-     # Certificate "Trustwave Global ECC P384 Certification Authority"
-     # Certificate "Certum EC-384 CA"
-     # Certificate "Certum Trusted Root CA"
-     # Certificate "GlobalSign ECC Root CA - R4"
-     # Certificate "Security Communication RootCA3"
-     # Certificate "Security Communication ECC RootCA1"
- removed certificates:
-     # Certificate "Security Communication Root CA"
-     # Certificate "Camerfirma Chambers of Commerce Root"
-     # Certificate "Chambers of Commerce Root - 2008"
-     # Certificate "Global Chambersign Root - 2008"
-     # Certificate "Certification Authority of WoSign G2"
-     # Certificate "CA WoSign ECC Root"
-     # Certificate "A-Trust-Qual-02"
-     # Certificate "Certification Authority of WoSign"
-     # Certificate "CA 沃通根证书"
-     # Certificate "StartCom Certification Authority G2"
-     # Certificate "China Internet Network Information Center EV Certificates Root"
-     # Certificate "VI Registru Centras RCSC (RootCA)"
-     # Certificate "StartCom Certification Authority"
-     # Certificate "CNNIC ROOT"
-     # Certificate "ANCERT Certificados CGN"
-     # Certificate "ANCERT Certificados Notariales"
-     # Certificate "ANCERT Corporaciones de Derecho Publico"
-     # Certificate "Global Chambersign Root"
-     # Certificate "CHAMBERS OF COMMERCE ROOT - 2016"
-     # Certificate "E-Tugra Global Root CA RSA v3"
-     # Certificate "E-Tugra Global Root CA ECC v3"
-     # Certificate "Tunisian Root Certificate Authority - TunRootCA2"
- added certificates:
-     # Certificate "D-Trust SBR Root CA 1 2022"
-     # Certificate "D-Trust SBR Root CA 2 2022"
-     # Certificate "Telekom Security SMIME ECC Root 2021"
-     # Certificate "Telekom Security TLS ECC Root 2020"
-     # Certificate "Telekom Security SMIME RSA Root 2023"
-     # Certificate "Telekom Security TLS RSA Root 2023"
-     # Certificate "FIRMAPROFESIONAL CA ROOT-A WEB"
- remove duplicated certificate record:
-     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"


author: Kopylov Pavel <pkopylov@cloudlinux.com> - 2025.2.74_v7.0.306-72.tuxcare.els1
changelog:
- update to CKBI 2.74 from NSS 3.110
- updated certificates:
-     # Certificate "Entrust.net Premium 2048 Secure Server CA"
-     # Certificate "Entrust Root Certification Authority"
-     # Certificate "AffirmTrust Commercial"
-     # Certificate "AffirmTrust Networking"
-     # Certificate "AffirmTrust Premium"
-     # Certificate "AffirmTrust Premium ECC"
-     # Certificate "Entrust Root Certification Authority - G2"
-     # Certificate "Entrust Root Certification Authority - EC1"
-     # Certificate "certSIGN ROOT CA"
-     # Certificate "ACCVRAIZ1"
-     # Certificate "Entrust Root Certification Authority - G4"
-     # Certificate "Security Communication ECC RootCA1"
-     # Certificate "BJCA Global Root CA1"
-     # Certificate "BJCA Global Root CA2"
- removed certificates:
-     # Certificate "CCA India 2015 SPL"
-     # Certificate "VAS Latvijas Pasts SSI(RCA)"
- added certificates:
-     # Certificate "TWCA CYBER Root CA"
-     # Certificate "TWCA Global Root CA G2"
-     # Certificate "SecureSign Root CA12"
-     # Certificate "SecureSign Root CA14"
-     # Certificate "SecureSign Root CA15"
-     # Certificate "D-TRUST BR Root CA 2 2023"
-     # Certificate "D-TRUST EV Root CA 2 2023"
- removed unsupported certificates:
-     # Certificate "Verisign Class 1 Public Primary Certification Authority-G3"
-     # Certificate "Verisign Class 2 Public Primary Certification Authority-G3"
-     # Certificate "Symantec Class 1 Public Primary Certification Authority-G6"
-     # Certificate "Symantec Class 2 Public Primary Certification Authority-G6"


author: Pavel Raiskup <praiskup@redhat.com> - 2.11-20
changelog:
- fix another bogus date in changelog
- update config.guess/config.sub for aarm64 build (#925189)
- run autoreconf instead of autoheader


author: Marek Polacek <polacek@redhat.com> 4.8.5-38
changelog:
- fix mode mismatch in prepare_cmp_insn (#1641329, PR target/63442)
- allow libitm to use HTM (#1659698)
- fix up memset handling in DSE (#1640805, PR rtl-optimization/69891)
- fix bits/bytes confusion in set_noop_p (#1594975, PR rtl-optimization/68814)
- enable initializing statics with COMPOUND_LITERAL_EXPR in C99
  (#1672652, PR c/63567)
- fix PIC_OFFSET_TABLE_REGNUM (#1614326)
- quash spurious -Wmissing-field-initializers warnings (#1633716, PR c/60784)
- fix ICE with alias template (#1648161, PR c++/53658)


author: Marek Polacek <polacek@redhat.com> 4.8.5-43
changelog:
- fix wrong code emitted for movv1qi on s390x (#1784759)
- fix wrong code with EH due to a bug in LRA (#1800526)


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 4.8.5-44.tuxcare.els1
changelog:
- CVE-2020-11023: sanitize HTML content passed to DOM manipulation methods to
  prevent execution of untrusted code


author: Andreas Schneider <asn@redhat.com> - 4.10.16-14
changelog:
- resolves: #1937867 - Fix possible core dump with printing support
- resolves: #1930747 - Ensure that libwbclient has been updated before
                       restarting services


author: Andreas Schneider <asn@redhat.com> - 4.10.16-16
changelog:
- resolves: #2019661 - Fix CVE-2016-2124
- resolves: #2019673 - Fix CVE-2020-25717
- resolves: #2021428 - Add missing PAC buffer types to krb5pac.idl


author: Andreas Schneider <asn@redhat.com> - 4.10.16-18
changelog:
- resolves: #2034800 - Fix usermap script regression caused by CVE-2020-25717
- resolves: #2036595 - Fix MIT realm regression caused by CVE-2020-25717
- resolves: #2046148 - Fix CVE-2021-44142


author: Andreas Schneider <asn@redhat.com> - 4.10.16-19
changelog:
- resolves: #2081649 - Fix idmap_rfc2307 and idmap_nss returning wrong
                       mapping for uid/gid conflict


author: Pavel Kopylov <pkopylov@cloudlinux.com> 4.10.16-25.tuxcare.els1
changelog:
- CVE-2023-34966: fix infinite loop vulnerability in mdssvc RPC service
- some tests were added as skipped


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.6.3-44
changelog:
- 1774460 - CVE-2019-8696 cups: stack-buffer-overflow in libcups's asn1_get_packed function [rhel-7]
- 1774461 - CVE-2019-8675 cups: stack-buffer-overflow in libcups's asn1_get_type function [rhel-7]
- 1753809 - Settings in ~/.cups/client.conf aren't used


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.6.3-46
changelog:
- 1715907 - CUPS- client: cupsGetPPD3() function tries to load PPD from IPP printer and not from the CUPS queue


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 1.6.3-52.tuxcare.els2
changelog:
- CVE-2025-58060: fix authentication bypass by checking password when AuthType
  is set to anything but Basic.


author: Arseniy Zolotarev <azolotarev@cloudlinux.com> - 1:1.6.3-52.tuxcare.els3
changelog:
- CVE-2024-35235: patch arbitrary chmod vulnerability in cupsd process when
  starting server with symbolic link Listen configuration item


author: Tim Powers <timp@redhat.com>
changelog:
- changelog started
- general cleanups, changed prefix to /usr, added manpage to files section
- including in Powertools


author: Tim Powers <timp@redhat.com>
changelog:
- update to 7.4.1 to fix bug #20337, problems with curl -c
- not using patch anymore, it's included in the new source. Keeping
  for reference


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- include curl-config in curl-devel
- update to 7.8 to fix memory leak and strlcat() symbol pollution from libcurl


author: Joe Orton <jorton@redhat.com> 7.9.8-2
changelog:
- fix `curl-config --libs` output for libdir!=/usr/lib
- remove docs/LIBCURL from docs list; remove unpackaged libcurl.la
- libtoolize and reconf


author: Adrian Havill <havill@redhat.com> 7.10.6-7
changelog:
- aclocal before libtoolize
- move OpenLDAP license so it's present as a doc file, present in
  both the source and binary as per conditions


author: Adrian Havill <havill@redhat.com> 7.12.1-1
changelog:
- upgrade to 7.12.1
- enable GSSAPI auth (#129353)
- enable I18N domain names (#134595)
- workaround for broken ProFTPD SSL auth (#134133). Thanks to
  Aleksandar Milivojevic


author: Adrian Havill <havill@redhat.com> 7.12.3-1
changelog:
- Upgrade to 7.12.3, which uses poll() for FDSETSIZE limit (#134794)
- require libidn-devel for devel subpkg (#141341)
- remove proftpd kludge; included upstream


author: Joe Orton <jorton@redhat.com> 7.12.3-3
changelog:
- don't pass /usr to --with-libidn to remove "-L/usr/lib" from
  'curl-config --libs' output on x86_64.


author: Ivana Varekova <varekova@redhat.com> - 7.15.1-2
changelog:
- fix multilib problem - #181290 - 
  curl-devel.i386 not installable together with curl-devel.x86-64


author: Jindrich Novy <jnovy@redhat.com> - 7.16.0-2
changelog:
- fix BuildRoot
- add Requires: pkgconfig for curl-devel
- move LDFLAGS and LIBS to Libs.private in libcurl.pc.in (#213278)


author: Jindrich Novy <jnovy@redhat.com> 7.16.2-4
changelog:
- another series of review fixes (#225671),
  thanks to Paul Howarth
- check version of ldap library automatically
- don't use %makeinstall and preserve timestamps
- drop useless patches


author: Jindrich Novy <jnovy@redhat.com> 7.16.3-1
changelog:
- update to 7.16.3
- drop .print patch, applied upstream
- next series of merge review fixes by Paul Howarth
- remove aclocal stuff, no more needed
- simplify makefile arguments
- don't reference standard library paths in libcurl.pc
- include docs/CONTRIBUTE


author: Jindrich Novy <jnovy@redhat.com> 7.16.4-5
changelog:
- add support for the NSS PKCS#11 pem reader so the command-line is the
  same for both OpenSSL and NSS by Rob Crittenden (rcritten@redhat.com)
- switch to NSS again


author: Jindrich Novy <jnovy@redhat.com> 7.17.1-1
changelog:
- update to curl 7.17.1
- include patch to enable SSL usage in NSS when a socket is opened
  nonblocking, thanks to Rob Crittenden (rcritten@redhat.com)


author: Jindrich Novy <jnovy@redhat.com> 7.17.1-3
changelog:
- drop useless ldap library detection since curl doesn't
  dlopen()s it but links to it -> BR: openldap-devel
- enable LDAPS support (#225671), thanks to Paul Howarth
- BR: krb5-devel to reenable GSSAPI support
- simplify build process
- update description


author: Jindrich Novy <jnovy@redhat.com> 7.18.1-1
changelog:
- update to curl 7.18.1 (fixes #397911)
- add ABI docs for libcurl
- remove --static-libs from curl-config
- drop curl-config patch, obsoleted by @SSL_ENABLED@ autoconf
  substitution (#432667)


author: Jindrich Novy <jnovy@redhat.com> 7.18.1-2
changelog:
- spec cleanup, thanks to Paul Howarth (#225671)
  - drop BR: libtool
  - convert CHANGES and README to UTF-8
  - _GNU_SOURCE in CFLAGS is no more needed
  - remove bogus rpath


author: Jindrich Novy <jnovy@redhat.com> 7.19.4-1
changelog:
- update to 7.19.4 (fixes CVE-2009-0037)
- fix leak in curl_easy* functions, thanks to Kamil Dudka
- drop nss-fix patch, applied upstream


author: Jindrich Novy <jnovy@redhat.com> 7.19.4-2
changelog:
- drop .easy-leak patch, causes problems in pycurl (#488791)
- fix libcurl-devel dependencies (#488895)


author: Kamil Dudka <kdudka@redhat.com> 7.19.4-6
changelog:
- upstream patch fixing memory leak in lib/nss.c (#453612)
- remove redundant dependency of libcurl-devel on libssh2-devel


author: Kamil Dudka <kdudka@redhat.com> 7.19.5-8
changelog:
- do not pre-login to all PKCS11 slots, it causes problems with HW tokens
- try to select client certificate automatically when not specified, thanks
  to Claes Jakobsson


author: Kamil Dudka <kdudka@redhat.com> 7.19.6-1
changelog:
- new upstream release, dropped applied patches
- changed NSS code to not ignore the value of ssl.verifyhost and produce more
  verbose error messages (#516056)


author: Kamil Dudka <kdudka@redhat.com> 7.19.6-3
changelog:
- avoid tight loop during a sftp upload
- http://permalink.gmane.org/gmane.comp.web.curl.library/24744


author: Kamil Dudka <kdudka@redhat.com> 7.19.6-4
changelog:
- use pkg-config to find nss and libssh2 if possible
- better patch (not only) for SCP/SFTP polling
- improve error message for not matching common name (#516056)


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-1
changelog:
- new upstream release, dropped applied patches
- workaround for broken TLS servers (#525496, #527771)


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-3
changelog:
- fix crash on doubly closed NSPR descriptor, patch contributed
  by Kevin Baughman (#534176)
- new version of patch for broken TLS servers (#525496, #527771)


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-11
changelog:
- upstream patch adding a new option -J/--remote-header-name
- dropped temporary workaround for #545779


author: Kamil Dudka <kdudka@redhat.com> 7.20.0-1
changelog:
- new upstream release - added support for IMAP(S), POP3(S), SMTP(S) and RTSP
- dropped patches applied upstream
- dropped curl-7.16.0-privlibs.patch no longer useful
- a new patch forcing -lrt when linking the curl tool and test-cases


author: Kamil Dudka <kdudka@redhat.com> 7.20.0-3
changelog:
- throw CURLE_SSL_CERTPROBLEM in case peer rejects a certificate (#565972)
- valgrind temporarily disabled (#574889)
- kerberos installation prefix has been changed


author: Paul Howarth <paul@city-fan.org> 7.20.1-3
changelog:
- replace Rawhide s390-sleep patch with a more targeted patch adding a
  delay after tests 513 and 514 rather than after all tests


author: Kamil Dudka <kdudka@redhat.com> 7.20.1-4
changelog:
- upstream patch preventing failure of test536 with threaded DNS resolver
- upstream patch preventing SSL handshake timeout underflow


author: Kamil Dudka <kdudka@redhat.com> 7.20.1-5
changelog:
- CRL support now works again (#581926)
- make it possible to start a testing OpenSSH server when building with SELinux
  in the enforcing mode (#521087)


author: Kamil Dudka <kdudka@redhat.com> 7.21.0-1
changelog:
- new upstream release, drop applied patches
- update of %description
- disable valgrind for certain test-cases (libssh2 problem)


author: Kamil Dudka <kdudka@redhat.com> 7.21.1-2
changelog:
- re-enable test575 on s390(x), already fixed (upstream commit d63bdba)
- modify system headers to work around gcc bug (#617757)
- curl -T now ignores file size of special files (#622520)
- fix kerberos proxy authentication for https (#625676)
- work around glibc/valgrind problem on x86_64 (#626470)


author: Paul Howarth <paul@city-fan.org> 7.21.1-3
changelog:
- fix up patches so there's no need to run autotools in the rpm build
- drop buildreq automake
- drop dependency on automake for devel package from F-14, where
  %{_datadir}/aclocal is included in the filesystem package
- drop dependency on pkgconfig for devel package from F-11, where
  pkgconfig dependencies are auto-generated


author: Kamil Dudka <kdudka@redhat.com> 7.21.2-4
changelog:
- prevent FTP client from hanging on unrecognized ABOR response (#649347)
- return more appropriate error code in case FTP server session idle
  timeout has exceeded (#650255)


author: Kamil Dudka <kdudka@redhat.com> 7.21.2-5
changelog:
- do not send QUIT to a dead FTP control connection (#650255)
- pull back glibc's implementation of str[n]casecmp(), #626470 appears fixed


author: Paul Howarth <paul@city-fan.org> 7.21.3-1
changelog:
- update to 7.21.3:
  - added --noconfigure switch to testcurl.pl
  - added --xattr option
  - added CURLOPT_RESOLVE and --resolve
  - added CURLAUTH_ONLY
  - added version-check.pl to the examples dir
  - check for libcurl features for some command line options
  - Curl_setopt: disallow CURLOPT_USE_SSL without SSL support
  - http_chunks: remove debug output
  - URL-parsing: consider ? a divider
  - SSH: avoid using the libssh2_ prefix
  - SSH: use libssh2_session_handshake() to work on win64
  - ftp: prevent server from hanging on closed data connection when stopping
    a transfer before the end of the full transfer (ranges)
  - LDAP: detect non-binary attributes properly
  - ftp: treat server's response 421 as CURLE_OPERATION_TIMEDOUT
  - gnutls->handshake: improved timeout handling
  - security: pass the right parameter to init
  - krb5: use GSS_ERROR to check for error
  - TFTP: resend the correct data
  - configure: fix autoconf 2.68 warning: no AC_LANG_SOURCE call detected
  - GnuTLS: now detects socket errors on Windows
  - symbols-in-versions: updated en masse
  - added a couple of examples that were missing from the tarball
  - Curl_send/recv_plain: return errno on failure
  - Curl_wait_for_resolv (for c-ares): correct timeout
  - ossl_connect_common: detect connection re-use
  - configure: prevent link errors with --librtmp
  - openldap: use remote port in URL passed to ldap_init_fd()
  - url: provide dead_connection flag in Curl_handler::disconnect
  - lots of compiler warning fixes
  - ssh: fix a download resume point calculation
  - fix getinfo CURLINFO_LOCAL* for reused connections
  - multi: the returned running handles counter could turn negative
  - multi: only ever consider pipelining for connections doing HTTP(S)
- drop upstream patches now in tarball
- update bz650255 and disable-test1112 patches to apply against new codebase
- add workaround for false-positive glibc-detected buffer overflow in tftpd
  test server with FORTIFY_SOURCE (similar to #515361)


author: Kamil Dudka <kdudka@redhat.com> 7.21.4-1
changelog:
- new upstream release
- avoid memory leak on SSL connection failure (upstream commit a40f58d)
- work around valgrind bug (#678518)


author: Kamil Dudka <kdudka@redhat.com> 7.21.7-3
changelog:
- fix SIGSEGV of curl -O -J given more than one URL (#723075)
- introduce the --delegation option of curl (#730444)
- initialize NSS with no database if the selected database is broken (#728562)


author: Paul Howarth <paul@city-fan.org> 7.25.0-1
changelog:
- new upstream release (#806264)
- fix character encoding of docs with a patch rather than just iconv
- update debug and multilib patches
- don't use macros for commands
- reduce size of %prep output for readability


author: Kamil Dudka <kdudka@redhat.com> 7.25.0-2
changelog:
- use NSS_InitContext() to initialize NSS if available (#738456)
- provide human-readable names for NSS errors (upstream commit a60edcc6)


author: Kamil Dudka <kdudka@redhat.com> 7.27.0-3
changelog:
- use the upstream facility to disable problematic tests
- do not crash if MD5 fingerprint is not provided by libssh2


author: Kamil Dudka <kdudka@redhat.com> 7.28.1-2
changelog:
- prevent NSS from crashing on client auth hook failure
- clear session cache if a client cert from file is used
- fix error messages for CURLE_SSL_{CACERT,CRL}_BADFILE


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-3
changelog:
- switch SSL socket into non-blocking mode after handshake (#960765)
- drop the hide_selinux.c hack no longer needed in %check


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-4
changelog:
- do not ignore poll() failures other than EINTR (#919127)
- curl_global_init() now accepts the CURL_GLOBAL_ACK_EINTR flag (#919127)


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-6
changelog:
- prevent an artificial timeout event due to stale speed-check data (#906031)
- show proper host name on failed resolve (#957173)


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-15
changelog:
- allow to use ECC ciphers if NSS implements them (#1058776)
- re-use of wrong HTTP NTLM connection in libcurl (CVE-2014-0015)


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-16
changelog:
- allow to use TLS > 1.0 if built against recent NSS (#1036789)
- use proxy name in error message when proxy is used (#1042831)
- refresh expired cookie in test172 from upstream test-suite (#1063693)


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-20
changelog:
- eliminate unnecessary delay when resolving host from /etc/hosts (#1130239)
- allow to enable/disable new AES cipher-suites (#1066065)
- call PR_Cleanup() on curl tool exit if NSPR is used (#1071254)
- implement non-blocking TLS handshake (#1091429)
- fix limited connection re-use for unencrypted HTTP (#1101092)
- disable libcurl-level downgrade to SSLv3 (#1154060)
- include response headers added by proxy in CURLINFO_HEADER_SIZE (#1161182)
- ignore CURLOPT_FORBID_REUSE during NTLM HTTP auth (#1166264)


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-21
changelog:
- use only full matches for hosts used as IP address in cookies (CVE-2014-3613)
- fix handling of CURLOPT_COPYPOSTFIELDS in curl_easy_duphandle (CVE-2014-3707)


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-23
changelog:
- require credentials to match for NTLM re-use (CVE-2015-3143)
- close Negotiate connections when done (CVE-2015-3148)


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-24
changelog:
- use the default min/max TLS version provided by NSS (#1170339)
- improve handling of timeouts and blocking direction to speed up FTP (#1218272)


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-26
changelog:
- implement 'curl --unix-socket' and CURLOPT_UNIX_SOCKET_PATH (#1263318)
- improve parsing of URL-encoded user name and password (#1260178)
- prevent test46 from failing due to expired cookie (#1258834)


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-28
changelog:
- prevent NSS from incorrectly re-using a session (#1269855)
- call PR_Cleanup() in the upstream test-suite if NSPR is used (#1243324)
- disable unreliable upstream test-case 2032 (#1241168)


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-33
changelog:
- fix re-using connections with wrong client cert (CVE-2016-5420)
- fix TLS session resumption client cert bypass (CVE-2016-5419)


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-34
changelog:
- acknowledge the --no-sessionid/CURLOPT_SSL_SESSIONID_CACHE option
  (required by the fix for CVE-2016-5419)


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-37
changelog:
- fix tight loop in non-blocking TLS handhsake over proxy (#1388162)
- handle cookies with numerical IPv6 address (#1341503)
- make libcurl recognize chacha20-poly1305 and SHA384 cipher-suites (#1374740)
- curl -E: allow to escape ':' in cert nickname (#1376062)
- run automake in %prep to avoid patching Makefile.in files from now on


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-43
changelog:
- curl --socks5-{basic,gssapi}: control socks5 auth (#1409208)
- nss: fix a memory leak when CURLOPT_CRLFILE is used (#1427883)
- nss: do not leak PKCS #11 slot while loading a key (#1444860)
- nss: fix a possible use-after-free in SelectClientCert() (#1473158)


author: Kamil Dudka <kdudka@redhat.com> - 7.29.0-48
changelog:
- fix RTSP bad headers buffer over-read (CVE-2018-1000301)
- fix FTP path trickery leads to NIL byte out of bounds write (CVE-2018-1000120)
- fix LDAP NULL pointer dereference (CVE-2018-1000121)
- fix RTSP RTP buffer over-read (CVE-2018-1000122)
- http: prevent custom Authorization headers in redirects (CVE-2018-1000007)
- doc: --tlsauthtype works only if built with TLS-SRP support (#1542256)
- update certificates in the test-suite because they expire soon (#1572723)


author: Kamil Dudka <kdudka@redhat.com> - 7.29.0-50
changelog:
- remove dead code, detected by Coverity Analysis
- remove unused variable, detected by GCC and Clang


author: Kamil Dudka <kdudka@redhat.com> - 7.29.0-52
changelog:
- prevent curl --rate-limit from hanging on file URLs (#1281969)
- fix NTLM password overflow via integer overflow (CVE-2018-14618)
- fix bad arithmetic when outputting warnings to stderr (CVE-2018-16842)
- backport options to force TLS 1.3 in curl and libcurl (#1672639)
- prevent curl --rate-limit from crashing on https URLs (#1683292)


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.29.0-59.1.tuxcare.els2
changelog:
- CVE-2022-27782: check additional TLS or SSH connection parameters that should
  have prohibited connection reuse
- CVE-2023-27534: fix SFTP path '~' resolving discrepancy
- fix read off end of array for SCP home directory case


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 7.29.0-59.2.tuxcare.els1
changelog:
- Moved tuxcare patches from 7.29.0-59.1.tuxcare.els2
- CVE-2023-38546: cookie: remove unnecessary struct fields
- CVE-2022-27782: check additional TLS or SSH connection parameters that should
  have prohibited connection reuse
- CVE-2023-27534: fix SFTP path '~' resolving discrepancy
- fix read off end of array for SCP home directory case


author: Jakub Jelen <jjelen@redhat.com> 2.1.26-18
changelog:
- Revert updated GSSAPI flags as in RFC 4752 to restore backward compatibility (#1154566)
- Add and document ability to run saslauth as non-root user (#1188065)
- Support AIX SASL GSSAPI (#1174322)
- Update client library to be thread safe (#1147659)
- Fix problem, that parsing short prefix matches the whole mechanism name (#1089267)
- Don't use unnecessary quotes around user description (#1082564)
- Fix confusing message when config file has typo (#1022479)


author: Jai S <jsathyapalan@cloudlinux.com> - 2.1.26-24.tuxcare.els1
changelog:
- CVE-2019-19906: fix out-of-bounds write leading to unauthenticated
  remote denial-of-service in OpenLDAP via a malformed LDAP packet


author: Petr Menšík <pemensik@redhat.com> - 2.76-16.1
changelog:
- Accept responses only on correct sockets (CVE-2020-25684)
- Use strong verification on queries (CVE-2020-25685)
- Handle multiple identical DNS queries better (CVE-2020-25686)
- Link against nettle for sha256 hash implementation


author: Thomas Woerner <twoerner@redhat.com> 1.38-1
changelog:
- new version 1.38
- Close File descriptor for unregognized devices (#159878)
  Thanks to David Milburn for the patch.
  Merged from RHEL-4
- enable tune2fs to set and clear feature resize_inode (#167816)
- removed outdated information from ext2online man page (#164383)


author: Thomas Woerner <twoerner@redhat.com> 1.38-2
changelog:
- splitted up libs from main package, into a new e2fsprogs-libs package
- fixed requires and prereqs


author: Thomas Woerner <twoerner@redhat.com> 1.38-2.1
changelog:
- fixed file conflicts between 32bit and 64bit packages (#168815)
- fixed mklost+found crashes with buffer overflow (#157773)
  Thanks to Arjan van de Ven for the patch


author: Thomas Woerner <twoerner@redhat.com> - 1.39-1
changelog:
- new version 1.39
- dropped ext2online, because resize2fs is now able to do online resize
- spec file cleanup
- enabled checks for build


author: Eric Sandeen <esandeen@redhat.com> 1.39-14
changelog:
- Many coverity-found potential leaks, segfaults, etc (#239354)
- Fix debugfs segfaults when no fs open (#208416, #209330)
- Avoid recursive loops in logdump due to symlinks in /dev (#210371)
- Don't write changes to the backup superblocks by default (#229561)
- Correct byteswapping for fast symlinks with xattrs (#232663)
- e2fsck: added sanity check for xattr validation (#230193)


author: Eric Sandeen <esandeen@redhat.com> 1.40.2-3
changelog:
- Update license tags
- Fix one open-create caller with no mode
- Protect ->open ops from glibc open-create-mode-checker
- Fix source URL
- Add gawk to BuildRequires


author: Eric Sandeen <esandeen@redhat.com> 1.40.2-10
changelog:
- Make (more) file timestamps match those in tarball for multilib tidiness 
- Fix e2fsprogs-libs summary (shared libs not static)


author: Eric Sandeen <esandeen@redhat.com> 1.40.2-12
changelog:
- Use upstream patch for blkid fat detection, avoids div-by-zero
  when encountering some BSD partitions (#398281)


author: Stepan Kasal <skasal@redhat.com> 1.40.2-13
changelog:
- The -devel package now requires device-mapper-devel, to match
  the dependency in blkid.pc (#410791)


author: Eric Sandeen <esandeen@redhat.com> 1.40.2-15
changelog:
- Drop resize_inode removal patch from tune2fs; ostensibly was
  for old kernels which could not mount, but seems to be fine.
- Drop pottcdate removal patch, and don't rebuild .po files,
  causes multilib problems and we generally shouldn't rebuild.
- Drop multilib patch; wrapper header should take care of this now.
- Drop ->open rename, Fedora seems ok with this now.


author: Eric Sandeen <sandeen@redhat.com> 1.40.4-7
changelog:
- Fix sb flag comparisons properly this time (#428893)
- Make 256-byte inodes for the [default] mkfs case.
  This will facilitate upgrades to ext4 later, and help xattr perf.


author: Eric Sandeen <esandeen@redhat.com> 1.40.7-1
changelog:
- New upstream version, special leap-day edition
- Fix resize2fs losing inline xattrs when shrinking (#434893)
  and add patch to fix swap_inode_full in this case
- Allow mke2fs & tune2fs to manipulate large_file feature (#258381)
- Handle lvm error conditions in libblkid (#433857)
- Allow tune2fs to clear the resize_inode feature (#167816)
- Teach blkid to detect LVM2 physical volumes (#409321)
- Show "mostly printable" xattrs as text in debugfs (#430621)
- Trimmed pre-1.38 rpm changelog entries


author: Eric Sandeen <esandeen@redhat.com> 1.40.8-2
changelog:
- Update ext2fs_swap_inode_full() fix to match upstream
- Check more of swapv1 header in blkid detection (#442937)


author: Eric Sandeen <sandeen@redhat.com> 1.41.2-1
changelog:
- New upstream version
- Updated default dir hash (half_md4) for better perf & fewer collisions
- Fixed ext4 online resizing with flex_bg
- ext4 journal now in extents format and in middle of filesystem
- fix unreadable e2image files
- fix file descriptor leak in libcom_err (#464689)


author: Eric Sandeen <sandeen@redhat.com> 1.41.3-3
changelog:
- Remove conservative "don't change journal location" patch for F11
- Add btrfs recognition to blkid


author: Eric Sandeen <sandeen@redhat.com> 1.41.4-4
changelog:
- Edit summary & description to include ext4 (#487469)
- Fix blkid null ptr deref in initrd (#486997)


author: Karel Zak <kzak@redhat.com> 1.41.6-3
changelog:
- temporary use BuildRequires: e2fsprogs-devel (we cannot install 
  new util-linux-ng with libblkid to buildroots without new e2fsprogs 
  without libblkid).


author: Eric Sandeen <sandeen@redhat.com> 1.41.6-5
changelog:
- Update journal backup blocks in sb after resize (#505339)
- Fix memory leak in extent handling functions
- Fix bug in inode writing in extent code, clobbered i_extra_isize etc


author: Eric Sandeen <sandeen@redhat.com> 1.41.9-8
changelog:
- Fix up topology patch to build w/ new util-linux-ng
- Fix endian swapping of backup journal blocks in sb


author: Eric Sandeen <sandeen@redhat.com> 1.41.9-9
changelog:
- Fix up stray output & re-enable make check
- Fix dlopen issues for newer libreadline
- Fix access beyond end of array in resize2fs


author: Eric Sandeen <sandeen@@redhat.com> 1.42.2-5
changelog:
- Add broken system clock config to e2fsck.conf to let boot
  continue even if system clock very wrong.


author: Lukas Czerner <lczerner@redhat.com> - 1.42.9-4
changelog:
- Fix posisble use after free in some error paths (#997982)
- Enable lazy_itable_init even if ext4 module is not loaded (#1071909)
- Remove any ocurence of ext4dev and test_fs from e2fsprogs (#1063801)
- Allow to resize ext4 file system past 16TB (#982871)
- Disable altivec instructions for libext2fs on ppc (#1074604)


author: Eric Sandeen <sandeen@redhat.com> 1.42.9-5
changelog:
- Various manpage updates for chattr and mount (#1053885)
- Fix resize2fs -P hang on corrupted filesystems (#1104612)


author: Eric Sandeen <sandeen@redhat.com> 1.42.9-8
changelog:
- e4defrag: backwards-allocated files should be defragmented (#1176785)
- tune2fs: allow removal of dirty journal with two "-f" options (#1212376)
- mke2fs: prevent creation of filesystem with unsupported revision (#1212378)
- libext2fs: prevent buffer overflows (#1293677)


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-10
changelog:
- libext2fs: don't ignore fsync errors (#1405049)
- Fix nroff macro issue in chattr man page (#1429213)


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-11
changelog:
- libext2fs: skip start_blk adjustment when stride and flex_bg is set (#1503969)
- tune2fs: edit dire warning about check intervals (#1433233)


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-13
changelog:
- e2fsck: warn if checkinterval and broken_system_clock both set (#1365594)
- e2fsprogs: fail to open 1k block size ext4 with bigalloc,meta_bg,^resize_inode (#1448019)


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-14
changelog:
- Various fixes and improvements (#1682935)
- Automatically enable meta_bg to avoid failure when creating huge fs with small bs (#1608635)
- don't ignore fsync errors in filefrag (#1451185)


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-18
changelog:
- fix out-of-bounds write on corrupted fs (#1797731)
- fix out-of-bounds write on corrupted fs (#1768710)
- fix e2fsprogs creating corrupted meta image (#1711880)
- fix typo in ext4 man page (#1720130)
- provide easy metod for creating compatible rhel6 fs (#1780277)
- better handling of trivial dir link count problem (#1820048)


author: Jan Synáček <jsynacek@redhat.com> - 1:24.3-21
changelog:
- fix libjpeg detection fails with gcc7 (#1487557)
- fix Emacs GUI Toolbar icons missing (#1477745)
- fix hardening: TLS certificate warnings should be hard errors (#1403643)


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-16
changelog:
- Remove EL-5 settings and old Fedora conditionals.
  Taken from fedora commits 903d8f35ed8ae16bece8ae8033f3d3926cc97595 and
  2c6eff99d7b50b87e8a1fe2e4a0489dfd90659b8.
- Fix builds using '--without docs'
- Change git-instaweb default from lighttpd(not available in rhel7) to
  apache2.
- Add requires for git-{instaweb,gnome-keyring} to pull them, when
  installing git-all.


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-17
changelog:
- Correctly return an error from fsck on encountering a .gitmodules symlink.
  This was broken in the debian 2.1.x backport and found by covscan.
  Fix the test to catch this.
- Correct a typo in changelog.


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-19
changelog:
- Fix httpd modules path to be independent from system architecture.
Upstream commit: 1976311aa285549599e5a451d7ad72b55a2b60e2
Resolves: #1213059


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-20
changelog:
- Fix CVE-2018-17456: arbitrary code execution via .gitmodules
  Thanks to Jonathan Nieder <jrnieder@gmail.com> for backporting to 2.1.x
  and to Steve Beattie <sbeattie@ubuntu.com> for backporting to 1.9.1


author: Ondrej Pohorelsky <opohorel@redhat.com> - 1.8.3.1-21
changelog:
- Fix CVE-2019-1387: remote code execution in recursive clones with nested
  submodules
  Resolves: CVE-2019-1387


author: Vít Ondruch <vondruch@redhat.com> - 1.8.3.1-23
changelog:
- Prevent crafted URL containing new lines, empty host or lacks a scheme
  to cause credential leak.
  Resolves: CVE-2020-11008


author: Linar Nadeev <lnadeev@cloudlinux.com> - 1.8.3.1-25.tuxcare.els1
changelog:
- CVE-2021-40330: forbid newlines in host and path in git_connect()
- CVE-2022-39260: shell - limit size of interactive commands


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 1.8.3.1-25.tuxcare.els3
changelog:
- CVE-2024-32004: detect dubious ownership of local repositories,
  backport the necessary functions


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 1.8.3.1-25.tuxcare.els5
changelog:
- CVE-2025-27613: fix issue where untrusted repositories could create and
  truncate files, with the fix implemented in versions 2.43.7 and later


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.96-2
changelog:
- Fixed "tainted search query is not properly quoted" for greylisting,
  patch provided by Marcel Härry <mh+fedora@scrit.ch>


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.96.1-1
changelog:
- New version
  Resolves: rhbz#2241735
  Resolves: rhbz#2241538
  Resolves: rhbz#2241540
  Resolves: rhbz#2241525
  Resolves: rhbz#2241526
  Resolves: rhbz#2241528
  Resolves: rhbz#2241530
  Resolves: rhbz#2241531
  Resolves: rhbz#2241533
  Resolves: rhbz#2241542
  Resolves: rhbz#2241543


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.97.1-1
changelog:
- New version
  Resolves: rhbz#2256145
- Fixed SMTP smuggling vulnerability
  Resolves: CVE-2023-51766


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 4.97.1-1.tuxcare.els1
changelog:
- CVE-2024-39929: fix incorrectly parsing MIME parses filenames that are specified
  using multiple parameters


author: Joe Orton <jorton@redhat.com> 1.95.8-9
changelog:
- regenerate configure/libtool correctly (#199361)
- strip DSP files from examples (#186889)
- fix expat.h compilation with g++ -pedantic (#190244)


author: Joe Orton <jorton@redhat.com> 1.95.8-10
changelog:
- remove trailing dot in Summary (#225742)
- use preferred BuildRoot per packaging guidelines (#225742)


author: Joe Orton <jorton@redhat.com> - 2.0.1-8
changelog:
- add security fix for CVE-2009-3560 (#533174)
- add security fix for CVE-2009-3720 (#531697)
- run the test suite


author: Tomas Korbar <tkorbar@redhat.com> - 2.1.0-13
changelog:
- Fix multiple CVEs
- CVE-2022-23852 expat: integer overflow in function XML_GetBuffer
- CVE-2021-45960 expat: Large number of prefixed XML attributes on a single tag can crash libexpat
- CVE-2021-46143 expat: Integer overflow in doProlog in xmlparse.c
- CVE-2022-22827 Integer overflow in storeAtts in xmlparse.c
- CVE-2022-22826 Integer overflow in nextScaffoldPart in xmlparse.c
- CVE-2022-22825 Integer overflow in lookup in xmlparse.c
- CVE-2022-22824 Integer overflow in defineAttribute in xmlparse.c
- CVE-2022-22823 Integer overflow in build_model in xmlparse.c
- CVE-2022-22822 Integer overflow in addBinding in xmlparse.c
- Resolves: CVE-2022-23852
- Resolves: CVE-2021-45960
- Resolves: CVE-2021-46143
- Resolves: CVE-2022-22827
- Resolves: CVE-2022-22826
- Resolves: CVE-2022-22825
- Resolves: CVE-2022-22824
- Resolves: CVE-2022-22823
- Resolves: CVE-2022-22822


author: Tomas Korbar <tkorbar@redhat.com> - 2.1.0-14
changelog:
- Fix multiple CVEs
- CVE-2022-25236 expat: namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
- CVE-2022-25235 expat: malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
- CVE-2022-25315 expat: integer overflow in storeRawNames()
- Resolves: CVE-2022-25236
- Resolves: CVE-2022-25235
- Resolves: CVE-2022-25315


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> 2.1.0-15.tuxcare.els1
changelog:
- CVE-2022-23990: lib: prevent integer overflow in function doProlog
- CVE-2022-43680: fix overeager DTD destruction in
  XML_ExternalEntityParserCreate


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.1.0-15.tuxcare.els2
changelog:
- CVE-2024-45490: Reject negative length for XML_ParseBuffer in xmlparse.c
- CVE-2024-45491: Detect integer overflow in dtdCopy on 32-bit platforms
- CVE-2024-45492: Detect integer overflow in nextScaffoldPart on 32-bit platforms


author: Ondrej Holy <oholy@redhat.com> - 2.0.0-4.rc4
changelog:
- CVE-2020-11521: Fix out-of-bounds write in planar.c (#1837621)
- CVE-2020-11523: Fix integer overflow in region.c (#1837622)
- CVE-2020-11524: Fix out-of-bounds write in interleaved.c (#1837623)


author: Linar Nadeev <lnadeev@cloudlinux.com> - 2:2.2.0-5.tuxcare.els1
changelog:
- CVE-2023-39352: add bound check in gdi_SolidFill
- CVE-2023-39353: check indices are within range
- CVE-2023-39356: fix checks for multi opaque rect
- CVE-2023-40181: fix cBitsRemaining calculation
- CVE-2023-40186: fix integer multiplications
- CVE-2023-40188: fix input length validation
- CVE-2023-40567: fix missing bounds checks
- CVE-2023-40569: fix missing destination checks
- CVE-2024-22211: check resolution for overflow
- CVE-2023-39351: free content of currentMessage on fail
- CVE-2023-39350: fix possible out of bound read
- CVE-2023-40589: properly verify all offsets while decoding data


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.1.1-5.tuxcare.els3
changelog:
- CVE-2024-32660: fix a bug when a malicious server can crash the FreeRDP
  client by sending invalid huge allocation size
- CVE-2024-32661: fix possible incorrect access
- CVE-2024-32659: fix out-of-bounds read
- fix typos in changelog


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 2.1.1-5.tuxcare.els4
changelog:
- CVE-2024-32458: fix missing input length checks
- CVE-2024-32459: fix missing input length check
- CVE-2024-32460: fix out-of-bound read in interleaved_decompress
- CVE-2024-32039: fix integer overflow
- CVE-2024-32040: fix missing check
- CVE-2024-32041: fix integer overflow


author: Cristian Gafton <gafton@redhat.com>
changelog:
- call libtoolize to sanitize config.sub and get ARM support
- dispoze of the patch (not necessary anymore)


author: Preston Brown <pbrown@redhat.com>
changelog:
- newer ttmkfdir that works better, moved ttmkfdir to /usr/bin from /usr/sbin
- freetype utilities moved to subpkg, X dependency removed from main pkg
- libttf.so symlink moved to devel pkg


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- libtool is used to build libttf, so use libtool to link ttmkfdir with it
- fixup a paths for a couple of missing docs


author: Mike A. Harris <mharris@redhat.com> 2.0.3-1
changelog:
- Updated to Freetype 2.0.3, minor specfile tweaks.
- Freetype2 docs are is in a separate tarball now. Integrated it.
- Built in new environment.


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.3-3
changelog:
- Change "Requires: freetype = name/ver" to "freetype = version/release",
  and move the requirements to the subpackages.


author: Bernhard Rosenkraenzer <bero@redhat.com> 2.0.3-4
changelog:
- Add ft2build.h to -devel package, since it's included by all other
  freetype headers, the package is useless without it


author: Mike A. Harris <mharris@redhat.com> 2.0.4-2
changelog:
- Added new subpackage freetype-demos, added demos to build
- Disabled ftdump, ftlint in utils package favoring the newer utils in
  demos package.


author: Elliot Lee <sopwith@redhat.com> 2.0.5-3
changelog:
- Fix bug #56901 (ttmkfdir needed to list Unicode encoding when generating
  font list). (ttmkfdir-iso10646.patch)
- Use _smp_mflags macro everywhere relevant. (freetype-pre1.4-make.patch)
- Undo fix for #24253, assume compiler was fixed.


author: Mike A. Harris <mharris@redhat.com> 2.0.6-2
changelog:
- Made ttmkfdir inclusion conditional, and set up a define to include
  ttmkfdir in RHL 7.x builds, since ttmkfdir is now moving to the new
  XFree86-font-utils package.


author: Tim Powers <timp@redhat.com> 2.0.6-3
changelog:
- bumping release so that we don't collide with another build of
  freetype, make sure to change the release requirement in the XFree86
  package


author: Mike A. Harris <mharris@redhat.com> 2.0.8-2
changelog:
- Updated to freetype 2.0.8, however docs and demos are stuck at 2.0.7
  on the freetype website.  Munged specfile to deal with the problem by using
  {oldversion} instead of version where appropriate.  <sigh>


author: Mike A. Harris <mharris@redhat.com> 2.1.2-10
changelog:
- Attempted to fix lib64 issue in freetype-demos build with X11_LINKLIBS
- Cleaned up various _foodir macros throughtout specfile
- Removed with_ttmkfdir build option as it is way obsolete


author: Mike A. Harris <mharris@redhat.com> 2.1.3-2
changelog:
- Update to freetype 2.1.3
- Removed ttmkfdir sources and patches, as they have been moved from the
  freetype packaging to XFree86 packaging, and now to the ttmkfdir package
- Removed patches that are now included in 2.1.3:
  freetype-2.1.1-primaryhints.patch, freetype-2.1.2-slighthint.patch,
  freetype-2.1.2-bluefuzz.patch, freetype-2.1.2-stdw.patch,
  freetype-2.1.2-transform.patch, freetype-2.1.2-autohint.patch,
  freetype-2.1.2-leftright.patch
- Conditionalized inclusion of freetype 1.4 library.


author: Owen Taylor <otaylor@redhat.com> 2.1.3-4
changelog:
- Make FreeType robust against corrupt fonts with recursive composite 
  glyphs (#74782, James Antill)


author: Elliot Lee <sopwith@redhat.com> 2.1.3-7
changelog:
- Run libtoolize/aclocal/autoconf so that libtool knows to generate shared libraries 
  on ppc64.
- Use _smp_mflags (for freetype 2.x only)


author: Owen Taylor <otaylor@redhat.com> 2.1.4-1
changelog:
- Version 2.1.4
- Relibtoolize to get deplibs right for x86_64
- Use autoconf-2.5x for freetype-1.4 to fix libtool-1.5 compat problem (#91781)
- Relativize absolute symlinks to fix the -debuginfo package 
  (#83521, Mike Harris)


author: Florian La Roche <Florian.LaRoche@redhat.de>
changelog:
- allow compiling without the demos as that requires XFree86
  (this allows bootstrapping XFree86 on new archs)


author: Mike A. Harris <mharris@redhat.com> 2.1.7-3
changelog:
- Added -fno-strict-aliasing to CFLAGS and CXXFLAGS to try to fix SEGV and
  SIGILL crashes in mkfontscale which have been traced into freetype and seem
  to be caused by aliasing issues in freetype macros (#118021)


author: Owen Taylor <otaylor@redhat.com> 2.1.7-4
changelog:
- Add patch from freetype CVS to fix problem with eexec (#117743)
- Add freetype-devel to buildrequires and -devel requires
  (Maxim Dzumanenko, #111108)


author: Owen Taylor <otaylor@redhat.com> - 2.1.9-1
changelog:
- Upgrade to 2.1.9
- Since we are just using automake for aclocal, use it unversioned,
  instead of specifying 1.4.


author: Behdad Esfahbod <besfahbo@redhat.com> 2.2.1-1
changelog:
- Update to 2.2.1
- Remove FreeType 1, to move to extras
- Install new demos ftbench, ftchkwd, ftgamma, and ftvalid
- Enable modules gxvalid and otvalid


author: Behdad Esfahbod <besfahbo@redhat.com> 2.2.1-10
changelog:
- Fix crasher https://bugs.freedesktop.org/show_bug.cgi?id=6841
- Add freetype-2.2.1-memcpy-fix.patch


author: Behdad Esfahbod <besfahbo@redhat.com> 2.2.1-16
changelog:
- Backport binary-search fixes from HEAD
- Add freetype-2.2.1-ttcmap.patch
- Resolves: #208734

- Fix rendering issue with some Asian fonts.
- Add freetype-2.2.1-fix-get-orientation.patch
- Resolves: #207261

- Copy non-X demos even if not compiling with_xfree86.

- Add freetype-2.2.1-zero-item-size.patch, to fix crasher.
- Resolves #214048

- Add X11_PATH=/usr to "make"s, to find modern X.
- Resolves #212199


author: Behdad Esfahbod <besfahbo@redhat.com> 2.3.0-1
changelog:
- Update to 2.3.0.
- Drop upstream patches.
- Drop -fno-strict-aliasing, it should just work.
- Fix typo in ftconfig.h generation.


author: Behdad Esfahbod <besfahbo@redhat.com> 2.3.5-2
changelog:
- Change spec file to permit enabling bytecode-interpreter and
  subpixel-rendering without editing spec file.
- Resolves: 249986


author: Behdad Esfahbod <besfahbo@redhat.com> 2.3.7-3
changelog:
- Add full source URL to Source lines.
- Add docs to main and devel package.
- rpmlint is happy now.
- Resolves: #225770


author: Behdad Esfahbod <besfahbo@redhat.com> 2.3.9-2
changelog:
- Add Provides: freetype-bytecode and freetype-subpixel if built
  with those options.
- Resolves: #155210


author: Behdad Esfahbod <behdad@redhat.com> 2.3.11-1
changelog:
- Update to 2.3.11.
- Add freetype-2.3.11-more-demos.patch
- New demo programs ftmemchk, ftpatchk, and fttimer


author: Marek Kasik <mkasik@redhat.com> 2.4.3-2
changelog:
- Add freetype-2.4.3-CVE-2010-3855.patch
    (Protect against invalid `runcnt' values.)
- Resolves: #651764


author: Marek Kasik <mkasik@redhat.com> 2.4.4-3
changelog:
- Enable bytecode interpreter (#547532).
- Fall back to autohinting if a TTF/OTF doesn't contain any bytecode.


author: Marek Kasik <mkasik@redhat.com> 2.4.5-2
changelog:
- Add freetype-2.4.5-CVE-2011-0226.patch
    (Add better argument check for `callothersubr'.)
    - based on patches by Werner Lemberg,
      Alexei Podtelezhnikov and Matthias Drochner
- Resolves: #723469


author: Marek Kasik <mkasik@redhat.com> - 2.4.11-3
changelog:
- Fix emboldening:
    - split out MSB function
    - fix integer overflows
    - fix broken emboldening at small sizes
- Resolves: #891457


author: Marek Kasik <mkasik@redhat.com> - 2.4.11-11
changelog:
- Fixes CVE-2014-9657
   - Check minimum size of `record_size'.
- Fixes CVE-2014-9658
   - Use correct value for minimum table length test.
- Fixes CVE-2014-9675
   - New macro that checks one character more than `strncmp'.
- Fixes CVE-2014-9660
   - Check `_BDF_GLYPH_BITS'.
- Fixes CVE-2014-9661
   - Initialize `face->ttf_size'.
   - Always set `face->ttf_size' directly.
   - Exclusively use the `truetype' font driver for loading
     the font contained in the `sfnts' array.
- Fixes CVE-2014-9663
   - Fix order of validity tests.
- Fixes CVE-2014-9664
   - Add another boundary testing.
   - Fix boundary testing.
- Fixes CVE-2014-9667
   - Protect against addition overflow.
- Fixes CVE-2014-9669
   - Protect against overflow in additions and multiplications.
- Fixes CVE-2014-9670
   - Add sanity checks for row and column values.
- Fixes CVE-2014-9671
   - Check `size' and `offset' values.
- Fixes CVE-2014-9673
   - Fix integer overflow by a broken POST table in resource-fork.
- Fixes CVE-2014-9674
   - Fix integer overflow by a broken POST table in resource-fork.
   - Additional overflow check in the summation of POST fragment lengths.
- Work around behaviour of X11's `pcfWriteFont' and `pcfReadFont' functions
- Resolves: #1197740


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 2.8-14.1.tuxcare.els1
changelog:
- CVE-2022-27404: Fix buffer overflow in sfnt_init_face
- CVE-2022-27405: Fix segmentation violation via FNT_Size_Request
- CVE-2022-27406: Fix segmentation violation via FT_Request_Size


author: Martin Bříza <mbriza@redhat.com> - 4.0.1-1
changelog:
- Update to upstream 4.0.1 (#808005)
- Corrected Source0 link to .tar.gz extension as not all releases are available as .tar.bz2
- Resolves #724817 - gawk-4.0.0 regression in '\' escape handling in gsub()
- Resolves #820550 - gawk: getline in BEGIN skips 2 lines


author: Dmitrii Zudin <dzudin@cloudlinux.com> - 4.0.2-4.el7_3.1.tuxcare.els1
changelog:
- Fix CVE-2023-4156: builtin.c (format_tree): When collecting positional field
  widths or precisions, check for wrap around to negative values.


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 2.36.12-3.tuxcare.els1
changelog:
- CVE-2025-7345: fix heap buffer overflow during base64 encoding in
  gdk_pixbuf__jpeg_image_load_increment()


author: Robert Scheck <robert@fedoraproject.org> 4.1.6-2
changelog:
- Solved multilib problems with documentation (#465208, #474538)
- Removed static library from giflib-devel package (#225796 #c1)


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 2.56.1-9.tuxcare.els1
changelog:
- CVE-2021-27218: gbytearray: Do not accept too large byte arrays
- Enable internal tests
- Skip several failed tests from the check


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 2.56.1-9.tuxcare.els2
changelog:
- CVE-2023-29499: Fix GVariant offset table entry size which is not checked
  in is_normal()
- CVE-2023-32611: Fix an issue where g_variant_byteswap() can take a long time
  with some non-normal inputs
- CVE-2023-32665: Fix GVariant deserialisation which does not match spec
  for non-normal data
- CVE-2023-32636: Fix a wrong timeout in fuzz_variant_text()
- CVE-2023-32643: Fix a heap-buffer-overflow in g_variant_serialised_get_child()
- Fix g_test_bug assertion in gvariant test


author: Carlos O'Donell <carlos@redhat.com> - 2.17-321
changelog:
- CVE-2020-10029: Prevent stack corruption from crafted input in cosl, sinl,
  sincosl, and tanl function. (#1812119)


author: Florian Weimer <fweimer@redhat.com> - 2.17-325
changelog:
- Support /etc/sysconfig/strcasecmp-nonascii for enabling non-ASCII case
  conversion in strcasecmp, strncasecmp (#1993930)


author: Florian Weimer <fweimer@redhat.com> - 2.17-326.2
changelog:
- nscd: Do not use sendfile for the netgroup cache
- nscd: Use-after-free in netgroup cache
- CVE-2021-27645: nscd: double-free in netgroup cache
- CVE-2024-33599: nscd: buffer overflow in netgroup cache (RHEL-34263)
- CVE-2024-33600: nscd: null pointer dereferences in netgroup cache
- CVE-2024-33601: nscd: crash on out-of-memory condition
- CVE-2024-33602: nscd: memory corruption with NSS netgroup modules


author: Linar Nadeev <lnadeev@cloudlinux.com> - 2.17-326.3.tuxcare.els1
changelog:
- CVE-2021-3999: getcwd - Set errno to ERANGE for size == 1
- CVE-2021-35942: wordexp - handle overflow in positional parameter number
- CVE-2022-23218: Buffer overflow in sunrpc svcunix_create
- CVE-2022-23219: Buffer overflow in sunrpc clnt_create for "unix"


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 2.17-326.99.tuxcare.els1
changelog:
- CVE-2025-4802: prevent untrusted LD_LIBRARY_PATH from loading
  dynamically shared libraries in statically compiled binaries that call
  dlopen


author: Marc Ewing <marc@redhat.com>
changelog:
- started with package from Toshio Kuratomi <toshiok@cats.ucsc.edu>
- cleaned up file list
- fixed up install-info support


author: Michael Johnson <johnsonm@redhat.com>
changelog:
- include the private header file gmp-mparam.h because several
  apps seem to assume that they are building against the gmp
  source tree and require it.  Sigh.


author: Jakub Jelinek <jj@ultra.linux.cz>
changelog:
- merge in some debian gmp fixes
- Ulrich Drepper's __gmp_scale2 fix
- my mpf_set_q fix
- sparc64 fixes


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- switch to the configure and makeinstall macros
- FHS-compliance fixing
- move docs to non-devel package


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
- Fixed bugzilla bug #25515 where GMP wouldn't work on IA64 as IA64 is not
correctly identified as a 64 bit platform.


author: Trond Eivind Glomsrød <teg@redhat.com> 4.1-3
changelog:
- Redefine the configure macro, the included configure 
  script isn't happy about the rpm default one (#68190). Also, make
  sure the included libtool isn't replaced,


author: Florian La Roche <Florian.LaRoche@redhat.de>
changelog:
- enable mpfr  #104395
- enable cxx  #80195
- add COPYING.LIB
- add fixes from gmp web-site
- remove some cruft patches for older libtool releases


author: Jakub Jelinek <jakub@redhat.com> 4.1.4-11
changelog:
- make sure libmpfr.a doesn't contain SSE2 instructions on i?86 (#222371)
- rebase to mpfr 2.2.1 from 2.2.0 + cumulative fixes


author: Karsten Hopp <karsten@redhat.com> 4.1.4-12
changelog:
- remove trailing dot from summary
- fix buildroot
- fix post/postun/... requirements
- use make install DESTDIR=...
- replace tabs with spaces
- convert changelog to utf-8


author: Ivana Varekova <varekova@redhat.com> 4.2.1-1
changelog:
- update to 4.2.1
- do some spec cleanups
- fix 238794 - gmp-devel depends on {version} but not on 
  {version}-{release}
- remove mpfr (moved to separate package)


author: Peter Schiffer <pschiffe@redhat.com> 1:5.0.2-1
changelog:
- resolves: #702919
  update to 5.0.2
- resolves: #738091
  removed unused direct shlib dependency on libm
  updated license in gmp.h and gmp-mparam.h files


author: Frantisek Kluknavsky <fkluknav@redhat.com> - 1:5.1.0-1
changelog:
- rebase to 5.1.0, de-ansi patch no longer applicable
- upstream dropped libmp.so (bsdmp-like interface)
- silenced bogus date in changelog


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 1:6.0.0-13
changelog:
- Explicitly added '-g' option into CFLAGS & CXXFLAGS to correctly build .debug_info for i386 (bug #1413034)
- Added a workaround to correctly add hardening flags during build process (bug #1406689)


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 3.29.3-34.tuxcare.els1
changelog:
- CVE-2024-36472: fix portal helper from launching automatically based on
  network responses to prevent loading untrusted JavaScript code


author: Jeff Johnson <jbj@redhat.com> 1.0.20-1
changelog:
- update to 1.0.20.
- add --with-included-opencdk --with-included-libtasn1
- add --with-included-libcfg --with-included-lzo
- add --disable-srp-authentication.
- do "make check" after build.


author: Tomas Mraz <tmraz@redhat.com> 1.4.5-2
changelog:
- properly require install-info (patch by Ville Skyttä)
- standard buildroot and use dist tag
- add COPYING and README to doc


author: Tomas Mraz <tmraz@redhat.com> 2.4.1-1
changelog:
- new upstream version
- correct the license tag
- explicit --with-included-opencdk not needed
- use external lzo library, internal not included anymore


author: Tomas Mraz <tmraz@redhat.com> 2.8.5-3
changelog:
- drop superfluous rpath from binaries
- do not call autoreconf during build
- specify the license on utils subpackage


author: Tomas Mraz <tmraz@redhat.com> 2.12.7-2
changelog:
- fix problem when using new libgcrypt
- split libgnutlsxx to a subpackage (#455146)
- drop libgnutls-openssl (#460310)


author: Tomas Mraz <tmraz@redhat.com> 2.12.22-2
changelog:
- rebuilt with new libtasn1
- make guile bindings optional - breaks i686 build and there is
  no dependent package


author: Tomas Mraz <tmraz@redhat.com> 3.1.7-1
changelog:
- new upstream version, requires rebuild of dependencies
- this release temporarily includes old compatibility .so


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.7-1
changelog:
- new upstream release (#1110696)
- allow DSA/DH key generation with 1024 when not in FIPS140-2 mode (#1132705)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-4
changelog:
- reverted change to use the p11-kit certificate storage (#1110750)
- added functions to test DH/ECDH in FIPS-140-2 mode and fixed
  RSA key generation (#1110696)
- added manual dependencies on libtasn1 3.8 as well as p11-kit 0.20.7
- fixed SHA224 in SSSE3 optimized code
- fixed issue with handshake buffer resets (#1153106)
- fixed issue in RSA key generation with specific seeds in FIPS140-2 mode


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-9
changelog:
- Amended fix for FIPS enforcement issue (#1163848)
- Fixed issue with applications that close all file descriptors (#1165047)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-11
changelog:
- Applied fix for urandom FD in FIPS140 mode (#1165047)
- Applied fix for FIPS140-2 related regression (#1110696)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-13
changelog:
- Corrected reseed and respect of max_number_of_bits_per_request in 
  FIPS140-2 mode. Also enhanced the initial tests. (#1228199)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.24-1
changelog:
- Addressed issue with DSA public keys smaller than 2^1024 (#1238279)
- Addressed two-byte buffer overflow in the DTLS-0.9 protocol (#1209365)
- When writing certificates to smart cards write the CKA_ISSUER and
  CKA_SERIAL_NUMBER fields to allow NSS reading them (#1272179)
- Use the shared system certificate store (#1110750)
- Address MD5 transcript collision attacks in TLS key exchange (#1289888, 
  CVE-2015-7575)
- Allow hashing data over 2^32 bytes (#1306953)
- Ensure written PKCS#11 public keys are not marked as private (#1339453)
- Ensure secure_getenv() is called on all uses of environment variables
  (#1344591).
- Fix issues related to PKCS #11 private key listing on certain HSMs
  (#1351389)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.26-7
changelog:
- Address interoperability issue with 3.5.x (#1388932)
- Reject CAs which are both trusted and blacklisted in trust module (#1375303)
- Added new functions to set issuer and subject ID in certificates (#1378373)
- Reject connections with less than 1024-bit DH parameters (#1335931)
- Fix issue that made GnuTLS parse only the first 32 extensions (#1383748)
- Mention limitations of certtool in manpage (#1375463)
- Read PKCS#8 files with HMAC-SHA256 -as generated by openssl 1.1 (#1380642)
- Do not link directly to trousers but instead use dlopen (#1379739)
- Fix incorrect OCSP validation (#1377569)
- Added support for pin-value in PKCS#11 URIs (#1379283)
- Added the --id option to p11tool (#1399232)
- Improved sanity checks in RSA key generation (#1444780)
- Addressed CVE-2017-5334, CVE-2017-5335, CVE-2017-5336, CVE-2017-5337,
  CVE-2017-7869


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.26-9
changelog:
- Address crash in OCSP status request extension, by eliminating the
  unneeded parsing (CVE-2017-7507, #1455828)


author: Anderson Sasaki <ansasaki@redhat.com> 3.3.29-8
changelog:
- Backported --sni-hostname option which allows overriding the hostname
  advertised to the peer (#1444792)
- Improved counter-measures in TLS CBC record padding for lucky13 attack
  (CVE-2018-10844, #1589704, CVE-2018-10845, #1589707)
- Added counter-measures for "Just in Time" PRIME + PROBE cache-based attack
  (CVE-2018-10846, #1589708)
- Address p11tool issue in object deletion in batch mode (#1375307)
- Backport PKCS#11 tests from master branch. Some tests were disabled due to
  unsupported features in 3.3.x (--load-pubkey and --test-sign options, ECC key
  generation without login, and certificates do not inherit ID from the private
  key)
- p11tool explicitly marks certificates and public keys as NOT private objects
  and private keys as private objects
- Enlarge buffer size to support resumption with large keys (#1542461)
- Legacy HMAC-SHA384 cipher suites were disabled by default
- Added DSA key generation to p11tool (#1464896)
- Address session renegotiation issue using client certificate (#1434091)
- Address issue when importing private keys into Atos HSM (#1460125)


author: Dmitriy Popov <dpopov@cloudlinux.com> 3.3.29-9.tuxcare.els1
changelog:
- Keep the broken pkcs11 tests disabled.
- Added CVE-2024-0567 PoC test.
- CVE-2023-5981-pre1: improve level of randomness for each operations,
  always use _gnutls_switch_lib_state for pk wrappers.
- CVE-2023-5981-pre2: add constant time/cache operations to prevent
  or minimaze timining or cache side channel attacks.
- CVE-2023-5981: removes branching that depends on secret data to
  prevent potential side-channel attack.
- CVE-2024-0553: minimize branching after decryption.


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.02-087.el7.14.tuxcare.els1
changelog:
- CVE-2023-4692: ntfs: checks to ensure that NTFS drive's sector numbers are never
  written beyond the boundary
- CVE-2023-4693: ntfs: fix an out-of-bounds read flaw on NTFS filesystem driver


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.02-087.el7.14.tuxcare.els4
changelog:
- CVE-2024-45774: reader/jpeg: Heap OOB write during JPEG parsing
- CVE-2024-45775: commands/extcmd: Missing check for failed allocation
- CVE-2024-45776: grub-core/gettext: Integer overflow leads to heap OOB
  write and read
- CVE-2024-45777: grub-core/gettext: Integer overflow leads to heap OOB
  write
- CVE-2024-45780: fs/tar: Integer overflow causes Heap OOB write


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.02-087.el7.14.tuxcare.els5
changelog:
- CVE-2024-45781: fs/ufs: OOB write in the heap
- CVE-2024-45782: fs/hfs: strcpy() using the volume name
- CVE-2024-56737: fs/hfs: Fix stack OOB write with grub_strcpy()
- CVE-2024-45783: fs/hfs+: refcount can be decremented twice
- CVE-2025-0622: normal: Remove variables hooks on module unload
- CVE-2025-0622: gettext: Remove variables hooks on module unload


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.02-087.el7.14.tuxcare.els6
changelog:
- CVE-2025-0624: net: Out-of-bounds write in grub_net_search_configfile()
- CVE-2025-0690: read: Integer overflow may lead to out-of-bounds write
- CVE-2025-1118: commands/dump: The dump command is not in lockdown when
  secure boot is enabled
- CVE-2025-0678: squash4: Integer overflow may lead to heap based
  out-of-bounds write when reading data
- CVE-2025-1125: fs/hfs: Integer overflow may lead to heap based
  out-of-bounds write


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 1.10.4-2.tuxcare.els1
changelog:
- CVE-2024-47606: allocator: avoid integer overflow when allocating sysmem
- Fix documentation build with the newer gtk-doc


author: Wojciech Tatarski <wtatarski@cloudlinux.com> - 1.10.4-2.tuxcare.els2
changelog:
- CVE-2024-47538: fix stack-buffer overflow in
  vorbis_handle_identification_packet function by limiting writing beyond
  boundaries of position array


author: Jai S <jsathyapalan@cloudlinux.com> - 1.10.4-2.tuxcare.els3
changelog:
- CVE-2024-47615: fix OOB-Write in gst_parse_vorbis_setup_packet by validating
  integer size input to prevent memory corruption


author: Nikita Ivanov <nivanov@cloudlinux.com> - 2.4.6-99.1.tuxcare.els2
changelog:
- CVE-2021-26690: Fix NULL pointer dereference in mod_session
- CVE-2022-22719: Fix possible process crash due to unnoticed failures in mod_lua
- CVE-2022-29404: Fix possible DoS due to no default limit on possible input size
  in mod_lua
- CVE-2022-26377: Fix possible HTTP request smuggling in mod_proxy_ajp


author: Dmitriy Popov <dpopov@cloudlinux.com> - 2.4.6-99.1.tuxcare.els4
changelog:
- CVE-2024-38474: mod_rewrite: server weakness with encoded question marks
  in backreferences
- CVE-2024-38475: mod_rewrite: server weakness in mod_rewrite when first
  segment of substitution matches filesystem path
- CVE-2024-38477: mod_proxy: crash resulting in Denial of Service in
  mod_proxy via a malicious request
- CVE-2024-38476: http: server use exploitable/malicious backend application
  output to run local handlers via internal redirect
- CVE-2024-39573: mod_rewrite: proxy handler substitution


author: Dmitriy Popov <dpopov@cloudlinux.com> - 2.4.6-99.1.tuxcare.els5
changelog:
- CVE-2024-39884: modules: source code disclosure with handlers configured via AddType.
  Resolving regression introduced by CVE-2024-38476 fix.
- CVE-2024-40725: modules: source code disclosure with handlers configured via AddType.
  Resolving regression introduced by CVE-2024-39884 fix.


author: Dmitriy Popov <dpopov@cloudlinux.com> - 2.4.6-99.1.tuxcare.els6
changelog:
- CVE-2023-38709: faulty input validation in the core of Apache allows
  malicious or exploitable backend/content generators to split HTTP responses
- CVE-2024-24795: HTTP response splitting in multiple modules allows an
  attacker that can inject malicious response headers into backend applications
  to cause an HTTP desynchronization attack


author: Jai S <jsathyapalan@cloudlinux.com> - 2.4.6-99.0.5.1.tuxcare.els5
changelog:
- CVE-2014-8109: mod_lua: fix LuaAuthzProvider argument handling issue
- CVE-2019-10092: mod_proxy: fix limited cross-site scripting in mod_proxy error page


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 2.4.6-99.0.5.1.tuxcare.els6
changelog:
- CVE-2024-47252: escape user-supplied data in mod_ssl to prevent untrusted
  SSL/TLS clients from inserting escape characters into log files
- CVE-2025-49812: remove support for TLS upgrade to prevent HTTP
  desynchronisation attack


author: Joe Orton <jorton@redhat.com> - 2.2.15-3
changelog:
- default config tweaks:
 * harden httpd.conf w.r.t. .htaccess restriction (#591293)
 * load mod_substitute, mod_version by default
 * drop proxy_ajp.conf, load mod_proxy_ajp in httpd.conf
 * add commented list of shipped-but-unloaded modules
 * bump up worker defaults a little
 * drop KeepAliveTimeout to 5 secs per upstream
- fix LSB compliance in init script (#522074)
- bundle NOTICE in -tools
- use init script in logrotate postrotate to pick up PIDFILE
- drop some old Obsoletes/Conflicts


author: Joe Orton <jorton@redhat.com> - 2.2.17-7
changelog:
- generate dummy mod_ssl cert with CA:FALSE constraint (#667841)
- add man page stubs for httpd.event, httpd.worker
- drop distcache support
- add STOP_TIMEOUT support to init script


author: Joe Orton <jorton@redhat.com> - 2.2.21-6
changelog:
- complete conversion to systemd, drop init script (#770311)
- fix comments in /etc/sysconfig/httpd (#771024)
- enable PrivateTmp in service file (#781440)
- set LANG=C in /etc/sysconfig/httpd


author: Joe Orton <jorton@redhat.com> - 2.4.1-1
changelog:
- update to 2.4.1
- adopt upstream default httpd.conf (almost verbatim)
- split all LoadModules to conf.modules.d/*.conf
- include conf.d/*.conf at end of httpd.conf
- trim %changelog


author: Joe Orton <jorton@redhat.com> - 2.4.1-2
changelog:
- clean docroot better
- ship proxy, ssl directories within /var/cache/httpd
- default config:
 * unrestricted access to (only) /var/www
 * remove (commented) Mutex, MaxRanges, ScriptSock
 * split autoindex config to conf.d/autoindex.conf
- ship additional example configs in docdir


author: Joe Orton <jorton@redhat.com> - 2.4.1-3
changelog:
- add mod_proxy_html subpackage (w/mod_proxy_html + mod_xml2enc)
- move mod_ldap, mod_authnz_ldap to mod_ldap subpackage


author: Joe Orton <jorton@redhat.com> - 2.4.2-4
changelog:
- pull from upstream:
  * use TLS close_notify alert for dummy_connection (r1326980+)
  * cleanup symbol exports (r1327036+)


author: Joe Orton <jorton@redhat.com> - 2.4.2-15
changelog:
- move tmpfiles.d fragment into /usr/lib per new guidelines
- package /run/httpd not /var/run/httpd
- set runtimedir to /run/httpd likewise


author: Joe Orton <jorton@redhat.com> - 2.4.2-18
changelog:
- avoid use of "core" GIF for a "core" directory (#168776)
- drop use of "syslog.target" in systemd unit file


author: Joe Orton <jorton@redhat.com> - 2.4.3-7
changelog:
- use systemd scriptlets if available (#850149)
- don't run posttrans restart if /etc/sysconfig/httpd-disable-posttrans exists


author: Joe Orton <jorton@redhat.com> - 2.4.3-13
changelog:
- filter mod_*.so auto-provides (thanks to rcollet)
- pull in syslog logging fix from upstream (r1344712)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.4-5
changelog:
- execute systemctl reload as result of apachectl graceful
- mod_ssl: ignore SNI hints unless required by config
- mod_cache: forward-port CacheMaxExpire "hard" option
- mod_ssl: fall back on another module's proxy hook if mod_ssl proxy
  is not configured.


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.4-6
changelog:
- htpasswd/htdbm: fix hash generation bug (#956344)
- do not dump vhosts twice in httpd -S output (#928761)
- mod_cache: fix potential crash caused by uninitialized variable (#954109)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.4-12
changelog:
- mod_unique_id: replace use of hostname + pid with PRNG output (#976666)
- apxs: mention -p option in manpage


author: Joe Orton <jorton@redhat.com> - 2.4.6-13
changelog:
- mod_ssl: sanity-check use of "SSLCompression" (#1036666)
- mod_proxy_http: fix brigade memory usage (#1040447)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-17
changelog:
- mod_dav: add security fix for CVE-2013-6438 (#1077907)
- mod_log_config: add security fix for CVE-2014-0098 (#1077907)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-18
changelog:
- mod_cgid: add security fix for CVE-2014-0231 (#1120608)
- mod_proxy: add security fix for CVE-2014-0117 (#1120608)
- mod_deflate: add security fix for CVE-2014-0118 (#1120608)
- mod_status: add security fix for CVE-2014-0226 (#1120608)
- mod_cache: add secutiry fix for CVE-2013-4352 (#1120608)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-19
changelog:
- fix build on ppc64le by using configure macro (#1125545)
- compile httpd with -O3 on ppc64le (#1123490)
- mod_rewrite: expose CONN_REMOTE_ADDR (#1060536)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-30
changelog:
- core: fix bypassing of mod_headers rules via chunked requests (CVE-2013-5704)
- mod_cache: fix NULL pointer dereference on empty Content-Type (CVE-2014-3581)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-31
changelog:
- mod_proxy_fcgi: determine if FCGI_CONN_CLOSE should be enabled
  instead of hardcoding it (#1168050)
- mod_proxy: support Unix Domain Sockets (#1168081)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-32
changelog:
- mod_authn_dbd: fix use-after-free bug with postgresql (#1188779)
- mod_remoteip: correct the trusted proxy match test (#1179306)
- mod_status: honor remote_ip as documented (#1169081)
- mod_deflate: fix decompression of files larger than 4GB (#1170214)
- core: improve error message for inaccessible DocumentRoot (#1170220)
- ab: try all addresses instead of failing on first one when not available (#1125276)
- mod_proxy_wstunnel: add support for SSL (#1180745)
- mod_proxy_wstunnel: load this module by default (#1180745)
- mod_rewrite: add support for WebSockets (#1180745)
- mod_rewrite: do not search for directory if a URL will be rewritten (#1210091)
- mod_ssl: Fix SSL_CLIENT_VERIFY value when optional_no_ca and SSLSessionCache
  are used and SSL session is resumed (#1170206)
- mod_ssl: fix memory leak on httpd reloads (#1181690)
- mod_ssl: use SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA (#1118476)
- mod_cgi: return error code 408 on timeout (#1162152)
- mod_dav_fs: set default value of DAVLockDB (#1176449)
- add Documentation= to the httpd.service and htcacheclean.service (#1184118)
- do not display "bomb" icon for files ending with "core" (#1170215)
- add missing Reason-Phrase in HTTP response headers (#1162159)
- fix BuildRequires to require openssl-devel >= 1:1.0.1e-37 (#1160625)
- apachectl: ignore HTTPD variable from sysconfig (#1214401)
- apachectl: fix "graceful" documentation (#1214398)
- apachectl: fix "graceful" behaviour when httpd is not running (#1214430)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-34
changelog:
- mod_proxy_fcgi: honor Timeout / ProxyTimeout (#1222328)
- do not show all vhosts twice in httpd -D DUMP_VHOSTS output (#1225820)
- fix -D[efined] or <Define>[d] variables lifetime accross restarts (#1227219)
- mod_ssl: do not send NPN extension with not configured (#1226015)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-35
changelog:
- mod_remoteip: correct the trusted proxy match test (#1179306)
- mod_dav: send complete response when resource is created (#1235383)
- apachectl: correct the apachectl status man page (#1231924)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-36
changelog:
- Revert fix for #1162152, it is not needed in RHEL7
- mod_proxy_ajp: fix settings ProxyPass parameters for AJP backends (#1242416)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-37
changelog:
- core: fix chunk header parsing defect (CVE-2015-3183)
- core: replace of ap_some_auth_required with ap_some_authn_required
  and ap_force_authn hook (CVE-2015-3185)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-41
changelog:
- mod_cache: merge r->err_headers_out into r->headers when the response
  is cached for the first time (#1264989)
- mod_ssl: Do not send SSL warning when SNI hostname is not found as per
  RFC 6066 (#1298148)
- mod_proxy_fcgi: Ignore body data from backend for 304 responses (#1263038)
- fix apache user creation when apache group already exists (#1299889)
- fix apache user creation when USERGROUPS_ENAB is set to 'no' (#1288757)
- mod_proxy: fix slow response time for reponses with error status code
  when using ProxyErrorOverride (#1283653)
- mod_ldap: Respect LDAPConnectionPoolTTL for authn connections (#1300149)
- mod_ssl: use "localhost" in the dummy SSL cert for long FQDNs (#1240495)
- rotatelogs: improve support for localtime (#1244545)
- ab: fix read failure when targeting SSL server (#1255331)
- mod_log_debug: fix LogMessage example in documentation (#1279465)
- mod_authz_dbd, mod_authn_dbd, mod_session_dbd, mod_rewrite: Fix lifetime
  of DB lookup entries independently of the selected DB engine (#1287844)
- mod_ssl: fix hardware crypto support with custom DH parms (#1291865)
- mod_proxy_fcgi: fix SCRIPT_FILENAME when a balancer is used (#1302797)


author: Joe Orton <jorton@redhat.com> - 2.4.6-47
changelog:
- prefork: fix delay completing graceful restart (#1327624)
- mod_ldap: fix authz regression, failing to rebind (#1415257)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-48
changelog:
- Resolves: #1406184 - stapling_renew_response: abort early
  (before apr_uri_parse) if ocspuri is empty


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-50
changelog:
- Resolves: #1348019 - mod_proxy: Fix a race condition that caused a failed
  worker to be retried before the retry period is over


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-53
changelog:
- Resolves: #1376835 - httpd with worker/event mpm segfaults after multiple
  successive graceful reloads


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-54
changelog:
- Resolves: #1372692 - Apache httpd does not log status code "413" in
  access_log when exceeding LimitRequestBody


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-55
changelog:
- Resolves: #1371876 - Apache httpd returns "200 OK" for a request
  exceeding LimitRequestBody when enabling mod_ext_filter


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-56
changelog:
- Resolves: #1353740 - Backport Apache PR58118 to fix mod_proxy_fcgi
  spamming non-errors: AH01075: Error dispatching request to : (passing
  brigade to output filters)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-58
changelog:
- Resolves: #1364604 - Upstream Bug 56925 - ErrorDocument directive misbehaves
  with mod_proxy_http and mod_proxy_ajp


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-59
changelog:
- Resolves: #1378946 - Backport of apache bug 55910: Continuation lines
  are broken during buffer resize


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-60
changelog:
- Resolves: #1414258 - Crash during restart or at startup in mod_ssl,
  in certinfo_free() function registered by ssl_stapling_ex_init()


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-61
changelog:
- Related: #1414258 - Crash during restart or at startup in mod_ssl,
  in certinfo_free() function registered by ssl_stapling_ex_init()


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-62
changelog:
- Resolves: #1397241 - Backport Apache Bug 53098 - mod_proxy_ajp:
  patch to set worker secret passed to tomcat


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-64
changelog:
- Resolves: #1442872 - apache user is not created during httpd installation
  when apache group already exist with GID other than 48


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-68
changelog:
- Resolves: #1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw()
  authentication bypass
- Resolves: #1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer dereference
- Resolves: #1463207 - CVE-2017-7679 httpd: mod_mime buffer overread
- Resolves: #1463205 - CVE-2017-7668 httpd: ap_find_token() buffer overread
- Resolves: #1470748 - CVE-2017-9788 httpd: Uninitialized memory reflection
  in mod_auth_digest


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-73
changelog:
- Resolves: #1499253 - ProxyRemote with HTTPS backend sends requests
  with absoluteURI instead of abs_path


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-74
changelog:
- Resolves: #1430640 - "ProxyAddHeaders Off" does not become effective
  when it's defined outside <Proxy> setting


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-75
changelog:
- Resolves: #1448892 - Cannot override LD_LIBARY_PATH in Apache HTTPD
  using SetEnv or PassEnv. Needs documentation.


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-90
changelog:
- Resolves: #1566317 - CVE-2018-1312 httpd: Weak Digest auth nonce generation
  in mod_auth_digest
- Resolves: #1696141 - CVE-2019-0217 httpd: mod_auth_digest: access control
  bypass due to race condition
- Resolves: #1696096 - CVE-2019-0220 httpd: URL normalization inconsistency


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-91
changelog:
- Resolves: #1630886 - scriptlet can fail if hostname is not installed
- Resolves: #1565465 - CVE-2017-15710 httpd: Out of bound write in
  mod_authnz_ldap when using too small Accept-Language values
- Resolves: #1568298 - CVE-2018-1301 httpd: Out of bounds access after
  failure in reading the HTTP request
- Resolves: #1673457 - Apache child process crashes because ScriptAliasMatch
  directive
- Resolves: #1633152 - mod_session missing apr-util-openssl
- Resolves: #1649470 - httpd response contains garbage in Content-Type header
- Resolves: #1724034 - Unexpected OCSP in proxy SSL connection


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-94
changelog:
- Resolves: #1565491 - CVE-2017-15715 httpd: <FilesMatch> bypass with a trailing
  newline in the file name
- Resolves: #1747283 - CVE-2019-10098 httpd: mod_rewrite potential open redirect
- Resolves: #1724879 - httpd terminates all SSL connections using an abortive
  shutdown
- Resolves: #1715981 - Backport of SessionExpiryUpdateInterval directive
- Resolves: #1565457 - CVE-2018-1303 httpd: Out of bounds read in
  mod_cache_socache can allow a remote attacker to cause a denial of service
- Resolves: #1566531 - CVE-2018-1283 httpd: Improper handling of headers in 
  mod_session can allow a remote user to modify session data for CGI applications


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-97
changelog:
- Resolves: #1852350 - httpd/mod_proxy_http/mod_ssl aborted when sending
  a client cert to backend server
- Resolves: #1785100 - mod_cgid takes CGIDScriptTimeout x 2 seconds for timeout
- Resolves: #1862499 - Intermittent Segfault in Apache httpd due to pool
  concurrency issues


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.1
changelog:
- Resolves: #2011729 - CVE-2021-40438 httpd: mod_proxy: SSRF via a crafted
  request uri-path containing "unix:"


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.3
changelog:
- Resolves: #2035058 - CVE-2021-44790 httpd: mod_lua: possible buffer overflow
  when parsing multipart content


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.4
changelog:
- Resolves: #2031072 - CVE-2021-34798 httpd: NULL pointer dereference via
  malformed requests
- Resolves: #2031074 - CVE-2021-39275 httpd: out-of-bounds write in
  ap_escape_quotes() via malicious input
- Resolves: #1969226 - CVE-2021-26691 httpd: Heap overflow in mod_session


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.5
changelog:
- Resolves: #2065243 - CVE-2022-22720 httpd: HTTP request smuggling
  vulnerability in Apache HTTP Server 2.4.52 and earlier


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.6
changelog:
- Resolves: #2101997 - HEAD request with a 404 and custom ErrorPage causes
  corrupt and mixed-up responses


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.7
changelog:
- Resolves: #2177742 - CVE-2023-25690 httpd: HTTP request splitting with
  mod_rewrite and mod_proxy


author: Nikita Ivanov <nivanov@cloudlinux.com> - 2.4.6-99.1.tuxcare.els1
changelog:
- CVE-2022-23943: Fix out-of-bound write in mod_sed
- CVE-2022-22721: Fix integer overflow which resulted in out-of-bounds write
- CVE-2022-28615: Fix read beyond bounds in ap_strcmp_match()
- CVE-2022-31813: Fix possible bypass of IP based authentication


author: Ben Skeggs <bskeggs@redhat.com> 20090106-2
changelog:
- Add firmware needed for nouveau to operate correctly (this is Fedora
  only - do not upstream yet - we just moved it here from Fedora kernel)


author: Josh Boyer <jwboyer@redhat.com> 20120510-0.3.git375e954
changelog:
- Fix location of BuildRequires so git is inclued in the buildroot
- Create iwlXXXX-firmware subpackages (rhbz 828050)


author: Josh Boyer <jwboyer@redhat.com>
changelog:
- Consolidate rt61pci-firmware and rt73usb-firmware packages (rhbz 864959)
- Consolidate netxen-firmware and ql2[123]xx-firmware packages (rhbz 864959)


author: Jarod Wilson <jarod@redhat.com> - 20130820-0.3.git600caef
changelog:
- Put in proper URL and URL-less Source0 location, and a note about how
  we generate the tarball by hand from a git tree


author: Jarod Wilson <jarod@redhat.com> - 20131106-0.1.git7d0c7a8
changelog:
- Update to latest upstream linux-firmware to pick up bfa firmware (rhbz 1013426)
- Fix up Obsoletes to all use <= comparisons


author: Jarod Wilson <jarod@redhat.com> - 20140911-0.1.git365e80c
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- Adds Intel Quick Assist Technology firmware (rhbz 1127338)
- Updates bnx2x adapter firmware to version 7.10.51 (rhbz 1089403)
- Updates myri10ge adapter firmware to version 1.4.57 (rhbz 1063702)
- Removes firmware for drivers not shipped with Red Hat Enterprise Linux 7 (rhbz 1016595)


author: Rafael Aquini <aquini@redhat.com> - 20150612-37.git3161bfa
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- cxgb4: Update firmware to revision 1.13.32.0 (rhbz 1189256)
- qat: Update to the latest upstream firmware (rhbz 1173792)
- Use a common version number for both the iwl*-firmware packages and linux-firmware itself


author: Rafael Aquini <aquini@redhat.com> - 20150904-42.git6ebf5d5
changelog:
- Add Intel Omni-Path Architecture hfi1 Firmware (rhbz 1194910)
- Update skl firmware for gpu (rhbz 1210012)


author: Jarod Wilson <jarod@redhat.com> - 20150904-43.git6ebf5d5
changelog:
- Add more old chelsio firmwares, they nuked the one the driver in
  RHEL7.2 is expecting from upstream (rhbz 1262128)
- Remove amd-ucode again, it simply breaks too many systems (rhbz 1246393)


author: Rafael Aquini <aquini@redhat.com> - 20160223-44.git8d1fd61
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- Update Intel Omni-Path Architecture hfi1 Firmware (rhbz 1267015)


author: Rafael Aquini <aquini@redhat.com> - 20160426-45.git986a5a8
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- Restore AMD-ucode firmware blob again (rhbz 866700)
- qat: Update to the latest upstream firmware (rhbz 1173792)
- WiFi on Windstorm Peak Wireless Adapter 8265 - firmware support (rhbz 1315534)
- WiFi on Sandy Peak Wireless Adapter 3168 - firmware support (rhbz 1315536)


author: Rafael Aquini <aquini@redhat.com> - 20160615-46.gita4bbc81
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- Nuke old cxgb4 firmware blobs tarball (rhbz 1336906)
- Update to latest Chelsio firmware release version (rhbz 1336906)


author: Rafael Aquini <aquini@redhat.com> - 20160728-47.git0daeaf3
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- Core14 firmware release for 7265, 7260, 3160 wireless devices (rhbz 1358566)
- Core19 firmware release for 7265D, 8260, 8265, 3168 wireless devices (rhbz 1358568)


author: Rafael Aquini <aquini@redhat.com> - 20160830-49.git7534e19
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- Update QCA6174/hw3.0/board-2.bin file to support ath10k devices (rhbz 1368159)


author: Rafael Aquini <aquini@redhat.com> - 20170217-50.git6d3bc88
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- chelsio: Update to the latest firmware released version (rhbz 1395322)
- iwlwifi: Update to the latest firmware released version (rhbz 1385749)
- ath10k: Update to the latest firmware released version (rhbz 1385743)
- hfi1: Update to the latest firmware released version (rhbz 1382805)


author: Rafael Aquini <aquini@redhat.com> - 20170307-51.git87714d8
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- chelsio: Update to the latest firmware released version (rhbz 1385911)
- drm: Update for radeon and amdgpu latest firmware released version (rhbz 1425197)


author: Rafael Aquini <aquini@redhat.com> - 20170328-52.git44d8e8d
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- nfp: add firmware for Netronome Ethernet Driver (rhbz 1432592)


author: Rafael Aquini <aquini@redhat.com> - 20170530-54.gitdf40d15
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- opa: HFI firmware problems with new OPA switch firmware (rhbz 1452253)


author: Rafael Aquini <aquini@redhat.com> - 20171011-57.gitbf04291
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- ath10k: Update to the latest firmware released version (rhbz 1457363)
- opa: update Intel Omni-Path Architecture firmware (rhbz 1452785)
- chelsio: Pull in the latest firmware 1.16.63.0 (rhbz 1458328)
- qla2xxx: Update firmware version to 8.07.00 (rhbz 1427148)


author: Rafael Aquini <aquini@redhat.com> - 20171127-58.git17e6288
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- iwlwifi: Firmware update for 3160, 3168, 7260, 7265 and 7265D WIFI devices (rhbz 1508709)
- iwlwifi: Firmware update for 8260 and 8265 WIFI devices (rhbz 1508711)
- iwlwifi: Firmware update for 9260 and 9560 WIFI devices (rhbz 1501166)
- Fixes CVE-2016-0801 CVE-2017-0561 CVE-2017-9417


author: Rafael Aquini <aquini@redhat.com> - 20180113-60.git65b1c68
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- netr: Add Netronome TC flower firmware (rhbz 1518900)
- Revert amd-ucode for fam17h (rhbz 1533945)


author: Rafael Aquini <aquini@redhat.com> - 20180220-62.git6d51311
changelog:
- nfp: NIC stops transmitting for small MSS values when TSO is enabled (rhbz 1542263)
- chelsio: pull in latests firmware 1.17.14.0 (rhbz 1538590)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20180518-63.git2a9b2cf
changelog:
- Update to latest upstream linux-firmware image for assorted netdrv updates
- amd: add microcode for family 17h and update for family 15h (rhbz 1574575)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20180529-65.git7518922
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- amd: update microcode for family 15h (rhbz 1574575)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20180717-67.git8d69bab
changelog:
- Update to latest upstream linux-firmware image for assorted netdrv updates
- chelsio: update firmware to revision 1.20.8.0 (rhbz 1523202)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20180911-68.git85c5d90
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- nvidia: update firmware for Pascal GPUs (rhbz 1625514)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20190225-70.git80dee31
changelog:
- cxgb4: update firmware to revision 1.22.9.0 (rhbz 1671610)
- nfp: update Agilio SmartNIC flower firmware to rev AOTC-2.10.A.13 (rhbz 1637996)
- linux-firmware: Update firmware patch for Intel Bluetooth 8260 (rhbz 1649148)
- qed: Add 8.37.7.0 firmware image (rhbz 1654809)
- liquidio: fix GPL compliance issue (rhbz 1622521)
- Update Intel OPA hfi1 firmware (rhbz 1637240)
- qed: Add firmware 8.37.7.0 (rhbz 1643554)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20190318-71.git283373f
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- cxgb4: update firmware to revision 1.23.3.0 (rhbz 1642422)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20190429-72.gitddde598
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- cxgb4: update firmware to revision 1.23.4.0 (rhbz 1690727)
- linux-firmware: Add firmware file for Intel Bluetooth 22161 (rhbz 1622438)


author: Jan Stancek <jstancek@redhat.com> - 20190815-73.git07b925b
changelog:
- Update to latest upstream linux-firmware image for assorted updates (rhbz 1741356)
- iwlwifi- Update to support the Cyclone Peak Dual Band 2x2 802.11ax
- iwl7265-firmware sub-package merged into iwl7260-firmware sub-package


author: Jan Stancek <jstancek@redhat.com> - 20190918-74.git6c6918a
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- Update bnx2x firmware to latest upstream (rhbz 1720386)


author: Jan Stancek <jstancek@redhat.com> - 20191203-75.gite8a0f4c
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- Update qed zipped/unzipped firmware to latest upstream (rhbz 1720385)


author: Rado Vrbovsky <rvrbovsk@redhat.com> - 20200421-80.git78c0348
changelog:
- Cross-Process Information Leak (RHEL-8938)
- Return Address Predictor velunerability leading to information disclosure (RHEL-9250)


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 20200421-81.git78c0348.tuxcare.els1
changelog:
- Update AMD CPU microcode to 2023-12-05:
  - Update AMD CPU microcode for processor family 19h: sig 0x00a10f12,
    sig 0x00aa0f02, sig 0x00aa0f01, sig 0x00a10f11
- Update AMD CPU microcode for processor family 17h: sig 0x00830f10
- Fix CVE-2023-20569, CVE-2023-20593
- Use tuxcare.els suffixes for all packages


author: Rado Vrbovsky <rvrbovsk@redhat.com> - 20200421-82.git78c0348
changelog:
- AMD: INVD instruction may lead to a loss of SEV-ES guest machine memory integrity problem (RHEL-13985)


author: Denys Vlasenko <dvlasenk@redhat.com> - 20200421-83.git78c0348
changelog:
- hw: intel: Fix protection mechanism failure for some Intel(R) PROSet/Wireless WiFi
  Resolves: RHEL-4010, RHEL-4013, RHEL-4016, RHEL-4018, RHEL-4021


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 20200421-81.git78c0348.tuxcare.els2
changelog:
- Update iwlwifi firmware to mitigate CVE-2022-38076, CVE-2022-27635,
  CVE-2022-40964 for wifi adapters: Intel Dual Band Wireless-AC 3168,
  Intel Wireless 7265 (Rev D) Family, Intel Dual Band Wireless-AC 3165,
  Intel Dual Band Wireless-AC 8265, Intel Dual Band Wireless-AC 8260,
  Intel Wireless-AC 9560, Intel Wireless-AC 9462, Intel Wireless-AC 9461,
  Intel Wireless-AC 9260


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 20200421-83.git78c0348.tuxcare.els2
changelog:
- Update AMD CPU microcode for processor family 0x19:
  cpuid:0x00A00F10(ver:0x0A00107A), cpuid:0x00A10F12(ver:0x0A101248),
  cpuid:0x00AA0F02(ver:0x0AA00215), cpuid:0x00A00F12(ver:0x0A001238),
  cpuid:0x00A10F11(ver:0x0A101148), cpuid:0x00A00F11(ver:0x0A0011D5);
- Update AMD CPU microcode for processor family 0x17:
  cpuid:0x00800F12(ver:0x0800126F), cpuid:0x00830F10(ver:0x0830107C);
- Fix CVE-2023-31315 (AMD-SB-7014), CVE-2023-20592 (AMD-SB-3005)
- Update AMD CPU microcode to 2024-08-11


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 20200421-83.git78c0348.tuxcare.els3
changelog:
- Addition AMD CPU microcode for processor family 0x19:
  cpuid:0x00A70FC0(ver:0x0A70C005), cpuid:0x00A70F52(ver:0x0A705206),
  cpuid:0x00A00F82(ver:0x0A00820C), cpuid:0x00A40F41(ver:0x0A404107),
  cpuid:0x00A70F80(ver:0x0A708007), cpuid:0x00A20F10(ver:0x0A20102D),
  cpuid:0x00A70F41(ver:0x0A704107), cpuid:0x00A60F12(ver:0x0A601209),
  cpuid:0x00A10F81(ver:0x0A108108), cpuid:0x00A50F00(ver:0x0A500011),
  cpuid:0x00A20F12(ver:0x0A201210);
- Addition AMD CPU microcode for processor family 0x17:
  cpuid:0x00870F10(ver:0x08701034), cpuid:0x00860F01(ver:0x0860010D),
  cpuid:0x00860F81(ver:0x08608108);
- Update AMD CPU microcode for processor family 0x17:
  cpuid:0x008A0F00(ver:0x08A0000A);


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-27
changelog:
- CVE-2014-9029 - incorrect component number check in COC, RGN and QCC
                  marker segment decoders (#1171211)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-28
changelog:
- CVE-2014-8137 - double-free in in jas_iccattrval_destroy (#1173569)
- CVE-2014-8138 - heap overflow in jp2_decode (#1173569)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-29
changelog:
- CVE-2014-8157 - dec->numtiles off-by-one check in jpc_dec_process_sot() (#1183674)
- CVE-2014-8158 - unrestricted stack memory use in jpc_qmfb.c (#1183682)


author: Josef Ridky <jridky@redhat.com> - 1.900.1-30
changelog:
- Multiple security fixes (fixed by thoger):
  CVE-2015-5203 CVE-2015-5221 CVE-2016-1577 CVE-2016-1867 CVE-2016-2089
  CVE-2016-2116 CVE-2016-8654 CVE-2016-8690 CVE-2016-8691 CVE-2016-8692
  CVE-2016-8693 CVE-2016-8883 CVE-2016-8884 CVE-2016-8885 CVE-2016-9262
  CVE-2016-9387 CVE-2016-9388 CVE-2016-9389 CVE-2016-9390 CVE-2016-9391
  CVE-2016-9392 CVE-2016-9393 CVE-2016-9394 CVE-2016-9560 CVE-2016-9583
  CVE-2016-9591 CVE-2016-9600 CVE-2016-10248 CVE-2016-10249 CVE-2016-10251
- Fix implicit declaration warning caused by security fixes above


author: Omair Majid <omajid@redhat.com> 1:1.8.0.0-0.5.b87
changelog:
- Update to b87
- Remove all rhino support; use nashorn instead
- Remove upstreamed/unapplied patches


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.0-0.11.b89
changelog:
- prelink dependence excluded also for aaech64
- arm64 added to jitarches
- added source100 config.guess to repalce the outdated one in-tree
- added source101 config.sub  to repalce the outdated one in-tree
- added patch2011 system-libjpegAARCH64.patch (as aarch64-port is little bit diferent)
- added patch2031 system-lcmsAARCH64.patch (as aarch64-port is little bit diferent)
- added gcc-c++ build depndece so builddep will  result to better situation


author: Deepak Bhole <dbhole@redhat.com> - 1:1.8.0.0-0.15.b89
changelog:
- Added a missing includes patch (#302/%{name}-arm64-missing-includes.patch)
- Added --disable-precompiled-headers for arm64 build


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.0-0.26.b129
changelog:
- Add -headless subpackage based on java-1.7.0-openjdk
- Add abrt connector support
- Add -accessibility subpackage


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.0-0.31.b132
changelog:
- updated to rc4 aarch64 tarball
- outdated removed: patch2031 system-lcmsAARCH64.patch patch2011 system-libjpeg-aarch64.patch
  patch2021 system-libpng-aarch64.patch


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.0-2.b132
changelog:
- Include version information in desktop files
- Move desktop files from tarball to top level source


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.11-11.b12
changelog:
- backporting old fixes:
- get rid of jre-abrt, uniquesuffix, parallel install, jsa files,
  config(norepalce) bug, -fstack-protector-strong, OrderWithRequires,
  nss config, multilib arches, provides/requires excludes
- some additional cosmetic changes


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.11-12.b12
changelog:
- bumped release to build by previous release.
- forcing rebuild by jdk8
- uncommenting forgotten comment on tzdb link


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.11-17.b12
changelog:
- added build requires and requires for headles  _datadir/javazi-1.8/tzdb.dat
- restriction of tzdata provider, so we will be aware of another possible failure


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-1.b01
changelog:
- updated to u40-b01
- adapted  rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
- adapted  jdk8042159-allow_using_system_installed_lcms2.patch
- removed patch8 set-active-window.patch
- removed patch9 javadoc-error-jdk-8029145.patch
- removed patch10 javadoc-error-jdk-8037484.patch
- removed patch99 applet-hole.patch - itw 1.5.1 is able to ive without it


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-1.b02
changelog:
- adapted aarch64 patch
- removed upstreamed patch  0001-PPC64LE-arch-support-in-openjdk-1.8.patch
- added patch666 stackoverflow-ppc32_64-20140828.patch
- commented out patch2 1015432.patch (does nearly the same as new patch666)
- Resolves: rhbz#1125260


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.40-5.b26
changelog:
- Update aarch64 hotspot to jdk7u40-b02 to match the rest of the JDK
- Do not obsolete java-1.7.0-openjdk
- Resolves: rhbz#1125260


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.20-2.b26
changelog:
- moving all ppc64 to jit arches
- using cpp interpreter for ppc64le
- removing requirement on datadir/javazi-1.8/tzdb.dat
- Resolves: rhbz#1125260


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.20-5.b26
changelog:
- Update aarch64 hotspot to latest upstream version
- Depend on java-1.7.0-openjdk to work around self-building issues
- Resolves: rhbz#1125260


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.20-8.b26
changelog:
- Add patches for PPC zero build.
- Fixes stack overflow problem. See RHBZ#1015432.
- Fixes missing memory barrier in Atomic::xchg*
- Fixes missing PPC32/PPC64 defines for Zero builds on power.
- Resolves: rhbz#1125260


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.20-9.b26
changelog:
- Add hotspot compiler flag -fno-tree-vectorize which fixes the segfault in
  the bytecode verifier on ppc/ppc64.
- Resolves: rhbz#1125260


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.20-10.b26
changelog:
- Remove LIBDIR and funny definition of _libdir.
- Fix rpmlint warnings about macros in comments.
- Resolves: rhbz#1125260


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.25-3.b17
changelog:
- added patch12,removeSunEcProvider-RH1154143
- xdump excluded from ppc64le (rh1156151)
- Add check for src.zip completeness. See RH1130490 (by sgehwolf@redhat.com)
- Resolves: rhbz#1125260


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-4.b13
changelog:
- Fix configure script to use ppc64le, not ppc64.
- Add ppc64le support to LIBJSOUND_CFLAGS.
- Add a jvm.cfg for ppc64le
- Resolves: rhbz#1194378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-4.b13
changelog:
- Print contents of spec.gmk to see what is being passed to the HotSpot build.
- Resolves: rhbz#1194378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-4.b13
changelog:
- Set OPENJDK_TARGET_CPU_LEGACY to ppc64 so as not to mess up HotSpot build.
- Add -DABI_ELFv2 to CFLAGS on ppc64le to match OpenJDK 7.
- Print contents of hotspot-spec.gmk
- Resolves: rhbz#1194378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-4.b13
changelog:
- Override ppc64le as ppc64 only in hotspot-spec.gmk so as not to disrupt JDK build.
- Add property test case from java-1.7.0-openjdk build.
- Resolves: rhbz#1194378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-6.b13
changelog:
- Adjust ppc64le HotSpot patch for OpenJDK 8.
- Enable AArch64 configure/JDK patch on all archs to minimise patching issues.
- Adjust ppc64le patches to apply after the enableAArch64 patch.
- Add %{name} prefix to patches to avoid conflicts with OpenJDK 7 versions.
- Resolves: rhbz#1194378


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.45-27.b13
changelog:
- updated to security u45
- minor sync with 7.2
 - generate_source_tarball.sh
 - adapted java-1.8.0-openjdk-s390-java-opts.patch and java-1.8.0-openjdk-size_t.patch
 - reworked (synced) zero patches (removed 103,11 added 204, 400-403)
 - family of 5XX patches renamed to 6XX
 - added upstreamed patch 501 and 505
 - included removeSunEcProvider-RH1154143.patch
- returned java (jre only) provides
- repacked policies (source20)
- removed duplicated NVR provides
- added automated test for priority (length7)
- Resolves: RHBZ#1209077


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.45-34.b13
changelog:
- Omit jsa files from power64 file list as well, as they are never generated
- Resolves: rhbz#1202726


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.45-35.b13
changelog:
- Make use of system timezone data for OpenJDK 8.
- moved to boot build by openjdk8
- priority set  gcj < lengthOffFour < otherJdks (RH1175457)
- misusing already fixed bug
- Resolves: rhbz#1189530


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.45-36.b13
changelog:
- Correctly fix system timezone data issue by depending on correct tzdata version.
- Remove reference to tz.properties which is no longer used.
- Resolves: rhbz#1212571


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.51-0.b16
changelog:
- July 2015 security update to u51b16.
- Add script for generating OpenJDK tarballs from a local Mercurial tree.
- Add %{name} prefix to patches to avoid conflicts with OpenJDK 7 versions.
- Add patches for RH issues fixed in IcedTea 2.x and/or the upcoming u60.
- Use 'openjdk' as directory prefix to allow patch interchange with IcedTea.
- Re-generate EC disablement patch following CPU DH changes.
- Resolves: rhbz#1235163


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.51-1.b16
changelog:
- Re-introduce handling of java.security updates, with new md5sum of Jan 2015 version.
- Resolves: rhbz#1235163


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.65-0.b17
changelog:
- October 2015 security update to u65b17.
- Add script for generating OpenJDK tarballs from a local Mercurial tree.
- Update RH1191652 patch to build against current AArch64 tree.
- Use appropriate source ID to avoid unpacking both tarballs on AArch64.
- Add MD5 checksums for java.security from 8u51 and 8u60 RPMs.
- Resolves: rhbz#1257657


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.65-4.b17
changelog:
- moved to integration forest 
- sync with fedora (all but extracted luas and family)
- Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-1.b15
changelog:
- October 2015 security update to u71b15.
- Improve verbosity and helpfulness of tarball generation script.
- Remove RH1290936 workaround as RHEL does not have the hardened flags nor ARM32.
- Update patch documentation using version originally written for Fedora.
- Drop prelink requirement as we no longer use execstack.
- Drop ifdefbugfix patch as this is fixed upstream.
- Temporarily enable a full bootcycle to ensure flag changes don't break anything.
- Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-1.b15
changelog:
- Turn off additional CFLAGS/LDFLAGS on AArch64 as bootstrapping failed.
- Add patch for size_t formatting on s390 as size_t != intptr_t there.
- Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-1.b15
changelog:
- Add additional fixes for s390 warnings in arguments.cpp
- Temporarily turn off -Werror on s390 to make progress
- Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-1.b15
changelog:
- Make bootstrap build optional and turn it off by default.
- Fix remaining warnings in s390 fix and re-enable -Werror
- Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-1.b15
changelog:
- Change correct specifier in src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp
- Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-2.b15
changelog:
- Restore upstream version of system LCMS patch removed by 'sync with Fedora'
- Add patch to turn off strict overflow on IndicRearrangementProcessor{,2}.cpp
- Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-4.b15
changelog:
- Remove -fno-tree-vectorize now a GCC is available with this bug fixed.
- Add build requirement on a GCC with working tree vectorization.
- Enable bootstrap temporarily to ensure the JDK is functional.
- Resolves: rhbz#1146897


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-5.b15
changelog:
- Backport S8148351: Only display resolved symlink for compiler, do not change path
- Resolves: rhbz#1256464


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-6.b15
changelog:
- Define EXTRA_CPP_FLAGS again, after it was removed in the fix for 1146897.
- Resolves: rhbz#1146897


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-0.b15
changelog:
- Replace s390 Java options patch with general version from IcedTea.
- Apply s390 patches unconditionally to avoid arch-specific patch failures.
- Resolves: rhbz#1307108


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-0.b15
changelog:
- Remove fragment of s390 size_t patch that unnecessarily removes a cast, breaking ppc64le.
- Remove aarch64-specific suffix as update/build version are now the same as for other archs.
- Resolves: rhbz#1307108


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-0.b15
changelog:
- Remove unnecessary AArch64 port divergence on parsing jvm.cfg, broken by 9399aa7ef558
- Resolves: rhbz#1307108


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-1.b15
changelog:
- Add backport of 8147805: aarch64: C1 segmentation fault due to inline Unsafe.getAndSetObject
- Resolves: rhbz#1300630


author: jvanek <jvanek@redhat.com> - 1:1.8.0.72-3.b15
changelog:
- returning accidentlay removed hunk from renamed and so wrongly merged remove_aarch64_jvm.cfg_divergence.patch
- Resolves: rhbz#1300630


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-4.b15
changelog:
- Add patches to allow the SunEC provider to be built with the system NSS install.
- Re-generate source tarball so it includes ecc_impl.h.
- Adjust tarball generation script to allow ecc_impl.h to be included.
- Bring over NSS changes from java-1.7.0-openjdk spec file (NSS_CFLAGS/NSS_LIBS)
- Remove patch which disables the SunEC provider as it is now usable.
- Correct spelling mistakes in tarball generation script.
- Resolves: rhbz#1245810


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-5.b16
changelog:
- Update to u72b16.
- Drop 8147805 and jvm.cfg fix which are applied upstream.
- Resolves: rhbz#1307108


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.72-12.b15
changelog:
- Use a simple backport for PR2462/8074839.
- Don't backport the crc check for pack.gz. It's not tested well upstream.
- Resolves: rhbz#1307108


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-13.b16
changelog:
- When using a compositing WM, the overlay window should be used, not the root window.
- Resolves: rhbz#1176206


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-2.b03
changelog:
- Avoid WithSeed versions of NSS functions as they do not fully process the seed
- List current java.security md5sum so that java.security is replaced and ECC gets enabled.
- Resolves: rhbz#1245810


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
- Use basename of test file to avoid misinterpretation of full path as a package
- Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
- Enable a full bootstrap on JIT archs. Full build held back by Zero archs anyway.
- Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
- Add 8132051 port to Zero.
- Turn on bootstrap build for all to ensure we are now good to go.
- Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
- Revert settings to production defaults so we can at least get a build.
- Switch to a slowdebug build to try and unearth remaining issue on s390x.
- Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
- Turn off -Werror so s390 can build in slowdebug mode.
- Add fix for formatting issue found by previous s390 build.
- Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
- Temporarily remove power64 from JIT arches to see if endian issue appears on Zero.
- Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
- Add additional fix to Zero patch to properly handle result on 64-bit big-endian
- Revert debugging options (aarch64 back to JIT, product build, no -Wno-error)
- Enable full bootstrap on all architectures to check we are good to go.
- Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
- Roll back release number as release 1 never succeeded, even with tests disabled.
- Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.92-1.b14
changelog:
- Update to u92b14.
- Remove upstreamed patches for AArch64 byte behaviour and template issue.
- Remove upstreamed patches for Zero build failures 8087120 & 8143855.
- Replace 8132051 Zero fix with version upstreamed as 8154210 in 8u112.
- Add upstreamed patch 6961123 from u102 to fix application name in GNOME Shell.
- Add upstreamed patches 8044762 & 8049226 from u112 to fix JDI issues.
- Regenerate java-1.8.0-openjdk-rh1191652-root.patch against u92
- Resolves: rhbz#1335322


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.92-2.b14
changelog:
- Add fix for PKCS#10 output regression, adding -systemlineendings option.
- Move S8150954/RH1176206/PR2866 fix to correct section, as not in 9 yet.
- Resolves: rhbz#1337583


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.92-4.b14
changelog:
- added requires for copy-jdk-configs, to help with https://projects.engineering.redhat.com/browse/RCM-3654
- Resolves: rhbz#1296442


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.92-5.b14
changelog:
- added --family option with chkconfig version full dependence
- added nss restricting requires
- added zipped javadoc subpackage
- extracted lua scripts
- Resolves: rhbz#1296442
- Resolves: rhbz#1296414


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.92-9.b14
changelog:
- Add additional fixes (S6260348, S8159244) for u92 update.
- Add bug ID to Javadoc patch.
- Resolves: rhbz#1335322


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-1.b13
changelog:
- Update to u101b13.
- Document REPOS option in generate_source_tarball.sh
- Drop a leading zero from the priority as the update version is now three digits
- Resolves: rhbz#1350037


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-3.b13
changelog:
- Add missing hunk from 8147771, missed due to inclusion of unneeded 8138811
- Resolves: rhbz#1350037


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-4.b13
changelog:
- Replace bad 8159244 patch from upstream 8u with fresh backport from OpenJDK 9.
- Resolves: rhbz#1335322


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.101-7.b13
changelog:
- added patch532 hotspot-1358661.patch - to fix performance of bimorphic inlining may be bypassed by type speculation
- rhbz1358661
- added patch301 bz1204159_java8.patch - to fix systemtap on multiple jdks
- rhbz1204159
- added patch531 hotspot-8157306.changeset - to fix rare NPE injavac on aarch64
- rhbz1360863
- added all virtual provides of java-devel
- Resolves: rhbz#1216018


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-8.b13
changelog:
- Replace patch for S8157306 with upstream version, documented & applied on all archs with conditional in patch
- Resolves: rhbz#1360863


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-8.b13
changelog:
- Replace patch for S8162384 with upstream version. Document correctly along with SystemTap RH1204159 patch.
- Resolves: rhbz#1358661


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-9.b15
changelog:
- Update to aarch64-jdk8u101-b15.
- Rebase SystemTap tarball on IcedTea 3.1.0 versions so as to avoid patching.
- Drop additional hunk for 8147771 which is now applied upstream.
- Resolves: rhbz#1359857


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-0.b14
changelog:
- Update to aarch64-jdk8u102-b14.
- Drop 8140620, 8148752 and 6961123, all of which appear upstream in u102.
- Move 8159244 to 8u111 section as it only appears to be in unpublished u102 b31.
- Move 8158260 to 8u112 section following its backport to 8u.
- Resolves: rhbz#1359857


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.102-2.b14
changelog:
- @prefix@ in tapsetfiles substitued by prefix as necessary to work with systemtap3 (rhbz1371005)
- Resolves: rhbz#1295754


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.102-2.b14
changelog:
- declared check_sum_presented_in_spec and used in prep and check
- it is checking that latest packed java.security is mentioned in listing
- Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-3.b14
changelog:
- Rebuild java-1.8.0-openjdk for GCC aarch64 stack epilogue code generation fix (RH1372750)
- Resolves: rhbz#1359857


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-4.b14
changelog:
- Runtime native library requirements need to match the architecture of the JDK
- Resolves: rhbz#1375224


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-0.b14
changelog:
- Update to aarch64-jdk8u111-b14.
- Add latest md5sum for java.security file due to jar signing property addition.
- Drop S8157306 and the CORBA typo fix, both of which appear upstream in u111.
- Add LCMS 2 patch to fix Red Hat security issue RH1367357 in the local OpenJDK copy.
- Resolves: rhbz#1350037


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-3.b15
changelog:
- Add MD5 checksum from RHEL 7.2 security update so the 7.3 one overwrites it.
- Resolves: rhbz#1391132


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-4.b18
changelog:
- Update to aarch64-jdk8u111-b18, synced with upstream u111, S8170873 and new AArch64 fixes
- Resolves: rhbz#1391132


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-4.b18
changelog:
- Replace our correct version of 8159244 with the amendment to the 8u version from 8160122.
- Resolves: rhbz#1391132


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-5.b18
changelog:
- Use java-1.7.0-openjdk to bootstrap on RHEL to allow us to use main build target
- Resolves: rhbz#1391132


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.112-1.b16
changelog:
- Update to aarch64-jdk8u112-b16.
- Drop upstreamed patches for 8044762, 8049226, 8154210, 8158260 and 8160122.
- Re-generate size_t and key size (RH1163501) patches against u112.
- Resolves: rhbz#1391132


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-1.b13
changelog:
- Update to aarch64-jdk8u121-b13.
- Add MD5 checksum for the new java.security file (EC < 224, DSA < 1024 restricted)
- Update PR1834/RH1022017 fix to reduce curves reported by SSL to apply against u121.
- Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-2.b13
changelog:
- Backport "S8153711: [REDO] JDWP: Memory Leak: GlobalRefs never deleted when processing invokeMethod command"
- Resolves: rhbz#1284948


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-3.b13
changelog:
- Backport "8170888: [linux] Experimental support for cgroup memory limits in container (ie Docker) environments"
- Resolves: rhbz#1390708


author: jvanek <jvanek@redhat.com> - 1:1.8.0.121-4.b14
changelog:
- added shenandoah hotspot
- sync with fedora
- Resolves: rhbz#1400306
- Resolves: rhbz#1390708
- Resolves: rhbz#1388520
- Resolves: rhbz#1403992


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-6.b14
changelog:
- Regenerate tarball with correct version of PR2126 patch.
- Update generate_source_tarball.sh script to download correct version.
- Resolves: rhbz#1400306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-6.b14
changelog:
- Patch OpenJDK to check the system cacerts database directly
- Remove unneeded symlink to the system cacerts database
- Drop outdated openssl dependency from when the RPM built the cacerts database
- Resolves: rhbz#1319875


author: jvanek <jvanek@redhat.com> - 1:1.8.0.121-7.b14
changelog:
- updated to aarch64-shenandoah-jdk8u121-b14-shenandoah-merge-2017-03-08 (from aarch64-port/jdk8u-shenandoah) of hotspot
- used aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u121-b14-shenandoah-merge-2017-03-09.tar.xz as new sources for hotspot
- Resolves: rhbz#1400306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-9.b14
changelog:
- Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
- Update jstack tapset to handle AArch64
- Resolves: rhbz#1373848


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-10.b14
changelog:
- Move unprocessed nss.cfg to nss.cfg.in and add missing substitution to create nss.cfg for install
- Resolves: rhbz#1429774


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-10.b14
changelog:
- Add backports from 8u131 and 8u152 ahead of April CPU.
- Apply backports before local RPM fixes so they will be the same as when applied upstream
- Adjust RH1022017 following application of 8173783
- Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-1.b11
changelog:
- Update to aarch64-jdk8u131-b11 and aarch64-shenandoah-jdk8u131-b11.
- Drop upstreamed patches for 8147910, 8161993, 8170888 and 8173783.
- Update generate_source_tarball.sh to remove patch remnants.
- Cleanup Shenandoah tarball referencing and document how to create it.
- Add MD5 checksum for the new java.security file (MD5 disabled for JAR signing)
- Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-2.b11
changelog:
- Update tapset tarball to include the better error handling in PR3348
- http://icedtea.classpath.org/hg/icedtea8/rev/14fc67a5d5a3
- Resolves: rhbz#1438514


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-4.b11
changelog:
- Rename SystemTap tapset tarball to avoid conflicts with previous version.
- Resolves: rhbz#1438514


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-6.b12
changelog:
- Update to aarch64-jdk8u131-b12 and aarch64-shenandoah-jdk8u131-b12 for AArch64 8168699 fix
- Resolves: rhbz#1443417


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-8.b12
changelog:
- Restore cacerts symlink as some broken apps hardcode the path (see RH1448802)
- Resolves: rhbz#1319875


author: Zhengyu Gu <zgu@redhat.com> - 1:1.8.0.131-10.b12
changelog:
- Added 8181055-pr3394-rh1448880.patch to fix a corner case of previous change
- Resolves: rhbz#1448880


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.131-11.b12
changelog:
- make to use latest c-j-c and so fix persisting issues with java.security and other configfiles
- 1183793 is missing blocker
- Resolves: rhbz#1448880


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-12.b12
changelog:
- Add backports from 8u152 (8179084/RH1455694, 8181419/RH1463144, 8175887) ahead of July CPU.
- Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-1.b15
changelog:
- Update to aarch64-jdk8u141-b15 and aarch64-shenandoah-jdk8u141-b15.
- Update location of OpenJDK system library source code in remove-intree-libraries.sh
- Drop upstreamed patches for 6515172, 8144566, 8155049, 8165231, 8174164, 8174729 and 8175097.
- Update PR1983, PR2899 and PR2934 (SunEC + system NSS) to accomodate 8175110.
- Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-2.b16
changelog:
- Update to aarch64-jdk8u141-b16 and aarch64-shenandoah-jdk8u141-b16.
- Revert change to remove-intree-libraries.sh following backout of 8173207
- Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.144-1.b01
changelog:
- Update to aarch64-jdk8u144-b01 and aarch64-shenandoah-jdk8u144-b01.
- Exclude 8175887 from Shenandoah builds as it has been included in that repo.
- Resolves: rhbz#1477855


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.144-2.b01
changelog:
- Switch to IBM-supplied Montgomery backport and add remaining ppc64 fixes & CFF fix
- Resolves: rhbz#1498309
- Resolves: rhbz#1498319
- Resolves: rhbz#1498320
- Resolves: rhbz#1498321
- Resolves: rhbz#1484079


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.144-2.b01
changelog:
- Switch AArch64 to using java-1.8.0-openjdk to bootstrap until RH1482244 is fixed in bootstrap
- Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.144-2.b01
changelog:
- Reverted completely unnecessary patch addition which broke the RPM build.
- Resolves: rhbz#1484079


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-1.b12
changelog:
- Update to aarch64-jdk8u151-b12 and aarch64-shenandoah-jdk8u151-b12.
- Update location of OpenJDK zlib system library source code in remove-intree-libraries.sh
- Drop upstreamed patches for 8179084 and RH1367357 (part of 8183028).
- Update RH1191652 (root) and PR2842 to accomodate 8151841 (GCC 6 support).
- Update PR2964/RH1337583 to accomodate 8171319 (keytool warning output)
- Update RH1163501 to accomodate 8181048 (crypto refactoring)
- Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-1.b12
changelog:
- Add 8075484/PR3473/RH1490713 which is listed as being in 8u151 but not supplied by Oracle.
- Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-1.b12
changelog:
- Update SystemTap tapsets to version in IcedTea 3.6.0pre02 to fix RH1492139.
- Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-1.b12
changelog:
- Correct fix to RH1191652 root patch so existing COMMON_CCXXFLAGS_JDK is not lost.
- Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-1.b12
changelog:
- 8188030 is not yet upstream, so it should be listed under upstreamable fixes.
- 8181055, 8181419, 8145913, 8168318, 8170328 & 8181810 all now in 8u162.
- Resolves: rhbz#1499207


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.151-2.b12
changelog:
- repack policies adapted to new counts and paths
- note that also c-j-c is needed to make this apply in next update
- Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-3.b12
changelog:
- Switch bootstrap back to java-1.7.0-openjdk on all architectures, depending on RH1482244 fix
- Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-3.b12
changelog:
- Backport "8180048: Interned string and symbol table leak memory during parallel unlinking"
- Resolves: rhbz#1490260


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-5.b13
changelog:
- Update to aarch64-jdk8u151-b13 and aarch64-shenandoah-jdk8u151-b13.
- Drop upstreamed patch for 8075484.
- Resolves: rhbz#1508017


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.152-1.b16
changelog:
- Update to aarch64-jdk8u152-b16 and aarch64-shenandoah-jdk8u152-b16.
- Update 8145913/PR3466/RH1498309 patch following upstream addition of 8152172 (AES for PPC)
- Add new file cmsalpha.c to %{name}-remove-intree-libraries.sh
- Remove upstreamed patches for 8153711/PR3313/RH1284948, 8162384/PR3122/RH1358661, 8173941/PR3226,
-    8175813/PR3394/RH1448880, 8175887/PR3415, 8146086/PR3439/RH1478402, 8180048/PR3411/RH1449870 and
-    8164293/PR3412/RH1459641
- Resolves: rhbz#1508017


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.152-1.b16
changelog:
- Update to tzdata2017c (8190258/PR3499) to resolve TCK failure due to mismatch with system version.
- Resolves: rhbz#1508017


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.152-1.b16
changelog:
- Backport 8191137 and add updates to the translations (8191840 in OpenJDK 7)
- Resolves: rhbz#1512647


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.161-1.b12
changelog:
- Update to aarch64-jdk8u161-b12 and aarch64-shenandoah-jdk8u161-b12 (mbalao)
- Drop upstreamed patches for 8075484 (RH1490713), 8153711 (RH1284948),
  8162384 (RH1358661), 8164293 (RH1459641), 8173941, 8175813 (RH1448880),
  8175887 and 8180048 (RH1449870).(mbalao)
- drop more of usptreamed patches 565,566,567,568
  ( 8184673-pr3475-rh1487266.patch  8191840-pr3503-rh1512647.patch  8191137-pr3503-rh1512647.patch 8190258-pr3499-tzdata2017c.patch)
- Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-1.b12
changelog:
- Replace tarballs with version including AArch64 fix for 8174962 (S8194686)
- Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-1.b13
changelog:
- Update to b13 including Zero fix for 8174962 (S8194739) and restoring tzdata2017c update
- Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.162-0.b12
changelog:
- Update to aarch64-jdk8u162-b12 and aarch64-shenandoah-jdk8u162-b12.
- Remove upstreamed patches for 8181055/PR3394/RH1448880,
-  8181419/PR3413/RH1463144, 8145913/PR3466/RH1498309,
-  8168318/PR3466/RH1498320, 8170328/PR3466/RR1498321 and
-  8181810/PR3466/RH1498319.
- Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-1.b10
changelog:
- Bump release for RHEL 7.6 now branch is available.
- Resolves: rhbz#1538772
- Resolves: rhbz#1559766


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.171-3.b10
changelog:
- Backported from fedora: aarch64BuildFailure.patch, rhbz_1536622-JDK8197429-jdk8.patch, rhbz_1540242.patch
- Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-4.b10
changelog:
- Cleanup from previous commit.
- Remove unused upstream patch 8167200.hotspotAarch64.patch.
- Resolves: rhbz#1559766
- Resolves: rhbz#1536623


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-6.b10
changelog:
- Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add misisng ones
- Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-3.b10
changelog:
- Fix jconsole.desktop.in subcategory, replacing "Monitor" with "Profiling" (PR3550)
- Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-9.b12
changelog:
- Update to aarch64-jdk8u171-b12 and aarch64-shenandoah-jdk8u171-b12.
- Remove patch for 8200556/PR3566 as applied upstream.
- Resolves: rhbz#1573700


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-3.b11
changelog:
- Sync with IcedTea 3.8.0.
- Label architecture-specific fixes with architecture concerned
- x86: S8199936, PR3533: HotSpot generates code with unaligned stack, crashes on SSE operations (-mstackrealign workaround)
- PR3539, RH1548475: Pass EXTRA_LDFLAGS to HotSpot build
- 8171000, PR3542, RH1402819: Robot.createScreenCapture() crashes in wayland mode
- 8197546, PR3542, RH1402819: Fix for 8171000 breaks Solaris + Linux builds
- 8185723, PR3553: Zero: segfaults on Power PC 32-bit
- 8186461, PR3557: Zero's atomic_copy64() should use SPE instructions on linux-powerpcspe
- PR3559: Use ldrexd for atomic reads on ARMv7.
- 8187577, PR3578: JVM crash during gc doing concurrent marking
- 8201509, PR3579: Zero: S390 31bit atomic_copy64 inline assembler is wrong
- 8165489, PR3589: Missing G1 barrier in Unsafe_GetObjectVolatile
- PR3591: Fix for bug 3533 doesn't add -mstackrealign to JDK code
- 8184309, PR3596: Build warnings from GCC 7.1 on Fedora 26
- Resolves: rhbz#1573700


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-4.b11
changelog:
- Update Shenandoah tarball to include 2018-05-15 merge.
- Split PR3458/RH1540242 fix into AArch64 & Zero sections, so former can be skipped on Shenandoah builds.
- Drop PR3573 patch applied upstream.
- Restrict 8187577 fix to non-Shenandoah builds, as it's included in the new tarball.
- Resolves: rhbz#1573700


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-5.b11
changelog:
- Fix a number of bad bug identifiers (PR3546 should be PR3578, PR3456 should be PR3546)
- Resolves: rhbz#1573700


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-5.b11
changelog:
- Read jssecacerts file prior to trying either cacerts file (system or local) (PR3575)
- Resolves: rhbz#1567204


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-6.b11
changelog:
- Remove build flags exemption for aarch64 now the platform is more mature and can bootstrap OpenJDK with these flags.
- Remove duplicate -fstack-protector-strong; it is provided by the RHEL cflags.
- Resolves: rhbz#1573700


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-7.b11
changelog:
- Sync with IcedTea 3.8.0 patches to use -Wreturn-type.
- Add backports of 8141570, 8143245, 8197981 & 8062808.
- Drop pr3458-rh1540242-zero.patch which is covered by 8143245.
- Resolves: rhbz#1573700


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-7.b11
changelog:
- Bring in PR3519 from IcedTea 3.7.0 to fix remaining -Wreturn-type failure on AArch64.
- Resolves: rhbz#1573700


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-7.b11
changelog:
- Add additional fix (PR3601) to fix -Wreturn-type failures introduced by 8061651
- Resolves: rhbz#1573700


author: Jiri Vanek <jvanek@redhat.com> - 11:1.8.0.172-10.b11
changelog:
- jsa files changed to 444 to pass rpm verification
- Fix reg-ex for filtering private libraries' provides/requires.
- Resolves: rhbz#1573700


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-1.b03
changelog:
- Update to aarch64-jdk8u181-b03 and aarch64-shenandoah-jdk8u181-b03.
- Remove AArch64 patch for PR3458/RH1540242 as applied upstream.
- Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-3.b04
changelog:
- Mark bugs that have been pushed to 8u upstream and are scheduled for a release.
- Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-4.b04
changelog:
- Backport "8075942, PR3602: ArrayIndexOutOfBoundsException in sun.java2d.pisces.Dasher.goTo"
- Resolves: rhbz#1582032


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-4.b04
changelog:
- Backport "8203182, PR3603: Release session if initialization of SunPKCS11 Signature fails"
- Resolves: rhbz#1568033


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-5.b04
changelog:
- Add "8206406, PR3610, RH1597825: StubCodeDesc constructor publishes partially-constructed objects on StubCodeDesc::_list"
- Resolves: rhbz#1597825


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-6.b04
changelog:
- Add "8146115, PR3508, RH1463098: Improve docker container detection and resource configuration usage"
- Resolves: rhbz#1463098


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-7.b13
changelog:
- Update to aarch64-jdk8u181-b13 and aarch64-shenandoah-jdk8u181-b13.
- Remove 8187577/PR3578 now applied upstream.
- Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b15-0
changelog:
- Move to single OpenJDK tarball build, based on aarch64/shenandoah-jdk8u.
- Update to aarch64-shenandoah-jdk8u181-b15.
- Drop 8165489-pr3589.patch which was only applied to aarch64/jdk8u builds.
- Move buildver to where it should be in the OpenJDK version.
- Split ppc64 Shenandoah fix into separate patch file with its own bug ID (PR3620).
- Update pr3539-rh1548475.patch to apply after 8187045.
- Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b16-0
changelog:
- Update to aarch64-shenandoah-jdk8u181-b16.
- Drop PR3619 & PR3620 Shenandoah patches which should now be fixed upstream.
- Resolves: rhbz#1633822


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b10-0
changelog:
- Update to aarch64-shenandoah-jdk8u191-b10.
- Drop 8146115/PR3508/RH1463098 applied upstream.
- Resolves: rhbz#1633817


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.191.b12-2
changelog:
- made rhpkg and srpm or rebuild working on fedora again
- cosmetic changes - using macros where possible
- fixed issues in desktop files (missing vendor, unexpandedmacros, missing information)
- README.src renamed to README.md
- Resolves: rhbz#1633817


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.191.b12-3
changelog:
- cups moved to headful package
- enabled gtk2 in headful package (RH1598152)
- Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.191.b12-4
changelog:
- Update(s) from upstreamed patches:
  - jdk8036003-add_with_native_debug_symbols_configure_flag.patch
  - jdk8150954-pr2866-rh1176206-screenshot_xcomposite_jdk.patch =>
    jdk8150954-pr2866-rh1176206-screenshot_xcomposite_jdk.patch
    Deleted rh1176206-root.patch as thats no longer needed with
    upstream 8150954.
  - 8207057-pr3613-hotspot-assembler-debuginfo.patch =>
    jdk8207057-pr3613-no_debug_info_for_assembler_files_hotspot.patch and
    jdk8207057-pr3613-no_debug_info_for_assembler_files_root.patch. From JDK 8u
    backport.
- Use --with-native-debug-symbols=internal which JDK-8036003 adds.
- Remove comment for make invocation since it's no longer valid.
  --with-native-debug-symbols=internal will do everything we need.
- Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.191.b12-5
changelog:
- Removed patch, rh1214835.patch, since it's invalid:
  See https://icedtea.classpath.org/bugzilla/show_bug.cgi?id=2304#c3
- Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.191.b12-6
changelog:
- Add fixes for optimization gaps (annocheck issues):
  - 8210761: libjsig is being compiled without optimization
  - 8210647: libsaproc is being compiled without optimization
  - 8210416: [linux] Poor StrictMath performance due to non-optimized compilation
  - 8210425: [x86] sharedRuntimeTrig/sharedRuntimeTrans compiled without optimization
             8u upstream and aarch64/jdk8u upstream versions.
- Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.191.b12-7
changelog:
- Add patch jdk8210425-rh1632174-03-compile_with_o2_and_ffp_contract_off_as_for_fdlibm_zero.patch:
  - Annother fix for optimization gaps (annocheck issues)
  - Zero 8u version fix was missing. Hence, only shows up on Zero arches.
- Resolves: rhbz#1633817


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.191.b12-8
changelog:
- added Patch583 jdk8172850-rh1640127-01-register_allocator_crash.patch
- added Patch584 jdk8209639-rh1640127-02-coalesce_attempted_spill_non_spillable.patch
- Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b12-9
changelog:
- Fix patch organisation in the spec file:
-   * Move ECC patches back to upstreamable section
-   * Move system cacerts patches to upstreamable section
-   * Merge "Local fixes" and "RPM fixes" which amount to the same thing
-   * Move system libpng & lcms patches back to 8u upstreamable section
-   * Make it clearer that "Non-OpenJDK fixes" is currently empty
- Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b12-9
changelog:
- Note why PR1834/RH1022017 is not suitable to go upstream in its current form.
- Resolves: rhbz#1633817


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.191.b12-11
changelog:
- Renamed all patches to new convention
-   bug1-bug2-..-bugN-XY-lowercase_comment_suffix_or_jdkpart.patch
- Resolves: rhbz#1633817


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b12-13
changelog:
- Add backport of JDK-8029661 which adds TLSv1.2 support to the PKCS11 provider.
- Resolves: rhbz#1477159


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b12-15
changelog:
- Fix jdk8073139-pr1758-rh1191652-ppc64_le_says_its_arch_is_ppc64_not_ppc64le_jdk.patch paths to pass git apply
- Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b13-1
changelog:
- Update to aarch64-shenandoah-jdk8u191-b13.
- Update tarball generation script in preparation for PR3667/RH1656676 SunEC changes.
- Use remove-intree-libraries.sh to remove the remaining SunEC code for now.
- Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b14-1
changelog:
- Update to aarch64-shenandoah-jdk8u191-b14.
- Adjust JDK-8073139/PR1758/RH1191652 to apply following 8155627 backport.
- Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b14-2
changelog:
- Add 8131048 & 8164920 (PR3574/RH1498936) to provide a CRC32 intrinsic for PPC64.
- Resolves: rhbz#1498936


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.192.b12-1
changelog:
- Update to aarch64-shenandoah-jdk8u192-b12.
- Remove patches included upstream
  - JDK-8031668/PR2842
  - JDK-8148351/PR2842
  - JDK-6260348/PR3066
  - JDK-8061305/PR3335/RH1423421
  - JDK-8188030/PR3459/RH1484079
  - JDK-8205104/PR3539/RH1548475
  - JDK-8185723/PR3553
  - JDK-8186461/PR3557
  - JDK-8201509/PR3579
  - JDK-8075942/PR3602
  - JDK-8203182/PR3603
  - JDK-8206406/PR3610/RH1597825
  - JDK-8206425
  - JDK-8036003
  - JDK-8201495/PR2415
  - JDK-8150954/PR2866/RH1176206
- Re-generate patches (mostly due to upstream build changes)
  - JDK-8073139/PR1758/RH1191652
  - JDK-8143245/PR3548 (due to JDK-8202600)
  - JDK-8197429/PR3546/RH1536622 (due to JDK-8189170)
  - JDK-8199936/PR3533
  - JDK-8199936/PR3591
  - JDK-8207057/PR3613
  - JDK-8210761/RH1632174 (due to JDK-8207402)
  - PR3559 (due to JDK-8185723/JDK-8186461/JDK-8201509)
  - PR3593 (due to JDK-8081202)
  - RH1566890/CVE-2018-3639 (due to JDK-8189170)
  - RH1649664 (due to JDK-8196516)
- Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.192.b12-1
changelog:
- Add port of 8189170 to AArch64 which is missing from upstream 8u version.
- Resolves: rhbz#1661577


author: Jiri Vanek jvanek@redhat.com - 1:1.8.0.201.b09-2
changelog:
- Replaced pcsc-lite-devel (which is in optional channel) with pcsc-lite-libs.
- added rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch to make jdk work with pcsc


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.201.b09-3
changelog:
- Sync SystemTap & desktop files with upstream IcedTea release using new script
- Resolves: rhbz#1434241


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.201.b09-5
changelog:
- Update patch for RH1566890.
  - Renamed rh1566890_speculative_store_bypass_so_added_more_per_task_speculation_control_CVE_2018_3639 to
    rh1566890-CVE_2018_3639-speculative_store_bypass.patch
  - Added dependent patch,
    rh1566890-CVE_2018_3639-speculative_store_bypass_toggle.patch
- Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.201.b13-1
changelog:
- Update to aarch64-shenandoah-jdk8u201-b13.
- Drop JDK-8160748 & JDK-8189170 AArch64 patches now applied upstream.
- Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.202.b08-1
changelog:
- Update to aarch64-shenandoah-jdk8u202-b08.
- Remove patches included upstream
  - JDK-8211387/PR3559
  - JDK-8207057/PR3613
  - JDK-8165852/PR3468
  - JDK-8073139/PR1758/RH1191652
  - JDK-8044235
  - JDK-8172850/RH1640127
  - JDK-8209639/RH1640127
  - JDK-8131048/PR3574/RH1498936
  - JDK-8164920/PR3574/RH1498936
- Re-generate patches
  - JDK-8210647/RH1632174
- Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b02-1
changelog:
- Update to aarch64-shenandoah-jdk8u212-b02.
- Remove patches included upstream
  - JDK-8197429/PR3546/RH153662{2,3}
  - JDK-8184309/PR3596
  - JDK-8210647/RH1632174
  - JDK-8029661/PR3642/RH1477159
- Re-generate patches
  - JDK-8203030
- Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b02-1
changelog:
- Add missing part of JDK-8213419 for AArch64 removing duplicate uabs definitions
- Yet another cast to resolve s390 ambiguity in call to log2_intptr
- Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b01-1
changelog:
- Update to aarch64-shenandoah-jdk8u222-b01.
- Refactor PR2888 after inclusion of 8129988 upstream. Now includes PR3575.
- Drop 8171000, 8197546 & PR3634 as applied upstream.
- Adjust 8214206 fix for S390 as BinaryMagnitudeSeq moved to shenandoahNumberSeq.cpp
- Resolves: rhbz#1705328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b02-1
changelog:
- Update to aarch64-shenandoah-jdk8u222-b02.
- Drop 8064786/PR3599 & 8210416/RH1632174 as applied upstream (8064786 silently in 8176100).
- Resolves: rhbz#1705328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b03-1
changelog:
- Update to aarch64-shenandoah-jdk8u222-b03.
- Set milestone to "ea" as this is not the final release.
- Drop 8210425 patches applied upstream. Still need to add AArch64 version in aarch64/shenandoah-jdk8u.
- Re-generate JDK-8141570 & JDK-8143245 patches due to 8210425 zeroshark.make changes.
- Resolves: rhbz#1705328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b03-1
changelog:
- Handle milestone as variables so we can alter it easily and set the docs zip filename appropriately.
- Drop unused use_shenandoah_hotspot variable.
- Resolves: rhbz#1705328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b04-1
changelog:
- Update to aarch64-shenandoah-jdk8u222-b04.
- Drop remaining JDK-8210425/RH1632174 patch now AArch64 part is upstream.
- Resolves: rhbz#1705328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b07-1
changelog:
- Update to aarch64-shenandoah-jdk8u222-b07 and Shenandoah merge 2019-06-13.
- Resolves: rhbz#1724452


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.222.b07-2
changelog:
- Don't produce javadoc/javadoc-zip sub packages for the debug variant build.
- Don't perform a bootcycle build for the debug variant build.
- Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b08-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u222-b08.
- Adjust PR3083/RH134640 to apply after JDK-8182999
- Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b09-1
changelog:
- Update to aarch64-shenandoah-jdk8u222-b09.
- Switch to GA mode for final release.
- Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b09-2
changelog:
- Provide Javadoc debug subpackages for now, but populate them from the normal build.
- Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b09-2
changelog:
- Use normal_suffix for Javadoc zip filename to copy, as there is is no debug version.
- Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b01-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u232-b01.
- Switch to EA mode.
- Drop JDK-8210761/RH1632174 as now upstream.
- Resolves: rhbz#1498932


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b05-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u232-b05.
- Drop upstreamed patch JDK-8141570/PR3548.
- Adjust context of JDK-8143245/PR3548 to apply against upstream JDK-8141570.
- Resolves: rhbz#1737109


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b05-0.2.ea
changelog:
- Update to aarch64-shenandoah-jdk8u232-b05-shenandoah-merge-2019-09-09.
- Update version logic to handle -shenandoah* tag suffix.
- Resolves: rhbz#1737109


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-1
changelog:
- Update to aarch64-shenandoah-jdk8u232-b09.
- Switch to GA mode for final release.
- Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
- Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-3
changelog:
- Mark net.properties as a config file (based on Fedora patch by James Cassell)
- Resolves: rhbz#1710928


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-4
changelog:
- Update generate_source_tarball.sh script to use the PR3756 patch and retain the secp256k1 curve.
- Regenerate source tarball using the updated script and add the -'4curve' suffix.
- Resolves: rhbz#1746874


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-5
changelog:
- Replace JDK-8231991 backport with upstream version and include JDK-8234107 fixup.
- Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b05-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u242-b05.
- Attempt to fix Shenandoah formatting failures on S390, introduced by JDK-8232102.
- Revise b05 snapshot to include JDK-8236178.
- Add additional Shenandoah formatting fixes revealed by successful -Wno-error=format run
- Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b07-1
changelog:
- Update to aarch64-shenandoah-jdk8u242-b07.
- Switch to GA mode for final release.
- Remove Shenandoah S390 patch which is now included upstream as JDK-8236829.
- Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b08-1
changelog:
- Update to aarch64-shenandoah-jdk8u242-b08.
- Remove local copies of JDK-8031111 & JDK-8132111 as replaced by upstream versions.
- Fix paths in jdk8231991-mouse_wheel_focus.patch after git apply --stat complaints.
- Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b01-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u252-b01.
- Switch to EA mode.
- Adjust JDK-8199936/PR3533 patch following JDK-8227397 configure change
- Remove local copies of JDK-8231991 & JDK-8234107 as replaced by upstream versions.
- Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b03-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u252-b03.
- Adjust PR2974/RH1337583 & PR3083/RH1346460 following context changes in JDK-8230978
- Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b09-3
changelog:
- Update to aarch64-shenandoah-jdk8u242-b09.
- Switch to GA mode for final release.
- Resolves: rhbz#1810557


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b09-4
changelog:
- Add backports of JDK-8227269 & JDK-8241750 to resolve slow class loading with JDWP enabled.
- Resolves: rhbz#1751985


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b01-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u262-b01.
- Switch to EA mode.
- Adjust JDK-8143245/PR3548 patch following context changes due to JDK-8203287 for JFR
- Adjust RH1648644 following context changes due to introduction of JFR packages
- Add recently added binaries to alternatives set (clhsdb, hsdb, jfr)
- Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b02-0.2.ea
changelog:
- Enable JFR in our builds, ahead of upstream default.
- Only enable JFR for JIT builds, as it is not supported with Zero.
- Turn off JFR on x86 for now due to assert(SerializePageShiftCount == count) crash.
- Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b05-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u262-b05.
- Remove backports of JDK-8227269 & JDK-8241750 included upstream in 8u262-b05.
- Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b05-0.2.ea
changelog:
- Backport JDK-8243541 & require tzdata 2020a as latest tzdata package needs resource updates
- Resolves: rhbz#1838229


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b06-0.2.ea
changelog:
- Sync SystemTap & desktop files with upstream IcedTea release 3.15.0, removing previous workarounds
- Sync stapinstall handling with RHEL 8 implementation
- Need to support noarch for creating source RPMs for non-scratch builds.
- Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b07-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u262-b07.
- Drop JDK-8243541 backport now applied upstream.
- Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.4.ea
changelog:
- With JDK-8248399 fixed, a broken jfr binary is no longer installed on architectures without JFR.
- Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.5.ea
changelog:
- Restructure the build so a minimal initial build is then used for the final build (with docs)
- This reduces pressure on the system JDK and ensures the JDK being built can do a full build
- Introduce jfr_arches for architectures which support JFR.
- Introduce sa_arches for architectures which support the serviceability agent.
- Introduce share_arches for architectures which support class sharing (-Xshare:dump).
- Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b10-1
changelog:
- Update to aarch64-shenandoah-jdk8u262-b10.
- Switch to GA mode for final release.
- Update release notes for 8u262 release.
- Split JDK-8042159 patch into per-repo patches as upstream.
- Update JDK-8042159 JDK patch to apply after JDK-8238002 changes to Awt2dLibraries.gmk
- Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.265.b01-0
changelog:
- Update to aarch64-shenandoah-jdk8u265-b01.
- Update release notes for 8u265 release.
- Resolves: rhbz#1860456


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.265.b01-1
changelog:
- ASSEMBLY_EXCEPTION LICENSE THIRD_PARTY_README moved to fully versioned dirs
- Resolves: rhbz#1861222


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b01-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u272-b01.
- Switch to EA mode.
- Add debugging output for build.
- JFR must now be explicitly disabled when unwanted (e.g. x86), following switch of upstream default.
- Remove ZipConstants change from JDK-8186464 backport, now provided upstream by JDK-8075774
- Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b02-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u272-b02.
- Remove JDK-8154313 backport now applied upstream.
- Change target from 'zip-docs' to 'docs-zip', which is the naming used upstream.
- Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b04-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u272-b04.
- Update tarball generation script to use PR3795, following inclusion of JDK-8177334
- Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u272-b05.
- Fix context in JDK-8186464/RH1433262 patch, following JDK-8078334 @randomness tag addition.
- Add additional s390 size_t case in g1ConcurrentMarkObjArrayProcessor.cpp introduced by JDK-8057003
- Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u272-b05-shenandoah-merge-2020-08-28.
- Add additional s390 log2_intptr case in shenandoahUtils.cpp introduced by JDK-8245464
- Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.2.ea
changelog:
- Enable JFR on x86, now we have JDK-8252096: Shenandoah: adjust SerialPageShiftCount for x86_32 and JFR
- Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b06-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u272-b06.
- Update tarball generation script to use PR3799, following inclusion of JDK-8245468 (TLSv1.3)
- Resolves: rhbz#1876665


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.272.b09-0.1.ea
changelog:
- Set vendor property and vendor URLs
- Made URLs to be preconfigured by OS
- Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b09-0.1.ea
changelog:
- Include a test in the RPM to check the build has the correct vendor information.
- Use 'oj_' prefix on new vendor globals to avoid a conflict with RPM's vendor value.
- Improve quoting of vendor name
- Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-0
changelog:
- Update to aarch64-shenandoah-jdk8u272-b10.
- Switch to GA mode for final release.
- Update release notes for 8u272 release.
- Add backport of JDK-8254177 to update to tzdata 2020b
- Require tzdata 2020b due to resource changes in JDK-8254177
- Delay tzdata 2020b dependency until tzdata update has shipped.
- Adjust JDK-8062808/PR3548 following constantPool.hpp context change in JDK-8243302
- Adjust PR3593 following g1StringDedupTable.cpp context change in JDK-8240124 & JDK-8244955
- This tarball is embargoed until 2020-10-20 @ 1pm PT.
- Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-1
changelog:
- Add backport of JDK-8215727: "Restore JFR thread sampler loop to old / previous behaviour"
- Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.275.b01-0
changelog:
- Update to aarch64-shenandoah-jdk8u275-b01 (GA)
- Update release notes for 8u275.
- Resolves: rhbz#1895062


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b01-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u282-b01 (EA)
- Update release notes for 8u282-b01.
- Switch to EA mode.
- Require tzdata 2020b due to resource changes in JDK-8254177
- Remove PR3601, covered upstream by JDK-8062808.
- Remove upstreamed JDK-8197981/PR3548, JDK-8062808/PR3548, JDK-8254177 & JDK-8215727.
- Resolves: rhbz#1903903


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.282.b01-0.1.ea
changelog:
- Added patch600: rh1750419-redhat_alt_java.patch
- Replaced alt-java placeholder with real patched alt-java
- Removed patch529: rh1566890-CVE_2018_3639-speculative_store_bypass.patch
- Removed patch531: rh1566890-CVE_2018_3639-speculative_store_bypass_toggle.patch
- Both surpassed by new patch
- Resolves: rhbz#1901690


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b01-0.1.ea
changelog:
- Extend RH1750419 alt-java fix to include external debuginfo, following JDK-8252395 in 8u282-b01
- Resolves: rhbz#1901690


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b02-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u282-b02 (EA)
- Update release notes for 8u282-b02.
- Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b03-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u282-b03 (EA)
- Update release notes for 8u282-b03.
- Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b04-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u282-b04 (EA)
- Update release notes for 8u282-b04.
- Remove upstreamed patch PR3519
- Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b05-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u282-b05 (EA)
- Update release notes for 8u282-b05 and make some minor corrections.
- Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b06-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u282-b06 (EA)
- Update release notes for 8u282-b06.
- Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b07-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u282-b07 (EA)
- Update release notes for 8u282-b07.
- Fix placement issue in release notes, caught by comparing with vanilla version.
- Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b08-0
changelog:
- Update to aarch64-shenandoah-jdk8u282-b08 (GA)
- Update release notes for 8u282-b08.
- This tarball is embargoed until 2021-01-19 @ 1pm PT.
- Resolves: rhbz#1908963


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b01-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u292-b01 (EA)
- Update release notes for 8u292-b01.
- Switch to EA mode.
- Update tarball generation script to use PR3822 which handles
    JDK-8233228 & JDK-8035166 changes
- Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b02-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u292-b02 (EA)
- Update release notes for 8u292-b02.
- Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b03-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u292-b03 (EA)
- Update release notes for 8u292-b03.
- Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b04-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u292-b04 (EA)
- Update release notes for 8u292-b04.
- Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u292-b05 (EA)
- Update release notes for 8u292-b05.
- Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.1.ea
changelog:
- Re-organise S/390 patches for upstream submission, separating 8u upstream from Shenandoah fixes.
- Add new formatting case found in memprofiler.cpp on debug builds to PR3593 patch.
- Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.2.ea
changelog:
- Update to aarch64-shenandoah-jdk8u292-b05-shenandoah-merge-2021-03-11 (EA)
- Update release notes for 8u292-b05-shenandoah-merge-2021-03-11.
- Extend s390 patch to fix issue caused by JDK-8252660 backport and lack of JDK-8188813 in 8u.
- Revise JDK-8252660 s390 failure to make _soft_max_size a jlong so pointer types are accurate.
- Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b06-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u292-b06 (EA)
- Update release notes for 8u292-b06.
- Require tzdata 2020f due to JDK-8259048
- Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b07-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u292-b07 (EA)
- Update release notes for 8u292-b07.
- Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b08-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u292-b08 (EA)
- Update release notes for 8u292-b08.
- Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b09-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u292-b09 (EA)
- Update release notes for 8u292-b09.
- Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b10-0
changelog:
- Update to aarch64-shenandoah-jdk8u292-b10 (GA)
- Update release notes for 8u292-b10.
- This tarball is embargoed until 2021-04-20 @ 1pm PT.
- Resolves: rhbz#1938201


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b01-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u302-b01 (EA)
- Update release notes for 8u302-b01.
- Switch to EA mode.
- Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b02-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u302-b02 (EA)
- Update release notes for 8u302-b02.
- Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b03-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u302-b03 (EA)
- Update release notes for 8u302-b03.
- Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b03-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u302-b03-shenandoah-merge-2021-06-23 (EA)
- Update release notes for 8u302-b03-shenandoah-merge-2021-06-23.
- Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b04-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u302-b04 (EA)
- Update release notes for 8u302-b04.
- Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b05-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u302-b05 (EA)
- Update release notes for 8u302-b05.
- Remove JDK-8266929/RH1960024 as now upstream.
- Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b06-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u302-b06 (EA)
- Update release notes for 8u302-b06.
- Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b07-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u302-b07 (EA)
- Update release notes for 8u302-b07.
- Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b08-0
changelog:
- Update to aarch64-shenandoah-jdk8u302-b08 (EA)
- Update release notes for 8u302-b08.
- Switch to GA mode for final release.
- This tarball is embargoed until 2021-07-20 @ 1pm PT.
- Resolves: rhbz#1972395


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b01-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u312-b01 (EA)
- Update release notes for 8u312-b01.
- Switch to EA mode.
- Remove "-clean" suffix as no 8u312 builds are unclean.
- Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b02-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u312-b02 (EA)
- Update release notes for 8u312-b02.
- Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b03-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u312-b03 (EA)
- Update release notes for 8u312-b03.
- Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b04-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u312-b04 (EA)
- Update release notes for 8u312-b04.
- Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u312-b05 (EA)
- Update release notes for 8u312-b05.
- Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.2.ea
changelog:
- Update to aarch64-shenandoah-jdk8u312-b05-shenandoah-merge-2021-10-07
- Update release notes for 8u312-b05-shenandoah-merge-2021-10-07.
- Resolves: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.3.ea
changelog:
- Add patch to improve performance of common separators in Scanner.useLocale
- Move alt-java patch to correct section.
- Resolves: rhbz#1862929


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b07-1
changelog:
- Update to aarch64-shenandoah-jdk8u312-b07 (EA)
- Update release notes for 8u312-b07.
- Switch to GA mode for final release.
- This tarball is embargoed until 2021-10-19 @ 1pm PT.
- Resolves: rhbz#2011826


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b04-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u322-b04 (EA)
- Update release notes for 8u322-b04.
- Require tzdata 2021c as of JDK-8274407.
- Switch to EA mode.
- Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
- Related: rhbz#2022809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-1
changelog:
- Update to aarch64-shenandoah-jdk8u322-b06 (EA)
- Update release notes for 8u322-b06.
- Switch to GA mode for final release.
- Require tzdata 2021e as of JDK-8275766.
- Update tarball generation script to use git following shenandoah-jdk8u's move to github
- Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b01-0.1.ea
changelog:
- Update to shenandoah-jdk8u332-b01 (EA)
- Update release notes for shenandoah-8u332-b01.
- Switch to EA mode.
- Related: rhbz#2047529


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b06-0.1.ea
changelog:
- Update to shenandoah-jdk8u332-b06 (EA)
- Update release notes for shenandoah-8u332-b06.
- Resolves: rhbz#2047529


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b09-1
changelog:
- Update to shenandoah-jdk8u332-b09 (GA)
- Update release notes for 8u332-b09.
- Switch to GA mode for final release.
- This tarball is embargoed until 2022-04-19 @ 1pm PT.
- Resolves: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.342.b07-1
changelog:
- Update to shenandoah-jdk8u342-b07
- Update release notes for shenandoah-8u342-b07.
- Print release file during build, which should now include a correct SOURCE value from .src-rev
- Update tarball script with IcedTea GitHub URL and .src-rev generation
- Use "git apply" with patches in the tarball script to allow binary diffs
- Remove redundant "REPOS" variable from tarball script
- Include script to generate bug list for release notes
- Update tzdata requirement to 2022a to match JDK-8283350
- Rebase JDK-8186464 patch so it applies after JDK-8190753
- Resolves: rhbz#2106502


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.345.b01-1
changelog:
- Update to shenandoah-jdk8u345-b01 (GA)
- Update release notes for 8u345-b01.
- Resolves: rhbz#2112383


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b08-1
changelog:
- Update to shenandoah-jdk8u352-b08 (GA)
- Update release notes for shenandoah-8u352-b08.
- * This tarball is embargoed until 2022-10-18 @ 1pm PT. *
- Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b08-2
changelog:
- Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
- Add test to ensure timezones can be translated
- Related: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b07-0.1.ea
changelog:
- Update to shenandoah-jdk8u362-b07 (EA)
- Update release notes for shenandoah-8u362-b07.
- Switch to EA mode for 8u362 pre-release builds.
- Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
- Drop tzdata patches for 2022d & 2022e (JDK-8294357 & JDK-8295173) which are now upstream
- Update TestTranslations.java to test the new America/Ciudad_Juarez zone
- Resolves: rhbz#2150191


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b08-1
changelog:
- Update to shenandoah-jdk8u352-b08 (GA)
- Update release notes for shenandoah-8u352-b08.
- Fix broken links and missing release notes in older releases.
- Drop RH1163501 patch which is not upstream or in 11, 17 & 19 packages and seems obsolete
  - Patch was broken by inclusion of "JDK-8293554: Enhanced DH Key Exchanges"
  - Patch was added for a specific corner case of a 4096-bit DH key on a Fedora host that no longer exists
  - Fedora now appears to be using RSA and the JDK now supports ECC in preference to large DH keys
- Resolves: rhbz#2160111


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.372.b07-1
changelog:
- Update to shenandoah-jdk8u372-b07 (GA)
- Update release notes for shenandoah-8u372-b07.
- Require tzdata 2023c due to inclusion of JDK-8305113 in 8u372-b07
- Update generate_tarball.sh to add support for passing a boot JDK to the configure run
- Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
- Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
- Include JDK-8271199 backport early ahead of 8u382 (RH2175317)
- ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
- Resolves: rhbz#2185182
- Resolves: rhbz#2159458


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b01-0.1.ea
changelog:
- Update to shenandoah-jdk8u382-b01 (EA)
- Update release notes for shenandoah-8u382-b01.
- Switch to EA mode.
- Remove JDK-8271199 patch which is now upstream.
- Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b04-0.1.ea
changelog:
- Update to shenandoah-jdk8u382-b04 (EA)
- Update release notes for shenandoah-8u382-b04.
- Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b05-1
changelog:
- Update to shenandoah-jdk8u382-b05 (GA)
- Update release notes for shenandoah-8u382-b05.
- ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
- Resolves: rhbz#2221106


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.392.b08-1
changelog:
- For non debug subpackages, ghosted all alternatives (rhbz1649776)
- For non system JDKs, if-outed versionless provides.
- Aligned versions to be %{epoch}:%{version}-%{release} instead of chaotic
- Related: RHEL-11319


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.392.b08-1
changelog:
- Update to shenandoah-jdk8u392-b08 (GA)
- Update release notes for shenandoah-8u392-b08.
- Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
- Update bug URL for RHEL to point to the Red Hat customer portal
- Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
- Regenerate PR2462 patch following JDK-8315135
- Add backport of JDK-8312489 heading upstream for 8u402 (see OPENJDK-2095)
- Add missing JFR alternative ghost
- Move jcmd to the headless package
- ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
- Resolves: RHEL-12212
- Resolves: RHEL-13574
- Resolves: RHEL-13575
- Resolves: RHEL-13576
- Resolves: RHEL-11319
- Resolves: RHEL-13577


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 1:1.8.0.402.b06-1.tuxcare.els1
changelog:
- Upgrade to shenandoah-jdk8u402-b06. That fixes following CVEs:
- CVE-2024-20918: Array out-of-bounds access due to missing range check in C1 compiler
- CVE-2024-20919: JVM class file verifier flaw allows unverified bytecode execution
- CVE-2024-20921: Range check loop optimization issue
- CVE-2024-20926: Arbitrary Java code execution in Nashorn
- CVE-2024-20945: Logging of digital signature private keys
- CVE-2024-20952: RSA padding issue and timing side-channel attack against TLS
- Remove JDK-8312489 patch which is already in the sources


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 1:1.8.0.412.b08-1.tuxcare.els1
changelog:
- Upgrade to shenandoah-jdk8u412-b08. That fixes the following CVEs:
- CVE-2024-21011: Denial of service due to long Exception message logging
- CVE-2024-21085: Pack200 excessive memory allocation
- CVE-2024-21068: Integer overflow in C1 compiler address generation
- CVE-2024-21094: Unauthorized data modification due to C2 compilation failure
  with "Exceeded _node_regs array"


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 1:1.8.0.422.b05-1.tuxcare.els1
changelog:
- Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u422-b05. That fixes following CVEs:
- CVE-2024-21131: UTF8 size overflow
- CVE-2024-21138: Infinite loop vunlerability in SymbolTable
- CVE-2024-21140: Int overflow/underflow in Range Check Elimination (RCE)
- CVE-2024-21144: Invalid header validation leads to Pack200 excessive loading time
- CVE-2024-21145: Out-of-bounds access in MaskFill
- CVE-2024-21147: Out-of-bounds array index in Range Check Elimination (RCE)


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> 1:1.8.0.452.b09-1.tuxcare.els1
changelog:
- Upgrade openjdk-shenandoah-jdk8u-shenandoah-jdk8u452-b09. That fixes the following CVE:
  CVE-2025-21587, CVE-2025-30691 and CVE-2025-30698


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 1:1.8.0.462.b08-1.tuxcare.els1
changelog:
- Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u462-b08 (GA). That fixes following CVEs:
- CVE-2025-30749: better Glyph drawing
- CVE-2025-30754: enhance TLS protocol support
- CVE-2025-30761: improve scripting supports
- CVE-2025-50106: glyph out-of-memory access and crash


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.8-1
changelog:
- Update to jdk-11.0.20.0+8 (GA)
- Update release notes to 11.0.20.0+8
- Switch to GA mode for release
- ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
- Resolves: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.1.1-1
changelog:
- Update to jdk-11.0.20.1+1 (GA)
- Update release notes to 11.0.20.1+1
- Add backport of JDK-8312489 already upstream in 11.0.22 (see OPENJDK-2095)
- Add backport of JDK-8243210 already upstream in 11.0.21 (see RH2229269)
- Update openjdk_news script to specify subdirectory last
- Add missing discover_trees script required by openjdk_news
- Synchronise runtime and buildtime tzdata requirements
- Update README.md to match the version in later RHEL releases
- Resolves: rhbz#2236229


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.21.0.9-1
changelog:
- For non debug subpackages, ghosted all alternatives (rhbz1649776)
- For non system JDKs, if-outed versionless provides.
- Aligned versions to be %{epoch}:%{version}-%{release} instead of chaotic
- Related: RHEL-11320


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.21.0.9-1
changelog:
- Update to jdk-11.0.21+9 (GA)
- Update release notes to 11.0.21+9
- Remove system crypto policy patch which doesn't belong on RHEL 7 with no system policies
- Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
- Update bug URL for RHEL to point to the Red Hat customer portal
- Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
- Apply all patches using -p1
- Drop local backport of JDK-8243210 which is upstream from 11.0.21+2
- Add missing JFR alternative ghost
- Move jcmd to the headless package
- Replace -mstackrealign with -mincoming-stack-boundary=2 -mpreferred-stack-boundary=4 on x86_32 for stack alignment
- Disable the serviceability agent on Zero architectures even when the architecture itself is supported
- ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
- Resolves: RHEL-12217
- Resolves: RHEL-12910
- Resolves: RHEL-12913
- Resolves: RHEL-11320
- Resolves: RHEL-13227
- Resolves: RHEL-13217


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.21.0.9-2
changelog:
- Restore %{epoch}:%{javaver} versioning to jre, java, jre-headless, java-headless, java-devel & java-sdk
- Resolves: RHEL-19642


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.22.0.6-0.1.ea
changelog:
- Update to jdk-11.0.22+6 (EA)
- Update release notes to 11.0.22+6
- Switch to EA mode
- Drop local copy of JDK-8312489 which is now included upstream
- Resolves: RHEL-21031


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.22.0.7-1
changelog:
- Update to jdk-11.0.22+7 (GA)
- Update release notes to 11.0.22+7
- Switch to GA mode for release
- ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
- Resolves: RHEL-20966


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.1-0.1.ea
changelog:
- Update to jdk-11.0.23+1 (EA)
- Update release notes to 11.0.23+1
- Switch to EA mode
- Speed up PPC build by removing ppc64le --with-jobs=1 workaround


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.9-1
changelog:
- Update to jdk-11.0.23+9 (GA)
- Update release notes to 11.0.23+9
- Switch to GA mode for release
- Require tzdata 2024a due to upstream inclusion of JDK-8322725
- Only require tzdata 2023d for now as 2024a is unavailable in buildroot
- ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
- Resolves: RHEL-30914


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.9-2
changelog:
- Fix 11.0.22 release date in NEWS
- Restore ppc64le --with-jobs=1 workaround to avoid flaky ppc builds


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 1:11.0.26.0.4-1.tuxcare.els1
changelog:
- Upgrade to openjdk-11.0.26+4. The following CVEs were fixed:
- CVE-2024-21131: potential UTF8 size overflow
- CVE-2024-21138: excessive symbol length can lead to infinite loop
- CVE-2024-21140: range Check Elimination (RCE) pre-loop limit overflow
- CVE-2024-21144: Pack200 increase loading time due to improper header
  validation
- CVE-2024-21145: out-of-bounds access in 2D image handling
- CVE-2024-21147: RangeCheckElimination array index overflow
- CVE-2024-21208: HTTP client improper handling of maxHeaderSize
- CVE-2024-21210: array indexing integer overflow
- CVE-2024-21217: unbounded allocation leads to out-of-memory error
- CVE-2024-21235: integer conversion error leads to incorrect range check
- CVE-2025-21502: enhance array handling


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 1:11.0.27.0.6-1.tuxcare.els1
changelog:
- Upgrade to openjdk-11.0.27+6 (GA). The following CVEs were fixed:
- CVE-2025-21587: fix TLS connection support to avoid unauthorized
  access to critical data
- CVE-2025-30698: fix buffered image handling to avoid unauthorized
  access to accessible data
- CVE-2025-30691: improve compiler transformations to avoid unauthorized
  access to accessible data


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 11.0.28.0.6-1.tuxcare.els1
changelog:
- Upgrade to openjdk-11.0.28+6 (GA).). The following CVEs were fixed:
- CVE-2025-30749: better Glyph drawing
- CVE-2025-30754: enhance TLS protocol support
- CVE-2025-30761: improve scripting supports
- CVE-2025-50059: improve HTTP client header handling
- CVE-2025-50106: better Glyph drawing redux


author: Linar Nadeev <lnadeev@cloudlinux.com> - 1.15.1-55.tuxcare.els1
changelog:
- CVE-2024-37370: prevent modification of Extra Count field in GSS krb5 wrap
  token to avoid appearing truncated to application
- CVE-2024-37371: fix invalid memory reads during GSS message token handling


author: Paul Nasrat <pnasrat@redhat.com> - 3.3.6-1
changelog:
- Update to 3.3.6
- Fix typo  (#189647)
- Enable threading fixes (#181298)
- Conditionalize static library


author: Panu Matilainen <pmatilai@redhat.com> - 3.5.9-2
changelog:
- Remove references to temporary registers from cache on release (#463061)
- Enable loading of external extensions (#457433)


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.6.2-2
changelog:
- require tcl(abi) in sqlite-tcl subpackage (#474034)
- move tcl extensions to arch-specific location
- enable dependency extraction on the tcl dso
- require pkgconfig in sqlite-devel


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.12-2
changelog:
- disable strict aliasing to work around brokenness on 3.6.12 (#494266)
- run test-suite on build but let it fail for now


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.14-1
changelog:
- update to 3.6.14 (http://www.sqlite.org/releaselog/3_6_14.html)
- merge-review cosmetics (#226429)
  - drop ancient sqlite3 obsoletes
  - fix tab vs space whitespace issues
  - remove commas from summaries
- fixup io-test fsync expectations wrt SQLITE_DISABLE_DIRSYNC


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.17-1
changelog:
- update to 3.6.17 (http://www.sqlite.org/releaselog/3_6_17.html)
- disable to failing tests until upstream fixes


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.18-1
changelog:
- update to 3.6.18 (http://www.sqlite.org/releaselog/3_6_18.html)
- drop no longer needed test-disabler patches


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.23-1
changelog:
- update to 3.6.23 (http://www.sqlite.org/releaselog/3_6_23.html)
- drop the lemon sprintf patch, upstream doesn't want it
- make test-suite errors fail build finally


author: Panu Matilainen <pmatilai@redhat.com> - 3.7.4-1
changelog:
- update to 3.7.4 (http://www.sqlite.org/releaselog/3_7_4.html)
- deal with upstream source naming, versioning and format changing
- fixup wal2-test expections wrt SQLITE_DISABLE_DIRSYNC use


author: Panu Matilainen <pmatilai@redhat.com> - 3.7.7.1-1
changelog:
- update to 3.7.7.1 (http://www.sqlite.org/releaselog/3_7_7_1.html)
- autoconf no longer needed for build, libdl check finally upstreamed


author: Panu Matilainen <pmatilai@redhat.com> - 3.7.13-1
changelog:
- update to 3.7.13 (http://www.sqlite.org/releaselog/3_7_13.html)
- drop no longer needed savepoint relase patch


author: Panu Matilainen <pmatilai@redhat.com> - 3.7.15-1
changelog:
- update to 3.7.15 (http://www.sqlite.org/releaselog/3_7_15.html)
- fix an old incorrect date in spec changelog


author: Jan Stanek <jstanek@redhat.com> - 3.7.16.2-1
changelog:
- update to 3.7.16.2 (http://www.sqlite.org/releaselog/3_7_16_2.html)
- add support for aarch64 (rerunning autoconf) (#926568)


author: Jai S <jsathyapalan@cloudlinux.com> - 3.7.17-8.1.tuxcare.els2
changelog:
- CVE-2025-6965: fix memory corruption issue caused by a query where the number
  of aggregate terms could exceed the number of columns available.


author: Fridolin Pokorny <fpokorny@redhat.com> - 458-3
changelog:
- Expanded lessecho usage (#948597)
- Added lessfilter info to man (#948597)
- Expanded lesskey usage (#948597)
- Added --old-bot to help (#948597)


author: Jozef Mlich <jmlich@redhat.com> - 458-5
changelog:
- fixing regression in 72dfd3f63594e1d4c9416180a95c47ae583934c6
  incorrect parsing of commandline arguments
- Resolves #948597


author: Jozef Mlich <jmlich@redhat.com> - 458-8
changelog:
- changes introduced in less-458-old-bot-in-help.patch
  wasn't compiled in. It is necessary to use mkhelp tool.
  Resolves: #948597


author: Jozef Mlich <jmlich@redhat.com> - 458-9
changelog:
- The --use-backslash option documented in the man page
  was missing from online help for less.
  Resolves: #1109090


author: Dmitrii Zudin <dzudin@cloudlinux.com> - 458-9.tuxcare.els1
changelog:
- Fix CVE-2022-48624: filename.c (close_altfile): before 606 omits shell_quote
  calls for LESSCLOSE.


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.10-1
changelog:
- Only enable partition size tolerance with alignment (vpodzime)
- Limit the requested partition size to maximum possible (vpodzime)
- Do not verify vfat FS' size after generic resize (vpodzime)
- Specify tolerance for partition size (kailueke)
- Only use the exact constraint if not using any other (vpodzime)
- Check resulting FS size in tests for generic FS resize (vpodzime)
- Query setting FS label support and generic relabeling (kailueke)
- Do not strictly require all FS utilities (vpodzime)
- Compile everything with the C99 standard (vpodzime)
- Add partition resize function (kailueke)
- Generic Check and Repair Functions (kailueke)
- Query functions for FS resize and repair support (kailueke)
- Update the project/source URL in the spec file (vpodzime)
- Add functions for opening/closing TrueCrypt/VeraCrypt volumes (vpodzime)
- Adapt to a change in behaviour in new libmount (vpodzime)
- Try RO mount also if we get EACCES (vpodzime)
- Size in bytes for xfs_resize_device (kailueke)
- src/plugins/Makefile.am: Remove hard coded include path in /usr prefix (tristan.vanberkom)
- Fixed include for libvolume_key.h (tristan.vanberkom)
- Ignore parted warnings if possible (squimrel)
- bcache tests: Remove FEELINGLUCKY checks (tasleson)
- kbd.c: Code review corrections (tasleson)
- kbd.c: Make bd_kbd_bcache_create work without abort (tasleson)


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.11-1
changelog:
- Make the KbdZRAMDevicesTestCase inherit from KbdZRAMTestCase (vpodzime)
- Allow non-source directory builds (kailueke)
- Add a way to disable runtime dependency checks (vpodzime)
- Link to GObject even if no plugin is activated (kailueke)
- Skip zram tests on Rawhide (vpodzime)
- Keep most utilities available for tests (vpodzime)
- Use new libmount function to get (un)mount error message (vtrefny)
- Update the documentation URL (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.12-1
changelog:
- Own directories /etc/libblockdev and /etc/libblockdev/conf.d (vtrefny)
- Wait for resized partition (kailueke)
- Make sure the device is opened for libparted (vpodzime)
- Fix label check in swap_test (vtrefny)
- Use "run_tests" script for running tests from Makefile (vtrefny)
- Add a script for running tests (vtrefny)
- Tests: Move library initialization to setUpClass method (vtrefny)
- Stop skipping FAT resize tests on rawhide (vtrefny)
- Close filesystem before closing the partition during FAT resize (vtrefny)
- Use mountpoint for "xfs_info" calls (vtrefny)
- Use libmount cache when parsing /proc/mounts (vtrefny)
- Add some space for the CI status (vpodzime)
- Confirm the force when creating PVs in FS tests (vpodzime)
- Skip vgremove tests on 32bit Debian (vtrefny)
- Fix names of backing files in tests (vtrefny)
-  Fix checking for available locales (vtrefny)
- Skip dependency checking in mpath tests on Debian (vtrefny)
- Skip zRAM tests on Debian (vtrefny)
- Skip the test for device escrow on Debian too (vtrefny)
- Skip free region tests on Debian too (vtrefny)
- Fix redirecting command output to /dev/null in tests (vtrefny)
- Try harder to unmount devices in test cleanup (vtrefny)
- Require only plugins that are needed for given test (vtrefny)
- Try to get distribution info from "PrettyName" if "CPEName" isn't available (vtrefny)
- Use -ff when creating PVs in FS tests (vpodzime)
- Sync spec with downstream (vpodzime)


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.10-6
changelog:
- Fix sys/capabilities.h header (#55727)
- Move to /lib, some applications seem to be using this rather early
  (#55733)


author: Jakub Jelinek <jakub@redhat.com> 1.10-12
changelog:
- CFLAGS was using COPTFLAG variable, not COPTFLAGS
- build with -fpic
- apply the IA-64 patch everywhere, use capget/capset from glibc,
  not directly as _syscall (as it is broken on IA-32 with -fpic)
- reenable alpha


author: Mike A. Harris <mharris@redhat.com> 1.10-13
changelog:
- Removed %name macro sillyness from package Summary, description text, etc.
- Removed archaic Prefix: tag
- lib64 fixes everywhere to use _lib, _libdir, etc
- Removed deletion of RPM_BUILD_DIR from %clean section
- Added -q flag to setup macro
- Severely cleaned up spec file, and removed usage of perl


author: Karsten Hopp <karsten@redhat.de> 1.10-24
changelog:
- added development manpages
- as there are no manpages for the executables available, added at least
  a FAQ (#172324)


author: Steve Dickson <steved@redhat.com> 2.0.14-1
changelog:
- Updated to latest stable upstream version: 2.0.14-stable (bz 727129)
- Removed the installion of the outdate man pages and the latex raw docs.
- Corrected where the other doc are installed.


author: Steve Dickson <steved@redhat.com> 2.0.18-1
changelog:
- Updated to latest stable upstream version: 2.0.18-stable
- Moved documentation into its own rpm (bz 810138)


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.0.21-4.tuxcare.els1
changelog:
- CVE-2016-10195: fix an out-of-bounds stack read in the name_parse function
- CVE-2016-10196: fix a stack-based buffer overflow in the
  evutil_parse_sockaddr_port function
- CVE-2016-10197: fix DoS via an empty hostname in the search_make_new function


author: Jeff Johnson <jbj@redhat.com>
changelog:
- update to 1.1.7
- change license to LGPL.
- include splint annotations patch.
- install info pages.


author: Nalin Dahyabhai <nalin@redhat.com> 1.2.2-2
changelog:
- remove file conflicts in libgcrypt-config by making the 64-bit version
  think the libraries are in /usr/lib (which is wrong, but which it also
  prunes from the suggest --libs output, so no harm done, hopefully)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.2.4-4
changelog:
- clarify license
- force use of the linux /dev/random RNG, to avoid accidentally falling back
  to others which would affect the license of the resulting library


author: Nalin Dahyabhai <nalin@redhat.com> - 1.2.4-5
changelog:
- add missing gawk buildrequirement
- switch from explicitly specifying the /dev/random RNG to just verifying
  that the non-LGPL ones were disabled by the configure script


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.1-1
changelog:
- update to 1.4.1
- bump libgpgerror-devel requirement to 1.4, matching the requirement enforced
  by the configure script


author: Tomas Mraz <tmraz@redhat.com> 1.4.4-1
changelog:
- update to 1.4.4
- do not abort when the fips mode kernel flag is inaccessible
  due to permissions (#470219)
- hobble the library to drop the ECC support


author: Tomas Mraz <tmraz@redhat.com> 1.4.5-1
changelog:
- workaround for build on S390 (#548825)
- spec file cleanups
- upgrade to new minor upstream release


author: Tomas Mraz <tmraz@redhat.com> 1.4.5-3
changelog:
- drop the S390 build workaround as it is no longer needed
- additional spec file cleanups for merge review (#226008)


author: Tomas Mraz <tmraz@redhat.com> 1.4.5-5
changelog:
- use /dev/urandom for seeding in the FIPS mode
- make the tests to pass in the FIPS mode also fixing
  the FIPS-186-3 DSA keygen


author: Tomas Mraz <tmraz@redhat.com> 1.4.6-3
changelog:
- Make the FIPS-186-3 DSA implementation CAVS testable
- add configurable source of RNG seed /etc/gcrypt/rngseed
  in the FIPS mode (#700388)


author: Tomas Mraz <tmraz@redhat.com> 1.5.0-8
changelog:
- fix multilib conflict in libgcrypt-config
- fix minor memory leaks and other bugs found by Coverity scan


author: Tomáš Mráz <tmraz@redhat.com> 1.5.3-5
changelog:
- add FIPS DRBG implementation
- run the FIPS POST tests in shared library constructor
- make it possible to run the test suite in the FIPS mode


author: Tomáš Mráz <tmraz@redhat.com> 1.5.3-13
changelog:
- touch only urandom in the selftest and when /dev/random is
  unavailable for example by SELinux confinement
- fix the RSA selftest key (p q swap)


author: Tomáš Mráz <tmraz@redhat.com> 1.5.3-14
changelog:
- add DRBG CAVS driver and other necessary CAVS driver updates (#1172568)
- allow ath reinitialization in FIPS mode
- allow for auto-initialization of DRBG


author: Dmitriy Popov <dpopov@cloudlinux.com> 1.5.3-14.tuxcare.els1
changelog:
- CVE-2013-4576: Normalize the MPIs to prevent possible side-channel
  attacks
- CVE-2014-3591: Use ciphertext blinding for Elgamal to prevent
  possible side-channel attacks
- CVE-2021-33560: Use of smaller K for ephemeral key in ElGamal
  prevent generation of weak keys
- CVE-2021-40528: Add exponent blinding as well to mitigate
  side-channel attack on mpi_powm
- tests: Add a benchmark for Elgamal


author: Lennart Poettering <lpoetter@redhat.com> - 0-0.7.20100629git4176e5
changelog:
- New snapshot
- Split off -units package where other packages can depend on without pulling in the whole of systemd


author: Lennart Poettering <lpoetter@redhat.com> - 8-3
changelog:
- Reexecute after installation, take ownership of /var/run/user
- https://bugzilla.redhat.com/show_bug.cgi?id=627457
- https://bugzilla.redhat.com/show_bug.cgi?id=627634


author: Lennart Poettering <lpoetter@redhat.com> - 10-1
changelog:
- New upstream release
- https://bugzilla.redhat.com/show_bug.cgi?id=630401
- https://bugzilla.redhat.com/show_bug.cgi?id=630225
- https://bugzilla.redhat.com/show_bug.cgi?id=626966
- https://bugzilla.redhat.com/show_bug.cgi?id=623456


author: Lennart Poettering <lpoetter@redhat.com> - 14-1
changelog:
- Upstream update
- Enable hwclock-load by default
- Obsolete readahead
- Enable /var/run and /var/lock on tmpfs


author: Lennart Poettering <lpoetter@redhat.com> - 24-1
changelog:
- New upstream release
- https://bugzilla.redhat.com/show_bug.cgi?id=694079
- https://bugzilla.redhat.com/show_bug.cgi?id=693289
- https://bugzilla.redhat.com/show_bug.cgi?id=693274
- https://bugzilla.redhat.com/show_bug.cgi?id=693161


author: Lennart Poettering <lpoetter@redhat.com> - 25-1
changelog:
- New upstream release
- https://bugzilla.redhat.com/show_bug.cgi?id=694788
- https://bugzilla.redhat.com/show_bug.cgi?id=694321
- https://bugzilla.redhat.com/show_bug.cgi?id=690253
- https://bugzilla.redhat.com/show_bug.cgi?id=688661
- https://bugzilla.redhat.com/show_bug.cgi?id=682662
- https://bugzilla.redhat.com/show_bug.cgi?id=678555
- https://bugzilla.redhat.com/show_bug.cgi?id=628004


author: Lennart Poettering <lpoetter@redhat.com> - 26-1
changelog:
- New upstream release
- https://bugzilla.redhat.com/show_bug.cgi?id=699394
- https://bugzilla.redhat.com/show_bug.cgi?id=698198
- https://bugzilla.redhat.com/show_bug.cgi?id=698674
- https://bugzilla.redhat.com/show_bug.cgi?id=699114
- https://bugzilla.redhat.com/show_bug.cgi?id=699128


author: Lennart Poettering <lpoetter@redhat.com> - 26-2
changelog:
- Bugfix release
- https://bugzilla.redhat.com/show_bug.cgi?id=707507
- https://bugzilla.redhat.com/show_bug.cgi?id=707483
- https://bugzilla.redhat.com/show_bug.cgi?id=705427
- https://bugzilla.redhat.com/show_bug.cgi?id=707577


author: Michal Schmidt <mschmidt@redhat.com> - 28-3
changelog:
- Apply patches from current upstream
- https://bugzilla.redhat.com/show_bug.cgi?id=709909
- https://bugzilla.redhat.com/show_bug.cgi?id=710839
- https://bugzilla.redhat.com/show_bug.cgi?id=711015


author: Michal Schmidt <mschmidt@redhat.com> - 28-4
changelog:
- Apply patches from current upstream.
- Fixes memory size detection on 32-bit with >4GB RAM (BZ712341)


author: Lennart Poettering <lpoetter@redhat.com> - 35-1
changelog:
- New upstream release
- Update post scripts
- Resolves: #726683, #713384, #698198, #722803, #727315, #729997, #733706, #734611


author: Michal Schmidt <mschmidt@redhat.com> - 37-2
changelog:
- A couple of fixes from upstream:
- Fix a regression in bash-completion reported in Bodhi.
- Fix a crash in isolating.
- Resolves: #717325


author: Michal Schmidt <mschmidt@redhat.com> - 38-5
changelog:
- Build against libgee06. Reenable gtk tools.
- Delete unused patches.
- Add easy building of git snapshots.
- Remove legacy spec file elements.
- Don't mention implicit BuildRequires.
- Configure with --disable-static.
- Merge -units into the main package.
- Move section 3 manpages to -devel.
- Fix unowned directory.
- Run ldconfig in scriptlets.
- Split systemd-analyze to a subpackage.


author: Lennart Poettering <lpoetter@redhat.com> - 42-1
changelog:
- New upstream release
- Save a bit of entropy during system installation (#789407)
- Don't own /etc/os-release anymore, leave that to fedora-release


author: Dennis Gilmore <dennis@ausil.us> - 43-2
changelog:
- don't conflict with fedora-release systemd never actually provided
- /etc/os-release so there is no actual conflict


author: Dennis Gilmore <dennis@ausil.us> - 44-3
changelog:
- apply patch from upstream so we can build systemd on arm and ppc
- and likely the rest of the secondary arches


author: Michal Schmidt <mschmidt@redhat.com> - 44-4
changelog:
- Add triggers from Bill Nottingham to correct the damage done by
the obsoleted systemd-units's preun scriptlet (#807457).


author: Michal Schmidt <mschmidt@redhat.com> - 185-4.gita2368a3
changelog:
- Update to current git snapshot
- Add systemd-readahead-analyze
- Drop upstream patch
- Split systemd-libs
- Drop duplicate doc files
- Fixed License headers of subpackages


author: Lennart Poettering <lpoetter@redhat.com> - 188-1
changelog:
- New upstream release
- Enable gdm and avahi by default via the preset file
- Convert /etc/sysconfig/desktop to display-manager.service symlink
- Enable hardened build


author: Lennart Poettering <lpoetter@redhat.com> - 188-3
changelog:
- Remount file systems MS_PRIVATE before switching roots
- https://bugzilla.redhat.com/show_bug.cgi?id=847418


author: Ray Strode <rstrode@redhat.com> 188-4
changelog:
- more scriptlet fixes
(move dm migration logic to %posttrans so the service
files it's looking for are available at the time
the logic is run)


author: Lennart Poettering <lpoetter@redhat.com> - 189-3
changelog:
- Update preset policy
- Rename preset policy file from 99-default.preset to 90-default.preset so that people can order their own stuff after the Fedora default policy if they wish


author: Lennart Poettering <lpoetter@redhat.com> - 190-1
changelog:
- New upstream release
- Take possession of /etc/localtime, and remove /etc/sysconfig/clock
- https://bugzilla.redhat.com/show_bug.cgi?id=858780
- https://bugzilla.redhat.com/show_bug.cgi?id=858787
- https://bugzilla.redhat.com/show_bug.cgi?id=858771
- https://bugzilla.redhat.com/show_bug.cgi?id=858754
- https://bugzilla.redhat.com/show_bug.cgi?id=858746
- https://bugzilla.redhat.com/show_bug.cgi?id=858266
- https://bugzilla.redhat.com/show_bug.cgi?id=858224
- https://bugzilla.redhat.com/show_bug.cgi?id=857670
- https://bugzilla.redhat.com/show_bug.cgi?id=856975
- https://bugzilla.redhat.com/show_bug.cgi?id=855863
- https://bugzilla.redhat.com/show_bug.cgi?id=851970
- https://bugzilla.redhat.com/show_bug.cgi?id=851275
- https://bugzilla.redhat.com/show_bug.cgi?id=851131
- https://bugzilla.redhat.com/show_bug.cgi?id=847472
- https://bugzilla.redhat.com/show_bug.cgi?id=847207
- https://bugzilla.redhat.com/show_bug.cgi?id=846483
- https://bugzilla.redhat.com/show_bug.cgi?id=846085
- https://bugzilla.redhat.com/show_bug.cgi?id=845973
- https://bugzilla.redhat.com/show_bug.cgi?id=845194
- https://bugzilla.redhat.com/show_bug.cgi?id=845028
- https://bugzilla.redhat.com/show_bug.cgi?id=844630
- https://bugzilla.redhat.com/show_bug.cgi?id=839736
- https://bugzilla.redhat.com/show_bug.cgi?id=835848
- https://bugzilla.redhat.com/show_bug.cgi?id=831740
- https://bugzilla.redhat.com/show_bug.cgi?id=823485
- https://bugzilla.redhat.com/show_bug.cgi?id=821813
- https://bugzilla.redhat.com/show_bug.cgi?id=807886
- https://bugzilla.redhat.com/show_bug.cgi?id=802198
- https://bugzilla.redhat.com/show_bug.cgi?id=767795
- https://bugzilla.redhat.com/show_bug.cgi?id=767561
- https://bugzilla.redhat.com/show_bug.cgi?id=752774
- https://bugzilla.redhat.com/show_bug.cgi?id=732874
- https://bugzilla.redhat.com/show_bug.cgi?id=858735


author: Lennart Poettering <lpoetter@redhat.com> - 194-1
changelog:
- New upstream release
- https://bugzilla.redhat.com/show_bug.cgi?id=859614
- https://bugzilla.redhat.com/show_bug.cgi?id=859655


author: Lennart Poettering <lpoetter@redhat.com> - 195-1
changelog:
- New upstream release
- https://bugzilla.redhat.com/show_bug.cgi?id=831665
- https://bugzilla.redhat.com/show_bug.cgi?id=847720
- https://bugzilla.redhat.com/show_bug.cgi?id=858693
- https://bugzilla.redhat.com/show_bug.cgi?id=863481
- https://bugzilla.redhat.com/show_bug.cgi?id=864629
- https://bugzilla.redhat.com/show_bug.cgi?id=864672
- https://bugzilla.redhat.com/show_bug.cgi?id=864674
- https://bugzilla.redhat.com/show_bug.cgi?id=865128
- https://bugzilla.redhat.com/show_bug.cgi?id=866346
- https://bugzilla.redhat.com/show_bug.cgi?id=867407
- https://bugzilla.redhat.com/show_bug.cgi?id=868603


author: Michal Schmidt <mschmidt@redhat.com> - 195-4
changelog:
- add dmraid-activation.service to the default preset
- add yum protected.d fragment
- https://bugzilla.redhat.com/show_bug.cgi?id=869619
- https://bugzilla.redhat.com/show_bug.cgi?id=869717


author: Michal Schmidt <mschmidt@redhat.com> - 195-6
changelog:
- Fix cyclical dep between systemd and systemd-libs.
- Avoid broken build of test-journal-syslog.
- https://bugzilla.redhat.com/show_bug.cgi?id=873387
- https://bugzilla.redhat.com/show_bug.cgi?id=872638


author: Michal Schmidt <mschmidt@redhat.com> - 195-7
changelog:
- Revert udev killing cgroup patch for F18 Beta.
- https://bugzilla.redhat.com/show_bug.cgi?id=873576


author: Lennart Poettering <lpoetter@redhat.com> - 195-8
changelog:
- https://bugzilla.redhat.com/show_bug.cgi?id=873459
- https://bugzilla.redhat.com/show_bug.cgi?id=878093


author: Michal Schmidt <mschmidt@redhat.com> - 196-2
changelog:
- added spice-vdagentd.service to presets (Lennart, #876237)
- BR cryptsetup-devel instead of the legacy cryptsetup-luks-devel provide name
(requested by Milan Brož).
- verbose make to see the actual build flags


author: Michal Schmidt <mschmidt@redhat.com> - 196-3
changelog:
- Disable hardening on s390(x) because PIE is broken there and produces
text relocations with __thread (#868839).


author: Michal Schmidt <mschmidt@redhat.com> - 197-2
changelog:
- Added qemu-guest-agent.service to presets (Lennart, #885406).
- Add missing pygobject3-base to systemd-analyze deps (Lennart).
- Do not require hwdata, it is all in the hwdb now (Kay).
- Drop dependency on dbus-python.


author: Michal Schmidt <mschmidt@redhat.com> - 201-2
changelog:
- Automatically discover whether to run autoreconf and add autotools and git
BuildRequires based on the presence of patches to be applied.
- Use find -delete.


author: Harald Hoyer <harald@redhat.com> 202-2
changelog:
- nspawn create empty /etc/resolv.conf if necessary
- python wrapper: add sd_journal_add_conjunction()
- fix s390 booting
- Resolves: rhbz#953217


author: Harald Hoyer <harald@redhat.com> 202-3
changelog:
- fix ENOENT for getaddrinfo
- Resolves: rhbz#954012 rhbz#956035
- crypt-setup-generator: correctly check return of strdup
- logind-dbus: initialize result variable
- prevent library underlinking


author: Lennart Poettering <lpoetter@redhat.com> - 204-5
changelog:
- Rename 90-display-manager.preset to 85-display-manager.preset so that it actually takes precedence over 90-default.preset's "disable *" line (#903690)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 206-3
changelog:
- add dependency on kmod >= 14
- remove /var/log/journal to make journal non-persistant (#989750)
- add hypervkvpd.service to presets (#924321)


author: Harald Hoyer <harald@redhat.com> 206-4
changelog:
- journal: handle multiline syslog messages
- man: Fix copy&paste error
- core: synchronously block when logging
- journal: immediately sync to disk as soon as we receieve an EMERG/ALERT/CRIT message
- initctl: use irreversible jobs when switching runlevels
- udev: log error if chmod/chown of static dev nodes fails
- udev: static_node - don't touch permissions uneccessarily
- tmpfiles: support passing --prefix multiple times
- tmpfiles: introduce --exclude-prefix
- tmpfiles-setup: exclude /dev prefixes files
- logind: update state file after generating the session fifo, not before
- journalctl: use _COMM= match for scripts
- man: systemd.unit: fix volatile path
- man: link up scope+slice units from systemd.unit(5)
- man: there is no session mode, only user mode
- journal: fix hashmap leak in mmap-cache
- systemd-delta: Only print colors when on a tty
- systemd: fix segv in snapshot creation
- udev: hwdb - try reading modalias for usb before falling back to the composed one
- udevd: respect the log-level set in /etc/udev/udev.conf
- fstab-generator: respect noauto/nofail when adding sysroot mount


author: Harald Hoyer <harald@redhat.com> 206-5
changelog:
- obsolete upstart
Resolves: rhbz#978014
- obsolete hal
Resolves: rhbz#975589
- service: always unwatch PIDs before forgetting old ones
Resolves: rhbz#995197
- units: disable kmod-static-nodes.service in containers
- use CAP_MKNOD ConditionCapability
- fstab-generator: read rd.fstab=on/off switch correctly
- backlight: add minimal tool to save/restore screen brightness
- backlight: instead of syspath use sysname for identifying
- sysctl: allow overwriting of values specified in "later"
- systemd-python: fix initialization of _Reader objects
- udevd: simplify sigterm check
- libudev: fix hwdb validation to look for the *new* file
- units: make fsck units remain after exit
- udev: replace CAP_MKNOD by writable /sys condition
- libudev-enumerate.c:udev_enumerate_get_list_entry() fixed
- journal: fix parsing of facility in syslog messages


author: Harald Hoyer <harald@redhat.com> 206-8
changelog:
- support "debug" kernel command line parameter
- journald: fix fd leak in journal_file_empty
- journald: fix vacuuming of archived journals
- libudev: enumerate - do not try to match against an empty subsystem
- cgtop: fixup the online help
- libudev: fix memleak when enumerating childs


author: Lukas Nykryn <lnykryn@redhat.com> - 207-2
changelog:
- Advertise hibernation only if there's enough free swap
- swap: create .wants symlink to 'auto' swap devices
- Verify validity of session name when received from outside
- polkit: Avoid race condition in scraping /proc
Resolves: rhbz#1005142


author: Lukas Nykryn <lnykryn@redhat.com> - 207-5
changelog:
- create /etc/rc.d/rc.local (#968401)
- cgroup: always enable memory.use_hierarchy= for all cgroups (#1011575)
- remove user@.service (#1019738)
- drop some out-of-date references to cgroup settings (#1000004)
- explain NAME in systemctl man page (#978954)


author: Harald Hoyer <harald@redhat.com> 207-6
changelog:
- changed systemd-journal-gateway login shell to /sbin/nologin
- backported a lot of bugfixes
- udev: path_id - fix by-path link generation for scm devices
Resolves: rhbz#888707


author: Lukas Nykryn <lnykryn@redhat.com> - 207-9
changelog:
- treat reload failure as failure (#1036848)
- improve journal performance (#1029604)
- backport bugfixes (#1043525)
- fix handling of trailing whitespace in split_quoted (#984832)
- localed: match converted keymaps before legacy (#903776)
- improve the description of parameter X in tmpfiles.d page (#1029604)
- obsolete ConsoleKit (#1039761)
- make rc.local more backward comaptible (#1039465)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 207-12
changelog:
- shell-completion: remove load and dump from systemctl (#1048066)
- delta: ensure that d_type will be set on every fs (#1050795)
- tmpfiles: don't allow label_fix to print ENOENT when we want to ignore it (#1044871)
- udev/net_id: Introduce predictable network names for Linux on System z (#870859)
- coredumpctl: in case of error free pattern after print (#1052786)


author: Michal Sekletar <msekleta@redhat.com> - 208-1
changelog:
- rebase to systemd-208 (#1063332)
- do not create symlink /etc/systemd/system/syslog.service (#1055421)


author: Michal Sekletar <msekleta@redhat.com> - 208-2
changelog:
- require redhat-release package
- call systemd-tmpfiles after package installation (#1059345)
- move preset policy out of systemd package (#903690)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-7
changelog:
- setup tty permissions and group for /dev/sclp_line0 (#1070310)
- cdrom_id: use the old MMC fallback (#1038015)
- mount: don't send out PropertiesChanged message if actually nothing got changed (#1069718)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-8
changelog:
- rules: mark loop device as SYSTEMD_READY=0 if no file is attached (#1067422)
- utmp: make sure we don't write the utmp reboot record twice on each boot (#1053600)
- rework session shutdown logic (#1047614)
- introduce new stop protocol for unit scopes (#1064976)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-9
changelog:
- fixes crashes in logind and systemd (#1073994)
- run fsck before mouting root in initramfs (#1056661)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-11
changelog:
- logind-session: save stopping flag (#1082692)
- unit: add waiting jobs to run queue in unit_coldplug (#1083159)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-12
changelog:
- units/serial-getty@.service: add [Install] section (#1083936)
- units: order network-online.target after network.target (#1072431)
- util: consider both fuse.glusterfs and glusterfs network file systems (#1080229)
- core: make StopWhenUnneeded work in conjunction with units that fail during their start job (#986949)
- cgroups-agent: down-grade log level (#1044386)
- random-seed: raise POOL_SIZE_MIN constant to 1024 (#1066517)
- delta: do not use unicode chars in C locale (#1088419)
- core: print debug instead of error message (#1105608)
- journald: always add syslog facility for messages coming from kmsg (#1113215)
- fsck,fstab-generator: be lenient about missing fsck.<type> (#1098310)
- rules/60-persistent-storage: add nvme pcie ssd scsi_id ENV (#1042990)
- cgls: fix running with -M option (#1085455)
- getty: Start getty on 3270 terminals available on Linux on System z (#1075729)
- core: Added support for ERRNO NOTIFY_SOCKET  message parsing (#1106457)
- socket: add SocketUser= and SocketGroup= for chown()ing sockets in the file system (#1111761)
- tmpfiles: add --root option to operate on an alternate fs tree (#1111199)
- units: make ExecStopPost action part of ExecStart (#1036276)
- machine-id: only look into KVM uuid when we are not running in a container (#1123452)
- util: reset signals when we fork off agents (#1134818)
- udev: do not skip the execution of RUN when renaming a network device fails (#1102135)
- man: mention System Administrator's Guide in systemctl manpage (#978948)
- vconsole: also copy character maps (not just fonts) from vt1 to vt2, vt3, ... (#1002450)
- localed: consider an unset model as a wildcard (#903776)
- systemd-detect-virt: detect s390 virtualization (#1139149)
- socket: introduce SELinuxContextFromNet option (#1113790)
- sysctl: make --prefix allow all kinds of sysctl paths (#1138591)
- man: mention localectl in locale.conf (#1049286)
- rules: automatically online hot-added CPUs (#968811)
- rules: add rule for naming Dell iDRAC USB Virtual NIC as 'idrac' (#1054477)
- bash-completion: add verb set-property (#1064487)
- man: update journald rate limit defaults (#1145352)
- core: don't try to connect to d-bus after switchroot (#1083300)
- localed: check for partially matching converted keymaps (#1109145)
- fileio: make parse_env_file() return number of parsed items (#1069420)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-13
changelog:
- tmpfiles: minor modernizations (#1147524)
- install: when looking for a unit file for enabling, search for templates only after traversing all search directories (#1147524)
- install: remove unused variable (#1147524)
- bootctl: typo fix in help message (#1147524)
- logind: ignore failing close() on session-devices (#1147524)
- sysfs-show.c: return negative error (#1147524)
- core: only send SIGHUP when doing first kill, not when doing final sigkill (#1147524)
- cgroup: make sure to properly send SIGCONT to all processes of a cgroup if that's requested (#1147524)
- core: don't send duplicate SIGCONT when killing units (#1147524)
- efi: fix Undefined reference efi_loader_get_boot_usec when EFI support is disabled (#1147524)
- macro: better make IN_SET() macro use const arrays (#1147524)
- macro: make sure we can use IN_SET() also with complex function calls as first argument (#1147524)
- core: fix property changes in transient units (#1147524)
- load-modules: properly return a failing error code if some module fails to load (#1147524)
- core/unit: fix unit_add_target_dependencies() for units with no dependencies (#1147524)
- man: there is no ExecStopPre= for service units (#1147524)
- man: document that per-interface sysctl variables are applied as network interfaces show up (#1147524)
- journal: downgrade vaccuum message to debug level (#1147524)
- logs-show: fix corrupt output with empty messages (#1147524)
- journalctl: refuse extra arguments with --verify and similar (#1147524)
- journal: assume that next entry is after previous entry (#1147524)
- journal: forget file after encountering an error (#1147524)
- man: update link to LSB (#1147524)
- man: systemd-bootchart - fix spacing in command (#1147524)
- man: add missing comma (#1147524)
- units: Do not unescape instance name in systemd-backlight@.service (#1147524)
- manager: flush memory stream before using the buffer (#1147524)
- man: multiple sleep modes are to be separated by whitespace, not commas (#1147524)
- man: fix description of systemctl --after/--before (#1147524)
- udev: properly detect reference to unexisting part of PROGRAM's result (#1147524)
- gpt-auto-generator: don't return OOM on parentless devices (#1147524)
- man: improve wording of systemctl's --after/--before (#1147524)
- cgroup: it's not OK to invoke alloca() in loops (#1147524)
- core: don't try to relabel mounts before we loaded the policy (#1147524)
- systemctl: --kill-mode is long long gone, don't mention it in the man page (#1147524)
- ask-password: when the user types a overly long password, beep and refuse (#1147524)
- logind: don't print error if devices vanish during ACL-init (#1147524)
- tty-ask-password-agent: return negative errno (#1147524)
- journal: cleanup up error handling in update_catalog() (#1147524)
- bash completion: fix __get_startable_units (#1147524)
- core: check the right variable for failed open() (#1147524)
- man: sd_journal_send does nothing when journald is not available (#1147524)
- man: clarify that the ExecReload= command should be synchronous (#1147524)
- conf-parser: never consider it an error if we cannot load a drop-in file because it is missing (#1147524)
- socket: properly handle if our service vanished during runtime (#1147524)
- Do not unescape unit names in [Install] section (#1147524)
- util: ignore_file should not allow files ending with '~' (#1147524)
- core: fix invalid free() in killall() (#1147524)
- install: fix invalid free() in unit_file_mask() (#1147524)
- unit-name: fix detection of unit templates/instances (#1147524)
- journald: make MaxFileSec really default to 1month (#1147524)
- bootchart: it's not OK to return -1 from a main program (#1147524)
- journald: Fix off-by-one error in "Missed X kernel messages" warning (#1147524)
- man: drop references to removed and obsolete 'systemctl load' command (#1147524)
- units: fix BindsTo= logic when applied relative to services with Type=oneshot (#1147524)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-15
changelog:
- core: do not segfault if /proc/swaps cannot be opened (#1151239)
- man: we don't have 'Wanted' dependency (#1152487)
- environment: append unit_id to error messages regarding EnvironmentFile (#1147691)
- udevd: add --event-timeout commandline option (#1154778)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-16
changelog:
- logind: use correct "who" enum values with KillUnit. (#1155502)
- logind: always kill session when termination is requested (#1155502)
- udev: net_id - correctly name netdevs based on dev_port when set (#1155996)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-17
changelog:
- udev: net_id dev_port is base 10 (#1155996)
- udev: Fix parsing of udev.event-timeout kernel parameter (#1154778)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 217-0.2
changelog:
- spec fixes
- core: introduce new Delegate=yes/no property controlling creation of cgroup subhierarchies


author: Lukáš Nykrýn <lnykryn@redhat.com> - 218-0.3
changelog:
- rebase to 218
- remove networkd tmpfiles snipets due to packaging issues
- add resolved subpackage
- backport some nspawn features from upstream


author: Lukas Nykryn <lnykryn@redhat.com> - 219-2
changelog:
- udev: restore udevadm settle timeout (#1210981)
- udev: settle should return immediately when timeout is 0 (#1210981)
- udev: Fix ping timeout when settle timeout is 0 (#1210981)
- detect-virt: use /proc/device-tree (#1207773)
- ARM: detect-virt: detect Xen (#1207773)
- ARM: detect-virt: detect QEMU/KVM (#1207773)
- Persistent by_path links for ata devices (#1045498)
- man: document forwarding to syslog better (#1177336)
- man: fix typos in previous comimt (#1177336)
- LSB: always add network-online.target to services with priority over 10 (#1189253)
- rules: enable memory hotplug (#1105020)
- rules: reload sysctl settings when the bridge module is loaded (#1182105)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-3
changelog:
- console-getty.service: don't start when /dev/console is missing (#1222517)
- resolved: Do not add .busname dependencies, when compiling without kdbus. (#1222517)
- man: add journal-remote.conf(5) (#1222517)
- mount: don't run quotaon only for network filesystems (#1222517)
- mount: fix up wording in the comment (#1222517)
- udev: net_id - fix copy-paste error (#1222517)
- man: don't mention "journalctl /dev/sda" (#1222517)
- units: move After=systemd-hwdb-update.service dependency from udev to udev-trigger (#1222517)
- units: explicitly order systemd-user-sessions.service after nss-user-lookup.target (#1222517)
- zsh-completion: update loginctl (#1222517)
- zsh-completion: add missing -M completion for journalctl (#1222517)
- zsh-completion: update hostnamectl (#1222517)
- shell-completion: systemctl switch-root verb (#1222517)
- core/automount: beef up error message (#1222517)
- man: remove 'fs' from 'rootfsflags' (#1222517)
- shared: fix memleak (#1222517)
- udevd: fix synchronization with settle when handling inotify events (#1222517)
- python-systemd: fix is_socket_inet to cope with ports (#1222517)
- man: fix examples indentation in tmpfiles.d(5) (#1222517)
- systemctl: avoid bumping NOFILE rlimit unless needed (#1222517)
- exit-status: Fix "NOTINSSTALLED" typo (#1222517)
- tmpfiles: there's no systemd-forbid-user-logins.service service (#1222517)
- kmod-setup: load ip_tables kmod at boot (#1222517)
- util: Fix assertion in split() on missing ' (#1222517)
- units: set KillMode=mixed for our daemons that fork worker processes (#1222517)
- unit: don't add automatic dependencies on device units if they aren't supported (#1222517)
- update-done: ignore nanosecond file timestamp components, they are not reliable (#1222517)
- sd-daemon: simplify sd_pid_notify_with_fds (#1222517)
- fstab-generator: add x-systemd.requires and x-systemd.requires-mounts-for (#1164334)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-4
changelog:
- core: Fix assertion with empty Exec*= paths (#1222517)
- rules: load sg module (#1186462)
- util: add shell_maybe_quote() call for preparing a string for shell cmdline inclusion (#1016680)
- bus-util: be more verbose if dbus job fails (#1016680)
- notify: fix badly backported help message (#1199644)
- cryptsetup: craft a unique ID with the source device (#1226333)
- systemctl: introduce --now for enable, disable and mask (#1233081)
- udev: also create old sas paths (#957112)
- journald: do not strip leading whitespace from messages (#1227396)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-5
changelog:
- Revert "core: one step back again, for nspawn we actually can't wait for cgroups running empty since systemd will get exactly zero notifications about it" (#1199644)
- bus-creds: always set SD_BUS_CREDS_PID when we set pid in the mask (#1230190)
- sd-bus: do not use per-datagram auxiliary information (#1230190)
- sd-bus: store selinux context at connection time (#1230190)
- journald: simplify context handling (#1230190)
- bash-completion: add verb set-property (#1235635)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-6
changelog:
- sd-bus: don't inherit connection creds into message creds when we have a direct connection (#1230190)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-8
changelog:
- sysv-generator test: Fix assertion (#1222517)
- man: avoid line break in url (#1222517)
- Add VARIANT as a standard value for /etc/os-release (#1222517)
- Fix permissions on /run/systemd/nspawn/locks (#1222517)
- generators: rename add_{root,usr}_mount to add_{sysroot,sysroot_usr}_mount (#1222517)
- Generate systemd-fsck-root.service in the initramfs (#1222517)
- units: fix typo in systemd-resolved.service (#1222517)
- core: don't consider umask for SocketMode= (#1222517)
- timedate: fix memory leak in timedated (#1222517)
- coredump: make sure we vacuum by default (#1222517)
- tmpfiles: don't fail if we cannot create a subvolume because a file system is read-only but a dir already exists anyway (#1222517)
- resolved: fix crash when shutting down (#1222517)
- resolved: allow DnsAnswer objects with no space for RRs (#1222517)
- id128: add new sd_id128_is_null() call (#1222517)
- journalctl: Improve boot ID lookup (#1222517)
- test-hashmap: fix an assert (#1222517)
- units: make sure systemd-nspawn@.slice instances are actually located in machine.slice (#1222517)
- Revert "journald-audit: exit gracefully in the case we can't join audit multicast group" (#1222517)
- journald: handle more gracefully when bind() fails on audit sockets (#1222517)
- udev: link-config - fix corruption (#1222517)
- udev/net_id: Only read the first 64 bytes of PCI config space (#1222517)
- shared: generator - correct path to systemd-fsck (#1222517)
- logind: Save the user’s state when a session enters SESSION_ACTIVE (#1222517)
- small fix ru translation (#1222517)
- kmod-setup: don't warn when ipv6 can't be loaded (#1222517)
- Partially revert "ma-setup: simplify" (#1222517)
- ima-setup: write policy one line at a time (#1222517)
- ata_id: unbotch format specifier (#1222517)
- install: explicitly return 0 on success (#1222517)
- systemd.service.xml: document that systemd removes the PIDFile (#1222517)
- core: handle --log-target=null when calling systemd-shutdown (#1222517)
- man: ProtectHome= protects /root as well (#1222517)
- timedatectl: trim non-local RTC warning to 80 chars wide (#1222517)
- escape: fix exit code (#1222517)
- man: information about available properties (#1222517)
- journal: in persistent mode create /var/log/journal, with all parents. (#1222517)
- sysv-generator: fix wrong "Overwriting existing symlink" warnings (#1222517)
- mount: don't claim a device is gone from /proc/self/mountinfo before it is gone from *all* lines (#1222517)
- mount: properly check for mounts currently in /proc/self/mountinfo (#1222517)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-9
changelog:
- units: add [Install] section to tmp.mount
- bus-util: add articles to explanation messages (#1016680)
- bus-util: print correct warnings for units that fail but for which we have a NULL result only (#1016680)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-11
changelog:
- journald-server: don't read audit events (#1252409)
- everything: remove traces of --user (#1071363)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-12
changelog:
- selinux: fix check for transient units (#1255129)
- socket: fix setsockopt call. SOL_SOCKET changed to SOL_TCP. (#1135599)
- selinux: fix missing SELinux unit access check (#1185120)
- selinux: always use *_raw API from libselinux (#1256888)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-14
changelog:
- Revert "sysctl.d: default to fq_codel, fight bufferbloat" (#1263158)
- loginctl: print nontrivial properties in logictl show-* (#1260465)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-15
changelog:
- login: fix label on /run/nologin (#1264073)
- udev-rules: prandom character device node permissions (#1264112)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-16
changelog:
- login: fix gcc warning, include missing header file (#1264073)
- shutdown: make sure /run/nologin has correct label (#1264073)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-17
changelog:
- sd-event: fix prepare priority queue comparison function (#1266479)
- units: run ldconfig also when cache is unpopulated (#1265539)
- selinux: fix regression of systemctl subcommands when absolute unit file paths are specified (#1185120)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-19
changelog:
- udev: make naming for virtio devices opt-in (#1269216)
- tmpfiles.d: don't clean SAP sockets either (#1186044)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-20
changelog:
- run: synchronously wait until the scope unit we create is started (#1272368)
- device: rework how we enter tentative state (#1283579)
- core: Do not bind a mount unit to a device, if it was from mountinfo (#1283579)
- logind: set RemoveIPC=no by default (#1284588)
- sysv-generator: follow symlinks in /etc/rc.d/init.d (#1285492)
- sysv-generator test: always log to console (#1279034)
- man: RemoveIPC is set to no on rhel (#1284588)
- Avoid /tmp being mounted as tmpfs without the user's will (#1298109)
- test sysv-generator: Check for network-online.target. (#1279034)
- arm/aarch64: detect-virt: check dmi (#1278165)
- detect-virt: dmi: look for KVM (#1278165)
- Revert "journald: turn ForwardToSyslog= off by default" (#1285642)
- terminal-util: when resetting terminals, don't wait for carrier (#1266745)
- basic/terminal-util: introduce SYSTEMD_COLORS environment variable (#1247963)
- ask-password: don't abort when message is missing (#1261136)
- sysv-generator: do not join dependencies on one line, split them (#1288600)
- udev: fibre channel: fix NPIV support (#1266934)
- ata_id: unreverse WWN identifier (#1273306)
- Fixup WWN bytes for big-endian systems (#1273306)
- sd-journal: introduce has_runtime_files and has_persistent_files (#1082179)
- journalctl: improve error messages when the specified boot is not found (#1082179)
- journalctl: show friendly info when using -b on runtime journal only (#1082179)
- journalctl: make "journalctl /dev/sda" work (#947636)
- journalctl: add match for the current boot when called with devpath (#947636)
- man: clarify what happens when journalctl is called with devpath (#947636)
- core: downgrade warning about duplicate device names (#1296249)
- udev: downgrade a few warnings to debug messages (#1289461)
- man: LEVEL in systemd-analyze set-log level is not optional (#1268336)
- Revert "udev: fibre channel: fix NPIV support" (#1266934)
- udev: path-id: fibre channel NPIV - use fc_vport's port_name (#1266934)
- systemctl: is-active/failed should return 0 if at least one unit is in given state (#1254650)
- rules: set SYSTEMD_READY=0 on DM_UDEV_DISABLE_OTHER_RULES_FLAG=1 only with ADD event (#1312011)
- s390: add personality support (#1300344)
- socket_address_listen - do not rely on errno (#1316452)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-21
changelog:
- path_id: reintroduce by-path links for virtio block devices (#952567)
- journal: fix error handling when compressing journal objects (#1292447)
- journal: irrelevant coding style fixes (#1292447)
- install: follow unit file symlinks in /usr, but not /etc when looking for [Install] data (#1159308)
- core: look for instance when processing template name (#1159308)
- core: improve error message when starting template without instance (#1142369)
- man/tmpfiles.d: add note about permissions and ownership of symlinks (#1296288)
- tmpfiles: don't follow symlinks when adjusting ACLs, fille attributes, access modes or ownership (#1296288)
- udev: filter out non-sensically high onboard indexes reported by the kernel (#1230210)
- test-execute: add tests for RuntimeDirectory (#1324826)
- core: fix group ownership when Group is set (#1324826)
- fstab-generator: cescape device name in root-fsck service (#1306126)
- core: add new RandomSec= setting for time units (#1305279)
- core: rename Random* to RandomizedDelay* (#1305279)
- journal-remote: change owner of /var/log/journal/remote and create /var/lib/systemd/journal-upload (#1327303)
- Add Seal option in the configuration file for journald-remote (#1329233)
- tests: fix make check failure (#1159308)
- device: make sure to not ignore re-plugged device (#1332606)
- device: Ensure we have sysfs path before comparing. (#1332606)
- core: fix memory leak on set-default, enable, disable etc (#1331667)
- nspawn: fix minor memory leak (#1331667)
- basic: fix error/memleak in socket-util (#1331667)
- core: fix memory leak in manager_run_generators() (#1331667)
- modules-load: fix memory leak (#1331667)
- core: fix memory leak on failed preset-all (#1331667)
- sd-bus: fix memory leak in test-bus-chat (#1331667)
- core: fix memory leak in transient units (#1331667)
- bus: fix leak in error path (#1331667)
- shared/logs-show: fix memleak in add_matches_for_unit (#1331667)
- logind: introduce LockedHint and SetLockedHint (#3238) (#1335499)
- import: use the old curl api (#1284974)
- importd: drop dkr support (#1284974)
- import: add support for gpg2 for verifying imported images (#1284974)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-22
changelog:
- nspawn: when connected to pipes for stdin/stdout, pass them as-is to PID 1 (#1307080)
- mount: remove obsolete -n (#1339721)
- core: don't log job status message in case job was effectively NOP (#3199) (#1280014)
- core: use an AF_UNIX/SOCK_DGRAM socket for cgroup agent notification (#1305608)
- logind: process session/inhibitor fds at higher priority (#1305608)
- Teach bus_append_unit_property_assignment() about 'Delegate' property (#1337922)
- sd-netlink: fix deep recursion in message destruction (#1330593)
- add REMOTE_ADDR and REMOTE_PORT for Accept=yes (#1341154)
- core: don't dispatch load queue when setting Slice= for transient units (#1343904)
- run: make --slice= work in conjunction with --scope (#1343904)
- myhostname: fix timeout if ipv6 is disabled (#1330973)
- readahead: do not increase nr_requests for root fs block device (#1314559)
- manager: reduce complexity of unit_gc_sweep (#3507) (#1344556)
- hwdb: selinuxify a bit (#3460) (#1343648)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-23
changelog:
- udevadm: explicitly relabel /etc/udev/hwdb.bin after rename (#1350756)
- systemctl: return diffrent error code if service exist or not (#3385) (#1047466)
- systemctl: Replace init script error codes with enum (#3400) (#1047466)
- systemctl: rework "systemctl status" a bit (#1047466)
- journal-verify: don't hit SIGFPE when determining progress (#1350232)
- journal: avoid mapping empty data and field hash tables (#1350232)
- journal: when verifying journal files, handle empty ones nicely (#1350232)
- journal: explain the error when we find a non-DATA object that is compressed (#1350232)
- journalctl: properly detect empty journal files (#1350232)
- journal: uppercase first character in verify error messages (#1350232)
- journalctl: make sure 'journalctl -f -t unmatched' blocks (#1350232)
- journalctl: don't print -- No entries -- in quiet mode (#1350232)
- sd-event: expose the event loop iteration counter via sd_event_get_iteration() (#1342173)
- manager: Only invoke a single sigchld per unit within a cleanup cycle (#1342173)
- manager: Fixing a debug printf formatting mistake (#1342173)
- core: support IEC suffixes for RLIMIT stuff (#1351415)
- core: accept time units for time-based resource limits (#1351415)
- time-util: add parse_time(), which is like parse_sec() but allows specification of default time unit if none is specified (#1351415)
- core: support <soft:hard> ranges for RLIMIT options (#1351415)
- core: fix rlimit parsing (#1351415)
- core: dump rlim_cur too (#1351415)
- install: fix disable via unit file path (#1348208)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-25
changelog:
- units: increase watchdog timeout to 3min for all our services (#1267707)
- core: bump net.unix.max_dgram_qlen really early during boot (#1267707)
- core: fix priority ordering in notify-handling (#1267707)
- tests: fix personality tests on ppc64 and aarch64 (#1361049)
- systemctl: consider service running only when it is in active or reloading state (#3874) (#1362461)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-26
changelog:
- install: do not crash when processing empty (masked) unit file (#1159308)
- Revert "install: fix disable via unit file path" (#1348208)
- systemctl: allow disable on the unit file path, but warn about it (#3806) (#1348208)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-27
changelog:
- tmpfiles: enforce ordering when executing lines (#1365870)
- Introduce bus_unit_check_load_state() helper (#1256858)
- core: use bus_unit_check_load_state() in transaction_add_job_and_dependencies() (#1256858)
- udev/path_id: correct segmentation fault due to missing NULL check (#1365556)
- rules: load sg driver also when scsi_target appears (#45) (#1322773)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-29
changelog:
- fix gcc warnings about uninitialized variables (#1318994)
- journalctl: rework code that checks whether we have access to /var/log/journal (#1318994)
- journalctl: Improve boot ID lookup (#1318994)
- journalctl: only have a single exit path from main() (#1318994)
- journalctl: free all command line argument objects (#1318994)
- journalctl: rename boot_id_t to BootId (#1318994)
- util: introduce CMSG_FOREACH() macro and make use of it everywhere (#1318994)
- journald: don't employ inner loop for reading from incoming sockets (#1318994)
- journald: fix count of object meta fields (#1318994)
- journal-cat: return a correct error, not -1 (#1318994)
- journalctl: introduce short options for --since and --until (#1318994)
- journal: s/Envalid/Invalid/ (#1318994)
- journald: dispatch SIGTERM/SIGINT with a low priority (#1318994)
- lz4: fix size check which had no chance of working on big-endian (#1318994)
- journal: normalize priority of logging sources (#1318994)
- Fix miscalculated buffer size and uses of size-unlimited sprintf() function. (#1318994)
- journal: Drop monotonicity check when appending to journal file (#1318994)
- journalctl: unify how we free boot id lists a bit (#1318994)
- journalctl: don't trust the per-field entry tables when looking for boot IDs (#1318994)
- units: remove udev control socket when systemd stops the socket unit (#49) (#1370133)
- logind: don't assert if the slice is missing (#1371437)
- core: enable transient unit support for slice units (#1370299)
- sd-bus: bump message queue size (#1371205)
- install: fix disable when /etc/systemd/system is a symlink (#1285996)
- rules: add NVMe rules (#3136) (#1274651)
- rules: introduce disk/by-id (model_serial) symlinks for NVMe drives (#3974) (#1274651)
- rules: fix for possible whitespace in the "model" attribute (#1274651)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30
changelog:
- systemctl,pid1: do not warn about missing install info with "preset" (#1373950)
- systemctl/core: ignore masked units in preset-all (#1375097)
- shared/install: handle dangling aliases as an explicit case, report nicely (#1375097)
- shared/install: ignore unit symlinks when doing preset-all (#1375097)
- 40-redhat.rules: don't hoplug memory on s390x (#1370161)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30.1
changelog:
- If the notification message length is 0, ignore the message (#4237) (#1381573)
- systemctl: suppress errors with "show" for nonexistent units and properties (#1380686)
- 40-redhat.rules: disable auto-online of hot-plugged memory on IBM z Systems (#1381123)
- pid1: don't return any error in manager_dispatch_notify_fd() (#4240) (#1381573)
- pid1: process zero-length notification messages again (#1381573)
- pid1: more informative error message for ignored notifications (#1381573)


author: Michal Sekletar <msekleta@redhat.com> - 219-30.5
changelog:
- on update from systemd version 219-21 and older generate udev rules that preserve old network interface names on VMware VMs (#1391944)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-31
changelog:
- If the notification message length is 0, ignore the message (#4237) (#1380175)
- systemctl: suppress errors with "show" for nonexistent units and properties (#1380259)
- 40-redhat.rules: disable auto-online of hot-plugged memory on IBM z Systems (#1375603)
- pid1: don't return any error in manager_dispatch_notify_fd() (#4240) (#1380259)
- pid1: process zero-length notification messages again (#1380259
- pid1: more informative error message for ignored notifications (#1380259)
- manager: 219 needs u->id in log_unit_debug (#1380259)
- virt: add possibility to skip the check for chroot (#1379852)
- load-fragment: fix parsing values in bytes and prevent returning -ERANGE incorrectly (#1396277)
- core: fix assertion check (#1396312)
- tmp.mount.hm4: After swap.target (#3087) (#1298355)
- make sure all swap units are ordered before the swap target (#1298355)
- Recognise Lustre as a remote file system (#4530) (#1390542)
- unit: don't add Requires for tmp.mount (#1372249)
- core: return 0 from device_serialize() (#1403249)
- mtd_probe: include stdint (#1404251)
- tests: fix failure of test-execute if /dev/mem is not available (#5028) (#1410056)
- sd-journal: properly export has_{persistent|runtime}_files() (#1409527)
- core: add possibility to set action for ctrl-alt-del burst (#4105) (#1353028)
- failure-action: generalize failure action to emergency action (#1353028)
- core: use emergency_action for ctr+alt+del burst (#1353028)
- udev/path_id: introduce support for NVMe devices (#4169) (#1373150)
- core: fix CapabilityBoundingSet merging (#1409586)
- core: fix capability bounding set parsing (#1409586)
- core: make parsing of RLIMIT_NICE aware of actual nice levels (#1409588)
- shared: fix double free in unmask (#5005) (#1409997)
- shared: fix double free in link (#1409997)
- shared: check strdup != NULL (#1409997)
- core: improve error message when RefuseManualStart(Stop) is hit (#5132) (#1026648)
- systemctl: fix 'is-enabled' exit status on failure when executed in chroot (#4773) (#1413964)
- man: document that the automatic journal limits are capped to 4G by default (#1418547)
- random-seed: raise POOL_SIZE_MIN to 1024 (#1386824)
- bash-completion: add support for --now (#5155) (#1351806)
- basic: fix touch() creating files with 07777 mode (#1416062)
- udev: net_id: add support for phys_port_name attribute (#4506) (#1392426)
- install: introduce UnitFileFlags (#1413041)
- shared, systemctl: teach is-enabled to show installation targets (#1413041)


