# changelog

author: Tomas Mlcoch <tmlcoch at redhat.com> - 1.7.13-1
changelog:
  - Fix ABI compatibility (RhBug: 1185180)
  - fastestmirror: Add LRO_FASTESTMIRRORTIMEOUT option
  - downloader: Move broken mirror at the end of the list of mirrors (RhBug: 1183998)
  - Make building tests and docs optional
  - librepo: Don't download remote mirrorlist/metalink when LRO_LOCAL is specified (Resolves #41)


author: Tomas Mlcoch <tmlcoch at redhat.com> - 1.7.14-1
changelog:
  - tests: Use g_assert_cmpuint instead of ck_assert_uint_eq (Pullrequest #43)
  - Add LRO_OFFLINE
  - Python: Handle: Raise ValueError instead of TypeError when an unknown option is specified
  - Python: Result: Use ValueError instead of TypeError when an unknown option value is specified
  - Add LR_VERSION constant with version string
  - python: Import contants from C librepo module in a loop
  - repoconf: Add support for failover and skip_if_unavailable options
  - handle: Change of LRO_LOCAL causes invalidation of internal mirrorlist (related to RhBug: 1188600)
  - Load local mirrorlists when LRO_LOCAL is on (related to RhBug: 1188600)
  - util: Add lr_is_local_path()
  - New module repoconf for reading *.repo files
  - Add LRO_HTTPHEADER option (RhBug: 1181123)


author: Tomas Mlcoch <tmlcoch at redhat.com> - 1.7.15-1
changelog:
  - Do not inlude header in the body output (RhBug: 1207685)
  - metalink: Proper error handling
  - New LRR_RPMMD_* contants
  - Support for client certificates
  - Use 'metadata in the rpm-md format' instead of 'yum metadata' (Issue #51)
  - CMakeLists.txt: do not check for CXX
  - build: Use solely pkg-config to find glib


author: Colin Walters <tmlcoch@redhat.com> - 1.7.16-1
changelog:
  - Add LRI_LOWSPEEDTIME and LRI_LOWSPEEDLIMIT
  - downloader: Don't consider CURLE_RECV_ERROR and CURLE_SEND_ERROR as fatal errors (RhBug: 1219817)
  - test_repoconf: Fix SIGSEGV in repoconf_assert_na (RhBug: 1222471)
  - repoconf: Proper handling of gint64 and guint64 types
  - build: Be compatible with cmake 2.8
  - handle: Do not free temporary error msg if there is no one (RhBug: 1219822)
  - utils/make_rpm.sh: Accept rpmbuild options as second argument (Issue #49)
  - Python: call lr_global_init() during module initialization
  - Add global function log_set_file that allow user to set a file where logs will be written (Issue #53)
  - util: Honor RFC 3986 (Issue #55)


author: Marek Blaha <mblaha@redhat.com> - 1.8.1-1
changelog:
  - Add yumrecord substitution mechanism (mluscon)
  - Fix a memory leak in signature verification (cwalters)
  - Add new option LRO_FTPUSEEPSV
  - downloader prepare_next_transfer(): simplify long line
  - downloader prepare_next_transfer(): add missing error check
  - downloader prepare_next_transfer(): cleanup error path
  - downloader prepare_next_transfer() - fix memory leak on error path (Alan Jenkins)
  - handle: Don't use proxy cache for downloads of metalink/mirrorlist
  - handle: Don't set CURLOPT_HTTPHEADER into curl handle immediately when specified
  - downloader: Implement logic for no_cache param in LrDownloadTarget (RhBug: 1297762)
  - Add no_cache param to LrDownloadTarget and lr_downloadtarget_new()
  - New test: always try to download from the fastest mirror (Alexander Todorov)


author: Adam Tkac <atkac redhat com> 2.0.8-1
changelog:
  - update to 2.0.8 (#851364)
  - swig207-rh830660.patch merged
  - swig207-r13128.patch merged
  - swig-rh841245.patch merged


author: Jitka Plesnikova <jplesnik@redhat.com> - 2.0.10-1
changelog:
  - Update to 2.0.10
  - swig203-rh706140.patch merged
  - swig204-rh752054.patch merged
  - Create swig-2.0.10-Fix-x390-build.patch


author: Lokesh Mandvekar <lsm5@redhat.com> - 2:1.0.0-52.dev.git70ca035
changelog:
  - built commit 70ca035 with additional patches to change default root and
  to revert apply cgroups earlier


author: Marek Grac <mgrac@redhat.com> - 4.0.11-5
changelog:
  - fence_wti: Fix problem with EOL introduced by rebase
    Resolves: rhbz#1148762
  - fence_rsb: Fix issue with new firmware 
    Resolves: rhbz#1111597


author: Marek Grac <mgrac@redhat.com> - 4.0.11-6
changelog:
  - fence_cisco_ucs and fence_vmware_soap should logout even in case of failure
    Resolves: rhbz#1111599
  - fence_vmware_soap: Fix issue with import of fail_usage
    Resolves: rhbz#1153059


author: Marek Grac <mgrac@redhat.com> - 4.0.11-9
changelog:
  - fence_ilo_ssh: Fix EOL issue, syslog problem and add fence_ilo_[34]_ssh symlink
    Resolves: rhbz#1121122


author: Marek Grac <mgrac@redhat.com> - 4.0.11-11
changelog:
  - fence_ipmilan: Unset default cipher
    Resolves: rhbz#1206294
  - fence_ilo2: Add --tls1.0
    Resolves: rhbz#1206293
  - update scripts so 'make check' is working again


author: Richard Hughes <rhughes@redhat.com> - 3.14.3-3
changelog:
  - Re-apply the fix "Change the UI policy to show the comps tree" as it was
    lost in the rebase process.
  - Resolves: #1174550


author: Richard Hughes <rhughes@redhat.com> - 3.14.3-6
changelog:
  - Create a -common subpackage and make the "parent" package depend on all
    the split out applications. This fixes upgrades from old versions.
  - Resolves: #1290868


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-3
changelog:
  - mkfs.xfs: disable finobt by default, disable sparse inodes entirely (#1345961)
  - Fix header files for compatibility (#1340553)


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-4
changelog:
  - xfs_db: Fix multi-inode-record chunks in 4.5.0 (#1346927)
  - xfs_repair: Fix special inode handling in 4.5.0 (#1347698)
  - xfs_repair: Fix quota inode handling in 4.5.0 (#1347719)


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.23.1.el7]
changelog:
  - [net] af_unix: Guard against other == sk in unix_dgram_sendmsg (Jakub Sitnicki) [1337513 1285792]
  - [net] unix: avoid use-after-free in ep_remove_wait_queue (Paolo Abeni) [1337513 1285792]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.26.1.el7]
changelog:
  - [block] blk-mq: fix race between timeout and freeing request (David Milburn) [1347743 1288601]
  - [x86] nmi: Fix use of unallocated cpumask_var_t (Jerry Snitselaar) [1346176 1069217]
  - [x86] nmi: Perform a safe NMI stack trace on all CPUs (Jerry Snitselaar) [1346176 1069217]
  - [kernel] printk: Add per_cpu printk func to allow printk to be diverted (Jerry Snitselaar) [1346176 1069217]
  - [lib] seq: Add minimal support for seq_buf (Jerry Snitselaar) [1346176 1069217]
  - [fs] ovl: use a minimal buffer in ovl_copy_xattr (Vivek Goyal) [1347235 1306358]
  - [fs] ovl: allow zero size xattr (Vivek Goyal) [1347235 1306358]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.27.1.el7]
changelog:
  - [md] raid5: check_reshape() shouldn't call mddev_suspend (Jes Sorensen) [1344313 1312828]
  - [net] sctp: Potentially-Failed state should not be reached from unconfirmed state (Xin Long) [1347809 1333696]
  - [net] sctp: fix the transports round robin issue when init is retransmitted (Xin Long) [1347809 1333696]
  - [net] sctp: fix suboptimal edge-case on non-active active/retrans path selection (Xin Long) [1347809 1333696]
  - [net] sctp: spare unnecessary comparison in sctp_trans_elect_best (Xin Long) [1347809 1333696]
  - [net] sctp: improve sctp_select_active_and_retran_path selection (Xin Long) [1347809 1333696]
  - [net] sctp: migrate most recently used transport to ktime (Xin Long) [1347809 1333696]
  - [net] sctp: refactor active path selection (Xin Long) [1347809 1333696]
  - [net] sctp: remove NULL check in sctp_assoc_update_retran_path (Xin Long) [1347809 1333696]
  - [net] sctp: rework multihoming retransmission path selection to rfc4960 (Xin Long) [1347809 1333696]
  - [net] sctp: retran_path not set properly after transports recovering (Xin Long) [1347809 1333696]
  - [mm] memcg: fix endless loop caused by mem_cgroup_iter (Herton R. Krzesinski) [1344750 1297381]
  - [scsi] qla2xxx: Set relogin flag when we fail to queue login requests (Chad Dupuis) [1347344 1273080]
  - [x86] perf/x86/intel/uncore: Add Broadwell-EP uncore support (Jiri Olsa) [1347374 1259976]
  - [x86] perf/x86/intel/uncore: Add Broadwell-DE uncore support (Jiri Olsa) [1348063 1306834]
  - [lib] rhashtable: Do hashing inside of rhashtable_lookup_compare() (Phil Sutter) [1343639 1238749]
  - [s390] mm: four page table levels vs. fork (Hendrik Brueckner) [1341547 1308879] {CVE-2016-2143}
  - [firmware] dmi_scan: Fix UUID endianness for SMBIOS >= 2.6 (Prarit Bhargava) [1340118 1294461]
  - [misc] cxl: Export AFU error buffer via sysfs (Gustavo Duarte) [1343537 1275968]
  - [misc] cxl: Poll for outstanding IRQs when detaching a context (Alexander Gordeev) [1338886 1332487]
  - [misc] cxl: Keep IRQ mappings on context teardown (Alexander Gordeev) [1338886 1332487]
  - [netdrv] mlx4_en: Fix endianness bug in IPV6 csum calculation (kamal heib) [1337431 1325358]
  - [acpi] srat: fix SRAT parsing order with both LAPIC and X2APIC present (Prarit Bhargava) [1336821 1331394]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.28.2.el7]
changelog:
  - [net] bridge: include in6.h in if_bridge.h for struct in6_addr (Jiri Benc) [1331285 1268057]
  - [net] inet: defines IPPROTO_* needed for module alias generation (Jiri Benc) [1331285 1268057]
  - [net] sync some IP headers with glibc (Jiri Benc) [1331285 1268057]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.28.3.el7]
changelog:
  - [net] tcp: enable per-socket rate limiting of all 'challenge acks' (Florian Westphal) [1355603 1355605] {CVE-2016-5696}
  - [net] tcp: uninline tcp_oow_rate_limited() (Florian Westphal) [1355603 1355605] {CVE-2016-5696}
  - [net] tcp: make challenge acks less predictable (Florian Westphal) [1355603 1355605] {CVE-2016-5696}


author: Akemi Yagi <toracat@centos.org> [3.10.0-327.28.3.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - Add in a patch that fixes missing Unifying device issue [bug#7340]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Add in a patch that fixes waking up from S3 for AMD family [bug#7645]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Add in a patch that fixes crash due to xfrm oops [bug#9646]
  - Enabled spidev [bug#9955]
  - Add in patches from bugs 10073 and 10191 [bug#10073 bug#10191]
  - Add in a patch from bug 10320 [bug#10320]
  - Add patches [bug#10516]
  - Add a patch [bug#10447]
  - Add a patch [bug#10729]
  - Enable ATM drivers [bug#10845]
  - Add 9pfs config options [bug#10849]
  - Add a patch [bug#11184]


author: Thomas Haller <thaller@redhat.com> 1.2.7-3
changelog:
  - Add manual page for usb_modeswitch_dispatcher and fix errors in
    manual page of usb_modeswitch (rhbz#948451, rhbz#884203).


author: Dan Walsh <dwalsh@redhat.com> - 2.1.11-3
changelog:
  - Update to latest patches from eparis/Upstream
  -   checkpolicy: libsepol: implement default type policy syntax
  -   
  -   We currently have a mechanism in which the default user, role, and range
  -   can be picked up from the source or the target object.  This implements
  -   the same thing for types.  The kernel will override this with type
  -   transition rules and similar.  This is just the default if nothing
  -   specific is given.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-1
changelog:
  - Update to upstream 
          * Fix errors found by coverity
          * implement default type policy syntax
          * Free allocated memory when clean up / exit.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-4
changelog:
  - Fix a segmentation fault if the --handle-unknown option was set without
  arguments.
  - Thanks to Alexandre Rebert and his team at Carnegie Mellon University
  for detecting this crash.


author: Mark Wielaard <mjw@redhat.com> - 0.162-1
changelog:
  - Update to 0.162 (#1224169, #1223462, #1207799)
  - Include elfutils/known-dwarf.h
  - Drop BuildRequires glibc-headers


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-23
changelog:
  - Don't copy /etc/localtime on -chroot package installation (#1186773)
  - Fix SPF resource records check to comply with RFC7208 (#1215164)
  - Don't use ISC's DLV by default (#1223336)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.17-2
changelog:
  - Fix the minimal required tdb version
  - Related: rhbz#1133914 - Rebase libldb to version 1.1.17 or newer


author: Kalev Lember <kalevlember@gmail.com> - 2:3.8.2-1
changelog:
  - Revert back to gtk2-based 3.8.2 -- following upstream, the gtk3
    version is now in 'glade' package (#731227)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-6
changelog:
  - release 1.3.3.1-6
  - Resolves: bug 1151287 - dynamically added macro aci is not evaluated on the fly (DS 47922)
  - Resolves: bug 1080186 - Need to move slapi_pblock_set(pb, SLAPI_MODRDN_EXISTING_ENTRY, original_entry->ep_entry) prior to original_entry overwritten (DS 47897)
  - Resolves: bug 1150694 - Encoding of SearchResultEntry is missing tag (DS 47920)
  - Resolves: bug 1150695 - ldbm_back_modify SLAPI_PLUGIN_BE_PRE_MODIFY_FN does not return even if one of the preop plugins fails. (DS 47919)
  - Resolves: bug 1139882 - Fix remaining compiler warnings (DS 47892)
  - Resolves: bug 1150206 - result of dna_dn_is_shared_config is incorrectly used (DS 47918)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-8
changelog:
  - release 1.3.3.1-8
  - Resolves: bug 1156607 - Crash in entry_add_present_values_wsi_multi_valued (DS 47937)
  - Resolves: bug 1153737 - Disable SSL v3, by default (DS 47928, DS 47945, DS 47948)
  - Resolves: bug 1158804 - Malformed cookie for LDAP Sync makes DS crash (DS 47939)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-9
changelog:
  - release 1.3.3.1-9
  - Resolves: bug 1153737 - Disable SSL v3, by default. (DS 47928)
  - Resolves: bug 1163461 - Should not check aci syntax when deleting an aci (DS 47953)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-10
changelog:
  - release 1.3.3.1-10
  - Resolves: bug 1172731 - CVE-2014-8112 password hashing bypassed when "nsslapd-unhashed-pw-switch" is set to off 
  - Resolves: bug 1166265 - DS hangs during online total update (DS 47942)
  - Resolves: bug 1168151 - CVE-2014-8105 information disclosure through 'cn=changelog' subtree
  - Resolves: bug 1044170 - Allow memberOf suffixes to be configurable (DS 47526)
  - Resolves: bug 1171356 - Bind DN tracking unable to write to internalModifiersName without special permissions (DS 47950)
  - Resolves: bug 1153737 - logconv.pl -- support parsing/showing/reporting different protocol versions (DS 47949)
  - Resolves: bug 1171355 - start dirsrv after chrony on RHEL7 and Fedora (DS 47947)
  - Resolves: bug 1170707 - cos_cache_build_definition_list does not stop during server shutdown (DS 47967)
  - Resolves: bug 1170708 - COS memory leak when rebuilding the cache (DS - Ticket 47969)
  - Resolves: bug 1170709 - Account lockout attributes incorrectly updated after failed SASL Bind (DS 47970)
  - Resolves: bug 1166260 - cookie_change_info returns random negative number if there was no change in a tree (DS 47960)
  - Resolves: bug 1012991 - Error log levels not displayed correctly (DS 47636)
  - Resolves: bug 1108881 - rsearch filter error on any search filter (DS 47722)
  - Resolves: bug 994690  - Allow dynamically adding/enabling/disabling/removing plugins without requiring a server restart (DS 47451)
  - Resolves: bug 1162997 - Running a plugin task can crash the server (DS 47451)
  - Resolves: bug 1166252 - RHEL7.1 ns-slapd segfault when ipa-replica-install restarts (DS 47451)
  - Resolves: bug 1172597 - Crash if setting invalid plugin config area for MemberOf Plugin (DS 47525)
  - Resolves: bug 1139882 - coverity defects found in 1.3.3.x (DS 47965)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-11
changelog:
  - release 1.3.3.1-11
  - Resolves: bug 1080186 - During delete operation do not refresh cache entry if it is a tombstone (DS 47750)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-12
changelog:
  - release 1.3.3.1-12
  - Resolves: bug 1182477 - Windows Sync accidentally cleared raw_entry (DS 47989)
  - Resolves: bug 1180325 - upgrade script fails if /etc and /var are on different file systems (DS 47991 )
  - Resolves: bug 1183655 - Schema learning mechanism, in replication, unable to extend an existing definition (DS 47988)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-14
changelog:
  - release 1.3.3.1-14
  - Resolves: bug 1189154 - DNS errors after IPA upgrade due to broken ReplSync (DS 48030)
              Fixes spec file to make sure all the server instances are stopped before upgrade
  - Resolves: bug 1186548 - ns-slapd crash in shutdown phase (DS 48005)


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-4
changelog:
  - Rebase to upstream 1a4ef7d180e77bcd6423f342d62e05e516c4e852 (1.1.18-rc4)
  - Resolves: rhbz#1381754
  - Resolves: rhbz#1474428
  - Resolves: rhbz#1499217
  - Resolves: rhbz#1508373


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-5
changelog:
  - Properly clean up primitive inside bundle
  - Scalability improvements
  - Resolves: rhbz#1499217
  - Resolves: rhbz#1508373


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-6
changelog:
  - Rebase to upstream 2b07d5c5a908998891c3317faa30328c108d3a91 (1.1.18)
  - If on-fail=ignore, migration-threshold should also be ignored
  - Resolves: rhbz#1474428
  - Resolves: rhbz#1507344


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-7
changelog:
  - Avoid node attribute write delay when corosync.conf has only IP addresses
  - Fix regressions in "pcs resource cleanup" behavior
  - Restore ordering of unfencing before fence device starts
  - Ensure --wait options work when bundles are in use
  - Fix possible invalid transition with bundle ordering constraints
  - Resolves: rhbz#1454960
  - Resolves: rhbz#1508350
  - Resolves: rhbz#1517796
  - Resolves: rhbz#1519812
  - Resolves: rhbz#1522822


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-10
changelog:
  - Always trigger transition when quorum changes
  - Match clone names correctly with crm_resource --cleanup
  - Fix pcs resource --wait timeout when bundles are used
  - Observe colocation constraints correctly with bundles in master role
  - Resolves: rhbz#1464068
  - Resolves: rhbz#1508350
  - Resolves: rhbz#1519812
  - Resolves: rhbz#1527072


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-11.1
changelog:
  - Do not schedule notifications for unrunnable actions
  - Do not expire remote failures if fencing is pending
  - Do not consider attribute order difference as CIB change in crm_diff
  - Resolves: rhbz#1563345
  - Resolves: rhbz#1566533
  - Resolves: rhbz#1568720


author: Honza Horak <hhorak@redhat.com> - 1.9.1-1
changelog:
  - Updated to new upstream release 1.9.1
  - Dropped -filestruct, -ndbmlock and -fhs patches, they are not 
    needed anymore and GDBM_NOLOCK is used always
  - Run testsuite


author: Honza Horak <hhorak@redhat.com> - 1.10-1
changelog:
  - Updated to new upstream release 1.10
  - Dropped -shortread patch, which has been already applied by upstream
  - Disable large file support, that is enabled by default since 1.9, 
    but not compatible with db files created using gdbm-1.8.3 and lower
  - License change to GPLv3+
  - Add doc files THANKS AUTHORS NOTE-WARNING
  - Changed text in NOTE-WARNING to correspond with build settings


author: Jan Friesse <jfriesse@redhat.com> 2.3.4-5
changelog:
  - Resolves: rhbz#1197091
  - Resolves: rhbz#1197671

  - Votequorum: Fix auto_tie_breaker default (rhbz#1197091)
  - merge upstream commit 314a01c98e5f98ff686333966dbe675935b7b6a8 (rhbz#1197091)
  - Don't allow both two_node and auto_tie_breaker in corosync.conf (rhbz#1197671)
  - merge upstream commit c832ade034fa737561ccabefbe417c9d7855d970 (rhbz#1197671)


author: Jan Friesse <jfriesse@redhat.com> 2.3.4-6
changelog:
  - Resolves: rhbz#1170347
  - Resolves: rhbz#1225441
  - Resolves: rhbz#1226842
  - Resolves: rhbz#1229194
  - Resolves: rhbz#1234261
  - Resolves: rhbz#1234266
  - Resolves: rhbz#682771
  - Resolves: rhbz#773464

  - config: Make sure user doesn't mix IPv6 and IPv4 (rhbz#773464)
  - merge upstream commit 6c028d4d9c53decaa9469c792ac68fd2a886e7d9 (rhbz#773464)
  - config: Process broadcast option consistently (rhbz#773464)
  - merge upstream commit 70bd35fc06e68a010d780dfa39bd68d4bd2f7da7 (rhbz#773464)
  - config: Ensure mcast address/port differs for rrp (rhbz#773464)
  - merge upstream commit 6449bea835c90045baa23e3e041fed1df2abf070 (rhbz#773464)
  - Reset timer_problem_decrementer on fault (rhbz#1234261)
  - merge upstream commit 8f284b26b3331e1ab252969ba65543e6d9217ab1 (rhbz#1234261)
  - automake: Check minimum automake version (rhbz#773464)
  - merge upstream commit 114b826c67126fe1f690ad976b5217a8487994a4 (rhbz#773464)
  - Set RR priority by default (rhbz#1170347)
  - merge upstream commit 177ef0e5240b4060ff5b14eab6f2eefee3aa777d (rhbz#1170347)
  - Log auto-recovery of ring only once (rhbz#773464)
  - merge upstream commit e0ac861efdc32831366a2b5f5cc1d61e2ffa5504 (rhbz#773464)
  - totem: Ignore duplicated commit tokens in recovery (rhbz#1234261)
  - merge upstream commit 4ee84c51fa73c4ec7cbee922111a140a3aaf75df (rhbz#1234261)
  - corosync_ring_id_store: Use safer permissions (rhbz#1234266)
  - merge upstream commit 252b38ab8a62ff083e83b1d6f514109f7b7cbb42 (rhbz#1234266)
  - totemsrp: Format member list log as unsigned int (rhbz#773464)
  - merge upstream commit 5d9acc5604eb4e8a739cb37a4ad46bcc5ad8deb6 (rhbz#773464)
  - cpg: Add support for messages larger than 1Mb (rhbz#682771)
  - merge upstream commit 8cc8e513633a1a8b12c416e32fb5362fcf4d65dd (rhbz#682771)
  - Really add cpghum (rhbz#682771)
  - merge upstream commit 3842ba6080e00fd9484a2a875d982e149f67bc44 (rhbz#682771)
  - quorum: don't allow quorum_trackstart to be called twice (rhbz#1229194)
  - merge upstream commit 82526d2fe9137e8b604f1bbae6d6e39ba41377f9 (rhbz#1229194)
  - totemconfig: Check for duplicate nodeids (rhbz#773464)
  - merge upstream commit 997074cc3e1ea425ca63e453b7e2181741bdcef0 (rhbz#773464)
  - totem: Log a message if JOIN or LEAVE message is ignored (rhbz#773464)
  - merge upstream commit 53f67a2a7914228f1a406aad61ea6768525e11b0 (rhbz#773464)
  - totemsrp: Improve logging of left/down nodes (rhbz#773464)
  - merge upstream commit ab8942f6260fde93824ed2a18e09e572b59ceb25 (rhbz#773464)
  - votequorum: Fix auto_tie_breaker behaviour in odd-sized clusters (rhbz#1229194)
  - merge upstream commit b9f5c290b7dedd0a677cdfc25db7dd111245a745 (rhbz#1229194)
  - Add note about rrp active beeing unsupported (rhbz#1226842)
  - merge upstream commit 219965f4fe694eaaf2eb4ea05cdc7e35f5146114 (rhbz#1226842)
  - Log: Add logrotate configuration file (rhbz#1225441)
  - merge upstream commit aabbace625b3c68332b4356887378fca81f8f387 (rhbz#1225441)


author: Jan Friesse <jfriesse@redhat.com> 2.3.4-7
changelog:
  - Related: rhbz#682771

  - Don't link with libz when not needed (rhbz#682771)
  - merge upstream commit 145f9279d12cf0b981494bbd4dabbc9c3641378e (rhbz#682771)


author: Jan Friesse <jfriesse@redhat.com> 2.3.4-7.1
changelog:
  - Resolves: rhbz#1283067

  - totemudp: Move udp bind() so that multicast works with IPv6 (rhbz#1283067)
  - merge upstream commit 165561df9ba1e0be2a11ff550b70da94990eb2f5 (rhbz#1283067)


author: Jan Friesse <jfriesse@redhat.com> 2.3.4-7.2
changelog:
  - Resolves: rhbz#1333397

  - totemconfig: Explicitly pass IP version (rhbz#1333397)
  - merge upstream commit 60565b7da7d271651c30cd7fdca6e3f3eb5327ac (rhbz#1333397)


author: Jan Friesse <jfriesse@redhat.com> 2.3.4-7.3
changelog:
  - Resolves: rhbz#1338667

  - cmapctl: Handle corosync errors in print_key func (rhbz#1338667)
  - merge upstream commit 8ab7743068cc6cd5bf235d1ccae65de1d91784f0 (rhbz#1338667)


author: Steve Dickson <steved@redhat.com> 0.25-13
changelog:
  - Strip newlines out of IDMAP_LOG messages (bz 1261124)
  - Fixed some NEGATIVE_RETURNS that a Covscan scan found (bz 1271449)


author: Steve Dickson <steved@redhat.com> 0.25-14
changelog:
  - nss_getpwnam: correctly check for negative values (bz 1271449)
  - Fixed a memory leak in nss_name_to_gid() (bz 1271449)


author: Peter Jones <pjones@redhat.com> - 2.02-0.60
changelog:
  - Fix ppc64 deciding /boot/efi might somehow be the CHRP partition if it
    exists.  This is also why the bug we fixed in 0.59 showed up at all.
    Resolves: rhbz#1443809
    Resolves: rhbz#1442970
  - Fix a regexp problem where rpm spec parser un-escapes things that
    don't need escaping, which causes our s/-mcpu=power8/-mcpu=power6/
    to fail.
    Related: rhbz#1443809


author: Peter Jones <pjones@redhat.com> - 2.02-0.61
changelog:
  - Fix some minor ia32 booting bugs
    Related: rhbz#1310763
    Related: rhbz#1411748
    Related: rhbz#1300009
  - Add support for non-Ethernet network cards
    Related: rhbz#1232432
  - Add support for http booting
    Resolves: rhbz#1232432
  - Fix efi module subpackage obsoletes/provides
    Resolves: rhbz#1447723
  - Make ppc modules subpackages use different directories on the filesystem.
    Resolves: rhbz#1455243


author: Peter Jones <pjones@redhat.com> - 2.02-0.65.1
changelog:
  - More precise requires and obsoletes on the -tools* subpackages to avoid
    issues with mixing and matching repos the subpackages are split between.
    Resolves: rhbz#1499669


author: CentOS Sources <bugs@centos.org> - 2.02-0.65.el7.centos.2
changelog:
  - Roll in CentOS Secureboot keys
  - Move the edidir to be CentOS, so people can co-install fedora, rhel and centos


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7_0.6
changelog:
  - kvm-vmstate-reduce-code-duplication.patch [bz#1095706]
  - kvm-vfio-pci-Add-debug-config-options-to-disable-MSI-X-K.patch [bz#1110693 bz#1110695]
  - kvm-vfio-correct-debug-macro-typo.patch [bz#1110693 bz#1110695]
  - kvm-vfio-pci-Fix-MSI-X-debug-code.patch [bz#1110693 bz#1110695]
  - kvm-vfio-pci-Fix-MSI-X-masking-performance.patch [bz#1110693 bz#1110695]
  - kvm-vfio-Fix-MSI-X-vector-expansion.patch [bz#1110693 bz#1110695]
  - kvm-vfio-Don-t-cache-MSIMessage.patch [bz#1110693 bz#1110695]
  - kvm-virtio-net-Do-not-filter-VLANs-without-F_CTRL_VLAN.patch [bz#1130149]
  - kvm-virtio-net-add-vlan-receive-state-to-RxFilterInfo.patch [bz#1130149]
  - kvm-memory-Don-t-call-memory_region_update_coalesced_ran.patch [bz#1124660]
  - Resolves: bz#1110693
    (2x RHEL 5.10 VM running on RHEL 7 KVM have low TCP_STREAM throughput)
  - Resolves: bz#1110695
    (2x RHEL 5.10 VM running on RHEL 7 KVM have low TCP_STREAM throughput)
  - Resolves: bz#1124660
    ([FJ7.0 Bug] RHEL7.0 guest attaching 150 or more virtio-blk disks fails to start up)
  - Resolves: bz#1130149
    (rx filter incorrect when guest disables VLAN filtering)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7_0.7
changelog:
  - kvm-mirror-Fix-resource-leak-when-bdrv_getlength-fails.patch [bz#1132806]
  - kvm-blockjob-Add-block_job_yield.patch [bz#1132806]
  - kvm-mirror-Go-through-ready-complete-process-for-0-len-i.patch [bz#1132806]
  - kvm-qemu-iotests-Test-BLOCK_JOB_READY-event-for-0Kb-imag.patch [bz#1132806]
  - kvm-block-make-top-argument-to-block-commit-optional.patch [bz#1132806]
  - kvm-qemu-iotests-Test-0-length-image-for-mirror.patch [bz#1132806]
  - kvm-mirror-Fix-qiov-size-for-short-requests.patch [bz#1132806]
  - Resolves: bz#1132806
    (advertise active commit to libvirt)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7_0.8
changelog:
  - kvm-vmstate_xhci_event-fix-unterminated-field-list.patch [bz#1145055]
  - kvm-vmstate_xhci_event-bug-compat-with-RHEL-7.0-RHEL-onl.patch [bz#1145055]
  - kvm-vbe-make-bochs-dispi-interface-return-the-correct-me.patch [bz#1139117]
  - kvm-vbe-rework-sanity-checks.patch [bz#1139117]
  - kvm-spice-display-add-display-channel-id-to-the-debug-me.patch [bz#1139117]
  - kvm-spice-make-sure-we-don-t-overflow-ssd-buf.patch [bz#1139117]
  - Resolves: bz#1139117
    (CVE-2014-3615 qemu-kvm: Qemu: crash when guest sets high resolution [rhel-7.0.z])
  - Resolves: bz#1145055
    (vmstate_xhci_event: fix unterminated field list [rhel-7.0.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7_0.9
changelog:
  - kvm-scsi-disk-fix-bug-in-scsi_block_new_request-introduc.patch [bz#1141189]
  - Resolves: bz#1141189
    (bug in scsi_block_new_request() function introduced by upstream commit 137745c5c60f083ec982fe9e861e8c16ebca1ba8)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7_0.10
changelog:
  - kvm-block-add-helper-function-to-determine-if-a-BDS-is-i.patch [bz#1122925]
  - kvm-block-extend-block-commit-to-accept-a-string-for-the.patch [bz#1122925]
  - kvm-block-add-backing-file-option-to-block-stream.patch [bz#1122925]
  - kvm-block-add-__com.redhat_change-backing-file-qmp-comma.patch [bz#1122925]
  - Resolves: bz#1122925
    (Maintain relative path to backing file image during live merge (block-commit))


author: Bohuslav Kabrda <bkabrda@redhat.com> - 0.8-2
changelog:
  - Fixed reporting of more IPv4 addresses per interface
  Resolves: rhbz#1027685
  - Make get_active_devices() return IPv6-only devices, too
  Resolves: rhbz#1027678


author: Phil Cameron <pcameron@redhat.com> - 1.1.4-6
changelog:
  - fix 1283773 - segfault in rate_add_rate

    Jun 17 2014 Alejandro Pérez  <aeperezt@fedoraproject.org>
    fix 1109768 bad configuration logrotate
    Mar 02 2014 Alejandro Pérez  <aeperezt@fedoraproject.org>
    fix bug 1020552 - rpm report /var/lock/ipraf-ng is missing
    added missing file iptraf-nf-tmpfiles.conf
    Dec 03 2013 Nikola Pajkovsky <npajkovs@redhat.com>
    Fedora start using -Werror=format-security and iptraf-ng had some
    parts where error compilation was trigged.
    202b2e7b27a1 Makefile: add -Werror=format-security
    Resolved: #1037133


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.0-1
changelog:
  - Update to 1.6.0
  - Adds Modulemd.ModuleStream object, deprecating Modulemd.Module
  - Adds Modulemd.Translation and Modulemd.TranslationEntry objects
  - Adds Modulemd.ImprovedModule object that collects streams, defaults and
    translations together
  - Adds new Modulemd.index_from_*() funtions to get a hash table of
    Modulemd.ImprovedModule objects for easier searching
  - Moves function documentation to the public headers
  - Corrects the license headers to MIT (they were incorrectly listed as MITNFA
    in previous releases)
  - Makes the "eol" field optional for Modulemd.ServiceLevel
  - Clean up HTML documentation
  - Fixes a type error on 32-bit systems


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.3-1
changelog:
  - Update to 1.6.3
  - Drop upstreamed patch
  - Don't return ModuleStream objects from modulemd_module_new_all_from_*_ext()
  - Ensure that Component buildorder property is signed
  - Work around optimization bug
  - Don't crash dumping translation events without summary or desc
  - Remove Obsoletes: python-modulemd from EPEL


author: Lukáš Nykrýn <lnykryn@redhat.com> - 033-487
changelog:
  - add upstream tests
  - dracut.sh: fail hard, if we find modules and modules.dep is missing
  Resolves: rhbz#1298656
  - add dracut.pc pkg-config file
  Resolves: rhbz#1397853
  - systemd/dracut-cmdline.sh: unset "UNSET" $root
  Releated: rhbz#1365667
  - dracut.conf.5.asc: add Warning about leading and trailing spaces in lists
  - fips/module-setup.sh: make tcrypt non-optional


author: Lukáš Nykrýn <lnykryn@redhat.com> - 033-495
changelog:
  - ifup: don't ifup team master indefinitely
  Resolves: rhbz#1416958
  - write-ifcfg: do't write MTU twice for regular eth devices
  Resolves: rhbz#1366163
  - network/ifup: write override file before dhcp_do
  Resolves: rhbz#1415004


author: Lukáš Nykrýn <lnykryn@redhat.com> - 033-499
changelog:
  - module-setup.sh: Add ARM specific driver to initramfs image
  Resolves: #1459277
  - Revert "systemd/dracut-initqueue.sh: don't go into emergency"
  Resolves: #1396865
  - udev-rules: pull in 40-redhat-cpu-hotplug.rules
  Resolves: #1460707


author: Tom Callaway <spot@fedoraproject.org> - 6.0-9
changelog:
  - Apply changes to match.c to sync with recmatch from util.c (from zip 3.0)
    This also resolves the license issue in that file.


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-15
changelog:
  - Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140 CVE-2014-8141
    Resolves: #1196134 #1196122 #1196126 #1196130


author: Carlos O'Donell <carlso@redhat.com> - 2.17-146
changelog:
  - s390: Restore signal mask on setcontext/swapcontext (#1249114).
  - s390: Fix backtrace in the presence of makecontext (#1249115).


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.2.1.el7]
changelog:
  - [netdrv] macvtap: unbreak receiving of gro skb with frag list (Jason Wang) [1279794 1273737]
  - [net] ipv6: drop frames with attached skb->sk in forwarding (Hannes Frederic Sowa) [1281701 1243966]
  - [net] ipv6: ip6_forward: perform skb->pkt_type check at the beginning (Hannes Frederic Sowa) [1281701 1243966]
  - [net] sctp: Fix race between OOTB responce and route removal (Jamie Bainbridge) [1281426 1277309]
  - [x86] mm: fix VM_FAULT_RETRY handling (Andrea Arcangeli) [1281427 1277226]
  - [x86] mm: consolidate VM_FAULT_RETRY handling (Andrea Arcangeli) [1281427 1277226]
  - [x86] mm: move mmap_sem unlock from mm_fault_error() to caller (Andrea Arcangeli) [1281427 1277226]
  - [mm] let mm_find_pmd fix buggy race with THP fault (Larry Woodman) [1281424 1273993]
  - [mm] ksm: unstable_tree_search_insert error checking cleanup (Andrea Arcangeli) [1281422 1274871]
  - [mm] ksm: use find_mergeable_vma in try_to_merge_with_ksm_page (Andrea Arcangeli) [1281422 1274871]
  - [mm] ksm: use the helper method to do the hlist_empty check (Andrea Arcangeli) [1281422 1274871]
  - [mm] ksm: don't fail stable tree lookups if walking over stale stable_nodes (Andrea Arcangeli) [1281422 1274871]
  - [mm] ksm: add cond_resched() to the rmap_walks (Andrea Arcangeli) [1281422 1274871]
  - [powerpc] kvm: book3s_hv: Synthesize segment fault if SLB lookup fails (Thomas Huth) [1281423 1269467]
  - [powerpc] kvm: book3s_hv: Create debugfs file for each guest's HPT (David Gibson) [1281420 1273692]
  - [powerpc] kvm: book3s_hv: Add helpers for lock/unlock hpte (David Gibson) [1281420 1273692]
  - [powerpc] pci: initialize hybrid_dma_data before use (Laurent Vivier) [1279793 1270717]
  - [md] raid10: don't clear bitmap bit when bad-block-list write fails (Jes Sorensen) [1279796 1267652]
  - [md] raid1: don't clear bitmap bit when bad-block-list write fails (Jes Sorensen) [1279796 1267652]
  - [md] raid10: submit_bio_wait() returns 0 on success (Jes Sorensen) [1279796 1267652]
  - [md] raid1: submit_bio_wait() returns 0 on success (Jes Sorensen) [1279796 1267652]
  - [md] crash in md-raid1 and md-raid10 due to incorrect list manipulation (Jes Sorensen) [1279796 1267652]
  - [md] raid10: ensure device failure recorded before write request returns (Jes Sorensen) [1279796 1267652]
  - [md] raid1: ensure device failure recorded before write request returns (Jes Sorensen) [1279796 1267652]
  - [block] nvme: Fix memory leak on retried commands (David Milburn) [1279792 1271860]
  - [cpufreq] intel_pstate: fix rounding error in max_freq_pct (Prarit Bhargava) [1281491 1263866]
  - [cpufreq] intel_pstate: fix PCT_TO_HWP macro (Prarit Bhargava) [1273926 1264990]
  - [cpufreq] revert "intel_pstate: add quirk to disable HWP on Skylake-S processors" (Prarit Bhargava) [1273926 1264990]
  - [cpufreq] revert "intel_pstate: disable Skylake processors" (Prarit Bhargava) [1273926 1264990]
  - [x86] kvm: svm: unconditionally intercept #DB (Paolo Bonzini) [1279469 1279470] {CVE-2015-8104}
  - [x86] virt: guest to host DoS by triggering an infinite loop in microcode (Paolo Bonzini) [1277560 1277561] {CVE-2015-5307}


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.5.1.el7]
changelog:
  - [net] vsock: Fix lockdep issue (Dave Anderson) [1292372 1253971]
  - [net] vsock: sock_put wasn't safe to call in interrupt context (Dave Anderson) [1292372 1253971]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.7.1.el7]
changelog:
  - [scsi] scsi_sysfs: protect against double execution of __scsi_remove_device() (Vitaly Kuznetsov) [1292075 1273723]
  - [powerpc] mm: Recompute hash value after a failed update (Gustavo Duarte) [1289452 1264920]
  - [misc] genwqe: get rid of atomic allocations (Hendrik Brueckner) [1289450 1270244]
  - [mm] use only per-device readahead limit (Eric Sandeen) [1287550 1280355]
  - [net] ipv6: update ip6_rt_last_gc every time GC is run (Hannes Frederic Sowa) [1285370 1270092]
  - [kernel] tick: broadcast: Prevent livelock from event handler (Prarit Bhargava) [1284043 1265283]
  - [kernel] clockevents: Serialize calls to clockevents_update_freq() in the core (Prarit Bhargava) [1284043 1265283]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.8.1.el7]
changelog:
  - [md] dm: fix AB-BA deadlock in __dm_destroy() (Mike Snitzer) [1296566 1292481]
  - [md] revert "dm-mpath: fix stalls when handling invalid ioctls" (Mike Snitzer) [1287552 1277194]
  - [cpufreq] intel_pstate: Fix limits->max_perf rounding error (Prarit Bhargava) [1296276 1279617]
  - [cpufreq] intel_pstate: Fix limits->max_policy_pct rounding error (Prarit Bhargava) [1296276 1279617]
  - [cpufreq] revert "intel_pstate: fix rounding error in max_freq_pct" (Prarit Bhargava) [1296276 1279617]
  - [crypto] nx: 842 - Add CRC and validation support (Gustavo Duarte) [1289451 1264905]
  - [powerpc] eeh: More relaxed condition for enabled IO path (Steve Best) [1289101 1274731]
  - [security] keys: Don't permit request_key() to construct a new keyring (David Howells) [1275929 1273465] {CVE-2015-7872}
  - [security] keys: Fix crash when attempt to garbage collect an uninstantiated keyring (David Howells) [1275929 1273465] {CVE-2015-7872}
  - [security] keys: Fix race between key destruction and finding a keyring by name (David Howells) [1275929 1273465] {CVE-2015-7872}
  - [x86] paravirt: Replace the paravirt nop with a bona fide empty function (Mateusz Guzik) [1259582 1259583] {CVE-2015-5157}
  - [x86] nmi: Fix a paravirt stack-clobbering bug in the NMI code (Mateusz Guzik) [1259582 1259583] {CVE-2015-5157}
  - [x86] nmi: Use DF to avoid userspace RSP confusing nested NMI detection (Mateusz Guzik) [1259582 1259583] {CVE-2015-5157}
  - [x86] nmi: Reorder nested NMI checks (Mateusz Guzik) [1259582 1259583] {CVE-2015-5157}
  - [x86] nmi: Improve nested NMI comments (Mateusz Guzik) [1259582 1259583] {CVE-2015-5157}
  - [x86] nmi: Switch stacks on userspace NMI entry (Mateusz Guzik) [1259582 1259583] {CVE-2015-5157}


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.9.1.el7]
changelog:
  - [security] keys: Fix keyring ref leak in join_session_keyring() (David Howells) [1298931 1298036] {CVE-2016-0728}


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.10.1.el7]
changelog:
  - [of] return NUMA_NO_NODE from fallback of_node_to_nid() (Thadeu Lima de Souza Cascardo) [1300614 1294398]
  - [net] openvswitch: do not allocate memory from offline numa node (Thadeu Lima de Souza Cascardo) [1300614 1294398]


author: Akemi Yagi <toracat@centos.org> [3.10.0-327.10.1.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - Add in a patch that fixes missing Unifying device issue [bug#7340]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Add in a patch that fixes waking up from S3 for AMD family [bug#7645]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Add in a patch that fixes crash due to xfrm oops [bug#9646]
  - Enabled spidev [bug#9955]
  - Add in patches from bugs 10073 and 10191 [bug#10073 bug#10191]
  - Add in a patch from bug 10320 [bug#10320]


author: Phil Sutter - 3.10.0-47
changelog:
  - Related: #1215006 - backport current version of the ss command
  - Related: #1219280 - backport: iproute2: vti6 support


author: Phil Sutter - 3.10.0-48
changelog:
  - Related: #1215006 - backport current version of the ss command
  - Resolves: #1247315 - Fix limitation in iproute/ss regarding dual-stack sockets


author: Phil Sutter - 3.10.0-49
changelog:
  - Resolves: bz#1241486 - backport: tc: fq scheduler
  - Related: #1215006 - backport current version of the ss command


author: Phil Sutter - 3.10.0-50
changelog:
  - Resolves: #1244851 - vti tunnel does not work
  - Resolves: #1155116 - iproute2: implement "-d" option for "ip mon"


author: Phil Sutter - 3.10.0-51
changelog:
  - Resolves: bz#1251451 - can't change the remote/local address of tunnel
    interface to "any" in ipip mode
  - Related: #1213869 - [6wind 7.2 Feat]: backport: iproute2: various netns
    features
  - Related: #1215006 - [RFE] backport current version of the ss command
  - Resolves: #1251070 - Fix multiple programming errors in iproute package
  - Related: #1198456 - backport: dynamic precision, human readable, and IEC
    output to ip stats
  - Related: #1210402 - [6wind 7.2 Feat]: backport: vxlan: unable to configure
    UDP checksums
  - Related: #1213869 - [6wind 7.2 Feat]: backport: iproute2: various netns
    features


author: Phil Sutter - 3.10.0-52
changelog:
  - Resolves: #1254095 - bridge: Add master device name to bridge fdb show
  - Resolves: #1255316 - tc does not allow to attach pfifo_fast qdisc
  - Related: #1251070 - Fix multiple programming errors in iproute package


author: Phil Sutter - 3.10.0-53
changelog:
  - Related: #1212026 - [6wind 7.2 Feat]: backport: ipxfrm: unable to configure
    SPD hash table - reverted this backport due to unmet dependencies


author: Marek Kasik <mkasik@redhat.com> - 2.4.11-10.el7_1.1
changelog:
  - Fixes CVE-2014-9657
     - Check minimum size of `record_size'.
  - Fixes CVE-2014-9658
     - Use correct value for minimum table length test.
  - Fixes CVE-2014-9675
     - New macro that checks one character more than `strncmp'.
  - Fixes CVE-2014-9660
     - Check `_BDF_GLYPH_BITS'.
  - Fixes CVE-2014-9661
     - Initialize `face->ttf_size'.
     - Always set `face->ttf_size' directly.
     - Exclusively use the `truetype' font driver for loading
       the font contained in the `sfnts' array.
  - Fixes CVE-2014-9663
     - Fix order of validity tests.
  - Fixes CVE-2014-9664
     - Add another boundary testing.
     - Fix boundary testing.
  - Fixes CVE-2014-9667
     - Protect against addition overflow.
  - Fixes CVE-2014-9669
     - Protect against overflow in additions and multiplications.
  - Fixes CVE-2014-9670
     - Add sanity checks for row and column values.
  - Fixes CVE-2014-9671
     - Check `size' and `offset' values.
  - Fixes CVE-2014-9673
     - Fix integer overflow by a broken POST table in resource-fork.
  - Fixes CVE-2014-9674
     - Fix integer overflow by a broken POST table in resource-fork.
     - Additional overflow check in the summation of POST fragment lengths.
  - Work around behaviour of X11's `pcfWriteFont' and `pcfReadFont' functions
  - Resolves: #1197739


author: Milan Crha <mcrha@redhat.com> - 3.8.5-28
changelog:
  - Add patch for RH bug #1131927 (Crash in LDAP's stop_view function)
  - Add patch for RH bug #1150382 (Coverity scan warning in IMAPx)
  - Add patch for RH bug #1122644 (Weather calendar doesn't work)


author: Robert Relyea <rrelyea@redhat.com> - 1.1.0-34
changelog:
  - recognize up to 32 keys and certs in coolkeys. (can go up to 62 with just #define changes)
  - own our cache file.
  - verify we are using the correct mechanisms


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.20-5
changelog:
  - Resolves: #1404817 - SIGSEV in TunnelStateData::handleConnectResponse()
    during squid reconfigure and restart


author: Akemi Yagi <toracat@centos.org> [3.10.0-327.4.5.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - Add in a patch that fixes missing Unifying device issue [bug#7340]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Add in a patch that fixes waking up from S3 for AMD family [bug#7645]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Add in a patch that fixes crash due to xfrm oops [bug#9646]
  - Enabled spidev [bug#9955]
  - Add in patches from bugs 10073 and 10191 [bug#10073 bug#10191]


author: Akemi Yagi <toracat@centos.org> [3.10.0-327.3.1.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - Add in a patch that fixes missing Unifying device issue [bug#7340]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Add in a patch that fixes waking up from S3 for AMD family [bug#7645]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Add in a patch that fixes crash due to xfrm oops [bug#9646]


author: Florian Festi <ffesti@redhat.com> - 4.11.3-14
changelog:
  - Enable plugin system but disable collection plugins. Needed for
    systemd-inhibit plugin (#1160401)
  - Move systemd-inhibit plugin into its own sub packge


author: William Cohen <wcohen@redhat.com> - 5.2.0-15
changelog:
  - Update papi L1 cache events on POWER7
  - Prevent papi-testsuite segfaults
  - Identify kernels that support rdpmc
  - Correct papi-testsuite byte_profile and sprofile tests on ppc64le
  - Update PAPI_L1_TCM event on Haswells


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-4
changelog:
  - Release 1.3.5.10-4
  - Resolves: bug 1209128 - [RFE] Add a utility to get the status of Directory Server instances (DS 48144)
  - Resolves: bug 1333184 - (389-ds-base-1.3.5) Fixing coverity issues. (DS 48919)
  - Resolves: bug 1350799 - CVE-2016-4992 389-ds-base: Information disclosure via repeat
  - Resolves: bug 1354660 - flow control in replication also blocks receiving results (DS 48767)
  - Resolves: bug 1356261 - Fixup tombstone task needs to set proper flag when updating (DS 48924)
  - Resolves: bug 1355760 - ns-slapd crashes during the deletion of backend (DS 48922)
  - Resolves: bug 1353629 - DS shuts down automatically if dnaThreshold is set to 0 in a MMR setup (DS 48916)
  - Resolves: bug 1355879 - nunc-stans: ns-slapd crashes during startup with SIGILL on AMD Opteron 280 (DS 48925)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-5
changelog:
  - Release 1.3.5.10-5
  - Resolves: bug 1333184 - (389-ds-base-1.3.5) Fixing coverity issues. (DS 48919)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-6
changelog:
  - Release 1.3.5.10-6
  - Resolves: bug 1326077 - Page result search should return empty cookie if there is no returned entry (DS 48928)
  - Resolves: bug 1360447 - nsslapd-workingdir is empty when ns-slapd is started by systemd (DS 48939)
  - Resolves: bug 1360327 - remove-ds.pl deletes an instance even if wrong prefix was specified (DS 48934)
  - Resolves: bug 1349815 - DS logs have warning:ancestorid not indexed for all CS subsystems (DS 48940)
  - Resolves: bug 1329061 - 389-ds-base-1.3.4.0-29.el7_2 "hang" (DS 48882)
  - Resolves: bug 1360976 - EMBARGOED CVE-2016-5405 389-ds-base: Password verification vulnerable to timing attack
  - Resolves: bug 1361134 - When fine-grained policy is applied, a sub-tree has a priority over a user while changing password (DS 48943) 
  - Resolves: bug 1361321 - Duplicate collation entries (DS 48936)
  - Resolves: bug 1316580 - dirsrv service doesn't ask for pin when pin.txt is missing (DS 48450)
  - Resolves: bug 1350799 - CVE-2016-4992 389-ds-base: Information disclosure via repeat


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-7
changelog:
  - Release 1.3.5.10-7
  - Resolves: bug 1316580 - dirsrv service doesn't ask for pin when pin.txt is missing (DS 48450)
  - Resolves: bug 1360976 - fixing a compiler warning


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-8
changelog:
  - Release 1.3.5.10-8
  - Resolves: bug 1321124 - Replication changelog can incorrectly skip over updates (DS 48954)
  - Resolves: bug 1364190 - Change example in /etc/sysconfig/dirsrv to use tcmalloc (DS 48950)
  - Resolves: bug 1366561 - ns-accountstatus.pl giving error even "No such object (32)" (DS 48956)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-9
changelog:
  - Release 1.3.5.10-9
  - Resolves: bug 1364190 - Change example in /etc/sysconfig/dirsrv to use tcmalloc (DS 48950)
  - Resolves: bug 1366828 - audit on failure doesn't work if attribute nsslapd-auditlog-logging-enabled is NOT enabled (DS 48958)
  - Resolves: bug 1368520 - Crash in import_wait_for_space_in_fifo() (DS 48960)
  - Resolves: bug 1368956 - man page of ns-accountstatus.pl shows redundant entries for -p port option
  - Resolves: bug 1369537 - passwordMinAge attribute doesn't limit the minimum age of the password (DS 48967)
  - Resolves: bug 1369570 - cleanallruv changelog cleaning incorrectly impacts all backends (DS 48964)
  - Resolves: bug 1369425 - ACI behaves erratically (DS 48972)
  - Resolves: bug 1370300 - set proper update status to replication agreement in case of failure (DS 48957)
  - Resolves: bug 1209094 - Allow logging of rejected changes (DS 48969)
  - Resolves: bug 1371283 - Server Side Sorting crashes the server. (DS 48970)
  - Resolves: bug 1371284 - Disabling CLEAR password storage scheme will crash server when setting a password (DS 48975)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-10
changelog:
  - Release 1.3.5.10-10
  - Resolves: bug 1370300 - set proper update status to replication agreement in case of failure (DS 48957)
  - Resolves: bug 1209094 - Allow logging of rejected changes (DS 48969)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-11
changelog:
  - Release 1.3.5.10-11
  - Resolves: bug 1321124 - Replication changelog can incorrectly skip over updates


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-12
changelog:
  - Release 1.3.5.10-12
  - Resolves: bug 1384785 - Replica install fails with old IPA master sometimes during replication process (DS 48992)
  - Resolves: bug 1388501 - 389-ds-base is missing runtime dependency - bind-utils (DS 48328)
  - Resolves: bug 1388581 - Replication stops working only when fips mode is set to true (DS 48909)
  - Resolves: bug 1390342 - ns-accountstatus.pl shows wrong status for accounts inactivated by Account policy plugin (DS 49014)
  - Resolves: bug 1390343 - trace args debug logging must be more restrictive (DS 49009)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 6.3.24-3
changelog:
  - Fix fetchmail loses last line of message if the non-default "mimedecode" option
    is enabled and if that line is not properly terminated
    Resolves: #955814


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 6.3.24-6
changelog:
  - Fix bogus dates in the %changelog
  - Backport better SSL protocol support and documentation
    Resolves: #1273016
  - Minor fixes in options, usage message and man page
    Resolves: #949013


author: Martin Sehnoutka <msehnout@redhat.com> - 3.0.2-20
changelog:
  - Resolves: #1147551 - Missing isolate_* options, incorrect default values of
    max_clients, max_per_ip in man vsftpd.conf


author: Zdenek Dohnal <zdohnal@redhat.com> - 3.0.2-22
changelog:
  - Resolves: #1432054 - secure ftp stopped working with default TLS settings in the new vsftpd package


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.2-23
changelog:
  - Redefine VSFTP_COMMAND_FD to 1
  - Resolves: rhbz#1443055
  - Document the relationship of text_userdb_names and chroot_local_user
  - Resolves: rhbz#1508021
  - Document allow_writeable_chroot in the man page
  - Resolves: rhbz#1508022
  - Improve documentation of ascii_* options
  - Resolves: rhbz#1517227
  - Add new filename generation algorithm for STOU command
  - Resolves: rhbz#1479237


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.2-25
changelog:
  - Add config option log_die allowing to pass error messages to syslog
  - Add config option bind_retries allowing to change the max number
  - of attempts to find a listening port for the PASV/EPSV command
  - Resolves: rhbz#1318198


author: Peter Jones <pjones@redhat.com> - 2.02-0.10
changelog:
  - Make editenv utilities (grub2-editenv, grub2-set-default, etc.) from
    non-UEFI builds work with UEFI builds as well, since they're shared
    from grub2-tools.
    Resolves: rhbz#1119943
  - Make more grub2-mkconfig generate menu entries with the OS name and version
    included.
    Resolves: rhbz#996794
  - Minimize the sort ordering for .debug and -rescue- kernels.
    Resolves: rhbz#1065360
  - Add GRUB_DISABLE_UUID to disable filesystem searching by UUID.
    Resolves: rhbz#1027833
  - Allow "fallback" to specify titles like the documentation says
    Resolves: rhbz#1026084


author: Peter Jones <pjones@redhat.com> - 2.02-0.11
changelog:
  - Fix grub2 segfault when root isn't set.
    Resolves: rhbz#1084536
  - Make the aarch64 loader be SB-aware.
    Related: rhbz#1100048
  - Enable regexp module
    Resolves: rhbz#1125916


author: Johnny Hughes <johnny@centos.org> - 2.02-0.16.el7.centos
changelog:
  - Move the edidir to be CentOS, so people can co-install fedora, rhel and centos
  - Roll in CentOS Secureboot keys


author: Jakub Filak <jfilak@redhat.com> 2.1.11-3
changelog:
  - fix a double free error in abrt-applet
  - configure Augeas to parse only required files
  - show 'Close' button in the Configuration dialogue
  - Resolves: #1050167, #1053534, #1054158


author: Jakub Filak <jfilak@redhat.com> 2.1.11-5
changelog:
  - abrt-cli requires libreport-rhel (the reporting workflows)
  - applet: don't notify missing ignored_problems file
  - abrt-cli: show a hint about creating a case in RHTS
  - abrt-cli: show a info text suggesting enabling the autoreporting
  - Related: #1044424
  - Resolves: #1054291, #1055565, #1056980


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-7
changelog:
  - Fix-handling-of-Machine-Check-Exceptions
  - abrt-harvest-vmcore recovers from Permission denied errors
  - never stop 'notify' event
  - install abrt-python files to arch specific dir
  - Resolves: #1032077, #1032511, #1057710
  - Related: #881123


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-9
changelog:
  - Stop consuming 100%CPU in abrt-upload-watch
  - Turn off Autoreporting
  - Enabled GPG check
  - Resolves: #1051480, #1063317


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-11
changelog:
  - Capture all necessary logs in sosreport.tar.gz
  - do not send ureport from abrt-applet
  - do not run gdb under root
  - Resolves: #1067114, #1069278, #1069719


author: Petr Hracek <phracek> - 4.1.0-0.20.20120314git3c2946
changelog:
  - Multiple packages are installing files under /etc/tmpfiles.d
  - comply http://fedoraproject.org/wiki/Packaging:Guidelines#Tmpfiles.d
  - Resolves: rhbz#1121958


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-8
changelog:
  - fence_aliyun: add logging
    Resolves: rhbz#1568742
  - fence_gce: add stackdriver-logging support, improve logging and
    set default mode to cycle
    Resolves: rhbz#1568753


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-11.8
changelog:
  - fence_rhevm: add RHEV v4 API support and auto-detection
    Resolves: rhbz#1708547
  - fence_azure_arm: use skip_shutdown feature
    Resolves: rhbz#1709110


author: Tim Waugh <twaugh@redhat.com> - 1.0.35-7
changelog:
  - Upstream patch to re-work filter costs (bug #998981). No longer need
    text filter costs patch as paps gets used by default now if
    installed.


author: Tim Waugh <twaugh@redhat.com> - 1.0.35-15:.1
changelog:
  - Applied upstream patch to fix BrowseAllow parsing issue
    (CVE-2014-4338, bug #1091568).
  - Applied upstream patch for cups-browsed DoS via
    process_browse_data() out-of-bounds read (CVE-2014-4337,
    bug #1111510).


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-22
changelog:
  - ipa-replica-install never checks for 7389 port (#1075165)
  - Non-terminated string may be passed to LDAP search (#1075091)
  - ipa-sam may fail to translate group SID into GID (#1073829)
  - Excessive LDAP calls by ipa-sam during Samba FS operations (#1075132)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-26
changelog:
  - When IdM server trusts multiple AD forests, IPA client returns invalid group
    membership info (#1079498)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-28
changelog:
  - ipa-client-automount fails with incompatibility error when installed against
    older IPA server (#1083108)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-28.1
changelog:
  - Server installation fails using external signed certificates with
    "IndexError: list index out of range" (#1130031)
  - Add rhino to BuildRequires to fix Web UI build error


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-73
changelog:
  - portblock: fix tickle_tcp bug
  - nfsserver: use rpcpipefs_dir variable
  - mysql: use replication_port variable
  - oracle: inform user that monprofile must start with C## for
    container databases

    Resolves: rhbz#1337109
    Resolves: rhbz#1337615
    Resolves: rhbz#1337124
    Resolves: rhbz#1328386


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-78
changelog:
  - nfsserver: fix monitor issues causing NFS to start on
    "debug-monitor" and "resource cleanup"
  - nfsserver: remove "up to 10 tries" on start to avoid issues with
    some services taking longer to start
  - nfsserver: stop rpc-gssd to allow unmounting of "rpcpipefs_dir"

    Resolves: rhbz#1356866
    Resolves: rhbz#1126073
    Resolves: rhbz#1346733


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-81
changelog:
  - oracle: fix issue with C## in monprofile and inform user that
    monuser must start with C## as well for container databases

    Resolves: rhbz#1328386


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-82
changelog:
  - portblock: create tickle_dir if it doesn't exist
  - tomcat: use systemd if available

    Resolves: rhbz#1303037
    Resolves: rhbz#1249430


author: Jarod Wilson <jarod@redhat.com> 17.1-1
changelog:
  - Rebase to upstream rdma-core v17.1 stable release
  - No more libibcm or ib sysv initscripts
  - Resolves: rhbz#1515647
  - Resolves: rhbz#1517208
  - Resolves: rhbz#1523201
  - Resolves: rhbz#1541751


author: Jarod Wilson <jarod@redhat.com> 17.1-3
changelog:
  - Grab latest stable-v17 fixes from upstream
  - Fix Provides/Obsoletes on removed libibcm
  - Fix Provides/Obsoletes on removed libehca
  - Straighten out SW parsing feature support for DPDK
  - Fix mlx5 rate-limiting support
  - Resolves: rhbz#1588096
  - Resovles: rhbz#1534856
  - Resolves: rhbz#1589525


author: Jarod Wilson <jarod@redhat.com> 17.2-2
changelog:
  - Restore SysV Initscripts ib ifup and ifdown helpers
  - Adjust MTU limit for IPoIB in datagram mode via ifup-ib
  - Resolves: rhbz#1593426
  - Resolves: rhbz#1593334


author: Jarod Wilson <jarod@redhat.com> 22-1
changelog:
  - Rebase to upstream rdma-core v22
  - Resolves: rhbz#1641921
  - Add mlx5 IB Device Memory support (MEMIC)
  - Resolves: rhbz#1644697
  - Add mlx5 Tunnel protocol RX decap/encap offload
  - Resolves: rhbz#1644709
  - Add mlx5 Tunnel protocol TX decap/encap offload
  - Resolves: rhbz#1644778
  - Add support for mlx5 infiniband flow counters
  - Resolves: rhbz#1644714
  - Add mlx5 DEVX interface
  - Resolves: rhbz#1644722
  - Add libbnxt_re support for SRQ
  - Resolves: rhbz#1570393


author: Jarod Wilson <jarod@redhat.com> 22.1-1
changelog:
  - Update to upstream v22.1 release with stable-v22 branch fixes
  - Add support for Broadcom 57500 RoCE adapter
  - Resolves: rhbz#1678274


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-19
changelog:
  - Import LCMS2 2.6 rebase changes into ghostscript (bug #959351)
  - Fix hanging of ghostscript when converting PDF -> PNG (bug #1302121)
  - Do not SIGSEGV after icc_profile error, report error instead (bug #1243784)
  - Fix the color printing on HP InkJet printers (bug #1225858)


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-855.el7]
changelog:
  - [crypto] algif_skcipher: Remove custom release parent function (Bruno Eduardo de Oliveira Meneguele) [1529441]
  - [crypto] algif_hash: Remove custom release parent function (Bruno Eduardo de Oliveira Meneguele) [1537376]
  - [mailbox] pcc: Drop uninformative output during boot (Kazuhito Hagio) [1515571]
  - [edac] skx_edac: Fix detection of single-rank DIMMs (Aristeu Rozanski) [1482248]
  - [md] free unused memory after bitmap resize (Nigel Croxon) [1532767]
  - [fs] sunrpc: ensure correct error is reported by xs_tcp_setup_socket() (Steve Dickson) [1536582]
  - [fs] Revert "fixing infinite OPEN loop in 4.0 stateid recovery" (Steve Dickson) [1542191]
  - [scsi] use 'scsi_device_from_queue()' for scsi_dh (Mike Snitzer) [1546212]
  - [scsi] dh: add a common helper to get a scsi_device from a request_queue (Mike Snitzer) [1546212]
  - [scsi] qedi: Drop cqe response during connection recovery (Chad Dupuis) [1543503]
  - [scsi] qedi: Fix a possible sleep-in-atomic bug in qedi_process_tmf_resp (Chad Dupuis) [1543503]
  - [scsi] qla4xxx: skip error recovery in case of register disconnect (Himanshu Madhani) [1541766]
  - [x86] spectre: fix the kernel build without CONFIG_RETPOLINE (Josh Poimboeuf) [1543939]


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-856.el7]
changelog:
  - [infiniband] ipoib: Add ipoib_enhanced module parameter (Slava Shwartsman) [1533013]
  - [netdrv] ibmvnic: Remove skb->protocol checks in ibmvnic_xmit (Desnes Augusto Nunes do Rosario) [1544356]
  - [netdrv] ibmvnic: Reset long term map ID counter (Desnes Augusto Nunes do Rosario) [1544356]
  - [netdrv] ibmvnic: queue reset when CRQ gets closed during reset (Desnes Augusto Nunes do Rosario) [1544356]
  - [netdrv] ibmvnic: Ensure that buffers are NULL after free (Desnes Augusto Nunes do Rosario) [1544356]
  - [netdrv] ibmvnic: Fix rx queue cleanup for non-fatal resets (Desnes Augusto Nunes do Rosario) [1544356]
  - [netdrv] ibmvnic: fix empty firmware version and errors cleanup (Desnes Augusto Nunes do Rosario) [1544356]
  - [netdrv] ibmvnic: fix firmware version when no firmware level has been provided by the VIOS server (Desnes Augusto Nunes do Rosario) [1544356]
  - [netdrv] mlx5e: Fix offloading of E-Switch TC pedit actions (Slava Shwartsman) [1545640]
  - [netdrv] qed: Correct setting the number of completion queues for FCoE functions (Chad Dupuis) [1542188]
  - [netdrv] ixgbe: fix crash in build_skb Rx code path (Ken Cox) [1520428]
  - [netdrv] tg3: APE heartbeat changes (Jonathan Toppins) [1546217]
  - [powerpc] pseries/vio: Dispose of virq mapping on vdevice unregister (Gustavo Duarte) [1544009]
  - [s390] qeth: fix underestimated count of buffer elements (Hendrik Brueckner) [1544698]
  - [x86] kvm: fix singlestepping over syscall (Paolo Bonzini) [1464481] {CVE-2017-7518}
  - [x86] paravirt: fix kabi breakage in pv_mmu_ops (Jeff Moyer) [1546027]
  - [x86] uaccess: introduce copy_from_iter_flushcache for pmem / cache-bypass operations (Jeff Moyer) [1471678]


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-857.el7]
changelog:
  - [media] v4l2-compat-ioctl32.c: refactor compat ioctl32 logic (Jarod Wilson) [1548430] {CVE-2017-13166}
  - [sound] alsa: seq: Fix use-after-free at creating a port (CVE-2017-15265) (Jaroslav Kysela) [1503381] {CVE-2017-15265}
  - [gpu] drm/radeon: insist on 32-bit DMA for Cedar on PPC64/PPC64LE (Rob Clark) [1546022]
  - [edac] disable only ghes_edac by default (Aristeu Rozanski) [1543078]
  - [edac] ghes: Model a single, logical memory controller (Aristeu Rozanski) [1543078]
  - [fs] cifs: release cifs root_cred after exit_cifs (Leif Sahlberg) [1525874]
  - [fs] gfs2: Fix fallocate chunk size (Andreas Grunbacher) [1545329]
  - [fs] gfs2: Fixes to "Implement iomap for block_map" (Andreas Grunbacher) [1542594]
  - [fs] gfs2: Clean up (lookup,fillup)_metapath (Andreas Grunbacher) [1542594]
  - [fs] iomap: warn on zero-length mappings (Andreas Grunbacher) [1542594]
  - [md] raid0: remove blank line printk from dump_zones() (John Pittman) [1534272]
  - [md] dm: use blkdev_get rather than bdgrab when issuing pass-through ioctl (Mike Snitzer) [1513037]
  - [mm] kvmalloc: stress the vmalloc path in the debugging kernel (Mikulas Patocka) [1523567]
  - [mm] fs: rework do_invalidatepage (Eric Sandeen) [1546079]
  - [net] netfilter: fix NULL ptr dereference in nf_send_reset() (Paolo Abeni) [1546148]


author: Akemi Yagi <toracat@centos.org> [3.10.0-862.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
     addmissing.patch  [puias]
     cpufreq.patch  [puias]
     i386-audit-stop-scri-stack-frame.patch  [puias]
     removejiffies.patch  [puias]
     undorhirqstat.patch  [puias]
     morefixes.patch      [puias+bug#12412]
     upstream-32bit-fixes-7_4.patch [puias+bug#12412]
     clear-32bit-Werror-warnings.patch  [bug#12412]
     qspinlock_types-32bit.patch   [ay]
     i686-7-4.patch [T.Kabe, bug#13890]
     firmware-efi-32bit.patch [ay]
     patch-spec_ctrl_i686.patch [T.Kabe bug#14353]
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Enabled spidev [bug#9955]
  - Add a patch [bug#10447]
  - Enable ATM drivers [bug#10845]
  - Add 9pfs config options [bug#10849]
  - Enable VFIO_PCI_VGA [bug#12435]
  - Rremove initramfs-xxxkdump.img upon kernel removal [bug#12703]
  - Add a patch from [bug#12841]
  - Add a patch from [bug#12818]
  - Enabled RT2800USB_RT3573 [bug#13162]
  - Enable LDM_PARTITION [bug#13526]
  - Add a patch to fix misleading warning [bug#13990]
  - Add BuildRequires: openssl-devel to the with_perf section [bug#13990]
  - Add a patch to fix build errors for EL7.5 [bug#14425]


author: T.Kabe [3.10.0-862.el7.centos.plus]
changelog:
  - Roll in i686 mods for 3.10.0-862 [bug#14703]
    upstream-32bit-fixes-7_5.patch [based on puias+bug#12412]
    patch-ALIGN-dupdef.patch
    patch-copy_from_user-warning-v1.patch
    patch-flush_tlb-undef.patch
    patch-get_stack_info-198d208df4.patch
    patch-MAX_LFS_FILESIZE-0cc3b0ec23.patch
    patch-no-unwind_unsafe_stack.patch
    patch-pcc-long-cast.patch
    patch-pps-timespec64-ade1bdffe9.patch
    patch-pud_devmap-multidef.patch
    patch-typo-7.5.patch
    patch-vmx-cmpxchg64-c0a1666bcb.patch
    patch-zu-format-v1.patch
    patch-nospec-32-v1.patch
    i386-retpoline-support-v6.patch


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-38
changelog:
  - Resolves: rhbz#1372753 - Access denied for user when access_provider =
                             krb5 is set in sssd.conf


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-39
changelog:
  - Resolves: rhbz#1375182 - SSSD goes offline when the LDAP server returns
                             sizelimit exceeded


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-40
changelog:
  - Resolves: rhbz#1375299 - sss_groupshow <user> fails with error "No such
                             group in local domain. Printing groups only
                             allowed in local domain"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-42
changelog:
  - Resolves: rhbz#1371631 - login using gdm calls for gdm-smartcard when
                             smartcard authentication is not enabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-43.1
changelog:
  - Resolves: rhbz#1392896 - AD provider: SSSD does not retrieve a domain-local
                             group with the AD provider when following AGGUDLP
                             group structure across domains


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-43.4
changelog:
  - Revert the fix for ignoring sudoUser case as it breaks processing
    of rules that completely lack a sudoUser attribute
  - Related: rhbz#1392946 - sudo: ignore case on case insensitive domains


author: Ray Strode <rstrode@redhat.com> - 0.8.9-0.29.20140113
changelog:
  - Fall back to text mode if /dev/dri/card0 can't modeset
    Resolves: #1431141
  - Remove unnecessary post scripts that rpm -V output
    Resolves: #1266085


author: Tom Lane <tgl@redhat.com> 2:1.5.10-3
changelog:
  - Remove compat subpackage (it's now a separate package "libpng12")
  - Minor specfile cleanup per suggestions from Tom Callaway
  Related: #845110


author: Tom Lane <tgl@redhat.com> 2:1.5.12-1
changelog:
  - Update to libpng 1.5.12 for minor bug fixes
  - Activate chunk size limits by default, with a very generous default limit


author: Richard W.M. Jones <rjones@redhat.com> - 1.12-13.1.el7
changelog:
  - Add patch to fix multilib conflicts in dnet-config
    resolves: rhbz#1059593
  - Remove RPM cruft from the spec file.


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.15.1.el7]
changelog:
  - [cpufreq] intel_pstate: Fix overflow in busy_scaled due to long delay (Prarit Bhargava) [1255496 1228346]
  - [netdrv] be2net: avoid vxlan offloading on multichannel configs (Ivan Vecera) [1256609 1232327]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.17.1.el7]
changelog:
  - [hv] vmbus: Cleanup vmbus_establish_gpadl() (Vitaly Kuznetsov) [1262096 1211914]
  - [scsi] iscsi: let session recovery_tmo sysfs writes persist across recovery (Chris Leech) [1261879 1139038]
  - [scsi] ipr: Fix invalid array indexing for HRRQ (Gustavo Duarte) [1260625 1251184]
  - [scsi] ipr: Fix incorrect trace indexing (Gustavo Duarte) [1260625 1251184]
  - [net] netfilter: synproxy: fix sending window update to client (Phil Sutter) [1257289 1257290 1251031 1242094]
  - [net] netfilter: ip6t_synproxy: fix NULL pointer dereference (Phil Sutter) [1257289 1257290 1251031 1242094]
  - [fs] nfsv4: Always drain the slot table before re-establishing the lease (Benjamin Coddington) [1256649 1240790]
  - [fs] Recover from stateid-type error on SETATTR (Benjamin Coddington) [1256639 1214410]
  - [netdrv] virtio-net: drop NETIF_F_FRAGLIST (Jason Wang) [1247839 1247840] {CVE-2015-5156}
  - [x86] mm: add memory tracking to native_pmdp_get_and_clear (David Bulkow) [1263525 1227357]
  - [fs] dcache: d_walk() might skip too much (Denys Vlasenko) [1173812 1173813] {CVE-2014-8559}
  - [fs] dcache: deal with deadlock in d_walk() (Denys Vlasenko) [1173812 1173813] {CVE-2014-8559}
  - [fs] dcache: move d_rcu from overlapping d_child to overlapping d_alias (Denys Vlasenko) [1173812 1173813] {CVE-2014-8559}
  - [fs] dcache: fold try_to_ascend() into the sole remaining caller (Denys Vlasenko) [1173812 1173813] {CVE-2014-8559}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.18.1.el7]
changelog:
  - [scsi] sd: split sd_init_command (Ewan Milne) [1264141 1109348]
  - [scsi] sd: retry discard commands (Ewan Milne) [1264141 1109348]
  - [scsi] sd: retry write same commands (Ewan Milne) [1264141 1109348]
  - [scsi] sd: don't use scsi_setup_blk_pc_cmnd for discard requests (Ewan Milne) [1264141 1109348]
  - [scsi] sd: don't use scsi_setup_blk_pc_cmnd for write same requests (Ewan Milne) [1264141 1109348]
  - [scsi] sd: don't use scsi_setup_blk_pc_cmnd for flush requests (Ewan Milne) [1264141 1109348]
  - [scsi] set sc_data_direction in common code (Ewan Milne) [1264141 1109348]
  - [scsi] restructure command initialization for TYPE_FS requests (Ewan Milne) [1264141 1109348]
  - [scsi] move the nr_phys_segments assert into scsi_init_io (Ewan Milne) [1264141 1109348]
  - [fs] xfs: remove bitfield based superblock updates (Brian Foster) [1261781 1225075]
  - [netdrv] ixgbe: fix X540 Completion timeout (John Greene) [1257633 1173786]
  - [lib] radix-tree: handle allocation failure in radix_tree_insert() (Seth Jennings) [1264142 1260613]
  - [crypto] nx - Fixing the limit number of bytes to be processed (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Fix SHA concurrence issue and sg limit bounds (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Moving NX-AES-XCBC to be processed logic (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Moving NX-AES-GCM to be processed logic (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Moving NX-AES-ECB to be processed logic (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Moving limit and bound logic in CTR and fix IV vector (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Moving NX-AES-CCM to be processed logic and sg_list bounds (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Moving NX-AES-CBC to be processed logic (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Check for bogus firmware properties (Herbert Xu) [1247127 1190103]
  - [md] raid1: extend spinlock to protect raid1_end_read_request against inconsistencies (Jes Sorensen) [1263416 1255758]
  - [md] raid1: fix test for 'was read error from last working device' (Jes Sorensen) [1263416 1255758]
  - [fs] xfs: direct IO EOF zeroing needs to drain AIO (Brian Foster) [1258942 1213370]
  - [fs] xfs: DIO write completion size updates race (Brian Foster) [1258942 1213370]
  - [fs] pnfs: Fix a memory leak when attempted pnfs fails (Steve Dickson) [1256640 1234986]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.19.1.el7]
changelog:
  - Revert: [fs] xfs: DIO write completion size updates race (Phillip Lougher) [1258942 1213370]
  - Revert: [fs] xfs: direct IO EOF zeroing needs to drain AIO (Phillip Lougher) [1258942 1213370]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.20.1.el7]
changelog:
  - Revert: [crypto] nx - Check for bogus firmware properties (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Moving NX-AES-CBC to be processed logic (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Moving NX-AES-CCM to be processed logic and sg_list bounds (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Moving limit and bound logic in CTR and fix IV vector (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Moving NX-AES-ECB to be processed logic (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Moving NX-AES-GCM to be processed logic (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Moving NX-AES-XCBC to be processed logic (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Fix SHA concurrence issue and sg limit bounds (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Fixing the limit number of bytes to be processed (Phillip Lougher) [1247127 1190103]


author: Akemi Yagi <toracat@centos.org> [3.10.0-229.20.1.el7.centos.plus]
changelog:
  - Roll in i686 mods (as of 3.10.0-229.20.1.el7)
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - Add in a patch that fixes missing Unifying device issue [bug#7340]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Add in a patch that fixes waking up from S3 for AMD family [bug#7645]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Add in a patch that fixes crash due to xfrm oops [bug#9646]


author: Ondrej Kozina <okozina@redhat.com> - 1.7.4-4
changelog:
  - patch: fix regression in blockwise functions
  - patch: avoid repeating error messages when device holders
    detected.
  - patch: add option to cryptsetup-reencrypt to print progress
    log sequentaly
  - patch: use --progress-frequency in reencryption dracut module
  - Resolves: #1480006 #1447632 #1479857


author: Ondrej Kozina <okozina@redhat.com> - 2.0.3-2
changelog:
  - patch: stop LUKS2 auto-recovery if device is no longer LUKS
    type
  - patch: update cryptsetup man page for --type option
  - patch: rephrase error message for invalid --type option in
    convert action
  - Resolves: #1599281 #1601477 #1601481


author: Ondrej Kozina <okozina@redhat.com> - 2.0.3-3
changelog:
  - Add expected permissions explicitly for locking directory.
  - Reinstate sed script removing library rpath from libtool
    script due to bug in upstream sources distribution.
  - Resolves: #1609847 #1610379


author: Colin Walters <walters@redhat.com> - 2018.1-2
changelog:
  - New upstream version for 7.5.0
  - https://github.com/ostreedev/ostree/releases/tag/v2018.1
  - https://github.com/ostreedev/ostree/releases/tag/v2017.15


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-12.5
changelog:
  - rabbitmq-cluster: get cluster status from mnesia during monitor
  - rabbitmq-cluster: fail monitor when node is in minority partition

    Resolves: rhbz#1641944
    Resolves: rhbz#1641946


author: Ivan Devat <idevat@redhat.com> - 0.9.165-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1572886 rhbz#1581150 rhbz#1579911 rhbz#1533849 rhbz#1557252 rhbz#1568353 rhbz#1574898 rhbz#1427273 rhbz#1475318 rhbz#1476862 rhbz#1535967 rhbz#1566382 rhbz#1588667 rhbz#1590533 rhbz#1403832 rhbz#1517333 rhbz#1529508


author: Ivan Devat <idevat@redhat.com> - 0.9.165-2
changelog:
  - Fixed validation for an unaccessible resource inside a bundle 
  - Fixed test of watchdog devices
  - Fixed command `pcs cluster node add-outside`
  - Fixed large key files distribution
  - Resolves: rhbz#1462248 rhbz#1475318 rhbz#1599758 rhbz#1600169


author: Ondrej Mular <omular@redhat.com> - 0.9.165-5
changelog:
  - Fixed `pcs stonith sbd watchdog test` error messages
  - Fixed avaliable watchdog devices listing
  - Resolves: rhbz#1475318


author: Ondrej Mular <omular@redhat.com> - 0.9.165-6
changelog:
  - Fix instance attributes setting for fence agents `fence_compute` and
    `fence_evacuate`
  - Resolves: rhbz#1623181


author: Ivan Devat <idevat@redhat.com> - 0.9.165-6.el7_6.1
changelog:
  - `pcs` no longer spawns unnecessary processes for reading node tokens
  - Fixed a bug causing most of the messages not being logged into pcsd.log
  - Lower load caused by periodical config files syncing in pcsd by making it sync less frequently
  - Improve logging of periodical config files syncing in pcsd
  - Resolves: rhbz#1683959 rhbz#1683957 rhbz#1683958


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-16
changelog:
  - Fix important coverity findings: missing include for flock and use bash for
    init script (RHBZ#1264399)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-17
changelog:
  - Fixed init script not to fail on missing restorecon (RHBZ#1246380)
  - Adapted man page snipplet for TRACE to use proper logging backend names
    (RHBZ#1261238)
  - Warn about use of DROP in nat table (RHBZ#1298879)
  - Fixed modules unload in init script (RHBZ#1324102)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-18
changelog:
  - Add support for --wait options to restore commands (RHBZ#1438597)
  - Do not set changed flag for rule check operations with module targets
    (RHBZ#1438597)
  - Add version option to restore commands (RHBZ#1438597)


author: Phil Sutter - 1.4.21-20
changelog:
  - Prevent iptables.service and ip6tables.service from running in parallel
    (RHBZ#1486803)
  - Don't restart services upon upgrade (RHBZ#1380141)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 0.17-37
changelog:
  - Improve message with response directions to reflect new option
    for user names with dot character


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 0.17-42
changelog:
  - Add systemd support (thanks to Zbigniew Jędrzejewski-Szmek and Jóhann B. Guðmundsson)
    Resolves: #737219


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-33
changelog:
  - Fix excessive queries caused by DS chasing with stub zones when DNSSEC is not used (#1291185)
  - Fix error in internal test suite (#1259514)
  - Fix named-checkconf call in *-chroot.service files (#1278082)
  - Fix incorrect path in BIND sample configuration and added comment to default configuration (#1247502)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-34
changelog:
  - Added support for CAA records (#1306610)
  - Use HTTPS URL instead of FTP for upstream sources (#1319280)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-36
changelog:
  - Added automatic interface scan functionality (#1294506)
  - Removed NetworkManager dispatcher script since it is not needed any more (#1294506)


author: Andreas Schneider <asn@redhat.com> - 4.8.1-1
changelog:
  - related: #1558560 - Rebase to newer Samba version
  - resolves: #1567896 - Fix possible crash if secrets db is emtpy
  - resolves: #1570020 - Fix a crash in smbd when dfsgetinfo is called


author: Andreas Schneider <asn@redhat.com> - 4.8.1-3
changelog:
  - resolves: #1575205 - Fix segfault when updating DNS with 'net ads join'
  - resolves: #1525511 - Fix idmap_rid dependency on trusted domain list


author: Andreas Schneider <asn@redhat.com> - 4.8.3-1
changelog:
  - related: #1558560 - Rebase to Samba version 4.8.3
  - resolves: #1579398 - Add winbind localauth krb5 plugin


author: Andreas Schneider <asn@redhat.com> - 4.8.3-4
changelog:
  - resolves: #1614132 - Fix delete-on-close after smb2_find
  - resolves: #1614265 - Fix CVE-2018-1139
  - resolves: #1614269 - Fix CVE-2018-10858


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-1
changelog:
  - rebase to 7.4.7
    add requirement on libestr >= 0.1.9
    resolves: #836485
    resolves: #1020854
    resolves: #1040036
  - drop patch 4; not needed anymore
    rsyslog-7.4.2-imuxsock-rfc3339.patch
  - install the rsyslog-recover-qi.pl tool
  - fix a typo in a package description
  - add missing defattr directives
  - add a patch to remove references to Google ads in the html docs
    rsyslog-7.4.7-bz1030044-remove-ads.patch
    Resolves: #1030043
  - add a patch to allow numeric specification of UIDs/GUIDs
    rsyslog-7.4.7-numeric-uid.patch
    resolves: #1032198
  - change the installation prefix to "/usr"
    resolves: #1032223
  - fix a bad date in the changelog
    resolves: #1043622
  - resolve a build issue with missing mysql_config by adding
    additional BuildRequires for the mysql package
  - add a patch to resolve build issue on ppc
    rsyslog-7.4.7-omelasticsearch-atomic-inst.patch


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-3
changelog:
  - replace rsyslog-7.3.15-imuxsock-warning.patch
    with rsyslog-7.4.7-bz1053669-imuxsock-wrn.patch
    resolves: #1053669
  - add rsyslog-7.4.7-bz1052266-dont-link-libee.patch to prevent
    linking the main binary with libee
    resolves: #1052266
  - add rsyslog-7.4.7-bz1054171-omjournal-warning.patch to fix
    a condition for issuing a warning in omjournal
    resolves: #1054171
  - drop the "v5" string from the conf file as it's misleading
    resolves: #1040036


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-5
changelog:
  - move the rscryutil man page to the crypto subpackage
    resolves: #1056565
  - add a patch to prevent message loss in imjournal
    rsyslog-7.4.7-bz1038136-imjournal-message-loss.patch
    resolves: #1038136


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-6
changelog:
  - disable the imklog plugin by default
    the patch for rhbz#1038136 caused duplication of kernel messages since the
    messages read by the imklog plugin were now also pulled in from journald
    resolves: #1078654


author: Bastien Nocera <bnocera@redhat.com> 3.14.3-1
changelog:
  - Update to 3.14.3
  - Re-add opensubtitles plugin, as it doesn't depend on PyXDG anymore
  Resolves: #1174589


author: Bastien Nocera <bnocera@redhat.com> 3.14.3-4
changelog:
  - Remove Python3 plugins, they're mostly accessory plugins,
    and RHEL 7.2 only support Python2 for now
  Resolves: #1259643


author: Ray Strode <rstrode@redhat.com> 3.14.3-5
changelog:
  - Add more goo to the compat desktop file to prevent them
    from exposing in control-center
  Related: #1259292


author: Mark Wielaard <mjw@redhat.com> - 0.170-1
changelog:
  - New upstream release. Remove upstreamed patches.
  - Sync provide_yama_scope with fedora.
  - Add elfutils-0.170-x86_64-backtrace-test-override.patch.


author: Mark Wielaard <mjw@redhat.com> - 0.171-1
changelog:
  - New upstream release.
    - DWARF5 and split dwarf, including GNU DebugFission, support.
    - readelf: Handle all new DWARF5 sections.
      --debug-dump=info+ will show split unit DIEs when found.
      --dwarf-skeleton can be used when inspecting a .dwo file.
      Recognizes GNU locviews with --debug-dump=loc.
    - libdw: New functions dwarf_die_addr_die, dwarf_get_units,
      dwarf_getabbrevattr_data and dwarf_cu_info.
      libdw will now try to resolve the alt file on first use
      when not set yet with dwarf_set_alt.
      dwarf_aggregate_size() now works with multi-dimensional arrays.
    - libdwfl: Use process_vm_readv when available instead of ptrace.
    - backends: Add a RISC-V backend.


author: Mark Wielaard <mjw@redhat.com> - 0.172-1
changelog:
  - New upstream release.
    - No functional changes compared to 0.171.
    - Various bug fixes in libdw and eu-readelf dealing with bad DWARF5
      data. Thanks to running the afl fuzzer on eu-readelf and various
      testcases.
    - eu-readelf -N is ~15% faster.


author: Siteshwar Vashisht <svashisht@redhat.com> - 20120801-37
changelog:
  - Add configuration option to enable signal bubbling for backward compatibility
    Resolves: #1484937


author: Kamil Dudka <kdudka@redhat.com> - 20120801-137
changelog:
  - Increase the release number by 100 to make sure it stays higher than in RHEL-6
    Related: #1484937


author: Lukas Nykryn <lnykryn@redhat.com> - 219-26
changelog:
  - install: do not crash when processing empty (masked) unit file (#1159308)
  - Revert "install: fix disable via unit file path" (#1348208)
  - systemctl: allow disable on the unit file path, but warn about it (#3806) (#1348208)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-27
changelog:
  - tmpfiles: enforce ordering when executing lines (#1365870)
  - Introduce bus_unit_check_load_state() helper (#1256858)
  - core: use bus_unit_check_load_state() in transaction_add_job_and_dependencies() (#1256858)
  - udev/path_id: correct segmentation fault due to missing NULL check (#1365556)
  - rules: load sg driver also when scsi_target appears (#45) (#1322773)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-29
changelog:
  - fix gcc warnings about uninitialized variables (#1318994)
  - journalctl: rework code that checks whether we have access to /var/log/journal (#1318994)
  - journalctl: Improve boot ID lookup (#1318994)
  - journalctl: only have a single exit path from main() (#1318994)
  - journalctl: free all command line argument objects (#1318994)
  - journalctl: rename boot_id_t to BootId (#1318994)
  - util: introduce CMSG_FOREACH() macro and make use of it everywhere (#1318994)
  - journald: don't employ inner loop for reading from incoming sockets (#1318994)
  - journald: fix count of object meta fields (#1318994)
  - journal-cat: return a correct error, not -1 (#1318994)
  - journalctl: introduce short options for --since and --until (#1318994)
  - journal: s/Envalid/Invalid/ (#1318994)
  - journald: dispatch SIGTERM/SIGINT with a low priority (#1318994)
  - lz4: fix size check which had no chance of working on big-endian (#1318994)
  - journal: normalize priority of logging sources (#1318994)
  - Fix miscalculated buffer size and uses of size-unlimited sprintf() function. (#1318994)
  - journal: Drop monotonicity check when appending to journal file (#1318994)
  - journalctl: unify how we free boot id lists a bit (#1318994)
  - journalctl: don't trust the per-field entry tables when looking for boot IDs (#1318994)
  - units: remove udev control socket when systemd stops the socket unit (#49) (#1370133)
  - logind: don't assert if the slice is missing (#1371437)
  - core: enable transient unit support for slice units (#1370299)
  - sd-bus: bump message queue size (#1371205)
  - install: fix disable when /etc/systemd/system is a symlink (#1285996)
  - rules: add NVMe rules (#3136) (#1274651)
  - rules: introduce disk/by-id (model_serial) symlinks for NVMe drives (#3974) (#1274651)
  - rules: fix for possible whitespace in the "model" attribute (#1274651)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30
changelog:
  - systemctl,pid1: do not warn about missing install info with "preset" (#1373950)
  - systemctl/core: ignore masked units in preset-all (#1375097)
  - shared/install: handle dangling aliases as an explicit case, report nicely (#1375097)
  - shared/install: ignore unit symlinks when doing preset-all (#1375097)
  - 40-redhat.rules: don't hoplug memory on s390x (#1370161)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30.1
changelog:
  - If the notification message length is 0, ignore the message (#4237) (#1381573)
  - systemctl: suppress errors with "show" for nonexistent units and properties (#1380686)
  - 40-redhat.rules: disable auto-online of hot-plugged memory on IBM z Systems (#1381123)
  - pid1: don't return any error in manager_dispatch_notify_fd() (#4240) (#1381573)
  - pid1: process zero-length notification messages again (#1381573)
  - pid1: more informative error message for ignored notifications (#1381573)


author: Michal Sekletar <msekleta@redhat.com> - 219-30.5
changelog:
  - on update from systemd version 219-21 and older generate udev rules that preserve old network interface names on VMware VMs (#1391944)


author: Jakub Čajka <jcajka@redhat.com> - 2.4.8-1
changelog:
  - Resolves: #1182038 - [7.2 FEAT] iprutils package update - ppc64/ppc64le
  - Resolves: #1183460 - RHEL7.1 BE: iprutils: Set known zeroed after format


author: Sinny Kumari <skumari@redhat.com> - 2.4.11.1-1
changelog:
  - Resolves: #1274367 - [7.3 FEAT] iprutils package update
  - Resolves: #1297921 - IPR: Raid migration fails to kick while executing through command line


author: Sinny Kumari <skumari@redhat.com> - 2.4.12.1-1
changelog:
  - Resolves: #1364131 - Integrate various important bug fixes for iprutils in
    RHEL7.3 by updating iprutils to 2.4.12


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-8
changelog:
  - Resolves: #1298288 [RFE] Improve performance in large environments.
    - cert: speed up cert-find
  - Resolves: #1317379 [EXPERIMENTAL][RFE] Web UI: allow Smart Card
    authentication
    - service: add flag to allow S4U2Self
    - Add 'trusted to auth as user' checkbox
    - Added new authentication method
  - Resolves: #1353881 ipa-replica-install suggests about
    non-existent --force-ntpd option
    - Don't show --force-ntpd option in replica install
  - Resolves: #1354441 DNS forwarder check is too strict: unable to add
    sub-domain to already-broken domain
    - DNS: allow to add forward zone to already broken sub-domain
  - Resolves: #1356146 performance regression in CLI help
    - schema: Speed up schema cache
    - frontend: Change doc, summary, topic and NO_CLI to class properties
    - schema: Introduce schema cache format
    - schema: Generate bits for help load them on request
    - help: Do not create instances to get information about commands and topics
    - schema cache: Do not reset ServerInfo dirty flag
    - schema cache: Do not read fingerprint and format from cache
    - Access data for help separately
    - frontent: Add summary class property to CommandOverride
    - schema cache: Read server info only once
    - schema cache: Store API schema cache in memory
    - client: Do not create instance just to check isinstance
    - schema cache: Read schema instead of rewriting it when SchemaUpToDate
  - Resolves: #1360769 ipa-server-certinstall couldnt unlock private key file
    - server install: do not prompt for cert file PIN repeatedly
  - Resolves: #1364113 ipa-password: ipa: ERROR: RuntimeError: Unable to create
    cache directory: [Errno 13] Permission denied: '/home/test_user'
    - schema: Speed up schema cache
  - Resolves: #1366604 `cert-find` crashes on invalid certificate data
    - cert: do not crash on invalid data in cert-find
  - Resolves: #1366612 Middle replica uninstallation in line topology works
    without '--ignore-topology-disconnect'
    - Fail on topology disconnect/last role removal
  - Resolves: #1366626 caacl-add-service: incorrect error message when service
    does not exists
    - Fix ipa-caalc-add-service error message
  - Resolves: #1367022 The ipa-server-upgrade command failed when named-pkcs11
    does not happen to run during dnf upgrade
    - DNS server upgrade: do not fail when DNS server did not respond
  - Resolves: #1367759 [RFE] [webui] warn admin if there is only one IPA server
    with CA
    - Add warning about only one existing CA server
    - Set servers list as default facet in topology facet group
  - Resolves: #1367773 thin client ignores locale change
    - schema check: Check current client language against cached one


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-9
changelog:
  - Resolves: #1081561 CA not start during ipa server install in pure IPv6 env
    - Fix ipa-server-install in pure IPv6 environment
  - Resolves: #1318169 Tree-root domains in a trusted AD forest aren't marked as
    reachable via the forest root
    - trust: make sure ID range is created for the child domain even if it exists
    - ipa-kdb: simplify trusted domain parent search
  - Resolves: #1335567 Update Warning in IdM Web UI API browser
    - WebUI: add API browser is tech preview warning
  - Resolves: #1348560 Mulitple domain Active Directory Trust conflict
    - ipaserver/dcerpc: reformat to make the code closer to pep8
    - trust: automatically resolve DNS trust conflicts for triangle trusts
  - Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
    certificate revocation
    - cert-revoke: fix permission check bypass (CVE-2016-5404)
  - Resolves: #1353936 custodia.conf and server.keys file is world-readable.
    - Remove Custodia server keys from LDAP
    - Secure permissions of Custodia server.keys
  - Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
    converted from CA-less to CA-full
    - custodia: include known CA certs in the PKCS#12 file for Dogtag
    - custodia: force reconnect before retrieving CA certs from LDAP
  - Resolves: #1362333 ipa vault container owner cannot add vault
    - Fix: container owner should be able to add vault
  - Resolves: #1365546 External trust with root domain is transitive
    - trust: make sure external trust topology is correctly rendered
  - Resolves: #1365572 IPA server broken after upgrade
    - Require pki-core-10.3.3-7
  - Resolves: #1367864 Server assumes latest version of command instead of
    version 1 for old / 3rd party clients
    - rpcserver: assume version 1 for unversioned command calls
    - rpcserver: fix crash in XML-RPC system commands
  - Resolves: #1367773 thin client ignores locale change
    - schema cache: Fallback to 'en_us' when locale is not available
  - Resolves: #1368754 ipa server uninstall fails with Python "Global Name error"
    - Fail on topology disconnect/last role removal
  - Resolves: #1368981 ipa otptoken-add --type=hotp --key creates wrong OTP
    - otptoken, permission: Convert custom type parameters on server
  - Resolves: #1369414 ipa server-del fails with Python stack trace
    - Handled empty hostname in server-del command
  - Resolves: #1369761 ipa-server must depend on a version of httpd that support
    mod_proxy with UDS
    - Require httpd 2.4.6-31 with mod_proxy Unix socket support
  - Resolves: #1370512 Received ACIError instead of DuplicatedError in
    stageuser_tests
    - Raise DuplicatedEnrty error when user exists in delete_container
  - Resolves: #1371479 cert-find --all does not show information about revocation
    - cert: add missing param values to cert-find output
  - Renamed patch 1011 to 0100, as it was merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-10
changelog:
  - Resolves: #1355753 adding two way non transitive(external) trust displays
    internal error on the console
    - Always fetch forest info from root DCs when establishing two-way trust
    - factor out `populate_remote_domain` method into module-level function
    - Always fetch forest info from root DCs when establishing one-way trust
  - Resolves: #1356101 Lightweight sub-CA certs are not tracked by certmonger
    after `ipa-replica-install`
    - Track lightweight CAs on replica installation
  - Resolves: #1357488 ipa command stuck forever on higher versioned client with
    lower versioned server
    - compat: Save server's API version in for pre-schema servers
    - compat: Fix ping command call
    - schema cache: Store and check info for pre-schema servers
  - Resolves: #1363905 man page for ipa-replica-manage has a typo in -c flag
    - Fix man page ipa-replica-manage: remove duplicate -c option
      from --no-lookup
  - Resolves: #1367865 webui: cert_revoke should use --cacn to set correct CA
    when revoking certificate
    - cert: include CA name in cert command output
    - WebUI add support for sub-CAs while revoking certificates
  - Resolves: #1368424 Unable to view certificates issued by Sub CA in Web UI
    - Add support for additional options taken from table facet
    - WebUI: Fix showing certificates issued by sub-CA
  - Resolves: #1368557 dnsrecord-add does not prompt for missing record parts
    internactively
    - dns: normalize record type read interactively in dnsrecord_add
    - dns: prompt for missing record parts in CLI
    - dns: fix crash in interactive mode against old servers
  - Resolves: #1370519 Certificate revocation in service-del and host-del isn't
    aware of Sub CAs
    - cert: fix cert-find --certificate when the cert is not in LDAP
    - Make host/service cert revocation aware of lightweight CAs
  - Resolves: #1371901 Use OAEP padding with custodia
    - Use RSA-OAEP instead of RSA PKCS#1 v1.5
  - Resolves: #1371915 When establishing external two-way trust, forest root
    Administrator account is used to fetch domain info
    - do not use trusted forest name to construct domain admin principal
  - Resolves: #1372597 Incorrect CA ACL evaluation of SAN DNS names in
    certificate request
    - Fix CA ACL Check on SubjectAltNames
  - Resolves: #1373272 CLI always sends default command version
    - cli: use full name when executing a command
  - Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
    - Fix ipa-certupdate for CA-less installation
  - Resolves: #1373540 client-install with IPv6 address fails on link-local
    address (always)
    - Fix parse errors with link-local addresses


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-11
changelog:
  - Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
    - Fix regression introduced in ipa-certupdate


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-12
changelog:
  - Resolves: #1373910 IPA server upgrade fails with DNS timed out errors.
  - Resolves: #1375269 ipa trust-fetch-domains throws internal error


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.1.1
changelog:
  - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
    by abusing password policy
    - ipa-kdb: search for password policies globally
  - Renamed patches 1011 and 1012 to 0146 and 0145, as they were merged upstream


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-27
changelog:
  - release 1.3.4.0-27
  - Resolves: bug 1309963 - keep alive entries can break replication (DS 48445)
  - Resolves: bug 1309964 - Crash in slapi_get_object_extension (DS 48536)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-28
changelog:
  - release 1.3.4.0-28
  - Resolves: bug 1315181 - change severity of some messages related to "keep alive" entries (DS 48420)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-29
changelog:
  - release 1.3.4.0-29
  - Resolves: bug 1316552 - License tag does not match actual license of code (DS 48757)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-30
changelog:
  - release 1.3.4.0-30
  - Resolves: bug 1321891 - DES to AES password conversion fails if a backend is empty (DS 48777)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-31
changelog:
  - release 1.3.4.0-31
  - Resolves: bug 1335423 - heap corruption at schema replication. (DS 48492)
  - Resolves: bug 1335107 - Paged results search returns the blank list of entries (DS 48808)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-32
changelog:
  - release 1.3.4.0-32
  - Resolves: bug 1344293 - At startup DES to AES password conversion causes timeout in start script (DS 48862)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-33
changelog:
  - release 1.3.4.0-33
  - Resolves: bug 1351323 - Improve MMR replication convergence (DS 48636)
  - Resolves: bug 1351447 - Supplier can skip a failing update, although it should retry. (DS 47788)
  - Resolves: bug 1350707 - Replication changelog can incorrectly skip over updates (DS 48766)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-7
changelog:
  - setup tty permissions and group for /dev/sclp_line0 (#1070310)
  - cdrom_id: use the old MMC fallback (#1038015)
  - mount: don't send out PropertiesChanged message if actually nothing got changed (#1069718)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-8
changelog:
  - rules: mark loop device as SYSTEMD_READY=0 if no file is attached (#1067422)
  - utmp: make sure we don't write the utmp reboot record twice on each boot (#1053600)
  - rework session shutdown logic (#1047614)
  - introduce new stop protocol for unit scopes (#1064976)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-9
changelog:
  - fixes crashes in logind and systemd (#1073994)
  - run fsck before mouting root in initramfs (#1056661)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-11
changelog:
  - logind-session: save stopping flag (#1082692)
  - unit: add waiting jobs to run queue in unit_coldplug (#1083159)


author: Ray Strode <rstrode@redhat.com> 0.8.9-0.3.20140113
changelog:
  - Read OS string from REDHAT_BUGZILLA_PRODUCT instead of PRETTY_NAME
    in /etc/os-release to work around a lorax bug.
    Resolves: #911553
  - Fix text splash when explicitly configured by user
    Related: #911553
    Related: #1026571


author: Ray Strode <rstrode@redhat.com> 0.8.9-0.9.20140113
changelog:
  - Ignore early fb devices
    Resolves: #1063758
    Resolves: #1064235
    Resolves: #1066641
  - Ignore udev if using lone serial console
    Resolves: #1058049
  - Fix password at start up race
    Resolves: #1070707
    Resolves: #1073145


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.4-3
changelog:
  - Bugzilla #1534772 - org.mozilla.jss.pkix.primitive.AlgorithmIdentifier
    decode/encode process alters original data (cfu)
  - Bugzilla #1554056 - JSS: Add support for TLS_*_SHA384 ciphers (cfu)


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.6-2
changelog:
  - Bugzilla #1747966 - CVE 2019-14823 jss: OCSP policy "Leaf and Chain" implicitly trusts the root certificate


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-21
changelog:
  - Fixed crash on reloading 'exec' configuration options (#1228893)
  - Fixed CVE-2014-3565, snmptrapd died when parsing certain traps (#1209361)
  - Fixed storageUseNFS functionality in hrStorageTable (#1193006)
  - Fixed forwarding of traps with RequestID=0 in snmptrapd (#1192511)
  - Fixed hrStorageTable to contain 31 bits integers (#1192221)
  - Fixed 'clientaddr' option for UDPv6 client messages (#1190679)
  - Fixed log level of SMUX messages (#1189393)
  - Fixed UDP-MIB::udpTable index on big-endian platforms (#1184433)
  - Fixed client utilities reporting 'read_config_store open failure on
    /var/lib/net-snmp/snmpapp.conf' (#1151310)
  - Fixed snmpd crash when failed to parse SMUX message headers (#1140236)
  - Added 'diskio' option to snmpd.conf, it's possible to monitor only
    selected devices in diskIOTable (#1092308)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-23
changelog:
  - Fixed parsing of invalid variables in incoming packets (#1248414)
  - Fixed HOST-RESOURCES-MIB::hrFSAccess flag when read-only filesystem
    becomes writable (#1241897)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-24
changelog:
  - Fixed lmSensorsTable not reporting sensors with duplicate names
    (#1252053)
  - Fixed close() overhead of extend commands (#1252048)
  - Fixed out-of-bounds write in python code (#1252034)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-27
changelog:
  - Allow clients to use UDPv6 addresses without 'udp6:' prefix (#1326850)
  - snmpd: Speed up ipAddressTable loading. (#1327240)
  - Fixed net-snmp segfault in netsnmp_copy_fd_set_to_large_fd_set (#1327200)
  - Fixed issue with net-snmp-perl dependency on net-snmp-devel (#1438875)


author: Doug Ledford <dledford@redhat.com> - 3.0-0.6.g6961daa.1
changelog:
  - Update to latest upstream version, which resovles some licensing issues
    on some of the source files


author: Mark Wielaard <mjw@redhat.com> - 0.176-1
changelog:
  - New upstream release (#1676504)
    CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7150,
    CVE-2019-7664, CVE-2019-7665, CVE-2018-16062, CVE-2018-16402,
    CVE-2018-16403, CVE-2018-18310, CVE-2018-18521, CVE-2018-18520.


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-8
changelog:
  - Resolves: rhbz#1434528
  - Resolves: rhbz#1434529
  - Resolves: rhbz#1434534

  - cfg: Prevents use of uninitialized buffer (rhbz#1434528)
  - merge upstream commit 52e6ae57ea06d0bef61c5c9250881bef1372ead2 (rhbz#1434528)
  - man: Fix typos in man page (rhbz#1434529)
  - merge upstream commit b642904ea9640bd7a1573a8c0d2c5bcb43a10dfc (rhbz#1434529)
  - Fix typo: Destorying -> Destroying (rhbz#1434529)
  - merge upstream commit 117d9e4eb77ef9941fdeaf17ddfd892514da8143 (rhbz#1434529)
  - init: Add doc URIs to the systemd service files (rhbz#1434529)
  - merge upstream commit 21a728785027483786e41c19f6aff57a95b80aa5 (rhbz#1434529)
  - man: Modify man-page according to command usage (rhbz#1434529)
  - merge upstream commit 79898e8cb1715e79b7467b91661b7341e2664550 (rhbz#1434529)
  - Totempg: remove duplicate memcpy in mcast_msg func (rhbz#1434528)
  - merge upstream commit 4a8e9d80409590cb42732ae3105b5ae71fda52c1 (rhbz#1434528)
  - upstart: Add softdog module loading example (rhbz#1434529)
  - merge upstream commit 75474d69bebea6c9c4ef2252476ce738cf92f0f4 (rhbz#1434529)
  - Remove deprecated doxygen flags (rhbz#1434529)
  - merge upstream commit b252013e42007ea7284ae54d035a30ca40f20fc0 (rhbz#1434529)
  - Remove redundant header file inclusion (rhbz#1434528)
  - merge upstream commit d6c7ade277a4a23d84c56d7fde6b60b377a1023b (rhbz#1434528)
  - Qdevice: fix spell errors in qdevice (rhbz#1434529)
  - merge upstream commit d9caa09c45d4560c89a1ad873087c0476cabab46 (rhbz#1434529)
  - doc: document watchdog_device parameter (rhbz#1434529)
  - merge upstream commit a5f97ae1b99063383d8f45168125b34232b91faf (rhbz#1434529)
  - Logsys: Change logsys syslog_priority priority (rhbz#1434534)
  - merge upstream commit 609cc0cc100aa1070d97b405273373682da0e270 (rhbz#1434534)
  - logconfig: Do not overwrite logger_subsys priority (rhbz#1434534)
  - merge upstream commit c866a2f8603b44e89eb21a6cf7d88134af2e8b66 (rhbz#1434534)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-9
changelog:
  - Resolves: rhbz#1445001

  - Main: Call mlockall after fork (rhbz#1445001)
  - merge upstream commit 238e2e62d8b960e7c10bfa0a8281d78ec99f3a26 (rhbz#1445001)
  - Disable aarch64 build (bz#1422598)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-10
changelog:
  - Resolves: rhbz#1439205
  - Resolves: rhbz#1461450
  - Resolves: rhbz#1469170
  - Resolves: rhbz#1476214

  - main: Don't ask libqb to handle segv, it doesn't work (rhbz#1439205)
  - merge upstream commit c0da36a6c0ecf7bc7def252a06336a7088e68086 (rhbz#1439205)
  - totem: Propagate totem initialization failure (rhbz#1461450)
  - merge upstream commit 0413a8f4672352171f0df731b7d9c1fe20acbc4c (rhbz#1461450)
  - totemcrypto: Refactor symmetric key importing (rhbz#1461450)
  - merge upstream commit a885868181c07ba9ab5cdfdad1d66d387b2a4428 (rhbz#1461450)
  - totemcrypto: Use different method to import key (rhbz#1461450)
  - merge upstream commit 5dadebd21862074deaeb9a337fc9e49f5e9f692a (rhbz#1461450)
  - main: Add option to set priority (rhbz#1469170)
  - merge upstream commit a008448efb2b1d45c432867caf08f0bcf2b4b9b0 (rhbz#1469170)
  - main: Add support for libcgroup (rhbz#1476214)
  - merge upstream commit c56086c701d08fc17cf6d8ef603caf505a4021b7 (rhbz#1476214)
  - totemcrypto: Fix compiler warning (rhbz#1461450)
  - merge upstream commit fdeed33f514e0056e322a45d9a0a04ca4b9a2709 (rhbz#1461450)


author: Jan Friesse <jfriesse@redhat.com> 2.4.3-2
changelog:
  - Resolves: rhbz#1536219

  - logging: Make blackbox configurable (rhbz#1536219)
  - merge upstream commit 8af39f66e56e319b6b93804c0400e6e29737a90f (rhbz#1536219)
  - logging: Close before and open blackbox after fork (rhbz#1536219)
  - merge upstream commit 995ed0bd814ff3eacf6c09534841e6ce39ab6614 (rhbz#1536219)


author: Jan Friesse <jfriesse@redhat.com> 2.4.3-5
changelog:
  - Resolves: rhbz#1376819
  - Resolves: rhbz#1634710

  - configure: add --with-initconfigdir option (rhbz#1376819)
  - merge upstream commit c0d8af0c7b247df16a90850b0edab4f978cb8192 (rhbz#1376819)
  - Use RuntimeDirectory instead of tmpfiles.d (rhbz#1376819)
  - merge upstream commit fde7fa0c6408709ccdd090aa9064e6a78232498a (rhbz#1376819)
  - totemcrypto: Fix importing of the private key (rhbz#1634710)
  - merge upstream commit 3f3e6b62719a263cb221c19a06d9a2c570234caa (rhbz#1634710)
  - qnetd: Check existence of NSS DB dir before fork (rhbz#1376819)
  - merge upstream commit eac28dffdf7f060f41f2b2e95bb0f4c6c033425d (rhbz#1376819)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.49-1
changelog:
  - add {nis,schema-compat}-ignore-subtree and -restrict-subtree settings,
    which should let us avoid deadlocks when tasks are modifying data in
    the backend database (#1007451)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.50-1
changelog:
  - if we get an EPIPE while registering with rpcbind, try to reconnect and
    retransmit before giving up


author: Nalin Dahyabhai <nalin@redhat.com> - 0.51-1
changelog:
  - fix another request argument memory leak in NIS server (#1040159)
  - fix miscellaneous items found by static analysis


author: Nalin Dahyabhai <nalin@redhat.com> - 0.52-1
changelog:
  - correctly reflect whether or not we're built with transaction support in
    the module's nsslapd-pluginVersion attribute
  - fix a couple of should've-used-memmove()-instead-of-memcpy() cases which
    would hit when removing maps or groups of maps (#1043546/#1043638)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.52-3
changelog:
  - remove ExclusiveArch if %{rhel} is 7 or higher, because 389-ds-base gets
    built for everything now (#1055711)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.52-5
changelog:
  - backport correction to the default settings for hosts.byname and
    hosts.byaddr NIS maps, so that their data items start with the host's
    address rather than a name (#1090948)


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.54-1
changelog:
  - Add support for IDM's ID views
  - Allow searching SSSD-provided users as memberUid case-insensitevly
  - Resolves: #1151436


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.54-2
changelog:
  - Complete ID views support to BIND operation
  - Ignore ID views outside schema-compat subtrees
  - Use 389-ds API compatible with RHEL 7.0
  - Resolves: #1151436


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-19.el7
changelog:
  - Resolves: #1462112 ipaserver installation fails in FIPS mode: OpenSSL
    internal error, assertion failed: Digest MD4 forbidden in FIPS mode!
    - ipa-sam: replace encode_nt_key() with E_md4hash() 
    - ipa_pwd_extop: do not generate NT hashes in FIPS mode
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces 
    - Fix local IP address validation 
    - ipa-dns-install: remove check for local ip address
    - refactor CheckedIPAddress class
    - CheckedIPAddress: remove match_local param
    - Remove ip_netmask from option parser
    - replica install: add missing check for non-local IP address
    - Remove network and broadcast address warnings


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-20.el7
changelog:
  - Resolves: #1452216 Replica installation grants HTTP principal
    access in WebUI
    - Make sure we check ccaches in all rpcserver paths


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7
changelog:
  - Resolves: #1470125 Replica install fails to configure IPA-specific
    temporary files/directories
    - replica install: drop-in IPA specific config to tmpfiles.d
  - Resolves: #1469978 bind package is not automatically updated during
    ipa-server upgrade process
    - Bumped Required version of bind-dyndb-ldap and bind package


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1
changelog:
  - Resolves: #1473272 Provide a tooling automating the configuration
    of Smart Card authentication on a FreeIPA master
    - smart-card advises: configure systemwide NSS DB also on master
    - smart-card advises: add steps to store smart card signing CA cert
    - Allow to pass in multiple CA cert paths to the smart card advises
    - add a class that tracks the indentation in the generated advises
    - delegate the indentation handling in advises to dedicated class
    - advise: add an infrastructure for formatting Bash compound statements
    - delegate formatting of compound Bash statements to dedicated classes
    - Fix indentation of statements in Smart card advises
    - Use the compound statement formatting API for configuring PKINIT
    - smart card advises: use a wrapper around Bash `for` loops
    - smart card advise: use password when changing trust flags on HTTP cert
    - smart-card-advises: ensure that krb5-pkinit is installed on client
  - Resolves: #1477046 Use CommonNameToSANDefault in default profile 
    (new installs only)
    - Add CommonNameToSANDefault to default cert profile
  - Resolves: #1475664 NULL LDAP context in call to ldap_search_ext_s
    during search in cn=ad,cn=trusts,dc=example,dc=com
    - NULL LDAP context in call to ldap_search_ext_s during search


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1.1
changelog:
  - Resolves: #1477046 Use CommonNameToSANDefault in default profile
    (new installs only)
    - Restore old version of caIPAserviceCert for upgrade only


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-21.el7.2
changelog:
  - Resolves: #1486794 - [ipa-replica-install] - 406 Client Error: Failed to
    validate message: Incorrect number of results (0) searching forpublic
    key for host
      - Always check peer has keys before connecting
  - Resolves: #1489300 - Unable to set ca renewal master on replica
      - Fix ipa config-mod --ca-renewal-master
  - Resolves: #1489815 - TypeError in renew_ca_cert prevents from swiching
    back to self-signed CA
      - Backport PR 988 to ipa-4-5 Fix Certificate renewal (with ext ca)
  - Resolves: #1489817 - ipa-server-upgrade failes with "This entry already exists"
      - Backport PR 1008 to ipa-4-5 Fix ipa-server-upgrade: This entry already exists
  - Resolves: #1490331 - FreeIPA/IdM installations which were upgraded from
    versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
    thus startup of Web UI fails
      - Adds whoami DS plugin in case that plugin is missing
  - Resolves: #1491545 - IPA WebUI does not work after upgrade from IPA 4.4 to 4.5
      - Fixing how sssd.conf is updated when promoting a client to replica
  - Resolves: #1492616 - ipa-otptoken-import - XML file is missing PBKDF2
    parameters!
      - ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace
  - Resolves: #1493153 - Updating from RHEL 7.3 fails with Server-Cert not found
    (ipa-server-upgrade)
      - Backport 4-5: Fix ipa-server-upgrade with server cert tracking


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-21.el7.2.2
changelog:
  - Resolves: #1493410 ipa-server-upgrade timeouts on wait_for_open ports
    expecting IPA services listening on IPv6 ports
      - Make sure upgrade also checks for IPv6 stack
      - control logging of host_port_open from caller
      - log progress of wait_for_open_ports
  - Resolves: #1493411 ipa help command returns traceback when no cache
    is present
      - Store help in Schema before writing to disk
      - Disable pylint in get_help function because of type confusion.


author: Zeeshan Ali <zeenix@redhat.com> - 0.2.7-3
changelog:
  - rhel: Add info on 6.5 and 7.0 (#1015055).
  - install-script,rhel: Fix for 'Server' & 7.0 (#1033007).


author: Doug Ledford <dledford@redhat.com> - 1.3.1-6
changelog:
  - Update valgrind settings and build against newest valgrind libs
    that resolve a register clobber issue on ppc (1142101)
  - Build against latest libibverbs
  - Related: bz1137044


author: Doug Ledford <dledford@redhat.com> - 1.3.1-7
changelog:
  - Remove modprobe file and move it to rdma package
  - Add requires on rdma package
  - Related: bz1164618


author: Arnaldo Carvalho de Melo <acme@redhat.com> - 0.2-1
changelog:
  - Add get_priority_{min,max} methods
  - Add constants for SCHED_{BATCH,FIFO,OTHER,RR}
  - Implement get_priority method
  - Add pchrt utility for testing the bindings, chrt clone
  - Add ptaskset utility for testing the bindings, taskset clone


author: John Kacur <jkacur@redhat.com> - 0.4-5
changelog:
  - Add man pages for pchrt and ptaskset
  - Fix and update usage messages for pchrt and ptaskset
  - Resolves:rhbz#948381


author: John Kacur <jkacur@redhat.com> - 0.4-6
changelog:
  - python-schedutils-Update-URL-in-python-schedutils.sp.patch
  - schedutils.c-added-support-for-SCHED_DEADLINE.patch
  Resolves: rhbz#1298388


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.165-1
changelog:
  - Support raid scrubbing on cache origin LV.
  - Add lvmraid(7) man page.
  - Use udev db to check for mpath components before running pvscan for lvmetad.
  - Improve explanation of udev fallback in libdevmapper.h.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.165-2
changelog:
  - Fix possible NULL pointer dereference when checking for monitoring.
  - Add lvmreport(7) man page.
  - Report 0% as dirty (copy%) for cache without any used block.
  - Fix lvm2api reporting of cache data and metadata percent.
  - Restore reporting of metadata usage for cache volumes (2.02.155).


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.165-3
changelog:
  - Fix lvchange --discard|--zero for active thin-pool.
  - Fix lvconvert --repair regression for RAID LVs.
  - Always specify snapshot cow LV for monitoring not internal LV. (2.02.165)
  - Ensure memory allocated internally for --filemap histogram bounds are freed.
  - Fix missing display of last created dmstats file map.
  - Use --alloc normal for mirror logs even if the mimages were stricter.
  - Fix reported origin lv field for cache volumes. (2.02.133)
  - Fix lock-holder device for thin pool with inactive thin volumes.
  - Enforce 4MiB or 25% metadata free space for thin pool operations.
  - Fix lvmetad metadata validation when rescanning VG.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.166-1
changelog:
  - Disable lvconvert of thin pool to raid while active.
  - Use dm_config_parse_without_dup_node_check() to speedup metadata reading.
  - Fix lvm2-activation-generator to read all LVM2 config sources. (2.02.155)
  - Fix man entry for dmsetup status.
  - Introduce new dm_config_parse_without_dup_node_check().


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.166-1.el7_3.1
changelog:
  - Fix lvconvert to allow repair for cache raid LVs.
  - Fix time when dmeventd is reloaded on package upgrade to start using new code.
  - Fix libdm versioning for dm_tree_node_size_changed symbol.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.166-1.el7_3.2
changelog:
  - Prevent raid4 creation/conversion on non-supporting kernels
  - Add direct striped -> raid4 conversion
  - Fix raid4 parity image pair position on conversions from striped/raid0*


author: Jakub Čajka <jcajka@redhat.com> - 2.4.2-1
changelog:
  - Resolves: #1088562 - [7.1 FEAT] iprutils package update - ppc64
  - Resolves: #1044679 - iprutils should use systemd
  - Resolves: #1092519 - iprutils - PIE and RELRO check


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.5.1.el7]
changelog:
  - [fs] revert "[fs] sunrpc: Ensure we always close the socket after a connection shuts down" (Dave Wysochanski) [1660784 1657399]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.7.1.el7]
changelog:
  - [scsi] lpfc: do not set queue->page_count to 0 if pc_sli4_params.wqpcnt is invalid (Ewan Milne) [1664067 1657981]
  - [scsi] qla2xxx: Delete session for nport id change (Himanshu Madhani) [1663508 1628301]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.8.1.el7]
changelog:
  - [tty] add rwsem to close race between copy_from_read_buf calls and reset_buffer_flags (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Fix stall at n_tty_receive_char_special() (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] audit: Fix audit source (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Fix auditing support for cannonical mode (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Fix 4096-byte canonical reads (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Remove read_cnt (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Don't wrap input buffer indices at buffer size (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Get read_cnt through accessor (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] Deprecate ldisc .chars_in_buffer() method (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Split n_tty_chars_in_buffer() for reader-only interface (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Line copy to user buffer in canonical mode (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Factor canonical mode copy from n_tty_read() (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] Make ldisc input flow control concurrency-friendly (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] Simplify tty buffer/ldisc interface with helper function (Christoph von Recklinghausen) [1660815 1649343]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.9.1.el7]
changelog:
  - [input] psmouse: fix button reporting for basic protocols (Benjamin Tissoires) [1662848 1658669]
  - [input] psmouse: add support for 2nd wheel on A4Tech Dual-Scroll wheel mice (Benjamin Tissoires) [1662848 1658669]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.10.1.el7]
changelog:
  - [fs] revert "[fs] nfs: Don't write back further requests if there is a pending write error" (Benjamin Coddington) [1672510 1656674]
  - [fs] cifs: connect to servername instead of IP for IPC$ share (Leif Sahlberg) [1672448 1647844]
  - [acpi] nfit: Fix command-supported detection (Charles Rose) [1671743 1665811]
  - [acpi] nfit: Block function zero DSMs (Charles Rose) [1671743 1665811]
  - [x86] efi-bgrt: Replace early_memremap() with memremap() (Lenny Szubowicz) [1671745 1481667]
  - [x86] efi-bgrt: Replace ioremap() with early_memremap() (Lenny Szubowicz) [1671745 1481667]
  - [scsi] libiscsi: Allow sd_shutdown on bad transport (Chris Leech) [1670680 1630979]
  - [block] blk-mq: punt failed direct issue to dispatch list (Ming Lei) [1670511 1656654]
  - [block] blk-mq: fix corruption with direct issue (Ming Lei) [1670511 1656654]
  - [powerpc] rtas: Fix a potential race between CPU-Offline & Migration (Steve Best) [1669044 1650249]
  - [powerpc] pseries: Disable CPU hotplug across migrations (Steve Best) [1669044 1650249]
  - [md] Add split counter for raid1 write request in the right place (Xiao Ni) [1668208 1659951]
  - [lib] string_helpers.c: fix infinite loop in string_get_size() (Ewan Milne) [1667989 1660565]
  - [kernel] stop_machine: Atomically queue and wake stopper threads (Phil Auld) [1667328 1557061]
  - [kernel] stop_machine: Disable preemption after queueing stopper threads (Phil Auld) [1667328 1557061]
  - [kernel] stop_machine: Disable preemption when waking two stopper threads (Phil Auld) [1667328 1557061]
  - [kernel] stop_machine, sched: Fix migrate_swap() vs. active_balance() deadlock (Phil Auld) [1667328 1557061]
  - [kernel] stop_machine: Make cpu_stop_queue_work() and stop_one_cpu_nowait() return bool (Phil Auld) [1667328 1557061]
  - [fs] proc: restrict kernel stack dumps to root (Joe Lawrence) [1642401 1638194] {CVE-2018-17972}
  - [fs] proc: use "unsigned int" for /proc/*/stack (Joe Lawrence) [1642401 1638194] {CVE-2018-17972}
  - [fs] libceph: fall back to sendmsg for slab pages (Ilya Dryomov) [1665814 1647460]
  - [scsi] csiostor: remove flush_scheduled_work() (Arjun Vynipadath) [1665370 1660882]
  - [pci] shpchp: Separate existence of SHPC and permission to use it (Myron Stowe) [1663241 1633873]
  - [pci] shpchp: Manage SHPC unconditionally on non-ACPI systems (Myron Stowe) [1663241 1633873]
  - [pci] shpchp: Fix AMD POGO identification (Myron Stowe) [1663241 1633873]
  - [mm] memcontrol: factor out reclaim iterator loading and updating (Aristeu Rozanski) [1663114 1595932]
  - [net] xfrm: policy: init locks early (Herbert Xu) [1660887 1641866]
  - [kernel] mm: clear __GFP_FS when PF_MEMALLOC_NOIO is set (Rafael Aquini) [1660392 1657714]
  - [nvme] flush namespace scanning work just before removing namespaces (Ewan Milne) [1659937 1622487]
  - [fs] fuse: don't need GETATTR after every READ (Miklos Szeredi) [1657921 1648781]
  - [fs] fuse: don't invalidate attrs when not using atime (Miklos Szeredi) [1657921 1648781]
  - [net] Set sk_prot_creator when cloning sockets to the right proto (Andrea Claudi) [1657351 1657352] {CVE-2018-9568}
  - [kernel] bpf: 32-bit RSH verification must truncate input before the ALU op (Jiri Olsa) [1641387 1641388] {CVE-2018-18445}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.11.1.el7]
changelog:
  - [net] netfilter: nf_nat: skip nat clash resolution for same-origin entries (Florian Westphal) [1686766 1648965]
  - [net] netfilter: nf_conntrack: resolve clash for matching conntracks (Florian Westphal) [1686766 1648965]
  - [net] netfilter: conntrack: skip clash resolution if nat is in place (Florian Westphal) [1686766 1648965]
  - [net] netfilter: conntrack: introduce clash resolution on insertion race (Florian Westphal) [1686766 1648965]
  - [net] netfilter: conntrack: fix race between confirmation and flush (Florian Westphal) [1686766 1648965]
  - [net] netfilter: conntrack: introduce nf_ct_acct_update() (Florian Westphal) [1686766 1648965]
  - [netdrv] hv_netvsc: Fix a network regression after ifdown/ifup (Mohammed Gamal) [1679997 1661632]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.12.1.el7]
changelog:
  - [kernel] locking/rwsem: Fix (possible) missed wakeup (Waiman Long) [1690323 1547078]
  - [kernel] futex: Fix (possible) missed wakeup (Waiman Long) [1690323 1547078]
  - [kernel] futex: Use smp_store_release() in mark_wake_futex() (Waiman Long) [1690323 1547078]
  - [kernel] sched/wake_q: Fix wakeup ordering for wake_q (Waiman Long) [1690323 1547078]
  - [kernel] sched/wake_q: Document wake_q_add() (Waiman Long) [1690323 1547078]
  - [scsi] mpt3sas: As per MPI-spec, use combined reply queue for SAS3.5 controllers when HBA supports more than 16 MSI-x vectors (Tomas Henzl) [1689379 1649288]
  - [x86] cpu: avoid crash in get_cpu_cache_id() (David Arcari) [1689120 1626279]
  - [net] igmp: Allow user-space configuration of igmp unsolicited report interval (Hangbin Liu) [1686771 1663941]
  - [net] igmp: Don't flush routing cache when force_igmp_version is modified (Hangbin Liu) [1686771 1663941]
  - [net] igmp: fix incorrect unsolicit report count after link down and up (Hangbin Liu) [1688225 1623359]
  - [net] igmp: fix incorrect unsolicit report count when join group (Hangbin Liu) [1688225 1623359]
  - [net] igmp: make function __ip_mc_inc_group() static (Hangbin Liu) [1688225 1623359]
  - [net] igmp: Reduce Unsolicited report interval to 1s when using IGMPv3 (Hangbin Liu) [1688225 1623359]
  - [netdrv] cxgb4: Mask out interrupts that are not enabled (Arjun Vynipadath) [1687487 1678729]
  - [acpi] apci / watchdog: enable acpi_watchdog_uses_rtc (David Arcari) [1683078 1663637]
  - [watchdog] simplify getting .drvdata (David Arcari) [1683079 1666393]
  - [acpi] acpi / watchdog: Prefer iTCO_wdt always when WDAT table uses RTC SRAM (David Arcari) [1683079 1666393]
  - [acpi] acpi / watchdog: Prefer iTCO_wdt on Lenovo Z50-70 (David Arcari) [1683079 1666393]
  - [acpi] acpi / watchdog: properly initialize resources (David Arcari) [1683079 1666393]
  - [acpi] acpi / watchdog: Fix init failure with overlapping register regions (David Arcari) [1683079 1666393]
  - [acpi] acpi / watchdog: Print out error number when device creation fails (David Arcari) [1683079 1666393]
  - [net] netfilter: nat: limit port clash resolution attempts (Florian Westphal) [1683093 1654777]
  - [net] netfilter: nat: remove l4 protocol port rovers (Florian Westphal) [1683093 1654777]
  - [net] netfilter: nat: cope with negative port range (Florian Westphal) [1683093 1654777]
  - [x86] mm/fault: Allow stack access below rsp (Waiman Long) [1678221 1651416]
  - [nvme] nvme-rdma: fix possible double free of controller async event buffer (David Milburn) [1678214 1659532]
  - [nvme] nvme-rdma: fix possible free of a non-allocated async event buffer (David Milburn) [1678214 1659532]
  - [nvme] nvme-rdma: stop admin queue before freeing it (David Milburn) [1678214 1659532]
  - [nvme] rdma: fix double freeing of async event data (David Milburn) [1678216 1655786]
  - [md] fix memleak for mempool (Nigel Croxon) [1678215 1599780]
  - [md] Memory leak when flush bio size is zero (Nigel Croxon) [1678215 1599780]
  - [md] fix lock contention for flush bios (Nigel Croxon) [1678215 1599780]
  - [net] ipv6: rate-limit probes for neighbourless routes (Sabrina Dubroca) [1677179 1637821]
  - [net] ipv6: Re-arrange code in rt6_probe() (Sabrina Dubroca) [1677179 1637821]
  - [netdrv] cxgb4: update supported DCB version (Arjun Vynipadath) [1673821 1668570]
  - [netdrv] cxgb4: when disabling dcb set txq dcb priority to 0 (Arjun Vynipadath) [1673821 1668570]
  - [kvm] kvm: fix kvm_ioctl_create_device() reference counting (Paolo Bonzini) [1671922 1671923] {CVE-2019-6974}
  - [kvm] KVM: nVMX: unconditionally cancel preemption timer in free_nested (Paolo Bonzini) [1671905 1671906] {CVE-2019-7221}
  - [mm] page-writeback.c: fix range_cyclic writeback vs writepages deadlock (Brian Foster) [1673281 1591574]
  - [fs] rbd: avoid corruption on partially completed bios (Ilya Dryomov) [1672514 1613493]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.12.2.el7]
changelog:
  - [x86] x86/speculation/mds: Add SMT warning message (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Move arch_smt_update() call to after mitigation decisions (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] x86/speculation/mds: Add mds=full,nosmt cmdline option (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kernel] x86/speculation: Remove redundant arch_smt_update() invocation (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Update MDS mitigation status after late microcode load (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Add debugfs x86/smt_present file (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Disable automatic enabling of STIBP with SMT on (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Add MDS vulnerability documentation (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Move L1TF to separate directory (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [base] x86/speculation/mds: Add sysfs reporting for MDS (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kvm] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/speculation: Consolidate CPU whitelists (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/msr-index: Cleanup bit defines (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/l1tf: Show actual SMT state (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/speculation: Simplify sysfs report of VMX L1TF vulnerability (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/speculation: Rework SMT state change (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [kernel] sched/smt: Expose sched_smt_present static key (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [kernel] sched/smt: Make sched_smt_present track topology (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/speculation: Disable STIBP when enhanced IBRS is in use (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/speculation: Move STIPB/IBPB string conditionals out of cpu_show_common() (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spectre_v2: Make spectre_v2_mitigation mode available (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Add X86_FEATURE_USE_IBPB (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Add casting to fix compilation error (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/cpufeatures: Add Intel PCONFIG cpufeature (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}


author: Akemi Yagi <toracat@centos.org> [3.10.0-957.12.2.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
     addmissing.patch  [puias]
     cpufreq.patch  [puias]
     i386-audit-stop-scri-stack-frame.patch  [puias]
     removejiffies.patch  [puias]
     undorhirqstat.patch  [puias]
     morefixes.patch      [puias+bug#12412]
     upstream-32bit-fixes-7_5.patch [puias+bug#12412]
     clear-32bit-Werror-warnings.patch  [bug#12412]
     qspinlock_types-32bit.patch   [ay]
     i686-7-4.patch [T.Kabe, bug#13890]
     firmware-efi-32bit.patch [ay]
     patch-spec_ctrl_i686.patch [T.Kabe bug#14353]
     686 mods for 7.5 [T.Kabe bug#14703]
     more 686 mods for 7.5 (-862.3.2) [pgreco]
     more 686 mods for 7.5 (-862.11.6) [pgreco, bug#15174]
     Patches updated for 7.6 [kabe, bug#15428]
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Enabled spidev [bug#9955]
  - Add a patch [bug#10447]
  - Enable ATM drivers [bug#10845]
  - Add 9pfs config options [bug#10849]
  - Enable VFIO_PCI_VGA [bug#12435]
  - Rremove initramfs-xxxkdump.img upon kernel removal [bug#12703]
  - Add a patch from [bug#12841]
  - Add a patch from [bug#12818]
  - Enabled RT2800USB_RT3573 [bug#13162]
  - Enable LDM_PARTITION [bug#13526]
  - Add a patch to fix misleading warning [bug#13990]
  - Add BuildRequires: openssl-devel to the with_perf section [bug#13990]
  - Add a patch to fix build errors for EL7.5 [bug#14425]
  - Added a patch to fix alsa potentail crash [bug14779]
  - Apply a patch to fix excessive warnings [bug#14413]
  - Apply a patch to fix mempolicy issue [bug#15115]
  - Add a patch to fix race in virtio_balloon [bug#15216]
  - Add shim requirement to the spec file for x86_64
  - Apply patches that fix ecryptfs issue [see bugs #7369, #15353] provided by @pgreco
  - Add an i686 patch to fix Hyper-V issue [bug#15374]
  - Add an nvme patch [bug#15406]
  - Enable NIU and add a patch that fixes build errors submitted by h-masuda [bug#15040]
  - Apply a patch from bug15639
  - Apply a patch from bug15707
  - Apply a patch from bug15742
  - Add a patch that fixes the earlier patch from bug15742
  - Add a patch from bug#15801
  - Add a patch from bug#15953 (ceph bug)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-11.4
changelog:
  - util: reset signals when we fork off agents
  - util: fix minimal race where we might miss SIGTERMs when forking off an agent


author: Lukas Nykryn <lnykryn@redhat.com> - 208-11.6
changelog:
  - rules: don't enable usb pm for Avocent devices (#1176736)
  - core: introduce new Delegate=yes/no property controlling creation of cgroup subhierarchies (#1179715)
  - core: don't migrate PIDs for units that may contain subcgroups, do this only for leaf units (#1179715)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-60
changelog:
  - Revert "rules: mark hotplugged memory as movable" (#1614686)
  - rules: implement new memory hotplug policy (#1614686)
  - Revert "rules: add udev rule that automatically offline HW attached to ACPI container" (#1597958)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-62
changelog:
  - cryptsetup-generator: introduce basic keydev support (#1619743)
  - cryptsetup-generator: don't return error if target directory already exists (#1619743)
  - cryptsetup-generator: allow whitespace characters in keydev specification (#1619743)
  - Make sure the mount units pulled by 'RequiresMountsFor=' are loaded (if they exist) (#1619743)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-62.2
changelog:
  - journald: do not store the iovec entry for process commandline on stack (#1657788)
  - journald: set a limit on the number of fields (1k) (#1657792)
  - journal-remote: set a limit on the number of fields in a message (#1657792)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-62.4
changelog:
  - Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (#1667870)
  - Allocate temporary strings to hold dbus paths on the heap (#1667870)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-62.6
changelog:
  - Revert "bus: when dumping string property values escape the chars we use as end-of-line and end-of-item marks" (#1643172)


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.127-1
changelog:
  - Do not init filters, locking, lvmetad, lvmpolld if command doesn't use it.
  - Order fields in struct cmd_context more logically.
  - Add lock_type to lvmcache VG summary and info structs.
  - Fix regression in cache causing some PVs to bypass filters (2.02.105).
  - Make configure --enable-realtime the default now.
  - Add dmstats.8 man page.
  - Add dmstats --segments switch to create one region per device segment.
  - Add dmstats --regionid, --allregions to specify a single / all stats regions.
  - Add dmstats --allprograms for stats commands that filter by program ID.
  - Add dmstats --auxdata and --programid args to specify aux data and program ID.
  - Add report stats sub-command to provide repeating stats reports.
  - Add clear, delete, list, and print stats sub-commands.
  - Add create stats sub-command and --start, --length, --areas and --areasize.
  - Recognize 'dmstats' as an alias for 'dmsetup stats' when run with this name.
  - Add a 'stats' command to dmsetup to configure, manage and report stats data.
  - Add statistics fields to dmsetup -o.
  - Add libdm-stats library to allow management of device-mapper statistics.
  - Add --nosuffix to suppress dmsetup unit suffixes in report output.
  - Add --units to control dmsetup report field output units.
  - Add support to redisplay column headings for repeating column reports.
  - Fix report header and row resource leaks.
  - Report timestamps of ioctls with dmsetup -vvv.
  - Recognize report field name variants without any underscores too.
  - Add dmsetup --interval and --count to repeat reports at specified intervals.
  - Add dm_timestamp functions to libdevmapper.
  - Recognise vg/lv name format in dmsetup.
  - Move size display code to libdevmapper as dm_size_to_string.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.128-1
changelog:
  - Allocation setting cache_pool_cachemode is replaced by cache_mode.
  - Don't attempt to close config file that couldn't be opened.
  - Check for valid cache mode in validation of cache segment.
  - Change internal interface handling cache mode and policy.
  - When no cache policy specified, prefer smq (if available) over mq.
  - Add demo cache-mq and cache-smq profiles.
  - Add cmd profilable allocation/cache_policy,cache_settings,cache_mode.
  - Require cache_check 0.5.4 for use of --clear-needs-check-flag.
  - Fix lvmetad udev rules to not override SYSTEMD_WANTS, add the service instead.
  - Fix 'dmstats list -o all' segfault.
  - Separate dmstats statistics fields from region information fields.
  - Add interval and interval_ns fields to dmstats reports.
  - Do not include internal glibc headers in libdm-timestamp.c (1.02.104)
  - Exit immediately if no device is supplied to dmsetup wipe_table.
  - Suppress dmsetup report headings when no data is output. (1.02.104)
  - Adjust dmsetup usage/help output selection to match command invoked.
  - Fix dmsetup -o all to select correct fields in splitname report.
  - Restructure internal dmsetup argument handling across all commands.
  - Add dm_report_is_empty() to indicate there is no data awaiting output.
  - Add more arg validation for dm_tree_node_add_cache_target().
  - Add --alldevices switch to replace use of --force for stats create / delete.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.129-1
changelog:
  - Drop error message when vgdisplay encounters an exported VG. (2.02.27)
  - Fix shared library generation to stop exporting internal functions.(2.02.120)
  - Accept --cachemode with lvconvert.
  - Fix and improve reporting properties of cache-pool.
  - Enable usage of --cachepolicy and --cachesetting with lvconvert.
  - Don't allow to reduce size of thin-pool metadata.
  - Fix debug buffer overflows in cmirrord logging.
  - Add --foreground and --help to cmirrord.
  - Add 'precise' column to statistics reports.
  - Add --precise switch to 'dmstats create' to request nanosecond counters.
  - Add precise argument to dm_stats_create_region().
  - Add support to libdm-stats for precise_timestamps
  - Fix devmapper.pc pkgconfig file to declare -lrt dependency properly.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.130-1
changelog:
  - Fix use of uninitialized device status if reading outdated .cache record.
  - Restore support for --monitor option in lvcreate (2.02.112).
  - Read thin-pool data and metadata percent without flush.
  - Detect blocked thin-pool and avoid scanning their thin volumes.
  - Check if dm device is usable before checking its size (2.02.116).
  - Extend parsing of cache_check version in configure.
  - Make lvpoll error messages visible in lvmpolld's stderr and in syslog.
  - Add 'make install_full_man' to install all man pages regardless of config.
  - Parse thin-pool status with one single routine internally.
  - Add --histogram to select default histogram fields for list and report.
  - Add report fields for displaying latency histogram configuration and data.
  - Add dmstats --bounds to specify histogram boundaries for a new region.
  - Add dm_histogram_to_string() to format histogram data in string form.
  - Add public methods to libdm to access numerical histogram config and data.
  - Parse and store histogram data in dm_stats_list() and dm_stats_populate().
  - Add an argument to specify histogram bounds to dm_stats_create_region().
  - Add dm_histogram_bounds_from_{string,uint64_t}() to parse histogram bounds.
  - Add dm_histogram handle type to represent a latency histogram and its bounds.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.130-2
changelog:
  - Fix vgimportclone cache_dir path name (2.02.115).
  - Disallow usage of --stripe and --stripesize when creating cache pool.
  - Swapping of LV identifiers handles more complex LVs.
  - Fix VG metadata comparison failure while scanning the VG for lvmetad.
  - Ignore persistent cache if configuration changed. (2.02.127)
  - Do not check for full thin pool when activating without messages (1.02.107).


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.130-3
changelog:
  - Enforce writethrough mode for cleaner policy.
  - Check for enough space in thin-pool in command before creating new thin.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.130-5.el7_2.1
changelog:
  - Fix possible data loss caused by lost buffered writes during thin pool
    resize after reaching its capacity.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.1
changelog:
  - Bump to 2.6.9 and u131b00.
  - Remove patch application debris in fsg.sh.
  - Re-generate PR2809 and RH1022017 against 2.6.9.
  - Update md5sum list with checksum for the new java.security file.
  - Add blacklisted.certs to installation file list.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.2
changelog:
  - Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
  - Update jstack tapset to handle AArch64
  - Handle unsupported architectures by calling the error function rather than a parse failure
  - ABS_JAVA_HOME_DIR is no longer used in the updated tapsets
  - Resolves: rhbz#1373986


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.3
changelog:
  - Backport "8173783: IllegalArgumentException: jdk.tls.namedGroups"
  - Apply backports before local RPM fixes so they will be the same as when applied upstream
  - Adjust RH1022017 following application of 8173783
  - Resolves: rhbz#1422738


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.1
changelog:
  - Bump to 2.6.10 and u141b00.
  - Add more detailed output to fsg.sh and generate_source_tarball.sh.
  - Update md5sum list with checksum for the new java.security file.
  - Drop 8173783 backport which is now applied upstream.
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.3
changelog:
  - Add support for using RSAandMGF1 with the SHA hash algorithms in the PKCS11 provider 
  - Resolves: rhbz#1273760


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.4
changelog:
  - Fix merge error with "native2ascii changes file permissions of input file"
  - Resolves: rhbz#1446700


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.141-2.6.10.5
changelog:
  - make to use latest c-j-c and so fix persisting issues with java.security and other configfiles
  - aligned with this change, applied repackReproduciblePolycies.sh
  - 1183793 is missing blocker
  - Resolves: rhbz#1448880


author: Michal Hlavinka <mhlavink@redhat.com> - 1.6.2-20
changelog:
  - drop last man page change, that option is just for compatibility
  - fix NAME section of man pages to be whatis friendly


author: Michal Hlavinka <mhlavink@redhat.com> - 1.6.2-23
changelog:
  - drop uuid-pgsql subpackage, it is outdated and does not work, use 
    uuid-ossp module from postgresql-contrib instead


author: Frantisek Kluknavsky <fkluknav@redhat.com> - 1.1.11-18
changelog:
  - ported from cdda-paranoia to libcdio-paranoia, modified paranoia-cdda.patch
  - fixed bogus date in changelog


author: Jakub Martisko <jamartis@redhat.com> - 1.1.11-25
changelog:
  - add support for device names of the form /dev/srN
  - fix provided by Frantisek Kluknavsky
  - resolves:rhbz#1058446


author: Jiri Pirko <jpirko@redhat.com> - 1.2-1
changelog:
  - Update to 1.2
  - libndp: silently ignore packets with optlen 0 [1016064]
  - libndp: fix processing for larger options [1016064]
  - libndp: do not fail on receiving non-ndp packets [1016078]


author: Jiri Pirko <jpirko@redhat.com> - 1.2-3
changelog:
  - libndp: fix [cppcheck] Undefined behavior: Variable 'buf' is used as parameter and destination in s[n]printf() [1044084]


author: Lubomir Rintel <lrintel@redhat.com> - 1.2-5
changelog:
  - libndp: validate the IPv6 hop limit [CVE-2016-3698]
  - libndb: reject redirect and router advertisements from non-link-local [CVE-2016-3698]


author: Eric Garver <egarver@redhat.com> - 1.2-7
changelog:
  - libndp: add option flags to send messages
  - ndptool: add option to send messages types
  - libndp: fix type of field "na" in "struct ndp_msgna"
  - libndp: revert API change for ndp_msg_send() and add


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 5.49-10
changelog:
  - Use vsnprintf instead of vsprintf to avoid buffer overflow
    (it happens e.g. when running systemtap testsuite)
    Resolves: #1038931


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 5.45-13
changelog:
  - Fix segfaults if Tcl is built with stubs and Expect is used directly from C program
    (patch taken from Debian project, written by Sergei Golovan)
    Resolves: #1091060


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 5.45-14
changelog:
  - Use different and probably better approach of fixing segfaults if Tcl is
    built with stubs and Expect is used directly from C program
    Resolves: #1091060


author: Bastien Nocera <bnocera@redhat.com> - 1.8-3
changelog:
  + shared-mime-info-1.8-3
  - Remove triggers, they're not supported in RHEL 7.4's RPM
  Resolves: #1433916


author: Peter Hutterer <peter.hutterer@redhat.com> 0.22.0-3
changelog:
  - Provide xorg-x11-drv-synaptics. The actual content is now provided by
    xorg-x11-drv-synaptics-legacy (#1394836). For details, see
    https://fedoraproject.org/wiki/Changes/RetireSynapticsDriver


author: Peter Hutterer <peter.hutterer@redhat.com> 0.23.0-2
changelog:
  - Ignore LED updates for disabled devices, avoids a null-pointer dereference
    when an AccessX timeout is set


author: Peter Hutterer <peter.hutterer@redhat.com> 0.25.0-2
changelog:
  - Don't provide xorg-x11-drv-synaptics (#1413811)
  - Don't reassign libinput to wacom touchpads, that's left to the user
  - Don't assign to wacom tablets, tablets behave differently on RHEL7.4


author: Pavel Raiskup <praiskup@redhat.com> - 1.26-25
changelog:
  - the /etc/rmt seems to be the best place where to look for rmt binary (see the
    commit message in Fedora's cpio.git for more info)


author: Tomas Repik <trepik@redhat.com> - 2:1.26-32
changelog:
  - restore incremental backups correctly, files were not being removed (rhbz#1184697)
  - fix the behavior of tar when --directory option is used together with
    --remove-files
  - repair the ignorance of --xattrs-exclude/include options (rhbz#1341786)
  - Intorduce new option '--keep-directory-symlink'


author: Rex Dieter <rdieter@fedoraproject.org> - 0.8.2-7
changelog:
  - libgpod.pc Requires: libimobiledevice-1.0 ... overlinking (#818594)
  - tighten subpkg deps (via %_isa)
  - omit -devel deps that (should) get autodetected already


author: Bill Nottingham <notting@redhat.com> 1.3.57-1
changelog:
  - assorted cleanups to LSB dependency support (#693202 fixed properly, #701573)
  - fix kill values for LSB-only scripts (#696305, <jbastian@redhat.com>)
  - don't apply start deps for services that aren't starting anywhere (#750446)


author: Bill Nottingham <notting@redhat.com> 1.3.58-1
changelog:
  - fix forwarding to systemctl with systemd >= 41 (#789256)
  - assorted regression fixes from 1.3.57 (#782152, etc.)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.3.60-1
changelog:
  - don't completely override LDFLAGS
  - pass along any rpm-configured LD flags
  - make sure install_initd/remove_initd provides appropriate help output for those commands (#803818)
  - check for overridden services in /etc too (#850899)
  - chconfig should own /etc/rc.d (#894328)
  - isXinetdEnabled should also ask systemd (#820363)
  - alternatives: look for service file also in /etc
  - alternatives: add --list option (#622635)
  - chkconfig: add hint to call systemctl list-unit-files and list-dependencies (#800334)
  - chkconfig: correctly handle unreadable init.d (#913807)
  - alternatives: call systemctl enable with --force (#915667)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.3.61-5
changelog:
  - chkconfig: don't create symlinks if they already exist
  - fix combination --type xinetd --list service
  - leveldb: restore selinux context for xinetd conf files


author: Prarit Bhargava <prarit@redhat.com> - 3:144.1.94d853b2ea81
changelog:
  - update NVR to 144 to match upstream
  - add Denverton SoC support [1273768]
  - add Kabylake U/Y support, 0x8E [1310954]
  - add Kabylake H/S support, 0x9E [1310955]
  - add Knights Mill support [1381316]
  - mcelog didn't remove /var/run/mcelog-client when exitting [1362123]


author: Jan Pazdziora <jpazdziora@redhat.com> - 0.9.7-1
changelog:
  - No longer call lookup_identity_hook explicitly, hook order does
    the same.
  - Silence compile warnings by specifying C99.


author: Jan Pazdziora <jpazdziora@redhat.com> - 0.9.8-1
changelog:
  - 1109923 - Fix module loading/configuration for Apache 2.4.
  - Document the runtime dependency on pam_authenticate_with_login_password.
  - Comment/code cleanup.


author: Paul Howarth <paul@city-fan.org> - 1.5.0-5
changelog:
  - Make GeoIP.dat -> GeoIP-initial.dat symlink in %install, not %post,
    and don't %ghost it
  - Run geoipupdate silently in %post and cron job
  - Create empty database files for %ghost to work with old rpm versions
  - Don't try to use noarch subpackages on old rpm versions
  - Update %description to mention database updates
  - Drop outdated README.Fedora


author: Jan Safranek <jsafrane@redhat.com> - 1.5.0-7
changelog:
  - Don't download the database in %post (#1029807)
  - Don't download GeoLiteASNum as it's no longer provided.


author: Jan Safranek <jsafrane@redhat.com> - 1.5.0-10
changelog:
  - Added base IPv6 database to GeoIP package
  - Added GeoIP-data subpackage with all other databases (#1201857)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-4.b13
changelog:
  - Set OPENJDK_TARGET_CPU_LEGACY to ppc64 so as not to mess up HotSpot build.
  - Add -DABI_ELFv2 to CFLAGS on ppc64le to match OpenJDK 7.
  - Print contents of hotspot-spec.gmk
  - Resolves: rhbz#1194378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-4.b13
changelog:
  - Override ppc64le as ppc64 only in hotspot-spec.gmk so as not to disrupt JDK build.
  - Add property test case from java-1.7.0-openjdk build.
  - Resolves: rhbz#1194378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-6.b13
changelog:
  - Adjust ppc64le HotSpot patch for OpenJDK 8.
  - Enable AArch64 configure/JDK patch on all archs to minimise patching issues.
  - Adjust ppc64le patches to apply after the enableAArch64 patch.
  - Add %{name} prefix to patches to avoid conflicts with OpenJDK 7 versions.
  - Resolves: rhbz#1194378


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.45-27.b13
changelog:
  - updated to security u45
  - minor sync with 7.2
   - generate_source_tarball.sh
   - adapted java-1.8.0-openjdk-s390-java-opts.patch and java-1.8.0-openjdk-size_t.patch
   - reworked (synced) zero patches (removed 103,11 added 204, 400-403)
   - family of 5XX patches renamed to 6XX
   - added upstreamed patch 501 and 505
   - included removeSunEcProvider-RH1154143.patch
  - returned java (jre only) provides
  - repacked policies (source20)
  - removed duplicated NVR provides
  - added automated test for priority (length7)
  - Resolves: RHBZ#1209076


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.45-7.b13
changelog:
  - Re-add %{name} prefix to patches to avoid conflicts with OpenJDK 7 versions.
  - Remove ppc64le test case now fix has been verified.
  - Resolves: rhbz#1194378


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-1.el7
changelog:
  - Rebase to 2.12.0 base [bz#1562218]
  - Resolves: bz#1562218
    (Rebase qemu-guest-agent for RHEL-7.6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-2.el7
changelog:
  - qemuga-qemu-ga-make-get-fsinfo-work-over-pci-bridges.patch [bz#1567041]
  - qemuga-qga-fix-driver-leak-in-guest-get-fsinfo.patch [bz#1567041]
  - Resolves: bz#1567041
    (qemu-guest-agent does not parse PCI bridge links in "build_guest_fsinfo_for_real_device" (q35))


author: Andreas Schneider <asn@redhat.com> - 4.4.4-4
changelog:
  - resolves: #1351655 - Fix winbind meomory leak with each cached credentials
                         login
  - resolves: #1351961 - Fix CVE-2016-2119


author: Andreas Schneider <asn@redhat.com> - 4.4.4-5
changelog:
  - resolves: #1359091 - Package /usr/lib/samba/ldb in the common-libs package
  - resolves: #1360788 - Fix multilib issue with ctdb-tests package
  - resolves: #1362385 - Fix Samba ignoring supplementary groups
  - resolves: #1364051 - Fix smbd panic with stale ctdb entries


author: Andreas Schneider <asn@redhat.com> - 4.4.4-6
changelog:
  - resolves: #1367316 - Increase required Kerbersion version number
  - resolves: #1366477 - Fix using the right krb5 ccache in libads
  - resolves: #1356501 - Fix high CPU usage with smbclient connection to
                         non-reachable IP


author: Andreas Schneider <asn@redhat.com> - 4.4.4-10
changelog:
  - resolves: #1393050 - Fix linking nss_wins with libreplace
  - resolves: #1393051 - Fix nss_wins function definitions for gethostbyname*
  - resolves: #1393048 - Fix %G substitution in AD case
  - resolves: #1393052 - Fix regression of smbclient unable to connect to
                         Apple and Azure


author: Andreas Schneider <asn@redhat.com> - 4.4.4-13
changelog:
  - resolves: #1437816 - Fix krb5 memory cache in libads sasl code
  - resolves: #1437741 - Fix CVE-2016-2125, CVE-2016-2126 and CVE-2017-2619


author: Sun Yunying <yunying.sun@intel.com> - 1.1.0-2
changelog:
  - Remove pkg_version to avoid dupliate use of version
  - Remove redundant BuildRequires for autoconf/automake/pkgconfig
  - Add comments for BuildRequires of sapi/tcti-device/tcti-socket
  - Use ExclusiveArch instead of ExcludeArch
  - Requires tpm2-tss version updated to 1.0-2
  - Updated release version and changelog


author: Sun Yunying <yunying.sun@intel.com> - 1.1.0-3
changelog:
  - Change spec file permission to 644 to avoid rpmlint complain
  - Update Requires to fix dependency check error reported in Bodhi
  - Remove tpm2-tss-devel version in BuildRequires comment
  - Update release version and changelog


author: Sun Yunying <yunying.sun@intel.com> - 1.1.0-4
changelog:
  - Dependency check failed for Requires again, here to fix this
  - Update release version and changelog


author: Jerry Snitselaar <jsnitsel@redhat.com> - 1.1.0-5
changelog:
  - Remove epel dependencies
  - Change tpm2-tss dependency to not be tied to 1 version
  - Fix resource leak in InitSysContext
  - Clean up HashEKPublicKey
  - Add needed null checks to tpm2_getmanufec
  - clean up resource leak in tpm2_getmanufec
  - use strdup to get server address in tpm2_getmanufec
  - change preparePcrSelections_g to void
  - return on success in print_rc_tpm_error_code
  - Update release version
  resolves: rhbz#1275029 - Add tpm2.0-tools package


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.0.11-44
changelog:
  - fence_mpath: update info to say unique key per node instead of per
    node/device
    Resolves: rhbz#1280151


author: Peter Rajnoha <prajnoha@redhat.com> - 0.5.3-1
changelog:
  - Tools now open the metadata device in O_EXCL mode to stop
    running the tools on active metadata.
  - Update to latest upstream release.


author: Peter Rajnoha <prajnoha@redhat.com> - 0.5.4-1
changelog:
  - Fix cache_check with --clear-needs-check-flag option to
    make sure metadata device is not open already by the tool
    when open with O_EXCL mode is requested.


author: Peter Rajnoha <prajnoha@redhat.com> - 0.5.5-1
changelog:
  - Support thin_delta's --metadata_snap option without specifying snap location.
  - Update man pages to make it clearer that tools shoulnd't be run on live metadata.
  - Fix bugs in the metadata reference counting for thin_check.


author: Peter Rajnoha <prajnoha@redhat.com> - 0.6.2-0.1.rc5
changelog:
  - New thin_ls command.
  - era_invalidate may be run on live metadata if the --metadata-snap
    option is given.


author: Peter Rajnoha <prajnoha@redhat.com> - 0.6.2-2
changelog:
  - Improve documentation and messages on output file preallocation
    when using thin_repair and thin_restore.


author: Nalin Dahyabhai <nalin@redhat.com> 0.75.14-1
changelog:
  - make pathname canonicalization slightly smarter, to handle ".." in
    locations (#1131758)
  - updates to self-tests (#1144082)


author: Jan Cholasta <jcholast@redhat.com> - 0.78.1-1
changelog:
  - Resolves: #1140241 RFE: Add SCEP support to certmonger
  - Resolves: #1148001 ipa-getcert killed by SIGABRT
  - Resolves: #1205756 Rebase certmonger to 0.77 or later
    - Update to upstream 0.78.1


author: Jan Cholasta <jcholast@redhat.com> - 0.78.3-1
changelog:
  - Resolves: #1244914 scep ca helper does not parse command line options
    correctly
  - Related:  #1205756 Rebase certmonger to 0.77 or later
    - Update to upstream 0.78.3


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-1
changelog:
  - Resolves: #1249753 challenge password not added in csr using start-tracking
  - Resolves: #1250397 Remove certmonger rekey feature in 7.2
    - Remove rekey feature
  - Related:  #1205756 Rebase certmonger to 0.77 or later
    - Update to upstream 0.78.4


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-2
changelog:
  - Resolves: #1345755 Support for specifying IPA lightweight CA
    - Add 'issuer' request option for specifying issuer
    - Documentation: mark $CERTMONGER_CA_ISSUER as 0.79
    - Comment/whitespace fixup
    - ipa-submit: Retry without "ca" on OptionError
    - getcert: fix a potential out-of-bounds
    - Document the -X option in the ipa-submit man page
  - Resolves: #1351052 certmonger build for RHEL 7.3 failure
    - Stop assuming RSA 512 works
    - Stop assuming RSA 512 works, part two
    - Fix a flakiness in the 028-dbus test


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-3
changelog:
  - Resolves: #1367683 getcert request command fails to use Sub CA using -X
    argument
    - Fix CA option name for ipa cert-request


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-3.1
changelog:
  - Use required DER encoding when setting CA basic constraint (#1560961)
  - NSS 3.34 more strictly enforces length checking when verifying signatures
    (#1560960)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-122.el7
changelog:
  - kvm-virtio-validate-the-existence-of-handle_output-befor.patch [bz#1367040]
  - Resolves: bz#1367040
    (QEMU crash when guest notifies non-existent virtqueue)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-123.el7
changelog:
  - kvm-Fix-backport-of-target-i386-add-feature-flags-for-CP.patch [bz#1371619]
  - kvm-Add-skip_dump-flag-to-ignore-memory-region-during-du.patch [bz#1373088]
  - Resolves: bz#1371619
    (Flags xsaveopt xsavec xgetbv1 are missing on qemu-kvm)
  - Resolves: bz#1373088
    ([FJ7.3 Bug]: virsh dump with both --memory-only and --format option fails)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-124.el7
changelog:
  - kvm-target-i386-Add-support-for-FEAT_7_0_ECX.patch [bz#1372459]
  - kvm-target-i386-Add-more-Intel-AVX-512-instructions-supp.patch [bz#1372459]
  - Resolves: bz#1372459
    ([Intel 7.3 Bug] SKL-SP Guest cpu doesn't support avx512 instruction sets(avx512bw, avx512dq and avx512vl) (qemu-kvm))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-125.el7
changelog:
  - kvm-nbd-server-Set-O_NONBLOCK-on-client-fd.patch [bz#1285453]
  - Resolves: bz#1285453
    (An NBD client can cause QEMU main loop to block when connecting to built-in NBD server)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7
changelog:
  - kvm-virtio-recalculate-vq-inuse-after-migration.patch [bz#1376542]
  - Resolves: bz#1376542
    (RHSA-2016-1756 breaks migration of instances)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.1
changelog:
  - kvm-ide-fix-halted-IO-segfault-at-reset.patch [bz#1393042]
  - kvm-hw-i386-regenerate-checked-in-AML-payload-RHEL-only.patch [bz#1392027]
  - kvm-SPEC-file-flip-the-build-from-IASL-to-checked-in-AML.patch [bz#1392027]
  - Resolves: bz#1392027
    (shutdown rhel 5.11 guest failed and stop at "system halted")
  - Resolves: bz#1393042
    (system_reset should clear pending request for error (IDE))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.2
changelog:
  - kvm-virtio-introduce-virtqueue_unmap_sg.patch [bz#1393484]
  - kvm-virtio-introduce-virtqueue_discard.patch [bz#1393484]
  - kvm-virtio-decrement-vq-inuse-in-virtqueue_discard.patch [bz#1393484]
  - kvm-balloon-fix-segfault-and-harden-the-stats-queue.patch [bz#1393484]
  - kvm-virtio-balloon-discard-virtqueue-element-on-reset.patch [bz#1393484]
  - kvm-virtio-zero-vq-inuse-in-virtio_reset.patch [bz#1393484]
  - kvm-virtio-add-virtqueue_rewind.patch [bz#1393484]
  - kvm-virtio-balloon-fix-stats-vq-migration.patch [bz#1393484]
  - Resolves: bz#1393484
    ([RHEL7.3] KVM guest shuts itself down after 128th reboot)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.3
changelog:
  - kvm-net-check-packet-payload-length.patch [bz#1398217]
  - Resolves: bz#1398217
    (CVE-2016-2857 qemu-kvm: Qemu: net: out of bounds read in net_checksum_calculate() [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.4
changelog:
  - kvm-virtio-blk-Release-s-rq-queue-at-system_reset.patch [bz#1420049]
  - kvm-cirrus_vga-fix-off-by-one-in-blit_region_is_unsafe.patch [bz#1418232]
  - kvm-display-cirrus-check-vga-bits-per-pixel-bpp-value.patch [bz#1418232]
  - kvm-display-cirrus-ignore-source-pitch-value-as-needed-i.patch [bz#1418232]
  - kvm-cirrus-handle-negative-pitch-in-cirrus_invalidate_re.patch [bz#1418232]
  - kvm-cirrus-allow-zero-source-pitch-in-pattern-fill-rops.patch [bz#1418232]
  - kvm-cirrus-fix-blit-address-mask-handling.patch [bz#1418232]
  - kvm-cirrus-fix-oob-access-issue-CVE-2017-2615.patch [bz#1418232]
  - Resolves: bz#1418232
    (CVE-2017-2615 qemu-kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-7.3.z])
  - Resolves: bz#1420049
    (system_reset should clear pending request for error (virtio-blk))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.5
changelog:
  - kvm-cirrus-fix-patterncopy-checks.patch [bz#1420490]
  - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch [bz#1420490]
  - kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch [bz#1420490]
  - Resolves: bz#1420490
    (EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-7.3.z])


author: Lukas Czerner <lczerner@redhat.com> - 1.42.9-4
changelog:
  - Fix posisble use after free in some error paths (#997982)
  - Enable lazy_itable_init even if ext4 module is not loaded (#1071909)
  - Remove any ocurence of ext4dev and test_fs from e2fsprogs (#1063801)
  - Allow to resize ext4 file system past 16TB (#982871)
  - Disable altivec instructions for libext2fs on ppc (#1074604)


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-15
changelog:
  - allow to use ECC ciphers if NSS implements them (#1058776)
  - re-use of wrong HTTP NTLM connection in libcurl (CVE-2014-0015)


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-16
changelog:
  - allow to use TLS > 1.0 if built against recent NSS (#1036789)
  - use proxy name in error message when proxy is used (#1042831)
  - refresh expired cookie in test172 from upstream test-suite (#1063693)


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-28
changelog:
  - Fix problem with policy with path=* not working if there is no
    /dev/disk/by-path/ directory, as is the case with (S)ATA only systems
  - Resovles bz1045510


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-29
changelog:
  - Fix problem with mdadm crashing, if trying to create an IMSM array, with
    missing devices.
  - Resolves bz1056466


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-30
changelog:
  - Fix problem where Resync and recovery of RAID10 stopped at more than
    50% does not continue after reassemblation
  - Resolves bz1068154


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-31
changelog:
  - Fix problem of IMSM platform capabilities not being detected in UEFI
    mode when only the second SATA controller is enabled.
  - Resolves bz1074161


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-31.1
changelog:
  - Fix issue with mdmon not being launched correctly after reboot
    during container reshape second of a second RAID5 array, resulting in
    it being read-only and cannot be mounted.
  - Resolves bz1123031


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-31.2
changelog:
  - Fix problem with spare disk not being added correctly to IMSM array
    because mdmon is unable to write metadata to it.
  - Resolves bz1132829


author: Rafael Aquini <aquini@redhat.com> [3.10.0-507.el7]
changelog:
  - [netdrv] ixgbe: fix spoofed packets with macvlans (Ken Cox) [1324631]
  - [tools] perf mem: Fix -t store option for record command (Jiri Olsa) [1357531 1357543]
  - [x86] clock: Fix kvm guest tsc initialization (Prarit Bhargava) [1372759]
  - [x86] tsc: Enumerate BXT tsc_khz via CPUID (Prarit Bhargava) [1372759]
  - [drm] i915: Enable polling when we don't have hpd (Lyude Paul) [1277863]
  - [drm] i915/vlv: Disable HPD in valleyview_crt_detect_hotplug() (Lyude Paul) [1277863]
  - [drm] i915/vlv: Reset the ADPA in vlv_display_power_well_init() (Lyude Paul) [1277863]
  - [drm] i915/vlv: Make intel_crt_reset() per-encoder (Lyude Paul) [1277863]
  - [fs] Fix NULL pointer dereference in bl_free_device() (Benjamin Coddington) [1356796]
  - [fs] nfs/blocklayout: support RH/Fedora dm-mpath device nodes (Benjamin Coddington) [1356796]
  - [fs] nfs/blocklayout: refactor open-by-wwn (Benjamin Coddington) [1356796]
  - [fs] nfs/blocklayout: use proper fmode for opening block devices (Benjamin Coddington) [1356796]
  - [fs] sunrpc: fix UDP memory accounting (Paolo Abeni) [1298899]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-508.el7]
changelog:
  - [drm] i915: Add GEN7_PCODE_MIN_FREQ_TABLE_GT_RATIO_OUT_OF_RANGE to SNB (Lyude Paul) [1341633 1355776]
  - [drm] i915/gen9: implement missing case for SKL watermarks calculation (Lyude Paul) [1341633 1355776]
  - [drm] i915/gen9: fix the watermark res_blocks value (Lyude Paul) [1341633 1355776]
  - [drm] i915/gen9: fix plane_blocks_per_line on watermarks calculations (Lyude Paul) [1341633 1355776]
  - [drm] i915/gen9: minimum scanlines for Y tile is not always 4 (Lyude Paul) [1341633 1355776]
  - [drm] i915/gen9: fix the WaWmMemoryReadLatency implementation (Lyude Paul) [1341633 1355776]
  - [drm] i915/skl: Don't try to update plane watermarks if they haven't changed (Lyude Paul) [1341633 1355776]
  - [drm] i915/skl: Update DDB values atomically with wms/plane attrs (Lyude Paul) [1341633 1355776]
  - [drm] i915: Move CRTC updating in atomic_commit into it's own hook (Lyude Paul) [1341633 1355776]
  - [drm] i915/skl: Ensure pipes with changed wms get added to the state (Lyude Paul) [1341633 1355776]
  - [drm] i915/skl: Update plane watermarks atomically during plane updates (Lyude Paul) [1341633 1355776]
  - [drm] i915/gen9: Only copy WM results for changed pipes to skl_hw (Lyude Paul) [1341633 1355776]
  - [drm] i915/skl: Add support for the SAGV, fix underrun hangs (Lyude Paul) [1341633 1355776]
  - [drm] i915/gen6+: Interpret mailbox error flags (Lyude Paul) [1341633 1355776]
  - [drm] i915/gen9: Only copy WM results for changed pipes to skl_hw (Lyude Paul) [1341633 1355776]


author: Ade Lee <alee@redhat.com> - 1.0.1-10
changelog:
  - Resolves: rhbz#1117072 -  ppc64le is missing from ExcludeArch
  - reverted the previous change.  ppc64le now removed from ExcludeArch


author: Ade Lee <alee@redhat.com> 1.0.2-1
changelog:
  - Allow passwords to be retrieved post-init phase
  - Fix null termination issue on returned stored passwords


author: Petr Pisar <ppisar@redhat.com> - 1.11.23-29
changelog:
  - Correct handling systemd service (bug #737264)
  - Allow configuration with automake-1.13.1
  - Allow to stop all server instances by stopping cvs.target


author: Petr Pisar <ppisar@redhat.com> - 1.11.23-30
changelog:
  - Fix texinfo documentation to work with texinfo-5.1 (bug #970716)
  - Do not crash if crypt(3) returns NULL (bug #966497)


author: Petr Pisar <ppisar@redhat.com> - 1.11.23-31
changelog:
  - Allow CVS server to use any Kerberos key with cvs service name. This reverts
    canonicalization on clite side introduced with 1.11.23-20 and replaces it
    with a more benevolent key selection on server side. (bug #722972)


author: Petr Pisar <ppisar@redhat.com> - 1.11.23-32
changelog:
  - Harden build for cvs in server role (bug #983164)
  - Add cvs.sh(5) manual page (bug #983164)
  - Add cvs.csh(5) manual page (bug #983164)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b15-0
changelog:
  - Move to single OpenJDK tarball build, based on aarch64/shenandoah-jdk8u.
  - Update to aarch64-shenandoah-jdk8u181-b15.
  - Drop 8165489-pr3589.patch which was only applied to aarch64/jdk8u builds.
  - Move buildver to where it should be in the OpenJDK version.
  - Split ppc64 Shenandoah fix into separate patch file with its own bug ID (PR3620).
  - Update pr3539-rh1548475.patch to apply after 8187045.
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b16-0
changelog:
  - Update to aarch64-shenandoah-jdk8u181-b16.
  - Drop PR3619 & PR3620 Shenandoah patches which should now be fixed upstream.
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b10.
  - Drop 8146115/PR3508/RH1463098 applied upstream.
  - Resolves: rhbz#1633817


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-43
changelog:
  - curl --socks5-{basic,gssapi}: control socks5 auth (#1409208)
  - nss: fix a memory leak when CURLOPT_CRLFILE is used (#1427883)
  - nss: do not leak PKCS #11 slot while loading a key (#1444860)
  - nss: fix a possible use-after-free in SelectClientCert() (#1473158)


author: Owen Taylor <otaylor@redhat.com> - 3.8.4-7
changelog:
  - Add an upstream patch that fixes a bug with left-over window
    shadows that show up when we add patches to Clutter to stop
    redrawing the entire screen on every window move.
    Resolves: rhbz#1063984


author: Owen Taylor <otaylor@redhat.com> 3.8.4-13
changelog:
  - Add patches for quadbuffer stereo suppport
    Fix a bad performance problem drawing window thumbnails
    Resolves: rhbz#861507


author: Lubos Kardos <lkardos@redhat.com> - 20130529-10
changelog:
  - Allow to use vendor prefix in packages names
  - Include %nfsmountable macro into scl's rpm macros file


author: Jan Zeleny <jzeleny@redhat.com> - 20130529-13
changelog:
  - bump the version to get in sync with 7.1 branch
  - Reflect the state of %nfsmountable macro in collections' rpm macro files
  - escape all the % chars in changelog


author: Ray Strode <rstrode@redhat.com> - 3.26.1-1
changelog:
  - Update to 3.26.1
    Resolves: #1489359
    Related:  #1481740
  - Enable wayland support
    Resolves: #1481740
  - Fix bogus wtmp entries
    Resolves: #1391156


author: Ray Strode <rstrode@redhat.com> - 3.26.2.1-1
changelog:
  - Update to 3.26.2.1
    Integrates a lot of the downstream patches
    Related: #1481740
  - Fixes race condition introduced by list display patch
    Related: #1413900


author: William Cohen <wcohen@redhat.com> - 0.9.9-11
changelog:
  - Avoid setting POSIXLY_CORRECT for the children tasks of operf and ocount.
  - Fix handling of default unit masks longer than 11 char.
  - Fix extra and default unitmasks selection.
  - Allow operf to record information for Java anon_huges.


author: Chris Feist <cfeist@redhat.com> - 0.9.137-6
changelog:
  - Allowed configuration of resource-discovery option on location constraint
    rules
  - Resolves: rhbz#1054491


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.137-7
changelog:
  - When a role is removed in the GUI the user is now automatically deleted
    if they aren't members of another role
  - Resolves: rhbz#1054491


author: Chris Feist <cfeist@redhat.cmo> 0.9.137-8
changelog:
  - Configuration of resource-discovery is now available on advanced location
    constraint rules
  - Resolves: rhbz#1054491


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.137-9
changelog:
  - Added acl enable and disable commands
  - Display whether acls are enabled in the 'pcs acl' output
  - Resolves: rhbz#1054491


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.137-11
changelog:
  - Stop cluster nodes in parallel and keep cluster quorate during pacemaker
    shutdown
  - Resolves: rhbz#1180506


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-5
changelog:
  - RHEL 7.4 erratum
  - added doc patch about sudo lookup issue
    Resolves: rhbz#1293306
  - added test suite patch
    Resolves: rhbz#1360687
  - fixed use after free fqdn problem
    Resolves: rhbz#1360687


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-7
changelog:
  - rename the 90-nproc.conf to 20-nproc.conf (#1071618)
  - canonicalize user name in pam_selinux (#1071010)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-9
changelog:
  - fix CVE-2014-2583: potential path traversal issue in pam_timestamp
  - pam_pwhistory: call the helper if SELinux enabled


author: Phil Sutter <psutter@redhat.com> [1.0.6-5.el7]
changelog:
  - expr: lookup: give support for inverted matching (Phil Sutter) [1441084]
  - tests: stricter string attribute validation (Phil Sutter) [1441084]


author: Phil Sutter <psutter@redhat.com> [1.0.6-6.el7]
changelog:
  - chain: dynamically allocate name (Phil Sutter) [1353320]
  - src: Avoid returning uninitialized data (Phil Sutter) [1353319]
  - expr/limit: Drop unreachable code in limit_to_type() (Phil Sutter) [1353312]
  - ruleset: Initialize ctx.flags before calling nftnl_ruleset_ctx_set() (Phil Sutter) [1353322]
  - src: Fix nftnl_*_get_data() to return the real attribute length (Phil Sutter) [1353322]
  - expr/ct: prevent array index overrun in ctkey2str() (Phil Sutter) [1353309]
  - utils: Don't return directly from SNPRINTF_BUFFER_SIZE (Phil Sutter) [1353311]
  - set: prevent memleak in nftnl_jansson_parse_set_info() (Phil Sutter) [1353311]


author: Petr Pisar <ppisar@redhat.com> - 1.2.15-14
changelog:
  - Do not harness backing store by default. Export SDL_VIDEO_X11_BACKINGSTORE
    environment variable to enable it.
  - Resolves: rhbz#1245417


author: Tomas Hozza <thozza@redhat.com> - 0.17-49
changelog:
  - Compile finger with Full RELRO
  - Explicitly use gcc
  - Use only RPM_OPT_FLAGS and RPM_LD_FLAGS
  - Add systemd as BuildRequires because of unitdir macro


author: Hans de Goede <hdegoede@redhat.com> - 1.0.12-4
changelog:
  - Fix the crtc not being turned off, causing the dgpu to not suspend,
    after using a dgpu attached output


author: Lyude Paul <lyude@redhat.com> 1.0.13-2
changelog:
  - nouveau-1.0.13-fix-pageflipping-with-atomic.patch:
    Fix broken pageflipping with RHEL 7.4 DRM backport kernel (#1428214)


author: Petr Oros <poros@redhat.com> - 2.1-16.1
changelog:
  - Fix issue with hot microcode cpu reload.
  - Move dracut call into posttrans phase.
  - Resolves: #1402512


author: Carlos O'Donell <carlos@redhat.com> - 2.17-190
changelog:
  - Add transparent lock elision for default POSIX mutexes on
    Intel hardware with support for Intel TSX (#841653).
  - Update dynamic loader trampoline for Intel Skylake server (#1421155).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-191
changelog:
  - Add transparent lock elision for default POSIX mutexes on
    IBM POWER hardware with support for IBM POWER HTM (#731835).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-192
changelog:
  - Exclude lock elision support for older Intel hardware with
    Intel TSX that has hardware errata (#841653).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-196.2
changelog:
  - Update HWCAP bits for IBM POWER9 DD2.1 (#1515114)
  - Improve memcpy performance for POWER9 DD2.1 (#1516402)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-16
changelog:
  - release 1.3.3.1-16
  - Resolves: bug 1212894 - CVE-2015-1854 389ds-base: access control bypass with modrdn


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-17
changelog:
  - release 1.3.3.1-17
  - Resolves: bug 1230038 - idm/ipa 389-ds-base entry cache converges to 500 KB in dblayer_is_cachesize_sane (DS 48190)
  - Resolves: bug 1230037 - async simple paged results issue (DS 48146, DS 48192)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-18
changelog:
  - release 1.3.3.1-18
  - Resolves: bug 1232100 - CVE-2015-3230 389-ds-base: nsSSL3Ciphers preference not enforced server side (DS 48194)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-20
changelog:
  - release 1.3.3.1-20
  - Resolves: bug 1243718 - Winsync fails when AD users have multiple spaces (two)inside the value of the rdn attribute (DS 48223)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-21
changelog:
  - release 1.3.3.1-21
  - Resolves: bug 1258318 - Deadlock with retrochangelog, memberof plugin (DS 47931)
  - Resolves: bug 1259466 - Enhance ACIs to have more control over MODRDN operations (DS 47553)
  - Resolves: bug 1259999 - Some filters in RHDS10 are not working fine. (DS 48265)
  - Resolves: bug 1260000 - handling of "No original_tombstone for changenumber" errors (DS 47912)
  - Resolves: bug 1260001 - cleanallruv should completely clean changelog (DS 48208)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-22
changelog:
  - release 1.3.3.1-22
  - Resolves: bug 1262363 - In MMR, double free coould occur under some special condition (DS 48226)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-23
changelog:
  - release 1.3.3.1-23
  - Resolves: bug 1262363 - In MMR, double free coould occur under some special condition (DS 48226)


author: John Kacur <jkacur@redhat.com> - 2.2.1-2
changelog:
  - Various fixes for problems discovered by rpmlint
  - Update the address of FSF in various files
  - Install documentation and non-script python files at mode 644


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-13
changelog:
  - Release 1.3.5.10-13
  - Resolves: bug 1402030 - Non tombstone entry which dn starting with "nsuniqueid=...," cannot be deleted (DS 48133)
  - Resolves: bug 1402325 - do not treat missing csn as fatal (DS 49020)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-15
changelog:
  - Release 1.3.5.10-15
  - Resolves: bug 1402325 - do not treat missing csn as fatal (DS 48964)
  - Resolves: bug 1410080 - incompatible nsEncryptionConfig object definition prevents RHEL 7->6 schema replication (DS 49074)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-16
changelog:
  - Release 1.3.5.10-16
  - Resolves: bug 1414677 - (un)register/migration/remove may fail if there is no suffix (DS 49016)
  - Resolves: bug 1414678 - deadlock on cos cache rebuild (DS 49079)
  - Resolves: bug 1414679 - Release 1.3.5 may allow expired accounts access to systems (DS 49080, DS 49082)
  - Resolves: bug 1416368 - Aborted operation can leave RUV in incorrect state (DS 49008)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-17
changelog:
  - Release 1.3.5.10-17
  - Resolves: bug 1414677 - (un)register/migration/remove may fail if there is no suffix (DS 49016)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.5.10-19
changelog:
  - Release 1.3.5.10-19
  - Resolves: bug 1429495 - ns-slapd dies under heavy load 
  - Resolves: bug 1429498 - A filtered nsrole that specifies an empty nsrole in its nsRoleFilter will result in a segfault


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.5.10-20
changelog:
  - Bump version to 1.3.5.10-20
  - Resolves: bug 1437005 - CVE-2017-2668 389-ds-base: Remote crash via crafted LDAP messages


author: Richard W.M. Jones <rjones@redhat.com> - 0.5-6
changelog:
  - Completely disable Xen.  APIs seem to have changed incompatibly.
  - Add commits from upstream since 0.5.
  - Remove pagerate.pl when building on RHEL.
  - Modernize the spec file.


author: Richard W.M. Jones <rjones@redhat.com> - 0.5-11
changelog:
  - Output of 'rpm -qi' has changed, so the VirtualizationVendor metric
    was not working.
    resolves: rhbz#1085848


author: Thomas Woerner <twoerner@redhat.com> 2.3.3-4
changelog:
  - fixed Label draws Xft text over border of its parent (rhbz#584300#c3)
    (MotifZone bug #1521 refixed)


author: Thomas Woerner <twoerner@redhat.com> 2.3.3-5
changelog:
  - dropped file requires for /usr/share/X11/XKeysymDB, not needed and not 
    available anymore
  - added flex-static build requirement, because of flex package split


author: Thomas Woerner <twoerner@redhat.com> 2.3.4-1
changelog:
  - new version 2.3.4 with LGPL license
  - fixed some rpmlint warnings
  - new sub package for static libraries
  - added /etc/X11/mwm directory
  - removed defattrs


author: Thomas Woerner <twoerner@redhat.com> 2.3.4-2
changelog:
  - fixed requirements according to review (RHBZ#870049)
  - flex-static has been renamed to flex-devel with Fedora-18 and RHEL-7


author: Milan Crha <mcrha@redhat.com> - 3.12.10-5
changelog:
  - Add patch for RH bug #1366206 (Free/Busy Information returns wrong time)
  - Add patch for RH bug #1367455 (No contacts are displayed until search is started)


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-19
changelog:
  - Prevent TLS 1.2 Transcript Collision attacks against MD5 in key exchange protocol
  - Resolves: Bug 1289883


author: Doug Ledford <dledford@redhat.com> - 1.3.11-1
changelog:
  - Update to latest upstream release (dependency for another package)
  - Enable valgrind in build
  - Related: bz1092538


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-862.9.1.el7]
changelog:
  - [iscsi-target] Fix iscsi_np reset hung task during parallel delete (Maurizio Lombardi) [1583593 1579217]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.10.1.el7]
changelog:
  - [x86] add _TIF_UPROBE to _TIF_DO_NOTIFY_MASK (Oleg Nesterov) [1595155 1579521]
  - [x86] spec_ctrl: Always clear SPEC_CTRL MSRs when disabling IBRS (Radomir Vrbovsky) [1586150 1574730]
  - [sound] alsa: hda/realtek - Add headset mode support for Dell laptop (Jaroslav Kysela) [1588946 1528587]
  - [sound] alsa: hda/realtek - Support headset mode for ALC215/ALC285/ALC289 (Jaroslav Kysela) [1593586 1535427]
  - [mm] compaction: release zone irqlock in isolate_freepages_block (Andrea Arcangeli) [1596283 1582793]
  - [mm] compaction: change the timing to check to drop the spinlock (Andrea Arcangeli) [1596283 1582793]
  - [fs] dcache.c: add cond_resched() in shrink_dentry_list() (Aaron Tomlin) [1596184 1584693]
  - [misc] vmware balloon: Treat init like reset (Cathy Avery) [1595601 1540110]
  - [netdrv] qede: Fix ref-cnt usage count (Chad Dupuis) [1594700 1574847]
  - [x86] kvm: fix LAPIC timer drift when guest uses periodic mode ("Dr. David Alan Gilbert") [1594292 1584775]
  - [x86] kvm: remove APIC Timer periodic/oneshot spikes ("Dr. David Alan Gilbert") [1594292 1584775]
  - [netdrv] mlx4_en: Increase number of default RX rings (Erez Alfasi) [1594127 1520295]
  - [netdrv] mlx4_en: Limit the number of RX rings (Erez Alfasi) [1594127 1520295]
  - [netdrv] mlx4_en: Limit the number of TX rings (Erez Alfasi) [1594127 1520295]
  - [fs] ceph: don't set read_ahead_kb to 0 by default (Ilya Dryomov) [1590825 1579539]
  - [scsi] qla2xxx: Remove stale debug value for login_retry flag (Himanshu Madhani) [1588937 1578880]
  - [x86] topology: Update the 'cpu cores' field in /proc/cpuinfo correctly across CPU hotplug operations (Prarit Bhargava) [1588563 1582023]
  - [acpi] osi: Add OEM _OSI strings to disable NVidia RTD3 (Jaroslav Kysela) [1584685 1581391]
  - [hv] vmbus: Fix a rescind issue (Eduardo Otubo) [1582124 1518498]
  - [linux] libata: enable host-wide tags (Ewan Milne) [1581728 1491014]
  - [ata] libata: remove ATA_FLAG_LOWTAG (Ewan Milne) [1581728 1491014]
  - [ata] Add a new flag to destinguish sas controller (Ewan Milne) [1581728 1491014]
  - [ata] libata: make sata_sil24 use fifo tag allocator (Ewan Milne) [1581728 1491014]
  - [ata] libata: move sas ata tag allocation to libata-scsi.c (Ewan Milne) [1581728 1491014]
  - [ata] libata: use blk taging (Ewan Milne) [1581728 1491014]
  - [nvme] rdma: Use mr pool (David Milburn) [1581347 1547273]
  - [nvme] rdma: Check remotely invalidated rkey matches our expected rkey (David Milburn) [1581347 1547273]
  - [nvme] rdma: wait for local invalidation before completing a request (David Milburn) [1581347 1547273]
  - [nvme] rdma: don't complete requests before a send work request has completed (David Milburn) [1581347 1547273]
  - [nvme] rdma: don't suppress send completions (David Milburn) [1581347 1547273]
  - [x86] kvm: Fix loss of pending INIT due to race (Radim Krcmar) [1580467 1569473]
  - [mm] mempolicy: fix use after free when calling get_mempolicy (Augusto Caringi) [1576759 1576755] {CVE-2018-10675}
  - [sound] alsa: seq: Fix racy pool initializations (Jaroslav Kysela) [1550171 1593586 1550169 1535427] {CVE-2018-7566}
  - [crypto] algif_skcipher: Load TX SG list after waiting (Bruno Eduardo de Oliveira Meneguele) [1541870 1541875] {CVE-2017-13215}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.11.1.el7]
changelog:
  - [tcmu] allow userspace to reset ring (Xiubo Li) [1599669 1562587]
  - [tcmu] remove commands_lock (Xiubo Li) [1599669 1562587]
  - [tcmu] move expired command completion to unmap thread (Xiubo Li) [1599669 1562587]
  - [tcmu] add cmd timeout handling wq (Xiubo Li) [1599669 1562587]
  - [tcmu] don't block submitting context for block waits (Xiubo Li) [1599669 1562587]
  - [tcmu] fix double se_cmd completion (Xiubo Li) [1599669 1562587]
  - [tcmu] replace spin lock with mutex (Xiubo Li) [1599669 1562587]
  - [target] add SAM_STAT_BUSY sense reason (Xiubo Li) [1599669 1562587]
  - [target] core: add device action configfs files (Xiubo Li) [1599669 1562587]
  - [target] Avoid mappedlun symlink creation during lun shutdown (Xiubo Li) [1599656 1585081]
  - [spectre] update Spectre v1 mitigation string (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [spectre] fix hiddev nospec issues (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] syscall: clarify clobbered registers in entry code (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [powerpc] add missing barrier_nospec() in __get_user64_nocheck() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [spectre] fix gadgets found by smatch scanner (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [alsa] rme9652: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [alsa] hdspm: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [alsa] asihpi: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [alsa] opl3: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [alsa] hda: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [alsa] seq: oss: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [alsa] seq: oss: Fix unbalanced use lock for synth MIDI device (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [net] atm: Fix potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [kernel] time: Protect posix clock array access against speculation (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [kernel] sys.c: fix potential Spectre v1 issue (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [sched] autogroup: Fix possible Spectre-v1 indexing for sched_prio_to_weight[] (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [perf] core: Fix possible Spectre-v1 indexing for ->aux_pages[] (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [sysvipc] sem: mitigate semnum index against spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [alsa] control: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [usbip] vhci_sysfs: fix potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [media] dvb_ca_en50221: prevent using slot_info for Spectre attacs (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [media] dvb_ca_en50221: sanity check slot number from userspace (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [atm] zatm: Fix potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] kvm: Update spectre-v1 mitigation (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] kvm: Add memory barrier on vmcs field lookup (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] perf/msr: Fix possible Spectre-v1 indexing in the MSR driver (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] perf: Fix possible Spectre-v1 indexing for x86_pmu::event_map() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] perf: Fix possible Spectre-v1 indexing for hw_perf_event cache_* (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [net] nl80211: Sanitize array index in parse_txq_params (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [include] vfs, fdtable: Prevent bounds-check bypass via speculative execution (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] syscall: Sanitize syscall table de-references under speculation (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [powerpc] Use barrier_nospec in copy_from_user() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [include] nospec: Introduce barrier_nospec for other arches (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] Introduce barrier_nospec (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] spectre_v1: Disable compiler optimizations over array_index_mask_nospec() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] Implement array_index_mask_nospec (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [documentation] Document array_index_nospec (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [include] nospec: Include <asm/barrier.h> dependency (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [include] nospec: Allow index argument to have const-qualified type (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [include] nospec: Kill array_index_nospec_mask_check() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [include] nospec: Move array_index_nospec() parameter checking into separate macro (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [include] array_index_nospec: Sanitize speculative array de-references (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] get_user: Use pointer masking to limit speculation (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] Introduce __uaccess_begin_nospec() and uaccess_try_nospec (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] usercopy: Replace open coded stac/clac with __uaccess_{begin, end} (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] reorganize SMAP handling in user space accesses (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] uaccess: Tell the compiler that uaccess is unlikely to fault (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] uaccess: fix sparse errors (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-862.12.1.el7]
changelog:
  - [fs] CIFS: Fix NULL pointer deref on SMB2_tcon() failure (Leif Sahlberg) [1609159 1591092]
  - [net] multicast: do not restore deleted record source filter mode to new one (Hangbin Liu) [1610380 1586321]
  - [net] multicast: remove useless parameter for group add (Hangbin Liu) [1610380 1586321]
  - [net] ipv6/mcast: init as INCLUDE when join SSM INCLUDE group (Hangbin Liu) [1610380 1586321]
  - [net] ipv4/igmp: init group mode as INCLUDE when join source group (Hangbin Liu) [1610380 1586321]
  - [net] ipv6: mcast: fix unsolicited report interval after receiving querys (Hangbin Liu) [1610380 1586321]
  - [net] ipv6: refactor ipv6_dev_mc_inc() (Hangbin Liu) [1610380 1586321]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.13.1.el7]
changelog:
  - [infiniband] ib/ipoib: Fix race condition in neigh creation (Don Dutile) [1616164 1520300]
  - [gpu] qxl: hook monitors_config updates into crtc, not encoder (Gerd Hoffmann) [1614349 1544322]
  - [gpu] qxl: move qxl_send_monitors_config() (Gerd Hoffmann) [1614349 1544322]
  - [gpu] qxl: remove qxl_io_log() (Gerd Hoffmann) [1614349 1544322]
  - [kernel] locking: Introduce smp_mb__after_spinlock() (Steve Best) [1613814 1496574]
  - [scsi] ibmvfc: Avoid unnecessary port relogin (Steve Best) [1613202 1605080]
  - [powerpc] stf-barrier: update (rfi_)enabled_flush_types as in upstream (Gustavo Duarte) [1612353 1585297]
  - [powerpc] stf-barrier: update debugfs as in upstream (Gustavo Duarte) [1612353 1585297]
  - [powerpc] stf-barrier: update handle_ssbd() as in upstream (Gustavo Duarte) [1612353 1585297]
  - [powerpc] stf-barrier: update stf_barrier_enable() as in upstream (Gustavo Duarte) [1612353 1585297]
  - [powerpc] stf-barrier: add cpu_show_spec_store_bypass() as in upstream (Gustavo Duarte) [1612353 1585297]
  - [powerpc] stf-barrier: add comment as in upstream (Gustavo Duarte) [1612353 1585297]
  - [powerpc] stf-barrier: move code from setup_64.c to security.c as in upstream (Gustavo Duarte) [1612353 1585297]
  - [powerpc] stf-barrier: move code from setup.h to security_features.h as in upstream (Gustavo Duarte) [1612353 1585297]
  - [powerpc] stf-barrier: update fallback routine as in upstream (Gustavo Duarte) [1612353 1585297]
  - [powerpc] stf-barrier: update entry barrier slot as in upstream (Gustavo Duarte) [1612353 1585297]
  - [nvmet-fc] move tech preview warning to nvmet_fc_register_targetport call (Ewan Milne) [1610381 1608947]
  - [nvme-fc] move tech preview warning to nvme_fc_register_localport call (Ewan Milne) [1610381 1608947]
  - [block] blk-throttle: check stats_cpu before reading it from sysfs (Ming Lei) [1608228 1567748]
  - [powerpc] signals: Discard transaction state from signal frames (Steve Best) [1608227 1586153]
  - [ipc] shm.c: add split function to shm_vm_ops (Desnes Augusto Nunes do Rosario) [1608225 1586152]
  - [scsi] lpfc: Fix port initialization failure (Dick Kennedy) [1605235 1584377]
  - [vmbus] fix the missed signaling in hv_signal_on_read() (Vitaly Kuznetsov) [1605089 1591976]
  - [infiniband] ib/ipoib: Fix for potential no-carrier state (Donald Dutile) [1601935 1548474]
  - [vmwgfx] refuse to hibernate if we have any resources. (v2) (Dave Airlie) [1601516 1595136]
  - [netdrv] sfc: stop the TX queue before pushing new buffers (Xin Long) [1601353 1445576]
  - [lib] rhashtable: Fix rhlist duplicates insertion (Xin Long) [1601009 1559106]
  - [kernel] hrtimer: Allow concurrent hrtimer_start() for self restarting timers (Oleksandr Natalenko) [1600911 1574387]
  - [iommu] amd: Add NULL sanity check for struct irq_2_irte.ir_data (Suravee Suthikulpanit) [1600661 1542697]
  - [hid] wacom: Correct logical maximum Y for 2nd-gen Intuos Pro large (Benjamin Tissoires) [1600660 1591499]
  - [md] avoid NULL dereference to queue pointer (Ming Lei) [1600056 1581845]
  - [scsi] qla2xxx: Fix NULL pointer access for fcport structure (Himanshu Madhani) [1597546 1547714]
  - [scsi] csiostor: Add a soft dep on cxgb4 driver (Arjun Vynipadath) [1597529 1584003]
  - [mm] initialize pages on demand during boot (Masayoshi Mizuma) [1588366 1496330]
  - [mm] split deferred_init_range into initializing and freeing parts (Masayoshi Mizuma) [1588366 1496330]
  - [kernel] cpu/hotplug: Fix 'online' sysfs entry with 'nosmt' (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [net] ipv6: fix nospec-related regression in ipv6_addr_prefix() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3693}
  - [net] tcp: add tcp_ooo_try_coalesce() helper (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: call tcp_drop() from tcp_data_queue_ofo() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: detect malicious patterns in tcp_collapse_ofo_queue() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: avoid collapses in tcp_prune_queue() if possible (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: free batches of packets in tcp_prune_ofo_queue() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] add rb_to_skb() and other rb tree helpers (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: fix a stale ooo_last_skb after a replace (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: use an RB tree for ooo receive queue (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: refine tcp_prune_ofo_queue() to not drop all packets (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: increment sk_drops for dropped rx packets (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [x86] x86/syscall: Fix regression when using the last syscall (pkey_free) (Lauro Ramos Venancio) [1589033 1589035] {CVE-2018-3693}
  - [kernel] cpu: hotplug: detect SMT disabled by BIOS (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [documentation] l1tf: Fix typos (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Remove extra newline in vmentry_l1d_flush sysfs file (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Initialize the vmx_l1d_flush_pages' content (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] speculation: l1tf: Unbreak !__HAVE_ARCH_PFN_MODIFY_ALLOWED architectures (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [documentation] Add section about CPU vulnerabilities (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] bugs, kvm: introduce boot-time control of L1TF mitigations (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu: hotplug: Set CPU_SMT_NOT_SUPPORTED early (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu: hotplug: Expose SMT control init function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Allow runtime control of L1D flush (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Serialize L1D flush parameter setter (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Add static key for flush always (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Move l1tf setup function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Handle EPT disabled state proper (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Drop L1TF MSR list approach (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] litf: Introduce vmx status variable (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] bugs: Make cpu_show_common() static (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] bugs: Concentrate bug reporting into a separate function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu: hotplug: Online siblings when SMT control is turned on (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Use MSR save list for IA32_FLUSH_CMD if required (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Separate the VMX AUTOLOAD guest/host number accounting (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Add find_msr() helper function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Split the VMX MSR LOAD structures to have an host/guest numbers (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities, part 3 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu: hotplug: Boot HT siblings at least once, part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: fix typo in l1tf mitigation string (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities, part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Boot HT siblings at least once (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - Revert "x86/apic: Ignore secondary threads if nosmt=force" (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect PAE swap entries against L1TF (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: Extend 64bit swap file size limit (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu/AMD: Remove the pointless detect_ht() call (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] bugs: Move the l1tf function and define pr_fmt properly (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT, part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] topology: Provide topology_smt_supported() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread(), part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] apic: Ignore secondary threads if nosmt=force (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu/AMD: Evaluate smp_num_siblings early (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] CPU/AMD: Do not check CPUID max ext level before parsing SMP info (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu/intel: Evaluate smp_num_siblings early (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu/topology: Provide detect_extended_topology_early() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu/common: Provide detect_ht_early() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu: Remove the pointless CPU printout (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Split do_cpu_down() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] CPU: Modify detect_extended_topology() to return result (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: fix build for CONFIG_NUMA_BALANCING=n (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: sync with latest L1TF patches (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_NUMA PTEs and PMDs against speculation (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [mm] l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Report if too much memory for L1TF workaround (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Limit swap file size to MAX_PA/2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Add sysfs reporting for l1tf (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Make sure the first page is always reserved (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Protect PROT_NONE PTEs against speculation (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Protect swap entries against L1TF (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Increase 32bit PAE __PHYSICAL_PAGE_MASK (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] mm: Fix swap entry comment and macro (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] spec_ctrl: sync with upstream cpu_set_bug_bits() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86]  add support for L1D flush MSR (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.14.1.el7]
changelog:
  - [x86] microcode: Allow late microcode loading with SMT disabled (Josh Poimboeuf) [1619622 1614515]
  - [infiniband] core: Fix nospec regression (Josh Poimboeuf) [1619624 1616346]
  - [x86] microcode/amd: Do not load when running on a hypervisor (Vitaly Kuznetsov) [1618390 1607899]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-862.14.2.el7]
changelog:
  - [uio] fix possible circular locking dependency (Xiubo Li) [1608677 1560418]
  - [scsi] tcmu: Don't pass KERN_ERR to pr_err (Xiubo Li) [1608677 1560418]
  - [scsi] tcmu: add module wide block/reset_netlink support (Xiubo Li) [1608677 1560418]
  - [scsi] tcmu: simplify nl interface (Xiubo Li) [1608677 1560418]
  - [scsi] tcmu: track nl commands (Xiubo Li) [1608677 1560418]
  - [scsi] tcmu: delete unused __wait (Xiubo Li) [1608677 1560418]
  - [uio] fix crash after the device is unregistered (Xiubo Li) [1608677 1560418]
  - [uio] change to use the mutex lock instead of the spin lock (Xiubo Li) [1608677 1560418]
  - [uio] Prevent device destruction while fds are open (Xiubo Li) [1608677 1560418]
  - [uio] Reduce return paths from uio_write() (Xiubo Li) [1608677 1560418]
  - [uio] fix incorrect memory leak cleanup (Xiubo Li) [1608677 1560418]
  - [uio] add missing error codes (Xiubo Li) [1608677 1560418]
  - [uio] fix false positive __might_sleep warning splat (Xiubo Li) [1608677 1560418]
  - [uio] Destroy uio_idr on module exit (Xiubo Li) [1608677 1560418]
  - [uio] don't free irq that was not requested (Xiubo Li) [1608677 1560418]
  - [uio] support memory sizes larger than 32 bits (Xiubo Li) [1608677 1560418]
  - [uio] we cannot mmap unaligned page contents (Xiubo Li) [1608677 1560418]
  - [uio] Pass pointers to virt_to_page(), not integers (Xiubo Li) [1608677 1560418]
  - [uio] fix memory leak (Xiubo Li) [1608677 1560418]
  - [uio] Request/free irq separate from dev lifecycle (Xiubo Li) [1608677 1560418]
  - [uio] Simplify uio error path by using devres functions (Xiubo Li) [1608677 1560418]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.14.3.el7]
changelog:
  - [fs] exec: Limit arg stack to at most 75 of _STK_LIM (Yauheni Kaliuta) [1625980 1625991] {CVE-2018-14634}
  - [fs] exec: account for argv/envp pointers (Yauheni Kaliuta) [1625980 1625991] {CVE-2018-14634}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.14.4.el7]
changelog:
  - [scsi] Revert: lpfc: Fix port initialization failure (Radomir Vrbovsky) [1605235 1584377]
  - [scsi] Revert: qla2xxx: Fix NULL pointer access for fcport structure (Radomir Vrbovsky) [1597546 1547714]


author: Akemi Yagi <toracat@centos.org> [3.10.0-862.14.4.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Signed with the new secureboot key (as of kernel-862.14.4.el7)
  - Roll in i686 mods
     addmissing.patch  [puias]
     cpufreq.patch  [puias]
     i386-audit-stop-scri-stack-frame.patch  [puias]
     removejiffies.patch  [puias]
     undorhirqstat.patch  [puias]
     morefixes.patch      [puias+bug#12412]
     upstream-32bit-fixes-7_5.patch [puias+bug#12412]
     clear-32bit-Werror-warnings.patch  [bug#12412]
     qspinlock_types-32bit.patch   [ay]
     i686-7-4.patch [T.Kabe, bug#13890]
     firmware-efi-32bit.patch [ay]
     patch-spec_ctrl_i686.patch [T.Kabe bug#14353]
     686 mods for 7.5 [T.Kabe bug#14703]
     more 686 mods for 7.5 (-862.3.2) [pgreco]
     more 686 mods for 7.5 (-862.11.6) [pgreco, bug#15174]
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Enabled spidev [bug#9955]
  - Add a patch [bug#10447]
  - Enable ATM drivers [bug#10845]
  - Add 9pfs config options [bug#10849]
  - Enable VFIO_PCI_VGA [bug#12435]
  - Rremove initramfs-xxxkdump.img upon kernel removal [bug#12703]
  - Add a patch from [bug#12841]
  - Add a patch from [bug#12818]
  - Enabled RT2800USB_RT3573 [bug#13162]
  - Enable LDM_PARTITION [bug#13526]
  - Add a patch to fix misleading warning [bug#13990]
  - Add BuildRequires: openssl-devel to the with_perf section [bug#13990]
  - Add a patch to fix build errors for EL7.5 [bug#14425]
  - Added a patch to fix alsa potentail crash [bug14779]
  - Apply a patch to fix excessive warnings [bug#14413]
  - Apply a patch to fix mempolicy issue [bug#15115]
  - Add a patch to fix race in virtio_balloon [bug#15216]
  - Add shim requirement to the spec file for x86_64


author: Paul Wouters <pwouters@redhat.com> - 1.4.2-8
changelog:
  - Resolves: rhbz#CVE-2015-6496
  - Fold in upstream patches since 1.4.2 release up to git 900d7e8
  - Fold in upstream patch set of 2015-08-18 for coverity issues


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-10
changelog:
  - Fixes sysinfo - devices with name longer than 20 chars are mistaken for partitions
  - Resolves: rhbz#1169349


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-24
changelog:
  - Block info query: Add check for transient domain (rhbz#1065531)
  - Fix minor typos in messages and docs (rhbz#1045643)
  - LXC: Free variable vroot in lxcDomainDetachDeviceHostdevUSBLive() (rhbz#1045643)
  - LXC: free dst before lxcDomainAttachDeviceDiskLive returns (rhbz#1045643)
  - maint: fix comment typos (rhbz#1045643)
  - storage: avoid short reads while chasing backing chain (rhbz#1045643)
  - Don't block use of USB with containers (rhbz#1045643)
  - Fix path used for USB device attach with LXC (rhbz#1045643)
  - Record hotplugged USB device in LXC live guest config (rhbz#1045643)
  - Fix reset of cgroup when detaching USB device from LXC guests (rhbz#1045643)
  - Disks are always block devices, never character devices (rhbz#1045643)
  - Move check for cgroup devices ACL upfront in LXC hotplug (rhbz#1045643)
  - Add virFileMakeParentPath helper function (rhbz#1045643)
  - Add helper for running code in separate namespaces (rhbz#1045643)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC shutdown/reboot code (CVE-2013-6456)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC disk hotplug (CVE-2013-6456)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC USB hotplug (CVE-2013-6456)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC block hostdev hotplug (CVE-2013-6456)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC chardev hostdev hotplug (CVE-2013-6456)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC hotunplug code (CVE-2013-6456)
  - Ignore additional fields in iscsiadm output (rhbz#1067173)
  - qemuBuildNicDevStr: Set vectors= on Multiqueue (rhbz#1066209)
  - Don't depend on syslog.service (rhbz#1032695)
  - libvirt-guests: Run only after libvirtd (rhbz#1032695)
  - virSystemdCreateMachine: Set dependencies for slices (rhbz#1032695)
  - libvirt-guests: Wait for libvirtd to initialize (rhbz#1032695)
  - virNetServerRun: Notify systemd that we're accepting clients (rhbz#1032695)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-25
changelog:
  - maint: fix comma style issues: conf (rhbz#1032370)
  - Allow <source> for type=block to have no dev (rhbz#1032370)
  - Allow LUN type disks to have no source (rhbz#1032370)
  - virsh-volume: Unify strigification of volume type (rhbz#1032370)
  - conf: Refactor virDomainDiskSourcePoolDefParse (rhbz#1032370)
  - conf: Split out code to parse the source of a disk definition (rhbz#1032370)
  - conf: Rename virDomainDiskHostDefFree to virDomainDiskHostDefClear (rhbz#1032370)
  - conf: Refactor virDomainDiskSourceDefParse (rhbz#1032370)
  - storage: fix RNG validation of gluster via netfs (rhbz#1032370)
  - maint: fix comment typos. (rhbz#1032370)
  - storage: use valid XML for awkward volume names (rhbz#1032370)
  - build: Don't fail on '&lt; ' or '&gt; ' with old xmllint (rhbz#1032370)
  - storage: allow interleave in volume XML (rhbz#1032370)
  - storage: expose volume meta-type in XML (rhbz#1032370)
  - storage: initial support for linking with libgfapi (rhbz#1032370)
  - storage: document existing pools (rhbz#1032370)
  - storage: document gluster pool (rhbz#1032370)
  - storage: implement rudimentary glusterfs pool refresh (rhbz#1032370)
  - storage: add network-dir as new storage volume type (rhbz#1032370)
  - storage: improve directory support in gluster pool (rhbz#1032370)
  - storage: improve allocation stats reported on gluster files (rhbz#1032370)
  - storage: improve handling of symlinks in gluster (rhbz#1032370)
  - storage: probe qcow2 volumes in gluster pool (rhbz#1032370)
  - storage: fix typo in previous patch (rhbz#1032370)
  - conf: Export virStorageVolType enum helper functions (rhbz#1032370)
  - test: Implement fake storage pool driver in qemuxml2argv test (rhbz#1032370)
  - storage: reduce number of stat calls (rhbz#1032370)
  - storage: use simpler 'char *' (rhbz#1032370)
  - storage: refactor backing chain division of labor (rhbz#1032370)
  - storage: always probe type with buffer (rhbz#1032370)
  - storage: don't read storage volumes in nonblock mode (rhbz#1032370)
  - storage: skip selinux cleanup when fd not available (rhbz#1032370)
  - storage: use correct type for array count (rhbz#1032370)
  - storage: allow interleave in pool XML (rhbz#1032370)
  - qemuxml2argv: Add test to verify correct usage of disk type="volume" (rhbz#1032370)
  - qemuxml2argv: Add test for disk type='volume' with iSCSI pools (rhbz#1032370)
  - tests: Fix comment for fake storage pool driver (rhbz#1032370)
  - conf: Support disk source formatting without needing a virDomainDiskDefPtr (rhbz#1032370)
  - conf: Clean up virDomainDiskSourceDefFormatInternal (rhbz#1032370)
  - conf: Split out seclabel formating code for disk source (rhbz#1032370)
  - conf: Export disk source formatter and parser (rhbz#1032370)
  - snapshot: conf: Use common parsing and formatting functions for source (rhbz#1032370)
  - snapshot: conf: Fix NULL dereference when <driver> element is empty (rhbz#1032370)
  - conf: Add functions to copy and free network disk source definitions (rhbz#1032370)
  - qemu: snapshot: Detect internal snapshots also for sheepdog and RBD (rhbz#1032370)
  - conf: Add helper do clear disk source authentication struct (rhbz#1032370)
  - qemu: snapshot: Touch up error message (rhbz#1032370)
  - qemu: snapshot: Add functions similar to disk source pool translation (rhbz#1032370)
  - qemu: Refactor qemuTranslateDiskSourcePool (rhbz#1032370)
  - qemu: Split out formatting of network disk source URI (rhbz#1032370)
  - qemu: Simplify call pattern of qemuBuildDriveURIString (rhbz#1032370)
  - qemu: Use qemuBuildNetworkDriveURI to handle http/ftp and friends (rhbz#1032370)
  - qemu: Migrate sheepdog source generation into common function (rhbz#1032370)
  - qemu: Split out NBD command generation (rhbz#1032370)
  - qemu: Unify formatting of RBD sources (rhbz#1032370)
  - qemu: Refactor disk source string formatting (rhbz#1032370)
  - qemu: Clear old translated pool source (rhbz#1032370)
  - qemu: snapshots: Declare supported and unsupported snapshot configs (rhbz#1032370)
  - domainsnapshotxml2xmltest: Clean up labels and use bool instead of int (rhbz#1032370)
  - domainsnapshotxml2xmltest: Allow for better testing of snapshots (rhbz#1032370)
  - domainsnapshotxml2xml: Move files with conflicting names (rhbz#1032370)
  - domainsnapshotxml2xmltest: Add existing files as new tests (rhbz#1032370)
  - domainsnapshotxml2xmltest: Add test case for empty driver element (rhbz#1032370)
  - qemu: Fix indentation in qemuTranslateDiskSourcePool (rhbz#1032370)
  - qemu: snapshot: Fix incorrect disk type for auto-generated disks (rhbz#1032370)
  - storage: fix omitted slash in gluster volume URI (rhbz#1032370)
  - virsh: domain: Fix undefine with storage of 'volume' disks (rhbz#1032370)
  - snapshot: schema: Split out snapshot disk driver definition (rhbz#1032370)
  - storage: Add gluster pool filter and fix virsh pool listing (rhbz#1032370)
  - storage: fix bogus target in gluster volume xml (rhbz#1032370)
  - storage: Improve error message when a storage backend is missing (rhbz#1032370)
  - storage: Break long lines and clean up spaces in storage backend header (rhbz#1032370)
  - storage: Support deletion of volumes on gluster pools (rhbz#1032370)
  - qemu: snapshot: Avoid libvirtd crash when qemu crashes while snapshotting (rhbz#1032370)
  - qemu: snapshot: Forbid snapshots when backing is a scsi passthrough disk (rhbz#1034993)
  - qemu: Avoid crash in qemuDiskGetActualType (rhbz#1032370)
  - snapshot: Add support for specifying snapshot disk backing type (rhbz#1032370)
  - conf: Move qemuDiskGetActualType to virDomainDiskGetActualType (rhbz#1032370)
  - conf: Move qemuSnapshotDiskGetActualType to virDomainSnapshotDiskGetActualType (rhbz#1032370)
  - storage: Add file storage APIs in the default storage driver (rhbz#1032370)
  - storage: add file functions for local and block files (rhbz#1032370)
  - storage: Add storage file backends for gluster (rhbz#1032370)
  - qemu: Switch snapshot deletion to the new API functions (rhbz#1032370)
  - qemu: snapshot: Use new APIs to detect presence of existing storage files (rhbz#1032370)
  - qemu: snapshot: Add support for external active snapshots on gluster (rhbz#1032370)
  - storage: Fix build with older compilers afeter gluster snapshot series (rhbz#1032370)
  - storage: gluster: Don't leak private data when storage file init fails (rhbz#1032370)
  - spec: Use correct versions of libgfapi in RHEL builds (rhbz#1032370)
  - spec: Fix braces around macros (rhbz#1032370)
  - build: use --with-systemd-daemon as configure option (rhbz#1032695)
  - spec: require device-mapper-devel for storage-disk (rhbz#1032695)
  - spec: make systemd_daemon usage configurable (rhbz#1032695)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-26
changelog:
  - virNetDevVethCreate: Serialize callers (rhbz#1014604)
  - qemuBuildNicDevStr: Adapt to new advisory on multiqueue (rhbz#1071888)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-27
changelog:
  - spec: Let translations be properly updated (rhbz#1030368)
  - Update translation to supported languages (rhbz#1030368)
  - Add a mutex to serialize updates to firewall (rhbz#1074003)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-28
changelog:
  - qemu: Forbid "sgio" support for SCSI generic host device (rhbz#957292)
  - qemu: monitor: Fix invalid parentheses (rhbz#1075973)
  - qemu: Introduce qemuDomainDefCheckABIStability (rhbz#1076503)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-29
changelog:
  - nwfilter: Increase buffer size for libpcap (rhbz#1078347)
  - nwfilter: Display pcap's error message when pcap setup fails (rhbz#1078347)
  - nwfilter: Fix double free of pointer (rhbz#1071181)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-29.el7_0.1
changelog:
  - LSN-2014-0003: Don't expand entities when parsing XML (CVE-2014-0179)
  - virNetClientSetTLSSession: Restore original signal mask (rhbz#1112689)
  - Don't use AI_ADDRCONFIG when binding to wildcard addresses (rhbz#1112692)
  - qemu: Unlock the NWFilter update lock by leaving via the cleanup label (rhbz#1112690)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-29.el7_0.2
changelog:
  - qemu: split out cpuset.mems setting (rhbz#1135871)
  - qemu: leave restricting cpuset.mems after initialization (rhbz#1135871)
  - qemu: blkiotune: Use correct definition when looking up disk (CVE-2014-3633)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-29.el7_0.4
changelog:
  - qemu: blockcopy: Don't remove existing disk mirror info (rhbz#1149078)
  - qemu: copy: Accept 'format' parameter when copying to a non-existing img (rhbz#1149078)
  - qemu: reject rather than hang on blockcommit of active layer (rhbz#1150379)
  - CVE-2014-7823: dumpxml: security hole with migratable flag (CVE-2014-7823)
  - Fix crash when saving a domain with type none dac label (rhbz#1171124)


author: Ray Strode <rstrode@redhat.com> - 3.14.3-17
changelog:
  - Fix close after save functionality when closing window
    with unsaved documents
    Resolves: #1247999


author: Jaromir Capik <jcapik@redhat.com> - 1.20.6-29
changelog:
  - Removing OPTFLAGS
  - Introducing full RELRO
  - Missing header dir in Makefile.in / depend
  - Fixing UsrMove for i686 (mv -f says 'directory not empty')


author: Stephan Bergmann <sbergman@redhat.com> - 1:5.3.6.1-17
changelog:
  - Resolves: rhbz#1545262 Workaround for spurious ppc64le automated testing crash
  - Resolves: rhbz#1610692 silence console warnings from print dialog


author: Milan Crha <mcrha@redhat.com> - 3.8.5-22
changelog:
  - Add patch for RH bug #1070764 (Auto-mark as seen sometimes doesn't work)
  - Add patch for RH bug #1084414 (Fix various memory leaks)
  - Add patch for RH bug #1090629 (Filtered message not opened in a separate window)
  - Add patch for RH bug #1091882 (Labels GSettings busy loop)


author: Milan Crha <mcrha@redhat.com> - 3.8.5-25
changelog:
  - Add patch for RH bug #1098358 (Run mail formatter in the main thread)
  - Add patch for RH bug #1113177 (Reply with selection can lose white-spaces)


author: Milan Crha <mcrha@redhat.com> - 3.8.5-26
changelog:
  - Add patch for RH bug #1123136 (Crash when selecting mail header to show)
  - Add patch for RH bug #1118996 (Crash when customize mail view)
  - Add patch for RH bug #1116938 (Correct SMTP mail account editor UI update)
  - Add patch for RH bug #1110370 (Calendar view tooltip doesn't go away)
  - Add patch for RH bug #1075109 (Correct caret mode navigation to message body)
  - Add patch for RH bug #1070850 (Limit zoom value for previews)
  - Add patch for RH bug #1103823 (Crash after migration to maildir)
  - Add patch for RH bug #1033263 (Contact duplicate dialog auto expands indefinitely)
  - Add patch for RH bug #1070833 (Correct message list selection with collapsed threads)


author: Milan Crha <mcrha@redhat.com> - 3.8.5-29
changelog:
  - Add patch for RH bug #1166665 (Correct path in evolution.convert)
  - Update patch for RH bug #1070850 (Increase lower zoom limit)


author: Milan Crha <mcrha@redhat.com> - 3.8.5-31
changelog:
  - Add patch for RH bug #1002188 (Restart background processes after restore)
  - Add patch for RH bug #1170671 (Remove calendar events on its delete)


author: Matej Habrnal <mhabrnal@redhat.com> - 2.1.11-33
changelog:
  - lib: allow report SELinux denial from sealert under common user
  - mailx: stop creating dead.letter on mailx failures
  - mailx: introduce debug parameter -D
  - mailx: mail formatting: add comment right after %oneline
  - mailx: use problem report api to define an emais' content
  - lib: remove unused function make_description_bz
  - rhtsupport: attach all dump dir's element to a new case
  - rhtsupport: add pkg_vendor, reproducer and reproducible to description
  - rhtsupport: use problem report API to create description
  - lib: add Problem Format API
  - augeas: trim spaces before key value
  - rhtsupport: Discourage users from reporting in non Red Hat stuff
  - rhtsupport: Discourage users from opening one-shot crashes
  - report-gtk: Require Reproducer for RHTSupport
  - Add workflow for RHEL anonymous report
  - bugzilla: don't report private problem as comment
  - lib: move CREATE_PRIVATE_TICKET to the global configuration
  - event config: add support for 'restricted access'
  - report-gtk: offer users to create private ticket
  - bugzilla: make the event configurable
  - uploader: /etc/libreport/plugins/upload.conf as default conf file
  - dd: make function uid_in_group() public
  - uploader: add possibility to set SSH keyfiles
  - uploader: move username and password to the advanced options
  - uploader: allow empty username and password
  - curl: add possibility to configure SSH keys
  - Resolves #1289513, #1277849, #1289513, #1279453, #1258482, #1236613, #1261358, #1281312, #1309317, #1264921


author: Matej Habrnal <mhabrnal@redhat.com> - 2.1.11-36
changelog:
  - introduce 'stop_on_not_reportable' option
  - fix a double free of config at exit in reporter-rhtsupport
  - Related: #1373094, #1257159


author: Martin Kutlak <mkutlak@redhat.com> - 2.1.11-39
changelog:
  - Introduce workflow for adding data to existing case
  - Change default URL to the FAF server
  - wizard: fix 'Show log' window not displaying correctly
  - augeas: fix parsing spaces in configuration files
  - Related: #1303326, #1435256, #1463313


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-6
changelog:
  - Check the NSS certificate database directory for read permissions
    by the Apache user. (#1312583)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-8
changelog:
  - Fail start start when there are invalid Protocols defined (#1389114)
  - Handle group membership when testing NSS database filesystem
    permissions (#1395300)
  - Add OCSP cache tuning directives (#1392582) 
  - Don't share mod_nss NSS database with nss_pcache (#1382102)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-9
changelog:
  - Update nss_pcache.8 to drop directory and prefix options (#1382102)

  - Don't share mod_nss NSS database with nss_pcache (#1382102)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-12
changelog:
  - Correct URL and Source entries to point to pagure.io (#1502362)
  - Remove deprecated NSSSessionCacheTimeout from default config (#1257662)


author: Colin Walters <walters@redhat.com> - 17.0.0-12
changelog:
  - Add patch for aarch64
  - Fix for aarch64 64k pagesize. BZ#1076181 (Mark Salter <msalter@redhat.com>)
  - Resolves: #1027067


author: Jaromir Capik <jcapik@redhat.com> - 3.1.0-5
changelog:
  - Introducing man pages for binaries in the eepromer subpackage
  - Introducing -r switch in the i2cset help


author: Denys Vlasenko <dvlasenk@redhat.com> - 0.2.7-9
changelog:
  - Added commented-out "LimitNOFILE=" directive to conman.service.
  - This is systemd-esque way to change process limits for serivces.
  - Also and a comment when to use it.
  - Resolves: rhbz#1035228.


author: Bob Relyea <rrelyea@redhat.com> 0.6.2-22
changelog:
  - Don't rebuild documentation for each platform. Doing so creates unique 
  document files which are shared and conflict on multilib installations.


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-10
changelog:
  - Resolves: #1260663 crash of ipa-dnskeysync-replica component during
    ipa-restore
    - IPA Restore: allows to specify files that should be removed
  - Resolves: #1261806 Installing ipa-server package breaks httpd
    - Handle timeout error in ipa-httpd-kdcproxy
  - Resolves: #1262322 Failed to backup CS.cfg message in upgrade.
    - Server Upgrade: backup CS.cfg when dogtag is turned off


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-11
changelog:
  - Resolves: #1258965 ipa vault: set owner of vault container
    - baseldap: make subtree deletion optional in LDAPDelete
    - vault: add vault container commands
    - vault: set owner to current user on container creation
    - vault: update access control
    - vault: add permissions and administrator privilege
    - install: support KRA update
  - Resolves: #1261586 ipa config-mod addattr fails for ipauserobjectclasses
    - config: allow user/host attributes with tagging options
  - Resolves: #1262315 Unable to establish winsync replication
    - winsync: Add inetUser objectclass to the passsync sysaccount


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-12
changelog:
  - Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
    Trusts
    - winsync-migrate: Convert entity names to posix friendly strings
    - winsync-migrate: Properly handle collisions in the names of external groups
  - Resolves: #1261074 Adjust Firefox configuration to new extension signing
    policy
    - webui: use manual Firefox configuration for Firefox >= 40
  - Resolves: #1263337 IPA Restore failed with installed KRA
    - ipa-backup: Add mechanism to store empty directory structure
  - Resolves: #1264793 CVE-2015-5284 ipa: ipa-kra-install includes certificate
    and private key in world readable file [rhel-7.2]
    - install: fix KRA agent PEM file permissions
  - Resolves: #1265086 Mark IdM API Browser as experimental
    - WebUI: add API browser is experimental warning
  - Resolves: #1265277 Fix kdcproxy user creation
    - install: create kdcproxy user during server install
    - platform: add option to create home directory when adding user
    - install: fix kdcproxy user home directory
  - Resolves: #1265559 GSS failure after ipa-restore
    - destroy httpd ccache after stopping the service


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-13
changelog:
  - Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
    - Fix an integer underflow bug in libotp
  - Resolves: #1262996 ipa vault internal error on replica without KRA
    - install: always export KRA agent PEM file
    - vault: select a server with KRA for vault operations
  - Resolves: #1269777 IPA restore overwrites /etc/passwd and /etc/group files
    - do not overwrite files with local users/groups when restoring authconfig
  - Renamed patch 1011 to 0138, as it was merged upstream


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.11.1.el7]
changelog:
  - [fs] namespaces: Use task_lock and not rcu to protect nsproxy (Hannes Frederic Sowa) [1300618 1297032]
  - [fs] proc_namespace: simplify testing nsp and nsp->mnt_ns (Hannes Frederic Sowa) [1300618 1297032]
  - [net] possible use after free in dst_release (Hannes Frederic Sowa) [1300610 1296299]
  - [net] fix a race in dst_release() (Hannes Frederic Sowa) [1300610 1296299]
  - [net] ratelimit warnings about dst entry refcount underflow or overflow (Hannes Frederic Sowa) [1300610 1296299]
  - [net] fix IP early demux races (Hannes Frederic Sowa) [1300610 1296299]
  - [usb] xhci: init command timeout timer earlier to avoid deleting it uninitialized (Don Zickus) [1300605 1290202]
  - [scsi] be2iscsi: Fix updating the next pointer during WRB posting (Maurizio Lombardi) [1298981 1229330]


author: Akemi Yagi <toracat@centos.org> [3.10.0-327.13.1.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - Add in a patch that fixes missing Unifying device issue [bug#7340]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Add in a patch that fixes waking up from S3 for AMD family [bug#7645]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Add in a patch that fixes crash due to xfrm oops [bug#9646]
  - Enabled spidev [bug#9955]
  - Add in patches from bugs 10073 and 10191 [bug#10073 bug#10191]
  - Add in a patch from bug 10320 [bug#10320]
  - Add patches [bug#10516]
  - Add a patch [bug#10447]
  - Add patches [bug#10033]
  - Remove patch from bug#10191, bug#10320


author: Caolán McNamara <caolanm@redhat.com> - 0.4.0-8
changelog:
  - defining inline causes problems trying to build against libvisual headers, 
    e.g. libvisual-plugins


author: Jeff Layton <jlayton@redhat.com> 6.2-3
changelog:
  - fixes for bugs reported by coverity:
  - update bad bit shift patch with one that patches getcifsacl.c too
  - remove some dead code from getcifsacl.c, asn1.c, and data_blob.c
  - fix bad handling of allocated memory in del_mtab in mount.cifs.c


author: Jan Grulich <jgrulich@redhat.com> - 1.3.1-6
changelog:
  - Do not fail to bind a network socket
    Resolves: bz#1332575
  - Do not die when port is already taken
    Resolves: bz#1322155


author: Jan Grulich <jgrulich@redhat.com> - 1.7.1-1
changelog:
  - Update to 1.7.1
    Resolves: bz#1388620
    Resolves: bz#1343899
    Resolves: bz#1410164
    Resolves: bz#1415547
    Resolves: bz#1418945
    Resolves: bz#1416290
    Resolves: bz#1342956
  - Fix shared memory leakage
    Resolves: bz#1358090
  - Added systemd unit file for xvnc
    Resolves: bz#1393971


author: Jan Grulich <jgrulich@redhat.com> - 1.7.1-2
changelog:
  - Be more restrictive with shared memory mode bits
    Resolves: bz#1152552
    Limit max username/password size in SSecurityPlain [CVE-2017-7394]
    Resolves: bz#1438737
    Fix crash from integer overflow in SMsgReader::readClientCutText [CVE-2017-7395]
    Resolves: bz#1438742


author: Jan Grulich <jgrulich@redhat.com> - 1.7.1-3
changelog:
  - Delete underlying ssecurity in SSecurityVeNCrypt [CCVE-2017-7392]
    Resolves: bz#1439127
    Prevent double free by crafted fences [CVE-2017-7393]
    Resolves: bz#1439134


author: Lukas Nykryn <lnykryn@redhat.com> - 219-63
changelog:
  - dhcp6: make sure we have enough space for the DHCP6 option header (CVE-2018-15688)
  - journald: do not store the iovec entry for process commandline on stack (#1657788)
  - journald: set a limit on the number of fields (1k) (#1657792)
  - journal-remote: set a limit on the number of fields in a message (#1657792)
  - journald: free cmdline buffers owned by iovec (#1666646)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-64
changelog:
  - detect-virt: do not try to read all of /proc/cpuinfo (#1631531)
  - core: disable the effect of Restart= if there's a stop job pending for a service (#6581) (#1626382)
  - networkd: respect DHCP UseRoutes option (#1663365)
  - networkd: fix dhcp4 link without routes not being considered ready (#8728) (#1663365)
  - networkd: dont crash when mtu changes (#6594) (#1663365)
  - tmpfiles: "e" takes globs (#1641764)
  - tmpfiles: 'e' is supposed to operate on directory only (#1641764)
  - tmpfiles: 'e' is supposed to accept shell-style globs (#1641764)
  - bus-message: do not crash on message with a string of zero length (#1643396)
  - Revert "bus: when dumping string property values escape the chars we use as end-of-line and end-of-item marks" (#1643172)
  - set automount state to waiting when the mount is stopped (#1651257)
  - core: when deserializing state always use read_line(…, LONG_LINE_MAX, …) (CVE-2018-15686)
  - shorten hostname before checking for trailing dot (#1631625)
  - journald: fixed assertion failure when system journal rotation fails (#9893) (#1619543)
  - local-addresses: handle gracefully if routes lack an RTA_OIF attribute (#1627750)
  - rules: fix memory hotplug rule so systemd-detect-virt does not run too often (#1666612)
  - 6647 - use path_startswith("/dev") in cryptsetup (#6732) (#1664695)
  - core: mount-setup: handle non-existing mountpoints gracefully (#1585411)
  - units/rescue.service.in: fix announcement message (#1660422)
  - systemctl: Allow 'edit' and 'cat' on unloaded units (#1649518)
  - main: improve RLIMIT_NOFILE handling (#5795) (#1585913)
  - shared/sleep-config: exclude zram devices from hibernation candidates (#1609816)
  - journalctl: allow --file/--directory with --boot or --list-boots (#1463678)
  - journalct: allow --boot=0 to DTRT with --file/--directory (#1463678)
  - journal-remote: show error message if output file name does not end with .journal (bz#1267552)
  - artificially serialize building of .policy files (#1272485)
  - cryptsetup: add support for sector-size= option (#9936) (#1571801)
  - cryptsetup: do not define arg_sector_size if libgcrypt is v1.x (#9990) (#1571801)
  - journal: fix syslog_parse_identifier() (#1657794)
  - journal: do not remove multiple spaces after identifier in syslog message (#1657794)
  - tmpfiles: change ownership of symlinks too (#1620110)
  - tmpfiles: fix check for figuring out whether to call chmod() (#1620110)
  - shared/install: allow "enable" on linked unit files (#1628575)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-65
changelog:
  - backport fd_is_fs_type (#1663143)
  - backport chase_symlinks (#1663143)
  - fs-util: add new CHASE_SAFE flag to chase_symlinks() (#1663143)
  - fs-util: add new chase_symlinks() flag CHASE_OPEN (#1663143)
  - sd-dameon: also sent ucred when our UID differs from EUID (#1663143)
  - notify: add new --uid= command (#1663143)
  - core: be stricter when handling PID files and MAINPID sd_notify() messages (#1663143)
  - journald: respect KeepFree= as well as MaxUse= values (#1361893)
  - shutdown: in_container was used before its definition (#1693716)
  - core: Fix edge case when processing /proc/self/mountinfo (#1691511)
  - sd-bus: deal with cookie overruns (#1693559)
  - Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (#1667871)
  - Allocate temporary strings to hold dbus paths on the heap (#1667871)
  - sd-bus: if we receive an invalid dbus message, ignore and proceeed (#1667871)
  - udev: check if the spawned PID didn't exit after reaping unexpected PID (#1697909)
  - udev: call poll() again after killing the spawned process (#1697909)
  - udev: check age against both timeouts to prevent integer wraparound (#1697909)
  - avoid possible hang if our child process hangs (#1697909)
  - missing: when adding syscall replacements, use different names (#1694605)
  - include sys/sysmacros.h in more places (#1694605)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-66
changelog:
  - sd-bus: unify three code-paths which free struct bus_container (#1643394)
  - hashmap: don't use mempool (#1609349)
  - man: be more explicit about thread safety of sd_journal (#1609349)
  - selinux: don't log SELINUX_INFO and SELINUX_WARNING messages to audit (#1240730)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-67.1
changelog:
  - return error value on failure (#1729226)
  - revert local changes made during backport of the test (#1729226)
  - core/timer: Prevent timer looping when unit cannot start (#1729230)
  - core: add a "Requires=" dependency between units and the slices they are located in (#1729228)
  - core: rerun GC logic for a unit that loses a reference (#1729228)
  - pid1: rename unit_check_gc to unit_may_gc (#1729228)
  - pid1: include the source unit in UnitRef (#1729228)
  - pid1: fix collection of cycles of units which reference one another (#1729228)
  - pid1: free basic unit information at the very end, before freeing the unit (#1729228)
  - pid1: properly remove references to the unit from gc queue during final cleanup (#1729228)
  - service: relax PID file symlink chain checks a bit (#8133) (#1729414)
  - path-util: fix more path_is_mount e792e890f fallout (#1279231)


author: Tru Huynh <tru@pasteur.fr> - 219-67.1.0.1
changelog:
  - https://bugzilla.redhat.com/show_bug.cgi?id=1745199
  - https://github.com/systemd-rhel/rhel-7/pull/38/commits/3a3c7374893751d2974cbb1b05dfbf71b49df590


author: Ivan Devat <idevat@redhat.com> - 0.9.157-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1362493 rhbz#1315627 rhbz#1378742 rhbz#1334429 rhbz#1402374 rhbz#1389941 rhbz#1303969 rhbz#1415080 rhbz#1328882 rhbz#1434972 rhbz#1413958


author: Ivan Devat <idevat@redhat.com> - 0.9.158-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1447702 rhbz#1176018 rhbz#1433016 rhbz#1303969 rhbz#1386114 rhbz#1386512 rhbz#1390609 rhbz#1165821 rhbz#1315992 rhbz#1373614 rhbz#1422667 rhbz#1254984


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.158-2
changelog:
  - Fixed crash of the `pcs cluster setup` command when the `--force` flag was used
  - Fixed crash of the `pcs cluster destroy --all` command when the cluster was not running
  - Fixed crash of the `pcs config restore` command when restoring pacemaker authkey
  - Fixed "Error: unable to get cib" when adding a node to a stopped cluster
  - Resolves: rhbz#1176018


author: Ivan Devat <idevat@redhat.com> - 0.9.158-3
changelog:
  - Added option to create not hardened cluster with the `pcs cluster setup` command using the `--no-hardened` flag
  - Added option to create not hardened cluster from web UI
  - Fixed a crash in the `pcs cluster node add-remote` command when an id conflict occurs
  - Fixed creating a new cluster from the web UI
  - `pcs cluster node add-guest` now works with the flag `--skipp-offline`
  - `pcs cluster node remove-guest` can be run again when the guest node was unreachable first time
  - Fixed "Error: Unable to read /etc/corosync/corosync.conf" when running `pcs resource create`([rhbz#1386114])
  - Binary data are stored in corosync authkey
  - Resolves: rhbz#1284404 rhbz#1373614 rhbz#1165821 rhbz#1176018 rhbz#1386114


author: Ivan Devat <idevat@redhat.com> - 0.9.158-4
changelog:
  - Added support for enable and disable in bundles
  - New clusters are created with corosync encryption disabled by default
  - Flag `--master` is backward compatible in `pcs resource create`
  - Resolves: rhbz#1165821 rhbz#1433016 rhbz#1458153


author: Ivan Devat <idevat@redhat.com> - 0.9.158-5
changelog:
  - `pcs cluster setup` uses existing pacemaker authkey if it exists
  - `pcs resource create` shows only warning when case of remote node is detected
  - Resolves: rhbz#1459503


author: Ivan Devat <idevat@redhat.com> - 0.9.158-6
changelog:
  - It is now possible to disable, enable, unmanage and manage bundle resources and set their meta attributes
  - Fixed timeout when cluster setup takes long time in web UI
  - It is now mandatory to specify container type in the "resource bundle create" command
  - Resolves: rhbz#1447910 rhbz#1284404


author: Ivan Devat <idevat@redhat.com> - 0.9.158-6.el7_4.1
changelog:
  - `resurce update` no longer exits with an error when the `remote-node` meta attribute is set to the same value that it already has
  - Resolves: rhbz#1507399


author: Petr Lautrbach <plautrba@redhat.com> - 3.2.28-1
changelog:
  - Fix sealert message for capability2
  - Spelling fixes
  - sealert - provide a better error message when SELinux is disabled (#1420084)
  - Fix report problem summary string (#1343397)
  - Update setroubleshootd.8 (#1348140)


author: Vit Mojzis <vmojzis@redhat.com> - 3.2.29-1
changelog:
  - Fix sealert message for process2 (#1507909)
  - Remove additional "If " string from plugin messages (#1177347)
  - Fix semi-translated messages (#1332126)
  - Make labels on GtkButtons translatable
  - Set translation domain for Gtk.Builder() object to have strings correctly translated (#1370100)
  - Do not split If sentences to framework and plugins (#1177347)
  - Don't stop when the plugin directory is empty
  - Change "check_for_man" return value upon failure
  - Fix "plugin details" message content
  - Add "init_args" function to Plugin 
  - Fix sealert crash when setroubleshootd fails to start (#1405003)


author: Matthew Garrett <mjg59@srcf.ucam.org> - 0.5.4-15
changelog:
  - efibootmgr-0.5.4-Work-around-broken-Apple-firmware.patch
    Resolves: #873629
  - efibootmgr-0.5.4-Remove-device-path-padding-on-non-Itanium.patch - improve
    spec conformance
  - efibootmgr-0.5.4-fix-minor-memory-leak.patch - from upstream
  - efibootmgr-0.5.4-fix-disk-minor-number-discovery.patch - from upstream
  - efibootmgr-0.5.4-make_boot_var-does-not-check-for-failed-status-with-.patch -
    from upstream


author: David Howells <dhowells@redhat.com>
changelog:
  - Adjust the manual page for 'keyctl unlink' to show keyring is optional.
  - Add --version support for the keyutils version and build date.


author: David Howells <dhowells@redhat.com> - 1.5.4-1
changelog:
  - Fix the keyctl padd command and similar to handle binary input.
  - Make keyctl show able to take a keyring to dump.
  - Make keyctl show able to take a flag to request hex key IDs.
  - Make keyctl show print the real ID of the root keyring.


author: David Howells <dhowells@redhat.com> - 1.5.6-1
changelog:
  - Fix the request-key.conf.5 manpage.
  - Fix the max depth of key tree dump (keyctl show) [BZ 1002761].
  - The input buffer size for keyctl padd and pinstantiate should be larger [BZ 1002761].
  - Add keyctl_invalidate.3 manpage [BZ 1002761].


author: David Howells <dhowells@redhat.com> - 1.5.7-1
changelog:
  - Provide a utility function to find a key by type and name.
  - Allow keyctl commands to take a type+name arg instead of a key-id arg.
  - Add per-UID get_persistent keyring function [BZ 1014739].


author: Peter Jones <pjones@redhat.com> - 8.27-1
changelog:
  - Make grubby understand grub's "saved_entry" system
    Resolves: rhbz#808021
  - BuildRequire grub2 on appropriate platforms, for the test suite.
    Related: rhbz#808021


author: d.marlin <dmarlin@redhat.com>
changelog:
  - Only set RPM_OPT_FLAGS if undefined to avoid overwriting 
    the platform defaults.
    Resolves: rhbz#1023793


author: Thomas Haller <thaller@redhat.com> - 1:1.0.6-22
changelog:
  - platform: fix detection of s390 CTC device (rh #1272974)
  - core: fix queuing activation while waiting for carrier (rh #1079353)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.0.6-25
changelog:
  - vpn: cancel the secrets request on agent timeout (rh #1272023)
  - vpn: cancel the connect timer when vpn reconnects (rh #1272023)


author: Josef Ridky <jridky@redhat.com> - 10.79.00-4
changelog:
  - Resolves: #1523176 - add manual page for ppmtopga
  - Resolves: #1530606 - pbmtoepson command line option fix


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-15
changelog:
  - fix argv rewrite (#1047507)
  - fix memory leak (#1048995)
  - standard error output could get misdirected (#1048272)


author: Petr Lautrbach <plautrba@redhat.com> 2.5-9
changelog:
  - sandbox: create a new session for sandboxed processes - CVE-2016-7545
  - sandbox: do not try to setup directories without -X or -M


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.14.1.el7]
changelog:
  - [fs] move the call of __d_drop(anon) into __d_materialise_unique(dentry, anon) (Zheng Yan) [1692266 1627001]
  - [fs] dcache: d_splice_alias should ignore DCACHE_DISCONNECTED (Zheng Yan) [1692266 1627001]
  - [fs] dcache: d_splice_alias should detect loops (Zheng Yan) [1692266 1627001]
  - [fs] dcache: d_splice_alias mustn't create directory aliases (Zheng Yan) [1692266 1627001]
  - [fs] dcache: close d_move race in d_splice_alias (Zheng Yan) [1692266 1627001]
  - [fs] dcache: move d_splice_alias (Zheng Yan) [1692266 1627001]
  - [fs] dcache: don't clear DCACHE_DISCONNECTED too early (Zheng Yan) [1692266 1627001]
  - [fs] dcache: Don't set DISCONNECTED on "pseudo filesystem" dentries (Zheng Yan) [1692266 1627001]
  - [fs] dcache: use IS_ROOT to decide where dentry is hashed (Zheng Yan) [1692266 1627001]


author: Akemi Yagi <toracat@centos.org> [3.10.0-957.21.2.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
     addmissing.patch  [puias]
     cpufreq.patch  [puias]
     i386-audit-stop-scri-stack-frame.patch  [puias]
     removejiffies.patch  [puias]
     undorhirqstat.patch  [puias]
     morefixes.patch      [puias+bug#12412]
     upstream-32bit-fixes-7_5.patch [puias+bug#12412]
     clear-32bit-Werror-warnings.patch  [bug#12412]
     qspinlock_types-32bit.patch   [ay]
     i686-7-4.patch [T.Kabe, bug#13890]
     firmware-efi-32bit.patch [ay]
     patch-spec_ctrl_i686.patch [T.Kabe bug#14353]
     686 mods for 7.5 [T.Kabe bug#14703]
     more 686 mods for 7.5 (-862.3.2) [pgreco]
     more 686 mods for 7.5 (-862.11.6) [pgreco, bug#15174]
     Patches updated for 7.6 [kabe, bug#15428]
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Enabled spidev [bug#9955]
  - Add a patch [bug#10447]
  - Enable ATM drivers [bug#10845]
  - Add 9pfs config options [bug#10849]
  - Enable VFIO_PCI_VGA [bug#12435]
  - Rremove initramfs-xxxkdump.img upon kernel removal [bug#12703]
  - Add a patch from [bug#12841]
  - Add a patch from [bug#12818]
  - Enabled RT2800USB_RT3573 [bug#13162]
  - Enable LDM_PARTITION [bug#13526]
  - Add a patch to fix misleading warning [bug#13990]
  - Add BuildRequires: openssl-devel to the with_perf section [bug#13990]
  - Add a patch to fix build errors for EL7.5 [bug#14425]
  - Added a patch to fix alsa potentail crash [bug14779]
  - Apply a patch to fix excessive warnings [bug#14413]
  - Apply a patch to fix mempolicy issue [bug#15115]
  - Add a patch to fix race in virtio_balloon [bug#15216]
  - Add shim requirement to the spec file for x86_64
  - Apply patches that fix ecryptfs issue [see bugs #7369, #15353] provided by @pgreco
  - Add an i686 patch to fix Hyper-V issue [bug#15374]
  - Add an nvme patch [bug#15406]
  - Enable NIU and add a patch that fixes build errors submitted by h-masuda [bug#15040]
  - Apply a patch from bug15707
  - Apply a patch from bug15742
  - Add a patch that fixes the earlier patch from bug15742
  - Add a patch from bug#15801


author: Josh Boyer <jwboyer@fedoraproject.org>
changelog:
  - Don't splash warnings from broken BGRT firmware implementations
  - Require /usr/bin/kernel-install (rhbz 1331012)


author: Josh Boyer <jwboyer@fedoraproject.org>
changelog:
  - Enable NFC_NXP_NCI options (rhbz 1290556)
  - CVE-2016-4482 info leak in devio.c (rhbz 1332931 1332932)


author: Johnny Hughes <johnny@centos.org> - 4.4.9-301
changelog:
  - Undo some patches that install vmlinuz and the initrd outside where the CentOS Grub expects
  - Provides: xorg-x11-drv-vmmouse = 14.0.0 to build on el7


author: Johnny Hughes <johnny@centos.org> 4.4.13-303
changelog:
  - upgrade to upstream 4.4.13 from the LTS 4.4 branch
  - remove Patch659, now upstream
  - reomve Patch791, now upstream


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-8
changelog:
  - util: make virNetDev(Replace|Restore)MacAddress public functions (rhbz#1257004)
  - util: don't use netlink to save/set mac for macvtap+passthrough+802.1Qbh (rhbz#1257004)
  - cpu: Introduce IvyBridge CPU model (rhbz#1254420)
  - examples: Add example polkit ACL rules (rhbz#1115289)
  - qemu: don't use initialized ret in qemuRemoveSharedDevice (rhbz#1072736)
  - qemu: Introduce qemuDomainMachineIsS390CCW (rhbz#1258361)
  - qemu: Need to check for machine.os when using ADDRESS_TYPE_CCW (rhbz#1258361)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-9
changelog:
  - conf: fix crash when parsing a unordered NUMA <cell/> (rhbz#1260846)
  - vmx: Some whitespace cleanup (rhbz#1172544)
  - vmx: The virVMXParseDisk deviceType can be NULL, add some missing checks (rhbz#1172544)
  - vmx: Add handling for CDROM devices with SCSI passthru (rhbz#1172544)
  - qemu: hotplug: Properly clean up drive backend if frontend hotplug fails (rhbz#1262399)
  - qemu: Introduce QEMU_CAPS_DEVICE_RTL8139 (rhbz#1254044)
  - qemu: Introduce QEMU_CAPS_DEVICE_E1000 (rhbz#1254044)
  - qemu: Introduce QEMU_CAPS_DEVICE_VIRTIO_NET (rhbz#1254044)
  - qemu: Try several network devices when looking for a default (rhbz#1254044)
  - qemu: Report error if per-VM directory cannot be created (rhbz#1146886)
  - qemu: Do not allow others into per-VM subdirectories (rhbz#1146886)
  - qemu: Allow others to browse /var/lib/libvirt/qemu (rhbz#1146886)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-10
changelog:
  - virSecuritySELinuxSetSecurityAllLabel: drop useless virFileIsSharedFSType (rhbz#1124841)
  - security_selinux: Replace SELinuxSCSICallbackData with proper struct (rhbz#1124841)
  - virSecurityManager: Track if running as privileged (rhbz#1124841)
  - security_selinux: Take @privileged into account (rhbz#1124841)
  - qemu: Fix using guest architecture as lookup key (rhbz#1260753)
  - virfile: Check for existence of dir in virFileDeleteTree (rhbz#1146886)
  - Revert "qemu: Fix integer/boolean logic in qemuSetUnprivSGIO" (rhbz#1072736)
  - qemu: migration: Relax enforcement of memory hotplug support (rhbz#1252685)
  - conf: Add helper to determine whether memory hotplug is enabled for a vm (rhbz#1252685)
  - qemu: Make memory alignment helper more universal (rhbz#1252685)
  - conf: Drop VIR_DOMAIN_DEF_PARSE_CLOCK_ADJUST flag (rhbz#1252685)
  - conf: Document all VIR_DOMAIN_DEF_PARSE_* flags (rhbz#1252685)
  - conf: Add XML parser flag that will allow us to do incompatible updates (rhbz#1252685)
  - conf: Split memory related post parse stuff into separate function (rhbz#1252685)
  - conf: Rename max_balloon to total_memory (rhbz#1252685)
  - conf: Pre-calculate initial memory size instead of always calculating it (rhbz#1252685)
  - conf: Don't always recalculate initial memory size from NUMA size totals (rhbz#1252685)
  - qemu: command: Align memory sizes only on fresh starts (rhbz#1252685)
  - qemu: ppc64: Align memory sizes to 256MiB blocks (rhbz#1249006)
  - test: Add test to validate that memory sizes don't get updated on migration (rhbz#1252685)
  - qemu: Align memory module sizes to 2MiB (rhbz#1252685)
  - qemu: Refresh memory size only on fresh starts (rhbz#1242940)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-13
changelog:
  - qemu: Add conditions for qemu-kvm use on ppc64 (rhbz#1267882)
  - qemu: Move simplification variable to begining of the function (rhbz#1266856)
  - qemu: Extract -mem-path building into its own function (rhbz#1266856)
  - qemu: Add -mem-path even with numa (rhbz#1266856)
  - qemu: Use memory-backing-file only when needed (rhbz#1266856)
  - qemu: Always update migration times on destination (rhbz#1265902)
  - qemu: Copy completed migration stats only on success (rhbz#1265902)
  - qemu: Introduce flags in qemuMigrationCompleted (rhbz#1265902)
  - qemu: Make updating stats in qemuMigrationCheckJobStatus optional (rhbz#1265902)
  - qemu: Wait until destination QEMU consumes all migration data (rhbz#1265902)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-13.el7_2.1
changelog:
  - qemu: migration: Properly parse memory hotplug migration flag (rhbz#1280419)
  - qemu: Emit correct audit message for memory hot unplug (rhbz#1280420)
  - qemu: Emit correct audit message for memory hot plug (rhbz#1280420)
  - qemu: Extract logic to determine the mlock limit size for VFIO (rhbz#1280420)
  - qemu: hotplug: Fix mlock limit handling on memory hotplug (rhbz#1280420)
  - qemu: domain: Restructurate control flow in qemuDomainGetMlockLimitBytes (rhbz#1280420)
  - qemu: Explain mlock limit size more in detail (rhbz#1280420)
  - qemu: hotplug: Reject VFIO hotplug if setting RLIMIT_MEMLOCK fails (rhbz#1283924)
  - process: Log when limiting the amount of locked memory (rhbz#1283924)
  - qemu: Use qemuDomainRequiresMlock() in qemuBuildCommandLine() (rhbz#1283924)
  - qemu: Use qemuDomainRequiresMlock() when attaching PCI hostdev (rhbz#1283924)
  - qemu: Add ppc64-specific math to qemuDomainGetMlockLimitBytes() (rhbz#1283924)
  - qemu: Always set locked memory limit for ppc64 domains (rhbz#1283924)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-13.el7_2.4
changelog:
  - systemd: Escape machine name for machined (rhbz#1308494)
  - systemd: Add virSystemdGetMachineNameByPID (rhbz#1308494)
  - systemd: Modernize machine naming (rhbz#1308494)
  - virSystemdGetMachineNameByPID: Initialize @reply (rhbz#1308494)
  - util: Fix virCgroupNewMachine ATTRIBUTE_NONNULL args (rhbz#1308494)
  - dbus: Don't unref NULL messages (rhbz#1308494)
  - vmx: Expose datacenter path in domain XML (rhbz#1305489)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.15-1
changelog:
  - Rebased to libvirt-python-1.2.15 (rhbz#1194594)
  - The rebase also fixes the following bugs:
      rhbz#1212168


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-1
changelog:
  - Rebased to libvirt-python-1.2.17 (rhbz#1194594)
  - The rebase also fixes the following bugs:
      rhbz#1194594, rhbz#1222795


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-2
changelog:
  - examples: Introduce nodestats example (rhbz#1051494)
  - iothread: Fix crash if virDomainGetIOThreadInfo returns error (rhbz#1248295)
  - Check return value of PyList_Append (rhbz#1249511)


author: Jiri Denemark <jdenemar@redhat.com> - 1.3.2-1
changelog:
  - Rebased to libvirt-python-1.3.2 (rhbz#1286680)
  - The rebase also fixes the following bugs:
      rhbz#1311058


author: Jiri Denemark <jdenemar@redhat.com> - 1.3.3-1
changelog:
  - Rebased to libvirt-python-1.3.3 (rhbz#1286680)
  - The rebase also fixes the following bugs:
      rhbz#


author: Jiri Denemark <jdenemar@redhat.com> - 1.3.4-1
changelog:
  - Rebased to libvirt-python-1.3.4 (rhbz#1286680)
  - The rebase also fixes the following bugs:
      rhbz#1286680, rhbz#1326839


author: Pavel Raiskup <praiskup@redhat.com> - 1.5.2-1
changelog:
  - rebase to most up2date upstream tarball, remove patches already upstream, fix
    code movements in patches (#928758)
  - fix man-page-day objections (private #948866)
  - fix the build for aarch64 (#926571)


author: Pavel Raiskup <praiskup@redhat.com> - 1.5.2-2
changelog:
  - package spax and scpio separately (#959917)
  - fedora-review fixes, unapplied patch
  - make the spax to be pax alternative (#960007)


author: Pavel Raiskup <praiskup@redhat.com> - 1.5.2-7
changelog:
  - we should provide /etc/rmt symlink for a while (related to #968980)
  - use the ssh as the default remote access method


author: Sinny Kumari <skumari@redhat.com> - 3.10.0-1
changelog:
  - Rebase to 3.10.0
  - Resolves: #1519383 - openCryptoki token for EP11 - crucial enhancements for s390x
  - Remove opencryptoki-3.4-fix-root-checks.patch, fixed in 3.9.0
  - Remove opencryptoki-3.2-conditional-manpages.patch, fixed in 3.9.0


author: Than Ngo <than@redhat.com> - 3.11.0-1
changelog:
  - Resolves: #1063763 - opencryptoki tools should inform the user that he is not in pkcs11 group 
  - Resolves: #1641027 - enhanced IBM z14 functions
  - Resolves: #1641026 - support m_*Single functions from ep11 lib
  - Resolves: #1641025 - rebase to 3.11.0
  - Resolves: #1519386 - use CPACF hashes in ep11 token
  - Resolves: #1373833 - lock file directory is %ghost now


author: Than Ngo <than@redhat.com> - 3.11.0-3
changelog:
  - Resolves: #1688891 - C_EncryptInit fails with CKR_KEY_TYPE_INCONSISTENT. on ep11 token when using imported RSA public key


author: Jarod Wilson <jarod@redhat.com> - 3.0-6
changelog:
  - Update to upstream 3.0-3.1.gb36a595 tarball for upstream fixes
  - Add in manpages
  - Related: rhbz#1365750
  - Resolves: rhbz#948476


author: Jarod Wilson <jarod@redhat.com> - 3.0-7
changelog:
  - Address a myriad more coverity/clang warnings
  - Add raw_ethernet_* man page symlinks
  - Related: rhbz#1273176
  - Related: rhbz#948476


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-6
changelog:
  - Fix a coverity scan compile time warning for the pem module
  - Resolves: Bug 1002271 - NSS pem module should not require unique base file names


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-7
changelog:
  - Move several nss-sysinit manpages tar archives to the %files
  - Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-8
changelog:
  - Fix the spec file to apply the nss ecc list patch for bug 752980
  - Resolves: Bug 752980 - Support ECDSA algorithm in the nss package via puggable ecc


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-9
changelog:
  - Rebase to nss-3.15.4
  - Resolves: Bug 1054457 - CVE-2013-1740 nss: false start PR_Recv information disclosure security issue
  - Remove no longer needed patches for manpages that were applied upstream
  - Remove no longer needed patch to disable ocsp stapling tests
  - Update iquote.patch on account of upstream changes
  - Update and rename patch to pem/rsawrapr.c on account of upstream changes
  - Use the pristine upstream sources for nss without repackaging
  - Avoid unneeded manual step which may introduce errors


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-3
changelog:
  - Remove spurious man5 wildcard entry as all manpages are listed by name
  - Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-4
changelog:
  - Update pem sources to latest from nss-pem upstream
  - Pick up pem module fixes verified on RHEL and applied upstream
  - Remove no loger needed pem patches on acccount on this update
  - Add comments documenting the iquote.patch 
  - Resolves: Bug 1054457 - CVE-2013-1740


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-5
changelog:
  - Pick up a fix from rhel-6 and fix an rpm conflict
  - Don't hold issuer cert handles in crl cache
  - Resolves: Bug 1034409 - deadlock in trust domain and object lock
  - Move nss shared db files to the main package
  - Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-6
changelog:
  - Disallow disabling the internal module
  - Resolves: Bug 1056036 - nss segfaults with opencryptoki module


author: Jakub Jelinek <jakub@redhat.com> 4.8.2-7
changelog:
  - update from the 4.8 branch
    - PRs libgomp/59467, rtl-optimization/58295, target/56807,
  	testsuite/59442
    - fix LRA coalescing for real (PR middle-end/59470)


author: Jakub Jelinek <jakub@redhat.com> 4.8.2-10
changelog:
  - update from the 4.8 branch (#1052892)
    - PRs ada/55946, ada/59772, c++/56060, c++/58954, c++/59255, c++/59730,
  	fortran/57042, fortran/58998, fortran/59493, fortran/59612,
  	fortran/59654, ipa/59610, middle-end/59584, pch/59436,
  	rtl-optimization/54300, rtl-optimization/58668,
  	rtl-optimization/59137, rtl-optimization/59647,
  	rtl-optimization/59724, target/57386, target/59587, target/59625,
  	target/59652, testsuite/58630, tree-optimization/54570,
  	tree-optimization/59125, tree-optimization/59362,
  	tree-optimization/59715, tree-optimization/59745
  - default to -march=z196 instead of -march=z10 on s390/s390x (#1052890)


author: Jakub Jelinek <jakub@redhat.com> 4.8.2-12
changelog:
  - update from the 4.8 branch (#1052892)
    - PRs c++/59838, debug/54694, fortran/34547, fortran/58410,
  	middle-end/59827, middle-end/59860, target/58139, target/59142,
  	target/59695, target/59794, target/59826, target/59839
  - fix handling of initialized vars with flexible array members
    (#1035413, PR middle-end/28865)


author: Jakub Jelinek <jakub@redhat.com> 4.8.2-13
changelog:
  - when removing -Wall from CXXFLAGS, if -Werror=format-security
    is present, add -Wformat to it, so that GCC builds on F21


author: Jakub Jelinek <jakub@redhat.com> 4.8.2-15
changelog:
  - fix exception spec instantiation ICE (#1067398, PR c++/60046)
  - fix pch on aarch64 (#1058991, PR pch/60010)
  - configure with --enable-gnu-indirect-function on architectures
    and distros that support it and don't support it by default
    yet (#1067245)
  - fix vector permutation handling on i?86/x86_64 (PR target/57896)
  - fix __atomic_compare_exchange_* not to store into *expected
    on success (PR c++/60272)
  - fix -march=native on VMs where saving/restoring of YMM state
    is not supported, yet CPU supports f16c (PR driver/60233)
  - add ref7.C testcase (PR c++/60274)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-18
changelog:
  - CVE-2011-4516, CVE-2011-4517 jasper: heap buffer overflow flaws
    lead to arbitrary code execution (CERT VU#887409) (#765660)
  - Fixed problems found by static analysis of code (#761440)
  - spec file modernized


author: Martin Pitt <mpitt@redhat.com> 160-2
changelog:
  - Add kubevirt Virtual Machines overview
  - Redesign package list on Software Updates page and show RHEL Errata


author: Martin Pitt <mpitt@redhat.com> 165-1
changelog:
  - Update to 165 release
  - New VMs can be created on Machines page
  - Improve LVM volume resizing
  - Hide Docker storage pool reset button when it cannot work properly
  - Move NFS management into new details page
  - Show more details of sessions and services that keep NFS busy
  - Machines page now shows proper error notifications
  - Show virtual machines that are being created
  - Detect if libvirtd is not running and offer to start and/or enable it
  - Enable building of cockpit-machines-ovirt rhbz#1515796


author: Martin Pitt <mpitt@redhat.com> 169-1
changelog:
  - Update to 169 release
  - Storage: Offer installation of NFS client support on demand
  - Containers: Don't try to manage "overlay2" storage without a volume group
  - Machines: Fix "Start VM" checkbox layout
  - Software Updates: Fix security update icon rhbz#1582570
  - Drop obsolete cockpit-bashboard SELinux %post hack rhbz#1570833


author: Martin Pitt <mpitt@redhat.com> 170-1
changelog:
  - Update to 170 release
  - Software Updates: Layout rework
  - oVirt: Use authenticated libvirt connection by default rhbz#1297037


author: Martin Pitt <mpitt@redhat.com> 172-2
changelog:
  - Update to 172 release
  - Software Updates: Layout rework
  - Machines: Add virtual CPU configuration
  - Docker: Show container volumes


author: Martin Pitt <mpitt@redhat.com> 176-2
changelog:
  - Update to 176 release
  - Storage: Offer installation of VDO on demand
  - Machines: Add disks to a virtual machine


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-9
changelog:
  - Amended fix for FIPS enforcement issue (#1163848)
  - Fixed issue with applications that close all file descriptors (#1165047)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-11
changelog:
  - Applied fix for urandom FD in FIPS140 mode (#1165047)
  - Applied fix for FIPS140-2 related regression (#1110696)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-13
changelog:
  - Corrected reseed and respect of max_number_of_bits_per_request in 
    FIPS140-2 mode. Also enhanced the initial tests. (#1228199)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.24-1
changelog:
  - Addressed issue with DSA public keys smaller than 2^1024 (#1238279)
  - Addressed two-byte buffer overflow in the DTLS-0.9 protocol (#1209365)
  - When writing certificates to smart cards write the CKA_ISSUER and
    CKA_SERIAL_NUMBER fields to allow NSS reading them (#1272179)
  - Use the shared system certificate store (#1110750)
  - Address MD5 transcript collision attacks in TLS key exchange (#1289888, 
    CVE-2015-7575)
  - Allow hashing data over 2^32 bytes (#1306953)
  - Ensure written PKCS#11 public keys are not marked as private (#1339453)
  - Ensure secure_getenv() is called on all uses of environment variables
    (#1344591).
  - Fix issues related to PKCS #11 private key listing on certain HSMs
    (#1351389)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.26-7
changelog:
  - Address interoperability issue with 3.5.x (#1388932)
  - Reject CAs which are both trusted and blacklisted in trust module (#1375303)
  - Added new functions to set issuer and subject ID in certificates (#1378373)
  - Reject connections with less than 1024-bit DH parameters (#1335931)
  - Fix issue that made GnuTLS parse only the first 32 extensions (#1383748)
  - Mention limitations of certtool in manpage (#1375463)
  - Read PKCS#8 files with HMAC-SHA256 -as generated by openssl 1.1 (#1380642)
  - Do not link directly to trousers but instead use dlopen (#1379739)
  - Fix incorrect OCSP validation (#1377569)
  - Added support for pin-value in PKCS#11 URIs (#1379283)
  - Added the --id option to p11tool (#1399232)
  - Improved sanity checks in RSA key generation (#1444780)
  - Addressed CVE-2017-5334, CVE-2017-5335, CVE-2017-5336, CVE-2017-5337,
    CVE-2017-7869


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.26-9
changelog:
  - Address crash in OCSP status request extension, by eliminating the
    unneeded parsing (CVE-2017-7507, #1455828)


author: Anderson Sasaki <ansasaki@redhat.com> 3.3.29-8
changelog:
  - Backported --sni-hostname option which allows overriding the hostname
    advertised to the peer (#1444792)
  - Improved counter-measures in TLS CBC record padding for lucky13 attack
    (CVE-2018-10844, #1589704, CVE-2018-10845, #1589707)
  - Added counter-measures for "Just in Time" PRIME + PROBE cache-based attack
    (CVE-2018-10846, #1589708)
  - Address p11tool issue in object deletion in batch mode (#1375307)
  - Backport PKCS#11 tests from master branch. Some tests were disabled due to
    unsupported features in 3.3.x (--load-pubkey and --test-sign options, ECC key
    generation without login, and certificates do not inherit ID from the private
    key)
  - p11tool explicitly marks certificates and public keys as NOT private objects
    and private keys as private objects
  - Enlarge buffer size to support resumption with large keys (#1542461)
  - Legacy HMAC-SHA384 cipher suites were disabled by default
  - Added DSA key generation to p11tool (#1464896)
  - Address session renegotiation issue using client certificate (#1434091)
  - Address issue when importing private keys into Atos HSM (#1460125)


author: Richard W.M. Jones <rjones@redhat.com> - 1.3.10-5.7
changelog:
  - Fix: "Argument list too long" when using virt-v2v on Windows guest
    with French copy of Citrix installed
    related: rhbz#1145056


author: Klaus Wenninger <kwenning@redhat.com> - 1.4.0-2
changelog:
  - rebuild against pacemaker 1.20 to make sbd actually use
    the new libpengine API

    Resolves: rhbz#1661233


author: Klaus Wenninger <kwenning@redhat.com> - 1.4.0-3
changelog:
  - finalize cmap connection if disconnected from cluster
  - make handling of cib-connection loss more robust

    Resolves: rhbz#1691484


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-5.el7
changelog:
  - Resolves: 1697242 Communication with oddjob helper fails
    - Bypass D-BUS interface definition deficiences for trust-fetch-domains


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-7.el7
changelog:
  - Resolves: 1704227 - Wrong logic in ipactl restart leads to start instead of restart pki-tomcatd
    - ipactl restart: fix wrong logic when checking service list


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-8.el7
changelog:
  - Resolves: 1702651 - Command ipa conole is broken
    - ipa console: catch proper exception when history file can not be open
  - Resolves: 1704796 - Wrong CA replication topology created with two replicas
    - replica install: acknowledge ca_host override
  - Resolves: 1708873 - Unable to upgrade ipa data: IPA version error: data needs to be upgraded (expected version '4.7.90.pre1-3.fc30', current version '4.7.2-8.fc30')
    - upgrade: adtrust - catch empty result when retrieving list of trusts


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-9.el7
changelog:
  - Resolves: 1712794 - ERROR: invalid 'PKINIT enabled server': all masters must have IPA master role enabled
    - Consider configured servers as valid


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-10.el7
changelog:
  - Resolves: 1723473 - ipa upgrade fails with trust entry already exists
    - adtrust upgrade: fix wrong primary principal name


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-11.el7
changelog:
  - Resolves: 1723473 - ipa upgrade fails with trust entry already exists
    - adtrust upgrade: fix wrong primary principal name, part 2
  - Resolves: 1686302 - ipa trust fetch-domains, server parameter ignored
    - trust-fetch-domains: make sure we use right KDC when --server is specified


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-11.el7_7.2
changelog:
  - Resolves: #1752740 - when migrating trusted domain object structure, add default access control definitions, if they were missing in old trust objects
    - add default access control when migrating trust objects
    - adtrust: add default read_keys permission for TDO objects
    - Disable deprecated-lambda check in adtrust upgrade code


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-11.el7_7.3
changelog:
  - Resolves: #1756914 - Sub-CA key replication failure
    - Handle missing LWCA certificate or chain
    - Fix CustodiaClient ccache handling
    - CustodiaClient: use ldapi when ldap_uri not specified
    - CustodiaClient: fix IPASecStore config on ipa-4-7
    - Bump krb5 min version


author: Adam Jackson <ajax@redhat.com> 8.1.0-2
changelog:
  - Copy glxinfo to glxinfo%{__isa_bits}, to allow people to check that their
    compatibility drivers are working.


author: John Dennis <jdennis@redhat.com> - 2.4.1-7
changelog:
  - Add ECP support, brings Lasso up to current upstream tip + revised ECP patches
    Resolves: #1205342


author: John Dennis <jdennis@redhat.com> - 2.4.1-8
changelog:
  - Add explicit minimum dependency on glib2 2.42,
    for some reason RPM is not automatically detecting the dependency
    Resolves: #1254989


author: Jakub Hrozek <jhrozek@redhat.com> - 2.5.1-3
changelog:
  - Resolves: #1634267 - ECP signature check fails with
                         LASSO_DS_ERROR_SIGNATURE_NOT_FOUND when assertion signed
                         instead of response


author: Stephen Gallagher <sgallagh@redhat.com> - 0.9.18-3
changelog:
  - Make the dependency requirements arch-specific
  - Remove ancient, unused patches
  - Remove python variables that are not needed on modern systems


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.21-2
changelog:
  - Allow building with RHEL-7.0 libtalloc
  - Resolves: rhbz#1133919 - Rebase libtevent to version 0.9.21 or newer


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-4
changelog:
  - settings: clear unsaved flag on new connections (rh #1525078)
  - platform-linux: reload qdiscs and tfilters after removing them (rh #1527197)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-5
changelog:
  - wwan: add default route even if modem didn't return a gateway (rh #1527934)
  - dhcp: fix assertion failure for dhcp-client-id (rh #1531173)


author: Thomas Haller <thaller@redhat.com> - 1:1.10.2-6
changelog:
  - core: use distinct route-metric to keep connectivity on first activated device (rh #1505893)
  - core: fix enabling connectivity-check-enabled via D-Bus (rh #1534477)
  - core: fix invalid assertion deleting volatile connection (rh #1506552)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.10.2-7
changelog:
  - po: import translations (rh #1481186)
  - device: increase carrier wait time to 6 seconds (rh #1520826)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-10
changelog:
  - device: skip IP configuration phase for external devices (rh #1530288)
  - platform: fix crash during route-get call (rh #1534721)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.10.2-11
changelog:
  - ovs-interface: avoid starting ip configuration twice (rh #1540063)
  - libnm-core: ensure alignment of team.config and other team properties (rh #1533830)
  - nmcli: clear link-watchers before adding the new ones (rh #1533926)
  - libnm-core: update team.runner description (rh #1533799)
  - libnm-core: team: fix runner sys_prio default value (rh #1533810)
  - libnm: avoid a symbol clash with json-glib (rh #1535905)
  - libnm-core: team: add support to runner "random" (rh #1538699)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-12
changelog:
  - ppp: don't start IPv6 configuration on the device (rh #1515829)
  - device: avoid setting the IPv4 rp_filter (rh #1492472)
  - nmcli: team: clear runner-tx-hash before adding new hashes (rh #1541922)


author: Akira TAGOH <tagoh@redhat.com> - 1.6.2-1
changelog:
  - New upstream release.
  - the spec file cleanup.
  - Correct License field
  - Add Provides: bundled(egglib) to im-chooser-common since
    it actually contains things in libimchooseui.so.0


author: Akira TAGOH <tagoh@redhat.com> - 1.6.3-1
changelog:
  - New upstream release.
    - Add a link to the log file in the error dialog (#950488)
    - Fix a crash issue (#859624)


author: Jan Pokorný <jpokorny+rpm-booth@redhat.com> - 1.0-2.eb4256a.git
changelog:
  - update a subset of out-of-tree patches per
    https://github.com/ClusterLabs/booth/pull/22#issuecomment-216936987
  - pre-inclusion cleanups in the spec (apply systemd scriptlet operations
    with booth-arbitrator, avoid overloading file implicitly considered %doc
    as %license)
    Resolves: rhbz#1302087
    Related (Fedora): rhbz#1314865
    Related (Fedora): rhbz#1333509


author: Jan Pokorný <jpokorny+rpm-booth@redhat.com> - 1.0-3.570876d.git
changelog:
  - update per the changesets recently accepted by the upstream
    (memory/resource leaks fixes, patches previously attached separately
    that make unit test pass, internal cleanups, etc.)
    Resolves: rhbz#1302087


author: Jan Pokorný <jpokorny+rpm-booth@redhat.com> - 1.0-5.77d65dd.git
changelog:
  - update per the the current upstream, most notably the support for
    cluster-glue alternatives has been accepted (separate patches no
    longer needed)
  - make the main (envelope) package properly require the subpackages
    of the same version
  - add patches allowing for live_test.sh using pcs
  - allow building also against s390x architecture
    (per Pacemaker dependency constraint)
    Resolves: rhbz#1302087


author: Jan Pokorný <jpokorny+rpm-booth@redhat.com> - 1.0-6.ef769ef.git
changelog:
  - fix an issue with identity self-determination based on match
    between the addresses assigned at host and the configured addresses
    when a network-part-of-the-address-only match preceded a possible
    exact address match which would not be even tested if the length
    of the network prefix was the same (no longer for this exact one)
    Resolves: rhbz#1341720
  - fix a crash when running booth without determined identity
    (e.g., existing, yet empty configuration) under some circumstances
    Resolves: rhbz#1366616
  - make patches be applied using "git am" rather than "git apply"


author: Jan Grulich <jgrulich@redhat.com> - 0.26-2
changelog:
  - Fix heap-based buffer over-read in Exiv2::Image::byteSwap4 in image.cpp
    Resolves: bz#1547207

    Fix heap-based buffer over-read in Exiv2::getULong function in types.cpp
    Resolves: bz#1545232


author: Jan Grulich <jgrulich@redhat.com> - 0.26-3
changelog:
  - Fix uncontrolled recursion in image.cpp:Exiv2::Image::printIFDStructure() which can allow a
    remote attacker to cause a denial of service via a crafted tif file
    Resolves: bz#1548410


author: Peter Robinson <pbrobinson@fedoraproject.org> 0.12.4-1
changelog:
  - Update to 0.12.4
  - http://ftp.gnome.org/pub/GNOME/sources/libchamplain/0.12/libchamplain-0.12.4.news


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-19.el7_1.3
changelog:
  - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
  - allow only one step larger than panic threshold with -g (CVE-2015-5300)


author: Adam Jackson <ajax@redhat.com> 7.7-1
changelog:
  - rgb 1.0.5
  - xsessreg 1.0.8
  - xgamma 1.0.5
  - xhost 1.0.5
  - xmodmap 1.0.7
  - xsetroot 1.1.1
  - xstdcmap 1.0.3


author: Richard Marko<rmarko@redhat.com> 0.8-1
changelog:
  - New upstream version
    - Added support for json de/serialization of reports and stacktraces.
    - Library version number increased, as the interface changed since the last release


author: Jakub Filak <jfilak@redhat.com> 0.9-1
changelog:
  - New upstream version
    - Enrich koops uReport data with koops text and kernel version.
    - Improve koops modules handling.


author: Martin Milata <mmilata@redhat.com> 0.9-2
changelog:
  - Fix malformed JSON for some Java and koops reports
    - Resolves: #1035317
    - Resolves: #1036790
  - Fix memory leak in RPM handling
    - Resolves: #1016780
  - Check for unsigned overflows
    - Resolves: #1034869


author: Martin Milata <mmilata@redhat.com> 0.13-2
changelog:
  - Use elfutils unwinder
    - Resolves: #1051569
  - Disable function fingerprinting
    - Resolves: #1052402


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.5-9
changelog:
  - related: #846699
    do the renaming of nfsiostat properly, with patch
  - resolves: #1332662
    added tapestat utility for monitoring tape drives


author: Michal Sekletár <msekleta@redhat.com> - 10.1.5-18
changelog:
  - add -f flag to force fdatasync() after sa file update (#1662094)
  - don't call filesystem count functions when we are not collecting fs statistics (#1670060)
  - skip autofs when gathering filesystem statistics (#1670060)
  - fix use of incorrect preposition in sar man page (#1624410)
  - fix CPU usage reporting (#1618688)


author: Thomas Haller <thaller@redhat.com> - 1:1.4.0-3
changelog:
  - wifi: fix activation failure due to error changing MAC address (rh#1371623)
  - core: fix wrong source interface for PropertiesChanged D-Bus signal (rh#1371920)
  - team: restore validation of JSON configuration (rh#1371967)
  - device: manage firewall zone for assumed persistent connections (rh#1366288)
  - device: don't let external changes cause a release of the slave (rh#1357738)


author: Thomas Haller <thaller@redhat.com> - 1:1.4.0-5
changelog:
  - libnm,nmtui: fix handling empty cloned-mac-address property (rh#1372799)
  - ibft: grant required CAP_SYS_ADMIN capabilities (rh#1371201)


author: Thomas Haller <thaller@redhat.com> - 1:1.4.0-7
changelog:
  - wifi: another fix activation failure due to error changing MAC address (rh#1371623, rh#1374023)
  - dhcp: fix race condition that may cause lost lease events and DHCP timeouts (rh#1373276)


author: Hon Ching(Vicky) Lo <lo1@us.ibm.com> - 713-4
changelog:
  - Used ExclusiveArch instead of BuildArch tag
  - Removed attr from symlink in devel subpackage 
  - Added manpages and modified the Source0
  - Added CCFLAGS and LNFLAGS to enforce hardening and optimization


author: Jerry Snitselaar <jsnitsel@redhat.com> - 713-9
changelog:
  - Update release version
  resolves: rhbz#1384452 - New package request: Include IBM's Trusted Computing Group Software Stack (TSS) 2.0 (tss2)


author: Jerry Snitselaar <jsnitsel@redhat.com> - 713-10
changelog:
  - Fix missing pointer deref
  - Fix array index check
  - Clean up malloc checks
  - Fix default switch case in TSS_Name_GetName
  - Fix return in TPMS_NV_CERTIFY_INFO_Unmarshal
  - Check for null ticket file name in policyticket
  - Fix null check of context file name in contextload


author: Milan Crha <mcrha@redhat.com> - 2.62.2-2
changelog:
  - Backport upstream patch for CVE-2018-12910 - Crash in soup_cookie_jar.c: get_cookies() on empty hostnames
  - Resolves: #1598838


author: Boris Ranto <branto@redhat.com> - 2.0.19-12
changelog:
  - New release
  - Move OpenIPMI modprobe conf to /usr/lib/modprobe.d/ (#1195289)
  - Avoid warning on update/removal (#1256798)
  - Stop manually creating and shipping /var/run/OpenIPMI (#1296560)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-2
changelog:
  - Release 1.3.5.10-2
  - Resolves: bug 1353714 - If a cipher is disabled do not attempt to look it up (DS 48743)
  - Resolves: bug 1353592 - Setup-ds.pl --update fails - regression (DS 48755)
  - Resolves: bug 1353544 - db2bak.pl task enters infinitive loop when bak fs is almost full (DS 48914)
  - Resolves: bug 1354374 - Upgrade to 389-ds-base >= 1.3.5.5 doesn't install 389-ds-base-snmp (DS 48918)


author: Peter Hutterer <peter.hutterer@redhat.com> 0.34.2-2
changelog:
  - Add Pressure2K option for backwards-compatibility with applications that
    hardcode the previous pressure range (#1457024)


author: Peter Hutterer <peter.hutterer@redhat.com> 0.34.2-3
changelog:
  - Fix hang after unplugging a device (#1496650)
  - Correct device flags for some Cintiqs and Intuos pros (#1496659)


author: Tomas Hozza <thozza@redhat.com> 1.14-3
changelog:
  - Added libuuid-devel to BuildRequires to use libuuid functions
    in "src/warc.c" functions (#865421)


author: Tomas Hozza <thozza@redhat.com> - 1.14-5
changelog:
  - Added BuildRequires: perl-podlators for pod2man
  - Patched manpage to silent new Tex errors
  - Resolves: (#914571)


author: Tomas Hozza <thozza@redhat.com> - 1.14-6
changelog:
  - add missing options accept-regex and reject-regex to man page
  - fix errors in texi2pod introduced in Perl-5.18


author: Tomas Hozza <thozza@redhat.com> - 1.14-8
changelog:
  - Fix deadcode and possible use of NULL in vprintf (#913153)
  - Add documentation for --regex-type and --preserve-permissions
  - Fix --preserve-permissions to work as documented (and expected)
  - Fix bug when authenticating using user:password@url syntax (#912358)
  - Document and fix --backups option


author: Doug Ledford <dledford@redhat.com> - 1.1.0.237-2
changelog:
  - Some of the scripts are missing the execute bit, fix that
  - Clean up the check script to be more appropriate for in-box use
  - Resolves: bz1182413, bz1182417


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-6
changelog:
  - Resolves: rhbz#1371880

  - libvotequorum: Bump version (rhbz#1371880)
  - merge upstream commit 96f91f23a6a413535cc2f0e8492e2300373fed40 (rhbz#1371880)
  - votequorum: Don't update expected_votes display if value is too high (rhbz#1371880)
  - merge upstream commit 596433066805af029be1292a37a35ce31307f0bf (rhbz#1371880)
  - votequorum: simplify reconfigure message handling (rhbz#1371880)
  - merge upstream commit 4a385f2e94c7168dbd92168c54a80ee97a3c2140 (rhbz#1371880)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-7
changelog:
  - Related: rhbz#1371880

  - Fix build on RHEL7.3 latest (rhbz#1371880)
  - merge upstream commit 19e48a6eee20d5f34f79a3b8d4e1c694169c1d7b (rhbz#1371880)
  - Enable aarch64 build (bz#1422598)


author: Dave Anderson <anderson@redhat.com> - 2.0-3
changelog:
  - Replace obsolete _init() and _fini() functions.
  - Fix possible segmentation violation on calloc() failure.
  - Initialize trace_dat to avoid compiler warning.


author: Dave Anderson <anderson@redhat.com> - 2.0.12
changelog:
  - Differentiate ppc64 .ring_buffer_read text symbol from ring_buffer_read data symbol
  - Fix for ring_buffer_per_cpu.nr_pages size change on big-endian systems 
  - Fix for Linux 4.7 change to the TRACE_EVENT_FL_TRACEPOINT flag
    Resolves: rhbz#1441914
    Resolves: rhbz#1440726


author: Nalin Dahyabhai <nalin@redhat.com> 0.31.2-2
changelog:
  - add missing requires(post) on killall, which we use to poke the message
    bus daemon to get it to reload its configuration, spotted by rcritten


author: Nalin Dahyabhai <nalin@redhat.com> 0.31.3-2
changelog:
  - use %systemd_postun_with_restart instead of plain old %systemd_postun,
    because we can be restarted in the %postun


author: Nalin Dahyabhai <nalin@redhat.com> 0.31.4-1
changelog:
  - add an [Install] section containing WantedBy=sysinit.target to the systemd
    unit file (#963722), allowing it to actually be "enabled"


author: Nalin Dahyabhai <nalin@redhat.com> 0.31.5-1
changelog:
  - add man(5) pages for the configuration files that we include which get
    included by others, just to be tidy (#884552)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.31.5-4
changelog:
  - correctly check the error returned from getpwnam_r(), so that we don't
    miss an ERANGE error (#1098616, part of #1108398)
  - add a note to pam_oddjob_mkhomedir's manual pointing to where the
    configuration would actually go (part of #1108398)
  - stop overriding the system-wide UMASK default in our default
    oddjobd-mkhomedir.conf file (#995097,#1123860), and stop using its
    proprocessor-input file as a reference, since we're patching it now


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-34.3
changelog:
  - fix CVE-2010-5298 - possible use of memory after free
  - fix CVE-2014-0195 - buffer overflow via invalid DTLS fragment
  - fix CVE-2014-0198 - possible NULL pointer dereference
  - fix CVE-2014-0221 - DoS from invalid DTLS handshake packet
  - fix CVE-2014-0224 - SSL/TLS MITM vulnerability
  - fix CVE-2014-3470 - client-side DoS when using anonymous ECDH


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-35
changelog:
  - fix CVE-2014-3505 - doublefree in DTLS packet processing
  - fix CVE-2014-3506 - avoid memory exhaustion in DTLS
  - fix CVE-2014-3507 - avoid memory leak in DTLS
  - fix CVE-2014-3508 - fix OID handling to avoid information leak
  - fix CVE-2014-3509 - fix race condition when parsing server hello
  - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS
  - fix CVE-2014-3511 - disallow protocol downgrade via fragmentation


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-37
changelog:
  - add support for RFC 5649 (#1119738)
  - do not pass the FIPS integrity check if the .hmac files are empty (#1128849)
  - add ECC TLS extensions to DTLS (#1119803)
  - do not send ECC ciphersuites in SSLv2 client hello (#1090955)
  - properly propagate encryption failure in BIO_f_cipher (#1072439)
  - fix CVE-2014-0224 fix that broke EAP-FAST session resumption support
  - improve documentation of ciphersuites - patch by Hubert Kario (#1108026)
  - use case insensitive comparison for servername in s_server (#1081163)
  - add support for automatic ECDH curve selection on server (#1080128)
  - FIPS mode: make the limitations on DSA, DH, and RSA keygen
    length enforced only if OPENSSL_ENFORCE_MODULUS_BITS environment
    variable is set


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-39
changelog:
  - fix CVE-2014-3567 - memory leak when handling session tickets
  - fix CVE-2014-3513 - memory leak in srtp support
  - add support for fallback SCSV to partially mitigate CVE-2014-3566
    (padding attack on SSL3)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-40
changelog:
  - use FIPS approved method for computation of d in RSA
  - copy digest algorithm when handling SNI context switch


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-41
changelog:
  - fix CVE-2014-3570 - incorrect computation in BN_sqr()
  - fix CVE-2014-3571 - possible crash in dtls1_get_record()
  - fix CVE-2014-3572 - possible downgrade of ECDH ciphersuite to non-PFS state
  - fix CVE-2014-8275 - various certificate fingerprint issues
  - fix CVE-2015-0204 - remove support for RSA ephemeral keys for non-export
    ciphersuites and on server
  - fix CVE-2015-0205 - do not allow unauthenticated client DH certificate
  - fix CVE-2015-0206 - possible memory leak when buffering DTLS records


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42
changelog:
  - test in the non-FIPS RSA keygen for minimal distance of p and q
    similarly to the FIPS RSA keygen


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-22
changelog:
  - Related: #1102842 - squid rpm package misses /var/run/squid needed for
    smp mode. Creation of this directory was moved to service file.


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-23
changelog:
  - Related: #1102842 - squid rpm package misses /var/run/squid needed for
    smp mode. Creation of this directory was moved to tmpfiles.d conf file.


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-24
changelog:
  - Related: #1102842 - squid rpm package misses /var/run/squid needed for
    smp mode. Creation of /var/run/squid was also needed to be in SPEC file.


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-25
changelog:
  - Related: #1102842 - squid rpm package misses /var/run/squid needed for
    smp mode. Squid needs write access to /var/run/squid.


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-26.1
changelog:
  - Resolves: #1330576 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054
    squid: various flaws


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-26.2
changelog:
  - Related: #1330576 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054
    squid: various flaws


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-26.3
changelog:
  - Related: #1330576 - CVE-2016-4553 squid: Cache poisoning issue in
    HTTP Request handling
  - Related: #1334491 - CVE-2016-4554 CVE-2016-4555 CVE-2016-4556
    squid: various flaws


author: Kamil Dudka <kdudka@redhat.com> - 5.0.2-30
changelog:
  - fix stack-based buffer overflow in utils.c:checkmailpath() (CVE-2018-1100)
  - fix stack-based buffer overflow in gen_matches_files() (CVE-2018-1083)
  - fix stack-based buffer overflow in exec.c:hashcmd() (CVE-2018-1071)
  - avoid crash when copying empty hash table (CVE-2018-7549)
  - fix buffer overrun in xsymlinks (CVE-2017-18206)
  - fix NULL dereference in cd (CVE-2017-18205)
  - fix buffer overflow when scanning very long path for symlinks (CVE-2014-10072)
  - fix buffer overflow for very long fds in >& fd syntax (CVE-2014-10071)


author: Matej Habrnal <mhabrnal@redhat.com> - 2.1.11-46
changelog:
  - remove not implemented option AttemptHardlink in vmcore.conf
  - introduce unsafe reporting for not-reporable problems
  - rewrite skip_pfx() function to work with journal msgs
  - don't expect kernel's version '2.6.*' or '3.*.*'
  - Related: #1416586, #1257159, #1328264, #1378469


author: Martin Kutlak <mkutlak@redhat.com> - 2.1.11-49
changelog:
  - Translation updates
  - Stop creating uReports for unpackaged executables
  - koops: add detailed taint flag description for kernel oopses
  - koops: fix kernel oops and fatal MCE recognition
  - python: provide more information about Python exceptions
  - vmcore: fix replication of vmcore files
  - Related: #1271213, #1460224, #1374648, #1361116, #1228344,
  - Related: #1395285, #1214730, #1446410, #1319828, #1501718


author: CentOS Sources <bugs@centos.org> - 2.1.11-50.el7.centos
changelog:
  - Drop RHTS hint
  -  Change by David Mansfield <david@orthanc.cobite.com>
  -  Per http://bugs.centos.org/view.php?id=7192
  - Remove cli suggestion text patch
  - set URL to retrace server
  - update to not run sosreport
  -  Per http://bugs.centos.org/view.php?id=7913


author: Stephen Gallagher <sgallagh@redhat.com> - 2:2.12.1-15
changelog:
  - Generate SSL certificates with x509v3 and CA:FALSE
  - Automatically import self-signed certificates into local trust-store
  - Move SSL certificate generation into the systemd service file
  - Resolves: #1041555


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-1
changelog:
  - Fix packaging of tmpfiles
    Resolves: #1180993
  - Add install Platform_LINUX_XSCALE_GNU.h, Linkage.h and CIMListener.h to -devel
    because of lmiwbem (CIMListener class), add symlink to libpeglistener.so.1
    Resolves: #1120701
  - Update to upstream version 2.14.1
    Resolves: #1097187, #1039050, #1007386
  - Fix sending of SNMPv3 traps
    Resolves: #1218954


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-2
changelog:
  - Remove files created in %check
    Resolves: #1232341
  - Fix setupSDK in -devel
    Resolves: #1127399
  - Add snmp tests to the -test rpm and enable them, configure snmptrapd
    in test setup phase
    Related: #1218954


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-4
changelog:
  - Fix ppc64le SDK
    Resolves: #1266235
  - Move SSL certificates to more convenient place, update related scripts
    and README.RedHat.SSL
    Resolves: #1308809
  - Change repository update to get rid of warning messages during cleanup
    Resolves: #1257085
  - Remove TESTID environment variable which breaks automatic testing in Beaker
    Resolves: #1266655
  - Add CIMEnumerationContext.h and UintArgs.h to -devel
    Resolves: #1335873
  - Fix wrong formatting in cimconfig man page
    Resolves: #1263895
  - Add missing description of httpSessionTimeout to cimconfig man page
    Resolves: #1263894


author: Stef Walter <stefw@redhat.com> - 0.14.6-5
changelog:
  - Don't crash when full_name_format is not in sssd.conf [#1051033]
    This is a regression from a prior update.


author: Stef Walter <stefw@redhat.com> - 0.16.0-1
changelog:
  - Updated to upstream 0.16.0
  - Resolves: rhbz#1174911
  - Resolves: rhbz#1142191
  - Resolves: rhbz#1142148


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-26
changelog:
  - fix CVE-2013-6449 - crash when version in SSL structure is incorrect
  - drop weak ciphers from the default TLS ciphersuite list
  - add back some symbols that were dropped with update to 1.0.1 branch
  - more FIPS validation requirement changes


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-28
changelog:
  - fix CVE-2013-4353 - Invalid TLS handshake crash
  - fix CVE-2013-6450 - possible MiTM attack on DTLS1


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-31
changelog:
  - print ephemeral key size negotiated in TLS handshake (#1057715)
  - add DH_compute_key_padded needed for FIPS CAVS testing
  - make expiration and key length changeable by DAYS and KEYLEN
    variables in the certificate Makefile (#1058108)
  - change default hash to sha256 (#1062325)
  - lower the actual 3des strength so it is sorted behind aes128 (#1056616)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-13 + 0.9.3-9
changelog:
  - Increase limit of files for glob match in sftp (#1160377)
  - Add pam_reauthorize.so to /etc/pam.d/sshd (#1204233)
  - Show all config values in sshd test mode (#1187597)
  - Document required selinux boolean for working ssh-ldap-helper (#1178116)
  - Consistent usage of pam_namespace in sshd (#1125110)
  - Fix auditing when using combination of ForcedCommand and PTY (#1199112)
  - Add sftp option to force mode of created files (#1197989)
  - Ability to specify an arbitrary LDAP filter in ldap.conf for ssh-ldap-helper (#1201753)
  - Provide documentation line for systemd service and socket (#1181591)
  - Provide LDIF version of LPK schema (#1184938)
  - Document TERM environment variable (#1162683)
  - Fix ssh-copy-id on non-sh remote shells (#1201758)
  - Do not read RSA1 hostkeys for HostBased authentication in FIPS (#1197666)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-14 + 0.9.3-9
changelog:
  - Fix ldif schema to have correct spacing on newlines (#1184938)
  - Add missing values for sshd test mode (#1187597)
  - ssh-copy-id: tcsh doesnt work with multiline strings (#1201758)
  - Fix memory problems with newkeys and array transfers (#1223218)
  - Enhance AllowGroups documentation in man page (#1150007)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-15 + 0.9.3-9
changelog:
  - One more typo in manual page documenting TERM variable (#1162683)
  - Fix race condition with auditing messages answers (#1240613)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-17 + 0.9.3-9
changelog:
  - Security fixes released with openssh-6.9 (CVE-2015-5352) (#1247864)
   - XSECURITY restrictions bypass under certain conditions in ssh(1) (#1238231)
   - weakness of agent locking (ssh-add -x) to password guessing (#1238238)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-20 + 0.9.3-9
changelog:
  - Fix vulnerabilities published with openssh-7.0 (#1265807)
   - Privilege separation weakness related to PAM support
   - Use-after-free bug related to PAM support


author: Chris Leech <cleech@redhat.com> - 1.0.1-3.git036e314
changelog:
  - 1273663 sync with upstream v1.0.1-26-g036e314
    system capability incorrect advertised as station only


author: Kamil Dudka <kdudka@redhat.com> 1.4.3-9
changelog:
  - curl consumes too much memory during scp download (#1080459)
  - prevent a not-connected agent from closing STDIN (#1147717)


author: Kamil Dudka <kdudka@redhat.com> 1.4.3-12
changelog:
  - session: avoid printing misleading debug messages (#1503294)
  - scp: send valid commands for remote execution (#1489733)


author: Kamil Dudka <kdudka@redhat.com> 1.8.0-2
changelog:
  - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863)
  - fix out-of-bounds memory comparison with specially crafted message channel request (CVE-2019-3862)
  - fix out-of-bounds reads with specially crafted SSH packets (CVE-2019-3861)
  - fix zero-byte allocation in SFTP packet processing resulting in out-of-bounds read (CVE-2019-3858)
  - fix integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)
  - fix integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)
  - fix integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)


author: Thomas Haller <thaller@redhat.com> - 3.2.21-6
changelog:
  - fix rtnl_link_get_stat() for IPSTATS_MIB_* after kernel API breakage
  - fix parsing IFLA_PROTINFO which broke on older kernels (rh #1062533)
  - fix printing in nl_msec2str for whole seconds
  - don't reset route scope in rtnl_route_build_msg if set to RT_SCOPE_NOWHERE
  - backport nl_has_capability function


author: Thomas Haller <thaller@redhat.com> - 3.2.21-9
changelog:
  - improve local port handling for netlink socket with EADDRINUSE (rh #1249158)
  - rtnl: backport support for link-netnsid attribute (rh #1255050)


author: Owen Taylor <otaylor@redhat.com> - 3.14.4-26
changelog:
  - Turn on newly added "threaded swap wait" functionality in Cogl
    so that on NVIDIA cards, frame completion is handled in a proper
    non-blocking fashion, fixing bugs with idles not running when
    they should.
    Resolves: #1305076


author: Rui Matos <rmatos@redhat.com> - 3.14.4-29
changelog:
  - Allow clutter to fallback to the classic gl driver since mesa's
    software driver doesn't support gl3
    Related: #1361251


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.2-12
changelog:
  - Resolves: rhbz#1610667 - sssd_ssh leaks file descriptors when more than one certificate is converted into an SSH key
  - Resolves: rhbz#1583360 - The IPA selinux provider can return an error if SELinux is completely disabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.2-13
changelog:
  - Resolves: rhbz#1593756 - sssd needs to require a newer version of
                             libtalloc and libtevent to avoid an issue
                             in GPO processing


author: Michal Židek <mzidek@redhat.com> - 1.16.2-13.1
changelog:
  - Resolves: rhbz#1645047 - sssd only sets the SELinux login context if it
                             differs from the default [rhel-7.6.z]


author: Michal Židek <mzidek@redhat.com> - 1.16.2-13.2
changelog:
  - Resolves: Bug 1649784 - SSSD not fetching all sudo rules from
                            AD [rhel-7.6.z]


author: Michal Židek <mzidek@redhat.com> - 1.16.2-13.4
changelog:
  - Resolves: rhbz#1659083 - SSSD must be cleared/restarted periodically in
              order to retrieve AD users through IPA Trust [rhel-7.6.z]


author: Michal Židek <mzidek@redhat.com> - 1.16.2-13.5
changelog:
  - Resolves: rhbz#1659507 - SSSD's LDAP authentication provider does not work
                             if ID provider is authenticated with GSSAPI [rhel-7.6.z]


author: Michal Židek <mzidek@redhat.com> - 1.16.2-13.6
changelog:
  - Resolves: rhbz#1683578 - sssd_krb5_locator_plugin introduces delay in
                             cifs.upcall krb5 calls [rhel-7.6.z]


author: Michal Židek <mzidek@redhat.com> - 1.16.2-13.8
changelog:
  - Resolves: rhbz#1690759 - RHEL STIG pointing sssd Packaging issue [rhel-7.6.z]
                           - Part 2.


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-4
changelog:
  - cd to the correct directory before md5sum to fix BACKUP_INTEGRITY_CHECK.
    Upstream PR#1685, bz1532676


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-5
changelog:
  - Ensure that NetBackup is started automatically upon recovery (PR#1544)
    Also do not kill daemons spawned by sysinit.service at the service's end
    (PR#1610, applies to NetBackup and also to dhclient)
    Resolves #1506231


author: Tim Waugh <twaugh@redhat.com> 9.07-18
changelog:
  - Applied patch from upstream to fix memory handling issue that could
    lead to crashes (bug #1105519).


author: Jay Fenlason <fenlason@redhat.com> 1.5.7-8
changelog:
  - Add the -output patch to have programs use /var/cache/ibutils
    instead of /tmp
    Resolves: bz958569


author: Doug Ledford <dledford@redhat.com> - 1.5.7-12
changelog:
  - Change ExclusiveArch to ExcludeArch instead so we don't have
    the same problem again in the future
  - Update to the git repo tarball that we shipped in rhel6.6
  - Related: bz1123998


author: Owen Taylor <otaylor@redhat.com> - 3.14.4-49
changelog:
  - Fix bug where maximized windows would flicker to the wrong size when
    restarting the shell (on stereo enable or otherwise)
    Resolves: #1306802


author: Tomas Popela <tpopela@redhat.com> - 2.14.6-1
changelog:
  - Update to 2.14.6
  - Resolves: rhbz#1440681
  - Don't crash is no render is available in AX render object
  - Resolves: rhbz#1437672


author: Tomas Popela <tpopela@redhat.com> - 2.14.6-3
changelog:
  - Bundle only needed icu libraries
  - Don't list bundled icu libraries in provides
  - Resolves: rhbz#1383614


author: Tomas Popela <tpopela@redhat.com> - 2.14.7-1
changelog:
  - Update to 2.14.7
  - Backport more of a11y fixes from upstream
  - Fix JSC crashes on big endian arches
  - Resolves: rhbz#1442160


author: Tomas Popela <tpopela@redhat.com> - 2.14.7-2
changelog:
  - Fix a CLoop patch that was not correctly backported from upstream, causing
    crashes on big endian machines
  - Resolves: rhbz#1442160


author: Tomas Popela <tpopela@redhat.com> - 2.14.7-3
changelog:
  - Update the bundled brotli and woff2 to the latest releases due to
    woff2's license incompatibility with WebKitGTK+ project
  - Resolves: rhbz#1500368


author: Ray Strode <rstrode@redhat.com> 3.14.4-30
changelog:
  - Another timed login update.  Makes the indicator work
    when animations are disabled.
    Related: #1252424


author: Ray Strode <rstrode@redhat.com> 3.14.4-35
changelog:
  - Ensure the unlock password entry is desensitized when there's
    no password being asked for (Such as when the message is just
    "Please insert smartcard")
    Resolves: #1262999


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 1:6.0.0-13
changelog:
  - Explicitly added '-g' option into CFLAGS & CXXFLAGS to correctly build .debug_info for i386 (bug #1413034)
  - Added a workaround to correctly add hardening flags during build process (bug #1406689)


author: Marek Kasik <mkasik@redhat.com> - 3.8.2-8
changelog:
  - Allow to customize desktop size for RDP protocol
  - Add available translations for new strings
  - Resolves: #862389


author: Marek Kasik <mkasik@redhat.com> - 3.8.2-9
changelog:
  - Use FreeRDP API in RDP plugin
  - Request RDP certificate verification if needed
  - Add available translations for new strings
  - Resolves: #1091765


author: Jan Synáček <jsynacek@redhat.com> - 1.2.0.10-9
changelog:
  - dos2unix'ed the patch
  - Call dos2unix before patching and dos2unix Makefile as well
  - Use %{_sbindir} instead of '/sbin'


author: Than Ngo <than@redhat.com> - 2:2012-34.20130427_r30134
changelog:
  - Resolves: bz#1064453, add missing texlive-metapost and groff.enc
    Resolves: bz#948532, add missing manpages for pdfxmltex, xmltex
    Resolves: bz#1213886, tex4ht-bin requires latex
    Resolves: bz#1217556, port for poppler-0.26.5
    Resolves: bz#1035679, scriptlet errors when installing texlive packages
    Resolves: bz#1184987, add texlive-titling


author: Than Ngo <than@redhat.com> - 2:2012-39.20130427_r30134
changelog:
  - Resolves: #1320337 - dependiency on texlive-xetex-def
  - Resolves: #1350485 - updmap from texlive-tetex-bin cannot be executed
  - Resolves: #1337925 - scriptlet errors
  - Resolves: #1186825 - add coreutils for post/unpost


author: Pavel Raiskup <praiskup@redhat.com> - 5.1.2-5alpha
changelog:
  - fix manual page inconsistencies with help output (private #948533)
  - enable/fix the 'xzgrep -h' (private #850898)


author: Brian C. Lane <bcl@redhat.com> 3.1-16
changelog:
  - tests: Remove rmmod loop from t8001
    Resolves: rhbz#1040504
  - tests: Increase size of container filesystem in t4100
    Resolves: rhbz#1036149
  - tests: Disable t4100 dvh test for now
    Resolves: rhbz#1036093
  - libparted: Make sure not to treat percentages as exact
    Resolves: rhbz#1045957
  - tests: Use mkfs.xfs to create files
    Resolves: rhbz#1036152


author: Brian C. Lane <bcl@redhat.com> 3.1-18
changelog:
  - Fix manpage NAME so whatis works with parted
    Resolves: rhbz#948424
  - GPT add support for PReP GUID
    Resolves: rhbz#1108196


author: Brian C. Lane <bcl@redhat.com> 3.1-21
changelog:
  - Backport fix for 1 sector logical partition separation from start of extended
    Resolves: rhbz#1212323


author: Brian C. Lane <bcl@redhat.com> 3.1-22
changelog:
  - Use 512b sector size when communicating with device-mapper
    Resolves: rhbz#1188431
  - Add a test to make sure partitions are the correct size on device-mapper
    Related: rhbz#1188431


author: Brian C. Lane <bcl@redhat.com> 3.1-23
changelog:
  - libparted: Use read only when probing devices on linux
    Resolves: rhbz#1245144
  - tests: Use wait_for_dev_to_ functions
    Related: rhbz#1245144


author: Vit Mojzis <vmojzis@redhat.com> - 3.2.30-1
changelog:
  - Fix summary and "if" text for AVCs with unknown target path (#1437772)
  - Remove unused booleans.py file
  - src/sealert: Finish dbus communication after error (#1461486)


author: Vit Mojzis <vmojzis@redhat.com> - 3.2.30-3
changelog:
  - Check for the existence of setroubleshoot group separately (#1478118)
  - Fix AVC.__typeMatch to handle aliases properly (#1459844, #1459835, #1459875)
  - Fix allowed_target_types (#1460642, #1460648)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.191-2.6.15.1
changelog:
  - Bump to 2.6.15 and u191b00.
  - Drop PR3608/RH1566890/CVE-2018-3639 patch now applied upstream.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.201-2.6.16.1
changelog:
  - Bump to 2.6.16 and u201b00.
  - Update 8076221/PR2809 (disable RC4) to apply after 8208350 (disable DES)
  - Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.7.0.211-2.6.17.1
changelog:
  - Produce debug symbols for libpulse-java.so
  - Set IT_CFLAGS=-g so that debug symbols for the pulse audio
  - native library are being produced. This is needed to fix
  - rpmdiff errors of missing .debug_info in pulse-java.so.debug.
  - Resolves: rhbz#1661577


author: Owen Taylor <otaylor@redhat.com> - 1.18.2-12
changelog:
  - Add patches to improve display synchronization on NVIDIA
      
    When testing quadbuffer stereo patches, GNOME Shell would sometimes
    hang up on restart. This turned out to be a problem with display
    synchronization on NVIDIA. The patches added here make display
    synchronization work much more similarly with the NVIDIA drivers
    and the open source drivers, which not only fixes this bug, but should
    reduce future bugs.
      
    Resolves: #1305076

  - Add patches improving frame completion events in Cogl


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.9
changelog:
  - Resolves: #1311468 shared certificateProfiles container is missing on a
    freshly installed RHEL7.2 system
    - upgrade: unconditional import of certificate profiles into LDAP
  - Resolves: #1311470 ipa trust-add succeded but after that ipa trust-find
    returns "0 trusts matched"
    - upgrade: fix config of sidgen and extdom plugins
    - trusts: use ipaNTTrustPartner attribute to detect trust entries
    - Warn user if trust is broken
    - fix upgrade: wait for proper DS socket after DS restart
  - Resolves: #1311502 [RFE] compat tree: show AD members of IPA groups
    - slapi-nis: update configuration to allow external members of IPA groups


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.10
changelog:
  - Resolves: #1311470 ipa trust-add succeded but after that ipa trust-find
    returns "0 trusts matched"
    - Insure the admin_conn is disconnected on stop
    - Fix connections to DS during installation
  - Renamed patch 1011 to 0196, as it was merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.11
changelog:
  - Resolves: #1311470 ipa trust-add succeded but after that ipa trust-find
    returns "0 trusts matched"
    - Fix broken trust warnings


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.12
changelog:
  - Resolves: #1309382 issues with migration from RHEL 6 self-signed to RHEL 7 CA
    IPA setup
    - replica install: improvements in the handling of CA-related IPA config
      entries


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.13
changelog:
  - Resolves: #1324060 Installers fail when there are multiple versions of the
    same certificate
    - certdb: never use the -r option of certutil


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.15
changelog:
  - Related: #1327197 Crash during IPA upgrade due to slapd
    - spec file: update minimum required version of slapi-nis


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.16
changelog:
  - Resolves: #1337820 URI details missing and OCSP-URI details are incorrectly
    displayed when certificate generated using IPA on RHEL 7.2up2.
    - Prevent replica install from overwriting cert profiles
    - Detect and repair incorrect caIPAserviceCert config


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.17
changelog:
  - Resolves: #1339304 CA installed on replica is always marked as renewal master
    - replica install: do not set CA renewal master flag


author: Frank Ch. Eigler <fche@redhat.com> - 3.3-2
changelog:
  - Enable BPF build (rhbz1544689, rhbz1311586) (x86-64 only)
  - Fix vfs.add_to_page_cache probe (rhbz1547238)
  - Fix foreach_limit.exp compilability (rhbz1591267)


author: Serhei Makarov <smakarov@redhat.com> - 3.3-3
changelog:
  - Add BPF left-operand fix (rhbz1560044) (x86-64 only)
  - Add stap.1 note on missing stapbpf.8 (rhbz1560044)
  - Fix RHEL-ALT build (rhbz1544689)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-4 + 0.9.3-9
changelog:
  - revert the default of KerberosUseKuserok back to yes
  - fix kuserok patch which checked for the existence of .k5login unconditionally
    and hence prevented other mechanisms to be used properly


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-8 + 0.9.3-9
changelog:
  - increase size of AUDIT_LOG_SIZE to 256 (#1171163)
  - record pfs= field in CRYPTO_SESSION audit event (#1171248)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-10 + 0.9.3-9
changelog:
  - add new option GSSAPIEnablek5users and disable using ~/.k5users by default CVE-2014-9278
    (#1169843)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-2
changelog:
  - core: fix persisting managed state of device (rh #1440171)
  - proxy: fix use-after-free (rh #1450459)
  - device: don't wrongly delay startup complete waiting for carrier (rh #1450444)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-3
changelog:
  - dhcp: don't add route to DHCP4 server (rh #1448987)
  - libnm: fix NUL termination of device's description (rh #1443114)
  - libnm, core: ensure valid UTF-8 in device properties (rh #1443114)
  - core: fix device's UDI property on D-Bus (rh #1443114)
  - ifcfg-rh: omit empty next hop for routes in legacy format (rh #1452648)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.8.0-4
changelog:
  - device: update external configuration before commit (rh #1449873)
  - bluetooth: fix crash on connecting to a NAP (rh #1454385)
  - device: release removed devices from master on cleanup (rh #1448907)
  - core: activate slaves using ifindex order by default (rh #1452585)
  - nmcli: fix crash when setting 802-1x.password-raw (rh #1456362)
  - po: update translations (rh #1382625)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-5
changelog:
  - ifcfg-rh: fix writing legacy NETMASK value (rh #1445414)
  - tui: fix crash during connect (rh #1456826)
  - libnm: fix libnm rejecting VLAN ID 4095 (rh #1456911)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-6
changelog:
  - connectivity: fix periodic connectivity check (rh #1458399)
  - bond: improve option matching on daemon restart (rh #1457909)
  - device: fix touching device after external activation (rh #1457242)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-7
changelog:
  - bond: fix crash comparing mode while generating bond connection (rh #1459580)
  - connectivity: fix route penalty if WWAN and BT device using ip-ifindex (rh #1459932)
  - device: persist nm-owned in run state (rh #1376199)
  - device: fix assuming master device on restart (rh #1452062)
  - device: apply route metric penality only when the default route exists (rh #1459604)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.8.0-8
changelog:
  - cli: fix output of iface in overview output (rh#1460219)
  - ppp: unexport NMPPPManager instance on dispose (rh#1459579)
  - cli: remove spurious device names from wifi subcommands output (rh#1460527)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-9
changelog:
  - device: don't change MTU unless explicitly configured (rh #1460760)
  - core: don't remove external IPv4 addresses (rh #1459813)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-11
changelog:
  - core: fix wrongly delaying startup-complete for unrealized devices (rh#1498807)
  - core: fix unfreezing signals when unrealizing device fails (rh#1498755)


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-3
changelog:
  - Decrease the iteration count of PKCS#12 for compatibility with Windows
  - Fix deadlock when a token is re-inserted while a client process is running


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-5
changelog:
  - qemu: Fix domain state after reset (rhbz#1269575)
  - rpc: virnetserver: Rename ClientSetProcessingControls to ClientSetLimits (rhbz#1357776)
  - rpc: virnetserver: Move virNetServerCheckLimits which is static up in the file (rhbz#1357776)
  - rpc: virnetserver: Add code to CheckLimits to handle suspending of services (rhbz#1357776)
  - admin: rpc: virnetserver: Fix updating of the client limits (rhbz#1357776)
  - rpc: virnetserver: Remove dead code checking the client limits (rhbz#1357776)
  - storage: Fix a NULL ptr dereference in virStorageBackendCreateQemuImg (rhbz#1363636)
  - qemu: Introduce qemuAliasFromHostdev (rhbz#1289391)
  - qemu: Use the hostdev alias in qemuDomainAttachHostSCSIDevice error path (rhbz#1289391)
  - storage: Don't remove the pool for buildPool failure in storagePoolCreate (rhbz#1362349)
  - lxcDomainCreateXMLWithFiles: Avoid crash (rhbz#1363773)
  - admin: Fix the default uri for session daemon to libvirtd:///session (rhbz#1356858)
  - docs: Distribute subsite.xsl (rhbz#1365004)
  - qemuBuildMachineCommandLine: Follow our pattern (rhbz#1304483)
  - Introduce SMM feature (rhbz#1304483)
  - Introduce @secure attribute to os loader element (rhbz#1304483)
  - qemu: Enable secure boot (rhbz#1304483)
  - qemu: Advertise OVMF_CODE.secboot.fd (rhbz#1304483)
  - tests: Fix broken build (rhbz#1304483)
  - cpu_x86: Introduce x86FeatureIsMigratable (rhbz#1365500)
  - cpu_x86: Properly drop non-migratable features (rhbz#1365500)
  - tests: Add a test for host-model CPU with CMT feature (rhbz#1365500)
  - cpu_x86: Fix host-model CPUs on hosts with CMT (rhbz#1365500)
  - virt-admin: Fix the error when an invalid URI has been provided (rhbz#1365903)
  - conf: improve error log when PCI devices don't match requested controller (rhbz#1363627)
  - conf: don't allow connecting upstream-port directly to pce-expander-bus (rhbz#1361172)
  - conf: restrict where dmi-to-pci-bridge can be connected (rhbz#1363648)
  - conf: restrict expander buses to connect only to a root bus (rhbz#1358712)
  - virNetDevMacVLanCreateWithVPortProfile: Don't mask virNetDevMacVLanTapOpen error (rhbz#1240439)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-6
changelog:
  - qemu_command: don't modify heads for graphics device (rhbz#1366119)
  - virsh: Fix core for cmdSecretGetValue (rhbz#1366611)
  - conf: report an error message for non-existing USB hubs (rhbz#1367130)
  - conf: free the ports array of a USB hub (rhbz#1366097)
  - utils: storage: Fix JSON field name for uri based storage (rhbz#1367260)
  - qemu: Adjust the cur_ballon on coldplug/unplug of dimms (rhbz#1220702)
  - conf: Provide error on undefined iothreadsched entry (rhbz#1366484)
  - qemu: Fix the command line generation for rbd auth using aes secrets (rhbz#1182074)
  - qemu: Fix crash hot plugging luks volume (rhbz#1367259)
  - Revert "admin: Fix the default uri for session daemon to libvirtd:///session" (rhbz#1367269)
  - libvirt: convert to typesafe virConf accessors (rhbz#1367269)
  - admin: Fix default uri config option name s/admin_uri_default/uri_default (rhbz#1367269)
  - virt-admin: Properly fix the default session daemon URI to admin server (rhbz#1367269)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-7
changelog:
  - qemu: caps: Always assume QEMU_CAPS_SMP_TOPOLOGY (rhbz#1097930)
  - conf: Extract code formatting vCPU info (rhbz#1097930)
  - conf: Rename virDomainVcpuInfoPtr to virDomainVcpuDefPtr (rhbz#1097930)
  - conf: Don't report errors from virDomainDefGetVcpu (rhbz#1097930)
  - tests: qemuxml2xml: Format status XML header dynamically (rhbz#1097930)
  - conf: convert def->vcpus to a array of pointers (rhbz#1097930)
  - conf: Add private data for virDomainVcpuDef (rhbz#1097930)
  - qemu: domain: Add vcpu private data structure (rhbz#1097930)
  - qemu: domain: Extract formating and parsing of vCPU thread ids (rhbz#1097930)
  - qemu: Add cpu ID to the vCPU pid list in the status XML (rhbz#1097930)
  - qemu: Store vCPU thread ids in vcpu private data objects (rhbz#1097930)
  - Fix logic in qemuDomainObjPrivateXMLParseVcpu (rhbz#1097930)
  - qemu: Add qemuProcessSetupPid() and use it in qemuProcessSetupIOThread() (rhbz#1097930)
  - qemu: Use qemuProcessSetupPid() in qemuProcessSetupEmulator() (rhbz#1097930)
  - qemu: Use qemuProcessSetupPid() in qemuProcessSetupVcpu() (rhbz#1097930)
  - qemuBuildCpuCommandLine: Don't leak @buf (rhbz#1097930)
  - conf: Make really sure we don't access non-existing vCPUs (rhbz#1097930)
  - conf: Make really sure we don't access non-existing vCPUs again (rhbz#1097930)
  - qemu: capabilities: Drop unused function virQEMUCapsGetMachineTypes (rhbz#1097930)
  - qemu: caps: Sanitize storage of machine type related data (rhbz#1097930)
  - qemu: cap: Refactor access to array in virQEMUCapsProbeQMPMachineTypes (rhbz#1097930)
  - qemu: monitor: Add monitor API for device_add supporting JSON objects (rhbz#1097930)
  - qemu: monitor: Add do-while block to QEMU_CHECK_MONITOR_FULL (rhbz#1097930)
  - qemu: Improve error message in virDomainGetVcpus (rhbz#1097930)
  - qemu: domain: Rename qemuDomainDetectVcpuPids to qemuDomainRefreshVcpuInfo (rhbz#1097930)
  - qemu: monitor: Rename qemuMonitor(JSON|Text)GetCPUInfo (rhbz#1097930)
  - qemu: domain: Improve vCPU data checking in qemuDomainRefreshVcpu (rhbz#1097930)
  - qemu: domain: Simplify return values of qemuDomainRefreshVcpuInfo (rhbz#1097930)
  - internal: Introduce macro for stealing pointers (rhbz#1097930)
  - tests: qemucapabilities: Add data for qemu 2.7.0 (rhbz#1097930)
  - qemu: setcpus: Report better errors (rhbz#1097930)
  - qemu: setvcpus: Extract setting of maximum vcpu count (rhbz#1097930)
  - qemu: driver: Extract setting of live vcpu count (rhbz#1097930)
  - qemu: driver: Split out regular vcpu hotplug code into a function (rhbz#1097930)
  - conf: Provide error on undefined vcpusched entry (rhbz#1097930)
  - qemu: monitor: Return structures from qemuMonitorGetCPUInfo (rhbz#1097930)
  - qemu: monitor: Return struct from qemuMonitor(Text|Json)QueryCPUs (rhbz#1097930)
  - qemu: Add capability for query-hotpluggable-cpus command (rhbz#1097930)
  - qemu: Forbid config when topology based cpu count doesn't match the config (rhbz#1097930)
  - qemu: capabilities: Extract availability of new cpu hotplug for machine types (rhbz#1097930)
  - qemu: monitor: Extract QOM path from query-cpus reply (rhbz#1097930)
  - qemu: monitor: Add support for calling query-hotpluggable-cpus (rhbz#1097930)
  - qemu: monitor: Add algorithm for combining query-(hotpluggable-)-cpus data (rhbz#1097930)
  - tests: Add test infrastructure for qemuMonitorGetCPUInfo (rhbz#1097930)
  - tests: cpu-hotplug: Add data for x86 hotplug with 11+ vcpus (rhbz#1097930)
  - tests: cpu-hotplug: Add data for ppc64 platform including hotplug (rhbz#1097930)
  - tests: cpu-hotplug: Add data for ppc64 out-of-order hotplug (rhbz#1097930)
  - tests: cpu-hotplug: Add data for ppc64 without threads enabled (rhbz#1097930)
  - qemu: domain: Extract cpu-hotplug related data (rhbz#1097930)
  - qemu: domain: Prepare for VCPUs vanishing while libvirt is not running (rhbz#1097930)
  - util: Extract and rename qemuDomainDelCgroupForThread to virCgroupDelThread (rhbz#1097930)
  - conf: Add XML for individual vCPU hotplug (rhbz#1097930)
  - qemu: migration: Prepare for non-contiguous vcpu configurations (rhbz#1097930)
  - qemu: command: Add helper to convert vcpu definition to JSON props (rhbz#1097930)
  - qemu: process: Copy final vcpu order information into the vcpu definition (rhbz#1097930)
  - qemu: command: Add support for sparse vcpu topologies (rhbz#1097930)
  - qemu: Use modern vcpu hotplug approach if possible (rhbz#1097930)
  - qemu: hotplug: Allow marking unplugged devices by alias (rhbz#1097930)
  - qemu: hotplug: Add support for VCPU unplug (rhbz#1224341)
  - virsh: vcpuinfo: Report vcpu number from the structure rather than it's position (rhbz#1097930)
  - qemu: driver: Fix qemuDomainHelperGetVcpus for sparse vcpu topologies (rhbz#1097930)
  - doc: clarify documentation for vcpu order (rhbz#1097930)
  - conf: Don't validate vcpu count in XML parser (rhbz#1097930)
  - qemu: driver: Validate configuration when setting maximum vcpu count (rhbz#1370066)
  - conf: Fix build with picky GCC (rhbz#1097930)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-8
changelog:
  - util: storage: Properly set protocol type when parsing gluster json string (rhbz#1372251)
  - conf: Add IOThread quota and period scheduler/cputune defs (rhbz#1356937)
  - qemu: Add support to get/set IOThread period and quota cgroup values (rhbz#1356937)
  - network: new network forward mode 'open' (rhbz#846810)
  - virtlogd.socket: Tie lifecycle to libvirtd.service (rhbz#1372576)
  - cpu_x86: Fix minimum match custom CPUs on hosts with CMT (rhbz#1365500)
  - qemu: cgroup: Extract temporary relaxing of cgroup setting for vcpu hotplug (rhbz#1097930)
  - qemu: process: Fix start with unpluggable vcpus with NUMA pinning (rhbz#1097930)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-9
changelog:
  - Add helper for removing transient definition (rhbz#1368774)
  - qemu: Remove stale transient def when migration fails (rhbz#1368774)
  - qemu: Don't use query-migrate on destination (rhbz#1374613)
  - conf: allow hotplugging "legacy PCI" device to manually addressed PCIe slot (rhbz#1337490)
  - conf: Add support for virtio-net.rx_queue_size (rhbz#1366989)
  - qemu_capabilities: Introduce virtio-net-*.rx_queue_size (rhbz#1366989)
  - qemu: Implement virtio-net rx_queue_size (rhbz#1366989)
  - audit: Audit information about shmem devices (rhbz#1218603)
  - qemu: monitor: Use a more obvious iterator name (rhbz#1375783)
  - qemu: monitor: qemuMonitorGetCPUInfoHotplug: Add iterator 'anycpu' (rhbz#1375783)
  - qemu: monitor: Add vcpu state information to monitor data (rhbz#1375783)
  - qemu: domain: Don't infer vcpu state (rhbz#1375783)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-10.el7_3.1
changelog:
  - qemu: allow 32 slots on pcie-expander-bus, not just 1 (rhbz#1389369)
  - qemu: Reset post-copy capability after migration (rhbz#1392030)
  - qemuhotplugtest: Only read result_filename if used (rhbz#1392031)
  - schema: Allow shmem to have alias (rhbz#1392031)
  - conf: Allow copying of shmem defs (rhbz#1392031)
  - qemu: Make qemuBuildShmemDevStr static (rhbz#1392031)
  - qemu: Rename qemuBuildShmemDevStr to qemuBuildShmemDevLegacyStr (rhbz#1392031)
  - qemu: Move common checks outside qemuBuildShmemDevLegacyStr (rhbz#1392031)
  - qemu: Reorder shmem params nicely (rhbz#1392031)
  - qemu: Abstract shmem socket path preparation (rhbz#1392031)
  - qemu: Rename qemuBuildShmemBackendStr to qemuBuildShmemBackendChrStr (rhbz#1392031)
  - qemu: Add qemuAssignDeviceShmemAlias and use it (rhbz#1392031)
  - conf: Add some shmem helpers for future use (rhbz#1392031)
  - conf: Remove incorrect check when encoding shmem audit message (rhbz#1389013)
  - conf: Fix virDomainShmemDefFind (rhbz#1392031)
  - conf: Don't complicate find loop (rhbz#1392031)
  - qemu: Disable migration with ivshmem (rhbz#1392031)
  - conf, qemu: Add support for shmem model (rhbz#1392031)
  - conf, qemu: Add newer shmem models (rhbz#1392031)
  - qemu: Add capabilities for ivshmem-{plain, doorbell} (rhbz#1392031)
  - qemu: Save various defaults for shmem (rhbz#1392031)
  - qemu: Support newer ivshmem device variants (rhbz#1392031)
  - qemu: Add support for hot/cold-(un)plug of shmem devices (rhbz#1392031)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-10.el7_3.2
changelog:
  - qemu: Fix double free when live-attaching shmem (rhbz#1392031)
  - qemu: Make sure shmem memory is shared (rhbz#1392031)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-10.el7_3.3
changelog:
  - virDomainNetDefParseXML: Realign (rhbz#1392032)
  - virDomainNetGetActualType: Return type is virDomainNetType (rhbz#1392032)
  - qemuBuildInterfaceCommandLine: Move hostdev handling a bit further (rhbz#1392032)
  - qemuBuildInterfaceCommandLine: Move vhostuser handling a bit further (rhbz#1392032)
  - qemuBuildInterfaceCommandLine: Move from if-else forest to switch (rhbz#1392032)
  - qemuDomainAttachNetDevice: Move hostdev handling a bit further (rhbz#1392032)
  - qemuDomainAttachNetDevice: Explicitly list allowed types for hotplug (rhbz#1392032)
  - qemuBuildHostNetStr: Explicitly enumerate net types (rhbz#1392032)
  - qemuBuildChrChardevStr: Introduce @nowait argument (rhbz#1392032)
  - qemuBuildVhostuserCommandLine: Reuse qemuBuildChrChardevStr (rhbz#1392032)
  - qemuBuildVhostuserCommandLine: Unify -netdev creation (rhbz#1392032)
  - qemuBuildHostNetStr: Support VIR_DOMAIN_NET_TYPE_VHOSTUSER (rhbz#1392032)
  - qemu_hotplug: Support interface type of vhost-user hotplug (rhbz#1392032)
  - qemu: snapshot: Don't attempt to resume cpus if they were not paused (rhbz#1406765)
  - qemuDomainAttachNetDevice: Don't overwrite error on rollback (rhbz#1404186)
  - qemuDomainAttachNetDevice: Enable multiqueue for vhost-user (rhbz#1404186)
  - qemuDomainAttachNetDevice: pass mq and vectors for vhost-user with multiqueue (rhbz#1404186)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-10.el7_3.4
changelog:
  - qemuDomainAttachNetDevice: Avoid @originalError leak (rhbz#1404186)
  - qemu: snapshot: Resume VM after live snapshot (rhbz#1406765)


author: Marek Polacek <polacek@redhat.com> 4.8.5-28
changelog:
  - Minor testsuite fixes to clean up test results (#1469697)
  - retpoline support for spectre mitigation (#1535655)


author: Milind Changire <mchangir@redhat.com> - 3.12.2-10
changelog:
  - fixes bugs bz#1488120 bz#1565577 bz#1568297 bz#1570586 bz#1572043 
    bz#1572075 bz#1575840 bz#1575877


author: Milind Changire <mchangir@redhat.com> - 3.12.2-13
changelog:
  - fixes bugs bz#1493085 bz#1518710 bz#1554255 bz#1558948 bz#1558989 
    bz#1559452 bz#1567001 bz#1569312 bz#1569951 bz#1575539 bz#1575557 bz#1577051 
    bz#1580120 bz#1581184 bz#1581553 bz#1581647 bz#1582119 bz#1582129 bz#1582417 
    bz#1583047 bz#1588408 bz#1592666 bz#1594658


author: Milind Changire <mchangir@redhat.com> - 3.12.2-14
changelog:
  - fixes bugs bz#1547903 bz#1566336 bz#1568896 bz#1578716 bz#1581047 
    bz#1581231 bz#1582066 bz#1593865 bz#1597506 bz#1597511 bz#1597654 bz#1597768 
    bz#1598105 bz#1598356 bz#1599037 bz#1599823 bz#1600057 bz#1601314


author: Milind Changire <mchangir@redhat.com> - 3.12.2-16
changelog:
  - fixes bugs bz#1569657 bz#1608352 bz#1609163 bz#1609724 bz#1610825 
    bz#1611151 bz#1612098 bz#1615338 bz#1615440


author: Pravin Satpute <psatpute@redhat.com> 3.0.9-42
changelog:
  - Resolves: rh#1125703 ttmkfdir fails to build on arch: ppc64le (Generic build failure)
  - Patch from Peter Robinson <pbrobinson@redhat.com>


author: Marcela Mašláňová <mmaslano@redhat.com> - 1.4.11-2
changelog:
  - scriptlets are not created correctly if systemd is not in BR 986698
  - remove sub-package sysvinit, which is not needed anymore
  - update license, anacron is under GPLv2+


author: Marcela Mašláňová <mmaslano@redhat.com> - 1.4.11-3
changelog:
  - 919290 systemd script use "KillMode=process"
  - Fcntl locking has different semantics than flock. Prefer flock.
    - 49225e172d156531ca142518d2638350752e373a
  - Pull PAM environment variables also from session modules.
    - c8e7d1b43c86a85441cb09cf7e08090f3ec1f384


author: Marcela Mašláňová <mmaslano@redhat.com> - 1.4.11-5
changelog:
  - Cronie doesn't work when is executed as stand alone without systemd (for 
    debuging issues)
  - Fix another permission, hopefully all now.
  - Resolves: rhbz#1012420, rhbz#1015567


author: Peter Hatina <phatina@redhat.com> - 1.10.14-7
changelog:
  - Rebase some tvbuff API from upstream to 1.10.14
  - Fixes crash when tvb_length_remaining() is used
  - Related: CVE-2015-6244


author: Martin Sehnoutka <msehnout@redhat.com> - 1.10.14-12
changelog:
  - Fix wrong snaplen in man pages and help
  - Make the capture buffer bigger to prevent dropping packages


author: Elio Maldonado <emaldona@redhat.com> - 3.15-0.1.beta1.2
changelog:
  - Don't include prtypes.h from hasht.t
  - Resolves: rhbz#953277 - rawhide build of glibc fails due to fatal error from nss3/hasht.h


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Add the nss-util portion of a fix for a bug in nss and nss-util
  - Resolves: Bug 752980 - Support ECDSA via pluggable ECC in the nss package


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Update to nss-3.15.4
  - Modified the nss-split-util script to use the nss upstream pristine sources
  - Resolves: Bug 1054457 - CVE-2013-1740 nss: false start PR_Recv information disclosure security issue [rhel-7.0]


author: Jan Rybar <jrybar@redhat.com> 22.20-13
changelog:
  - fuser manpage: note about invisible other PIDs moved to RESTRICTIONS section
  - Resolves: rhbz#1400126


author: Jeff Moyer <jmoyer@redhat.com> - 53.1-4
changelog:
  - Fix up duplicate "-v" documentation in man page
  - Fix bogus test in invalidate_namespace_options
  - Resolves: bz#1350404 bz#1271425


author: Richard W.M. Jones <rjones@redhat.com> - 1.13-2
changelog:
  - Include two upstream patches for detecting Xen and Linux VServer better
    (RHBZ#973663).
  - Modernize the spec file.


author: Richard W.M. Jones <rjones@redhat.com> - 1.13-3
changelog:
  - Suppress warning message on Amazon EC2:
    "grep: /proc/xen/capabilities: No such file or directory"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.20-1.1
changelog:
  - Resolves: rhbz#1290714 - CVE-2015-5330 libldb: samba: Remote memory read
                             in Samba LDAP server [rhel-7.2.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.20-1.2
changelog:
  - Resolves: rhbz#1290714 - CVE-2015-5330 libldb: samba: Remote memory read
                             in Samba LDAP server [rhel-7.2.z]
  - Remove the patch from the previous commit, it doesn't fix a remotely
    eploitable issue. Add patches from upstream #11636 instead.


author: Jindrich Novy <jnovy@redhat.com> 4.7.25-18
changelog:
  - really fix the update path (#627019, #627387)
  - introduce -headers subpackage to avoid conflicts on multiarch
    systems (#590973)
  - install package license


author: Ondrej Holy <oholy@redhat.com> - 1.22.4-1
changelog:
  - Update to 1.22.4
  - Remove obsolete upstream patches
  - Add translations updates from upstream
  - Resolves: #1174716


author: Radovan Sroka <rsroka@redhat.com> 1.8.23-4
changelog:
  - RHEL-7.7 erratum
    Resolves: rhbz#1672876 - Backporting sudo bug with expired passwords
    Resolves: rhbz#1665285 - Problem with sudo-1.8.23 and 'who am i'


author: Richard W.M. Jones <rjones@redhat.com> - 0.5-0.4.alpha
changelog:
  - Avoid 'test/md5.c:126:3: warning: dereferencing type-punned pointer
    will break strict-aliasing rules' by adding -fno-strict-aliasing flag.


author: Richard W.M. Jones <rjones@redhat.com> - 0.5-0.6.alpha
changelog:
  - Fixes for CVE-2018-14679 CVE-2018-14680 CVE-2018-14681 CVE-2018-14682
  - resolves: rhbz#1611550 rhbz#1611551 rhbz#1611552 rhbz#1611553


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-8
changelog:
  - storage: Add --shrink to qemu-img command when shrinking vol (rhbz#1613746)
  - access: Fix nwfilter-binding ACL access API name generation (rhbz#1611320)
  - qemu: mdev: Use vfio-pci 'display' property only with vfio-pci mdevs (rhbz#1624735)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-9
changelog:
  - virDomainDefCompatibleDevice: Relax alias change check (rhbz#1621910)
  - virDomainDetachDeviceFlags: Clarify update semantics (rhbz#1621910)
  - virDomainNetDefCheckABIStability: Check for MTU change too (rhbz#1623157)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-10.el7_6.1
changelog:
  - security: dac: also label listen UNIX sockets (rhbz#1635228)
  - qemu: fix up permissions for pre-created UNIX sockets (rhbz#1635228)
  - virFileIsSharedFSType: Check for fuse.glusterfs too (rhbz#1635705)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-10.el7_6.2
changelog:
  - virfile: fix cast-align error (rhbz#1635705)
  - virfiletest: Fix test name prefix for virFileInData test (rhbz#1635705)
  - virfiletst: Test virFileIsSharedFS (rhbz#1635705)
  - virFileIsSharedFSType: Detect direct mount points (rhbz#1635705)
  - virfile: Rework virFileIsSharedFixFUSE (rhbz#1635705)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-10.el7_6.3
changelog:
  - virfile: Take symlink into account in virFileIsSharedFixFUSE (rhbz#1641798)
  - qemu: Properly report VIR_DOMAIN_EVENT_RESUMED_FROM_SNAPSHOT (rhbz#1634759)
  - qemu: Report more appropriate running reasons (rhbz#1634759)
  - qemu: Pass running reason to RESUME event handler (rhbz#1634759)
  - qemu: Map running reason to resume event detail (rhbz#1634759)
  - qemu: Avoid duplicate resume events and state changes (rhbz#1634759)
  - qemu: Don't ignore resume events (rhbz#1634759)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-10.el7_6.4
changelog:
  - qemu: Fix post-copy migration on the source (rhbz#1654732)
  - RHEL: cpu_map: Mark arch-facilities feature as non-migratable (rhbz#1664793)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-10.el7_6.5
changelog:
  - virfile: Detect ceph as shared FS (rhbz#1672178)
  - util: Don't overflow in virRandomBits (rhbz#1667329)
  - virrandom: Avoid undefined behaviour in virRandomBits (rhbz#1667329)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-10.el7_6.7
changelog:
  - cputest: Add data for Intel(R) Xeon(R) CPU E5-2630 v4 (rhbz#1687515)
  - cputest: Add data for Intel(R) Core(TM) i7-7600U (rhbz#1687515)
  - cputest: Add data for Intel(R) Xeon(R) CPU E7540 (rhbz#1687515)
  - cputest: Add data for Intel(R) Xeon(R) CPU E5-2650 (rhbz#1687515)
  - cputest: Add data for Intel(R) Core(TM) i7-8700 (rhbz#1687515)
  - cpu_x86: Separate signature parsing from x86ModelParse (rhbz#1687515)
  - cpu_x86: Add x86ModelCopySignatures helper (rhbz#1687515)
  - cpu_x86: Store CPU signature in an array (rhbz#1687515)
  - cpu_x86: Allow multiple signatures for a CPU model (rhbz#1687515)
  - cpu_map: Add hex representation of signatures (rhbz#1687515)
  - cpu_map: Add more signatures for Conroe CPU model (rhbz#1687515)
  - cpu_map: Add more signatures for Penryn CPU model (rhbz#1687515)
  - cpu_map: Add more signatures for Nehalem CPU models (rhbz#1687515)
  - cpu_map: Add more signatures for Westmere CPU model (rhbz#1687515)
  - cpu_map: Add more signatures for SandyBridge CPU models (rhbz#1687515)
  - cpu_map: Add more signatures for IvyBridge CPU models (rhbz#1687515)
  - cpu_map: Add more signatures for Haswell CPU models (rhbz#1687515)
  - cpu_map: Add more signatures for Broadwell CPU models (rhbz#1687515)
  - cpu_map: Add more signatures for Skylake-Client CPU models (rhbz#1687515)
  - cpu: Don't access invalid memory in virCPUx86Translate (rhbz#1687515)
  - cpu_x86: Log decoded CPU model and signatures (rhbz#1687515)
  - util: Modify virStorageFileGetSCSIKey return (rhbz#1687715)
  - storage: Rework virStorageBackendSCSISerial (rhbz#1687715)
  - util: Introduce virStorageFileGetNPIVKey (rhbz#1687715)
  - storage: Fetch a unique key for vHBA/NPIV LUNs (rhbz#1687715)


author: Christophe Fergeau <cfergeau@redhat.com> 0.14.0-8
changelog:
  - Fix copy and paste issues with vncclient
    Resolves: rhbz#1130218
  - Make vdagent more robust against xrandr failures
    Resolves: rhbz#1066422
  - Fix autostart of vdagent in gdm
    Resolves: rhbz#1052172


author: Christophe Fergeau <cfergeau@redhat.com> 0.14.0-9
changelog:
  - Don't install rsyslog config file. This can cause duplicate logging
    to syslog in rhel6->rhel7 upgrades, and is not really useful anyway
    as the same functionality can be achieved with journald
    Resolves: rhbz#1136881


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-11
changelog:
  - Add client to guest audio volume synchronization
    Resolves: rhbz#1264102
  - Exit with error when virtio channel device is missing
    Resolves: rhbz#1256704


author: Victor Toso <victortoso@redhat.com> - 0.14.0-14
changelog:
  - Do not allow drag-and-drop on (gdm) login screen
    Resolves: rhbz#1328761
  - Do not allow drag-and-drop on locked screen
    Resolves: rhbz#1323623


author: Petr Pisar <ppisar@redhat.com> - 2:1.04-6
changelog:
  - Restore object after failed truncate() call (bug #1095111)
  - Add 2015-06-30 and 2016-12-31 leap seconds (bug #1353509)


author: James Antill <james@fedoraproject.org> - 5.0.2-7
changelog:
  - Remove unneeded build require on tetex.
  - Resolves: rhbz#1037828
  - Depend on hostname package instead of /bin/hostname.


author: Kamil Dudka <kdudka@redhat.com> - 5.0.2-9
changelog:
  - signal safety when updating global state in execshfunc() (#1163823)
  - make the wait built-in work for already exited processes (#1162198)
  - replace an incorrect comment in /etc/zshenv (#1164312)
  - optimize matching of multiple * in wildcards (#1130418)
  - use heap rather than stack allocation for variable length arrays (#1165118)
  - shell emulation doc addition (#1147545)
  - suppress a warning about closing an already closed file descriptor (#1131191)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-100.el7
changelog:
  - kvm-block-update-test-070-for-vhdx.patch [bz#1171576]
  - kvm-block-coverity-fix-check-return-value-for-fcntl-in-g.patch [bz#1219217]
  - Resolves: bz#1171576
    (test case 064 and 070 of qemu-iotests fail for vhdx with qemu-kvm-1.5.3-83.el7)
  - Resolves: bz#1219217
    (Coverity-detected defect: call to fcntl without checking return value)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-101.el7
changelog:
  - kvm-serial-reset-state-at-startup.patch [bz#922014]
  - kvm-ide-Check-validity-of-logical-block-size.patch [bz#1134670]
  - Resolves: bz#1134670
    (fail to specify the physical_block_size/logical_block_size value not 512 for IDE disk)
  - Resolves: bz#922014
    (RFE: support hotplugging chardev & serial ports (Windows guests))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-102.el7
changelog:
  - kvm-mc146818rtc-add-rtc-reset-reinjection-QMP-command.patch [bz#1191226]
  - Resolves: bz#1191226
    (libvirt requires rtc-reset-reinjection command, backport it to RHEL7.1)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-103.el7
changelog:
  - kvm-Drop-superfluous-conditionals-around-g_strdup.patch [bz#1218919]
  - kvm-util-Drop-superfluous-conditionals-around-g_free.patch [bz#1218919]
  - kvm-util-Fuse-g_malloc-memset-into-g_new0.patch [bz#1218919]
  - kvm-util-uri-uri_new-can-t-fail-drop-dead-error-handling.patch [bz#1218919]
  - kvm-util-uri-realloc2n-can-t-fail-drop-dead-error-handli.patch [bz#1218919]
  - kvm-util-uri-URI-member-path-can-be-null-compare-more-ca.patch [bz#1218919]
  - kvm-util-uri-Add-overflow-check-to-rfc3986_parse_port.patch [bz#1218919]
  - Resolves: bz#1218919
    (Coverity-detected defect: buffer overrun at uri.c:2035)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-104.el7
changelog:
  - kvm-qemu-iotests-Filter-qemu-io-output-in-025.patch [bz#1170974]
  - Resolves: bz#1170974
    (test case 025 of qemu-iotests fail for raw with qemu-kvm-1.5.3-83.el7.x86_64)


author: Jeff E. Nelson <jen@redhat.com> - 1.5.3-105.el7
changelog:
  - kvm-qtest-ide-test-disable-flush-test.patch [bz#1270341]
  - Resolves: bz#1270341
    (qemu-kvm build failure race condition in tests/ide-test)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.1
changelog:
  - kvm-rbd-make-qemu-s-cache-setting-override-any-ceph-sett.patch [bz#1279389]
  - kvm-rbd-fix-ceph-settings-precedence.patch [bz#1279389]
  - Resolves: bz#1279389
    (ceph.conf properties override qemu's command-line properties)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.2
changelog:
  - kvm-raw-posix-Fix-.bdrv_co_get_block_status-for-unaligne.patch [bz#1298828]
  - Resolves: bz#1298828
    ([abrt] qemu-img: get_block_status(): qemu-img killed by SIGABRT)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.3
changelog:
  - kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE.patch [bz#1298047]
  - Resolves: bz#1298047
    (CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations [rhel-7.2.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.4
changelog:
  - kvm-vga-Remove-some-should-be-done-in-BIOS-comments.patch [bz#1331412]
  - kvm-vga-fix-banked-access-bounds-checking-CVE-2016-3710.patch [bz#1331412]
  - kvm-vga-add-vbe_enabled-helper.patch [bz#1331412]
  - kvm-vga-factor-out-vga-register-setup.patch [bz#1331412]
  - kvm-vga-update-vga-register-setup-on-vbe-changes.patch [bz#1331412]
  - kvm-vga-make-sure-vga-register-setup-for-vbe-stays-intac.patch [bz#1331412]
  - Resolves: bz#1331412
    (EMBARGOED CVE-2016-3710 qemu-kvm: qemu: incorrect banked access bounds checking in vga module [rhel-7.2.z])


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42.3
changelog:
  - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()
  - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison
  - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
  - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
  - fix CVE-2015-0292 - integer underflow in base64 decoder
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.3.2.el7]
changelog:
  - [x86] spec_ctrl: Fix late microcode problem with AMD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] entry: Add missing "$" in IBRS macros (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Clean up entry code & remove unused APIs (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Mask off SPEC_CTRL MSR bits that are managed by kernel (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: add support for SSBD to RHEL IBRS entry/exit macros (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [fs] proc: Use CamelCase for SSBD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Rename _RDS to _SSBD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [kernel] seccomp: Enable speculation flaw mitigations (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [fs] proc: Provide details on speculation flaw mitigations (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] nospec: Allow getting/setting on non-current task (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] speculation: Add prctl for Speculative Store Bypass mitigation (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] process: Allow runtime control of Speculative Store Bypass (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [uapi] prctl: Add speculation control prctls (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] kvm/vmx: Expose SPEC_CTRL Bit(2) to the guest (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs/amd: Add support to disable RDS on Fam[15, 16, 17]h if requested (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up RDS setting with IBRS code (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Expose /sys/../spec_store_bypass (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Read SPEC_CTRL MSR during boot and re-use (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Use separate PCP variables for IBRS entry and exit (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] cpufeatures: Make CPU bugs sticky (Waiman Long) [1566904 1566905] {CVE-2018-3639}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.3.3.el7]
changelog:
  - [x86] always enable eager FPU by default on non-AMD processors (Paolo Bonzini) [1589051 1589048] {CVE-2018-3665}


author: Akemi Yagi <toracat@centos.org> [3.10.0-862.3.3.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
     addmissing.patch  [puias]
     cpufreq.patch  [puias]
     i386-audit-stop-scri-stack-frame.patch  [puias]
     removejiffies.patch  [puias]
     undorhirqstat.patch  [puias]
     morefixes.patch      [puias+bug#12412]
     upstream-32bit-fixes-7_5.patch [puias+bug#12412]
     clear-32bit-Werror-warnings.patch  [bug#12412]
     qspinlock_types-32bit.patch   [ay]
     i686-7-4.patch [T.Kabe, bug#13890]
     firmware-efi-32bit.patch [ay]
     patch-spec_ctrl_i686.patch [T.Kabe bug#14353]
     686 mods for 7.5 [T.Kabe bug#14703]
     more 686 mods for 7.5 (-862.3.2) [pgreco]
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Enabled spidev [bug#9955]
  - Add a patch [bug#10447]
  - Enable ATM drivers [bug#10845]
  - Add 9pfs config options [bug#10849]
  - Enable VFIO_PCI_VGA [bug#12435]
  - Rremove initramfs-xxxkdump.img upon kernel removal [bug#12703]
  - Add a patch from [bug#12841]
  - Add a patch from [bug#12818]
  - Enabled RT2800USB_RT3573 [bug#13162]
  - Enable LDM_PARTITION [bug#13526]
  - Add a patch to fix misleading warning [bug#13990]
  - Add BuildRequires: openssl-devel to the with_perf section [bug#13990]
  - Add a patch to fix build errors for EL7.5 [bug#14425]
  - Added a patch to fix iotop error [bug14864]
  - Added a patch to fix fsnotify [bug14823]
  - Added a patch to fix alsa potentail crash [bug14779


author: pcpa <paulo.cesar.pereira.de.andrade@gmail.com> - 1.2.0-8
changelog:
  - Update fontconfig patch to apply issue found by upstream
  - Update fontconfig patch to apply issue with missing afm fonts (#896182)


author: pcpa <paulo.cesar.pereira.de.andrade@gmail.com> - 1.2.0-10
changelog:
  - Use stix fonts avoid problems with missing cm fonts (#908717)
  - Correct type mismatch in python3 font_manager (#912843, #928326)


author: Doug Ledford <dledford@redhat.com> - 3.3.5-2
changelog:
  - Drop libibmad as it didn't soname bump, and also remove the lower level
    opensm libs, libosm{comp,vendor} as they didn't soname bump either
  - Related: bz725016


author: Doug Ledford <dledford@redhat.com> - 3.3.5-3
changelog:
  - Change the file spec so we don't accidentally pick up the debug files in
    the base package on 32bit arches
  - Resolves: bz732495


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.2-10
changelog:
  - Resolves: rhbz#1586127 - Spurious check in the sssd nss memcache can cause the memory cache to be skipped


author: Petr Machata <pmachata@redhat.com> - 0.13-11
changelog:
  - Add missing last entry in long options array
    (chrpath-0.13-getopt_long.patch)
  - Update config.sub and config.guess to support aarch64
    (chrpath-0.13-aarch64.patch)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.10-15
changelog:
  - New upstream release 1.2.10
  - Remove upstreamed patches
  - Provides functionality for the upcoming Samba 4 beta


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-57
changelog:
  - Add 0065-UPBZ-995538-fail-rdac-on-unavailable.patch
    * make rdac checker always mark paths with asymmetric access state of
      unavailable as down
  - Resolves: bz #995538


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-58
changelog:
  - 0066-UP-dos-4k-partition-fix.patch
    * Make kpartx correctly handle 4K sector size devices with dos partitions.
  - Resolves: bz #1018439


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-59
changelog:
  - Add 0067-RHBZ-1022899-fix-udev-partition-handling.patch
    * Make sure to wipe partition devices on change event if they weren't 
      wiped on the device add event 
  - Add 0068-RHBZ-1034578-label-partition-devices.patch   
    * Make sure that partition devices are labeled like the whole device 
  - Add 0069-UPBZ-1033791-improve-rdac-checker.patch   
    *  Use RTPG data in RDAC checker 
  - Add 0070-RHBZ-1036503-blacklist-td-devs.patch
  - Add 0071-RHBZ-1031546-strip-dev.patch   
    * make multipathd interactive commands able to handle /dev/<devnode> 
      instead of just <devnode>
  - Resolves: bz #1022899, #1031546, #1033791, #1034578, #1036503


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-60
changelog:
  - Add 0072-RHBZ-1039199-check-loop-control.patch
    * Make kpartx use LOOP_CTL_GET_FREE and loop-control to find a free
      loop device. This will autoload the loop module.
  - Resolves: bz #1039199


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-63
changelog:
  - Modify 0072-RHBZ-1039199-check-loop-control.patch
    * only call close on the /dev/loop-control fd the open succeeds
  - Add 0073-RH-update-build-flags.patch
    * fix print call to work with -Werror=format-security compile flag, and
      change compilation flags for non-rpmbuild compiles
  - Add 0074-RHBZ-1056976-dm-mpath-rules.patch
    * Add rules to keep from doing work in udev if there are no
      active paths, or if the event was for a multipath device
      reloading its table due to a path change.
  - Add 0075-RHBZ-1056976-reload-flag.patch
    * multipath code to identify reloads that the new rules can
      ignore
  - Add 0076-RHBZ-1056686-add-hw_str_match.patch
    * add a new default config paramter, "hw_str_match", to make user
      device configs only overwrite builtin device configs if the
      identifier strings match exactly, like the default in RHEL6.
  - Add 0077-RHBZ-1054806-mpathconf-always-reload.patch
    * Make mpathconf always reconfgure multipathd when you run it with
      a reconfigure option and --with-multipathd=y, even if the
      configuration doesn't change.
  - Update Requires and BuildRequires for device-mapper to 1.02.82-2
  - Install new udev rules file /usr/lib/udev/rules.d/11-dm-mpath.rules
  - Related: bz #1039199
  - Resolves: bz #1054806, #1056686, #1056976


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-65
changelog:
  - Add 0078-RHBZ-1054044-fix-mpathconf-manpage.patch
    * Fix typo
  - Add 0079-RHBZ-1070581-add-wwid-option.patch
    * add multipath option "-a". To add a device's wwid to the wwids file
  - Resolves: bz #1054044, #1070581


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-66
changelog:
  - Add 0080-RHBZ-1075796-cmdline-wwid.patch
    * add multipath option "-A" to add wwids specified by the kernel
      command line mapth.wwid options.
  - Resolves: bz #1075796


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.10.0-2
changelog:
  - Fixed systemd error message regarding chroot-update, patch provided
    by John Heidemann <johnh@isi.edu>
    Resolves: rhbz#917463


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.10.1-7
changelog:
  - Fixed haproxy with TLS
    Resolves: rhbz#1370455
  - Fixed documentation about canonical maps
    Resolves: rhbz#1381871
  - Fixed build with kernel-4.*
    Resolves: rhbz#1575658


author: Jay Fenlason <fenlason@redhat.com> 1.6-1.el6
changelog:
  - New upstream release, with different build process, and without
    man pages, because we don't have the sowing package, and its
    licensing status is unclear (no licence description of any kind in
    the tarball).
    Related: rhbz725016


author: Jay Fenlason <fenlason@redhat.com> 1.6-2.el6
changelog:
  - Fix the psm RPM macros so that we can build a -psm variant of
    mpitests
  - remove the osu-micro-benchmarks, which are being installed with a
    bogus rpath, and which are included in mpitests
    Related: rhbz725016


author: Jay Fenlason <fenlason@redhat.com> 1.6-3.el6
changelog:
  - Change the requires on mvapich2-psm-devel to mvapich2-psm from mvapich2
    so that mpitests will build
  - clean up the build to not use .{non-}psm directories.
    Related: rhbz725016


author: Jay Fenlason <fenlason@redhat.com> 1.8-1
changelog:
  - New upstream version, with man pages again.
    This fixes the following bugs:
    Related: rhbz739138
    Resolves: rhbz613696
    Resolves: rhbz625620
    Resolves: rhbz735954
    Resolves: rhbz782263


author: Jay Fenlason <fenlason@redhat.com> 1.8-2
changelog:
  - Add BuildRequires on flex and bison
  - Add "export AR=ar" to allow builds on RHEL-7 to work.
    Resolves: rhbz822527


author: Jay Fenlason <fenlason@redhat.com> 1.8-3
changelog:
  - Move the module files to the (correct for RHEL-7) mpi/ directory.
  - Add MANPATH to the module files.


author: Jay Fenlason <fenlason@redhat.com> 2.0a-1
changelog:
  - Add Build Requires on autoconf, automake, libtool,
    perl-Digest-MD5, hwloc-devel, and libibmad-devel.
  - remove build requires on java
  - New upstream version, edited so it can pass a license audit.
    Resolves: rhbz1001718


author: Kyle McMartin <kmcmarti@redhat.com> - 2.0a-3
changelog:
  - aarch64: add get_cycles implementation since <asm/timex.h> is not
    an exported header.
  - Resolves: #1100046


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-11
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for
    standard conformance [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools
    CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1560233 - libtps does not directly depend on libz


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-12
changelog:
  - Updated "jss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1571582 - [MAN] Missing Man pages for tools CMCRequest,
    CMCResponse, CMCSharedToken (typos) [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1572548 - IPA install with external-CA is failing when
    FIPS mode enabled. [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1575521 - subsystem -> subsystem SSL handshake issue
    with TLS_ECDHE_RSA_* on Thales HSM [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581134 - ECC installation for non CA subsystems needs
    improvement [rhel-7.5.z] (jmagne)
  - Bugzilla Bug #1581135 - SAN in internal SSL server certificate in
    pkispawn configuration step [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581167 - CC: CMC profiles: Some CMC profiles have wrong
    input class_id [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581382 - ECDSA Certificates Generated by Certificate System
    9.3 fail NIST validation test with parameter field. [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-13
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd
    entry in a certifcate [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1585945 - CMC CRMF requests result in
    InvalidKeyFormatException when signing algorithm is ECC
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1587826 - ExternalCA: Installation failed during
    csr generation with ecc [rhel-7.5.z] (rrelyea, gkapoor)
  - Bugzilla Bug #1588944 - Cert validation for installation with
    external CA cert [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1588945 - CRMFPopClient tool - should allow
    option to do no key archival (cfu)
  - Bugzilla Bug #1589307 - CVE-2018-1080 pki-core: Mishandled
    ACL configuration in AAclAuthz.java reverses rules that allow
    and deny access [rhel-7.5.z] (ftweedal, cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-1
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1538311 - Using a Netmask produces an odd
    entry in a certifcate (ftweedal)
  - Bugzilla Bug #1544843 - ExternalCA: Installation failed during
    csr generation with ecc (rrelyea, gkapoor)
  - Bugzilla Bug #1557569 - Re-base pki-core from 10.5.1 to latest
    upstream 10.5.x (RHEL) (mharmsen)
  - Bugzilla Bug #1580394 - CMC CRMF requests result in
    InvalidKeyFormatException when signing algorithm is ECC (cfu)
  - Bugzilla Bug #1580527 - CVE-2018-1080 pki-core: Mishandled
    ACL configuration in AAclAuthz.java reverses rules that allow
    and deny access (ftweedal, cfu)
  - Bugzilla Bug #1585866 - CRMFPopClient tool - should allow
    option to do no key archival (cfu)
  - Bugzilla Bug #1588655 - Cert validation for installation with
    external CA cert (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-2
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1471935 - X500Name.directoryStringEncodingOrder overridden
    by CSR encoding (cfu)
  - Bugzilla Bug #1538311 - Using a Netmask produces an odd entry in a
    certificate (ftweedal)
  - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in
    SharedToken scenario's (cfu)
  - Bugzilla Bug #1550742 - Address ECC profile overrides (cfu)
  - Bugzilla Bug #1562841 - servlet profileSubmitCMCSimple throws NPE (cfu)
  - Bugzilla Bug #1572432 - AuditVerify failure due to line breaks (cfu)
  - Bugzilla Bug #1592961 - Need proper default subjectDN for CMC request
    authenticated through SharedToken (cfu)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-4
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1548203 - pki console configurations that involves ldap
    passwords leave the plain text password in signed audit logs (cfu)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1494591 - keyGen fails when only Identity


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-5
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1596629 - ipa-replica-install --setup-kra broken on DL0
    with latest version (abokovoy)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-6
changelog:
  - Updated nuxwdog dependencies
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #673182 - ECC keys not supported for signing
    audit logs (cfu)
  - Bugzilla Bug #1593805 - Better understanding of
    NSS_USE_DECODED_CKA_EC_POINT for ECC (cfu)
  - Bugzilla Bug #1601071 - Certificate generation happens with
    partial attributes in CMCRequest file (cfu)
  - Bugzilla Bug #1601569 - CC: Enable all config audit events
    (cfu)
  - Bugzilla Bug #1608375 - CMC Revocations throws exception
    with same reqIssuer & certissuer (cfu)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to


author: Tony Camuso <tcamuso@redhat.com> - 20-9
changelog:
  - Must be bumped to 20-9 due to changes and version bumps in the
    7.2-z stream.
    Resolves: rhbz#1320204


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-10
changelog:
  - weak-modules: deprecate --delete-modules switch.
  - weak-modules: implement some pathes configuration from cmdline.
  - weak-modules: redesign to reuse depmod -aeE functionality
    (with some preparation changes).
    This is an updated version of the script which doesn't support
    multiple installation of the same out-of-tree module (stored in the
    'extra' subdirectory). But it more correctly checks dependencies
    between the modules.
    Resolves: rhbz#1367942


author: Tony Camuso <tcamuso@redhat.com> - 20-10
changelog:
  - Rename patches so they are not specific to the build. This was
    causing problems with z-stream builds.
    Resolves: rhbz#1416498


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-12
changelog:
  - weak-modules: fix coverity introduced by latest changes
  - weak-modules: fix "permission denied" on some upgrades.
    Resolves: rhbz#1416566


author: Martin Osvald <mosvald@redhat.com> - 9.07-32
changelog:
  - Remove as many non-standard operators as possible to make the codebase
    closer to upstream for later CVEs
  - Resolves: #1621385 - CVE-2018-16511 ghostscript: missing type check in type
    checker (699659)
  - Resolves: #1649722 - CVE-2018-16539 ghostscript: incorrect access checking
    in temp file handling to disclose contents of files (699658) 
  - Resolves: #1621162 - CVE-2018-15908 ghostscript: .tempfile file permission
    issues (699657)
  - Resolves: #1621384 - CVE-2018-15909 ghostscript: shading_param incomplete
    type checking (699660)
  - Resolves: #1652902 - CVE-2018-16863 ghostscript: incomplete fix for
    CVE-2018-16509
  - Resolves: #1654045 ghostscript update breaks xdvi (gs: Error: /undefined in flushpage)
  - Resolves: #1651150 - CVE-2018-15911 ghostscript: uninitialized memory
    access in the aesdecode operator (699665)
  - Resolves: #1650061 - CVE-2018-16802 ghostscript: Incorrect "restoration of
    privilege" checking when running out of stack during exception handling
  - Resolves: #1652936 - CVE-2018-19409 ghostscript: Improperly implemented
    security check in zsetdevice function in psi/zdevice.c
  - Resolves: #1654622 - CVE-2018-16541 ghostscript: incorrect free logic in
    pagedevice replacement (699664)
  - Resolves: #1650211 - CVE-2018-17183 ghostscript: User-writable error
    exception table
  - Resolves: #1645517 - CVE-2018-18073 ghostscript: saved execution stacks
    can leak operator arrays
  - Resolves: #1648892 - CVE-2018-17961 ghostscript: saved execution stacks
    can leak operator arrays (incomplete fix for CVE-2018-17183)
  - Resolves: #1643117 - CVE-2018-18284 ghostscript: 1Policy operator
    allows a sandbox protection bypass
  - Resolves: #1655939 - CVE-2018-19134 ghostscript: Type confusion in
    setpattern (700141)
  - Resolves: #1657694 - ghostscript: Regression: Warning: Dropping incorrect
    smooth shading object (Error: /rangecheck in --run--)
  - Resolves: #1661210 pdf2ps reports an error when reading from stdin
  - Resolves: #1657334 - CVE-2018-16540 ghostscript: use-after-free in
    copydevice handling (699661)
  - Resolves: #1660570 - CVE-2018-19475 ghostscript: access bypass in
    psi/zdevice2.c (700153)
  - Resolves: #1660829 - CVE-2018-19476 ghostscript: access bypass in
    psi/zicc.c
  - Resolves: #1661279 - CVE-2018-19477 ghostscript: access bypass in
    psi/zfjbig2.c (700168)
  - Resolves: #1667443 - CVE-2019-6116 ghostscript: subroutines within
    pseudo-operators must themselves be pseudo-operators
  - Resolves: #1670443 - ghostscript: Regression: double comment chars
    '%' in gs_init.ps leading to missing metadata


author: Martin Osvald <mosvald@redhat.com> - 9.25-1
changelog:
  - Rebase to latest upstream version (bug #1636115)
  - Resolves: #1673399 - CVE-2019-3839 ghostscript: missing attack vector
    protections for CVE-2019-6116
  - Resolves: #1678172 - CVE-2019-3835 ghostscript: superexec operator
    is available (700585)
  - Resolves: #1680026 - CVE-2019-3838 ghostscript: forceput in DefineResource
    is still accessible (700576)
  - Resolves: #1670443 - ghostscript: Regression: double comment chars
    '%' in gs_init.ps leading to missing metadata
  - fix for pdf2dsc regression added to allow fix for CVE-2019-3839


author: Martin Osvald <mosvald@redhat.com> - 9.25-2.2
changelog:
  - Resolves: #1744008 - CVE-2019-14811 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdf_hook_DSC_Creator (701445)
  - Resolves: #1744012 - CVE-2019-14812 ghostscript: Safer Mode Bypass by .forceput Exposure in setuserparams (701444)
  - Resolves: #1744003 - CVE-2019-14813 ghostscript: Safer Mode Bypass by .forceput Exposure in setsystemparams (701443)
  - Resolves: #1744228 - CVE-2019-14817 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdfexectoken and other procedures (701450)


author: Václav Pavlín <vpavlin@redhat.com> - 0.5.0-1
changelog:
  - Updating the sources to 0.5.0 version. Following are the changes:
  - Change scan of SMBIOS slot <-> PCI methods, recurse to set SMBIOS slot field
  - Save off secondary bus of PCI device for PCI tree traversal
  - Add version number to biosdevname


author: Benjamin Tissoires <benjamin.tissoires@redhat.com> 1.1.5-3
changelog:
  - libXt 1.1.5
  - Merge F25:
  - Fix duplicate documentation (#1001246) by not using %doc
  - Turn on verbose build output via V=1 make
  - Remove %defattr
  - Use %?_isa in explicit package deps
  - Exclude docs from main package


author: Jaroslav Kysela <jkysela@redhat.com> - 1.0.25-1
changelog:
  - Updated to 1.0.25
  - Moved plugin specific configuration from /etc/alsa/pcm to /usr/share/alsa/alsa.conf.d


author: Hans de Goede <hdegoede@redhat.com> - 1.3.2-14
changelog:
  - Xclients: only try to start gnome classic session if installed
  - Resolves: rhbz#1078948
  - startx: Only specify vt argument automatically when run from a vt
  - Resolves: rhbz#1083188


author: Hans de Goede <hdegoede@redhat.com> - 1.3.4-1
changelog:
  - xinit 1.3.4
  - Drop xorg-x11-xinit-1.3.2-systemd-logind.patch (included upstream in 1.3.4)
  - Add patches from Fedora to fix automatically finding a free display-number
  - Resolves: rhbz#1194894


author: Doug Ledford <dledford@redhat.com> - 1.3.0-1
changelog:
  - Update to latest upstream release (1.2.3 -> 1.3.0)
  - Strip rocee related code out of upstream update
  - Add a buildrequires on libibumad because upstream needs it now
  - Fix lack of build on i686
  - Related: bz725016
  - Resolves: bz724896


author: Doug Ledford <dledford@redhat.com> - 1.3.0-2
changelog:
  - Update to latest upstream release
  - Initial import into Fedora
  - Remove runme from docs section (review item)
  - Improve description of package (review item)


author: Kyle McMartin <kmcmarti@redhat.com> - 2.0-4
changelog:
  - aarch64: add get_cycles implementation since <asm/timex.h> is no longer
    exported by the kernel.
  - Resolves: #1100043


author: Debarshi Ray <rishi@fedoraproject.org> - 3.22.2-3
changelog:
  - Disable the print button in the selection toolbar when printing isn't
    supported
    Resolves: #1438362


author: - Alexander Bokovoy <abokovoy@redhat.com> - 4.1.1-30
changelog:
  - resolves: #1083859  - Force KRB5CCNAME in Samba systemd units.
  - related: #1082598 - Fully enables systemd integration.


author: Petr Oros <poros@redhat.com> - 1:2.12-6
changelog:
  - Add preliminary support for SMBIOS 64-bit entry point (Mark Salter)
  - Add support for DDR4 memmory


author: Petr Oros <poros@redhat.com> - 1:2.12-9
changelog:
  - dmioem: Decode Acer-specific DMI type 170
  - dmioem: Decode HP-specific DMI types 212 and 219
  - dmioem: Decode HP-specific DMI type 233, and refactored 209 and 221 to use a common function
  - Resolves: #1232501


author: Rex Dieter <rdieter@fedoraproject.org> - 6:4.10.3-2
changelog:
  - pull in a few upstream fixes, including a couple minor security issues
  - Crash in DialogShadows::Private::freeX11Pixmaps() (kde#319137)


author: Martin Briza <mbriza@redhat.com> - 4.10.5-3
changelog:
  - make kpac_dhcp_helper full relro
  - set the variables in the generated cmake files to contain both 64b and 32b paths
  - hide "command not found" for one pkg-config invocation in the spec
  - fix macro expansion in the spec changelog
  - Resolves: #884052


author: Martin Briza <mbriza@redhat.com> - 4.10.5-4
changelog:
  - use a better way to figure out if lib or lib64 should be used
  - use -fno-strict-aliasing for type punned source files
  - Resolves: #884052


author: Brian C. Lane <bcl@redhat.com> - 19.31.74-1
changelog:
  - network: don't crash on virtual devices turned off (rvykydal)
    Resolves: rhbz#1080640
  - Do not try to set keyboard preview dialog's size (vpodzime)
    Resolves: rhbz#1011140


author: Brian C. Lane <bcl@redhat.com> - 19.31.75-1
changelog:
  - Display WWIDs in the filter UI for FCoE devices (clumens).
    Resolves: rhbz#1080316
  - Make it possible to override translation domain in GUIObjects (mkolman).
    Related: rhbz#1040240


author: Karanbir Singh <kbsingh@centos.org> - 19.31.79-1.el7.centos.2
changelog:
  - make centos.py the default installclass if its not RHEL/Fedora being built
  - use the right path for the EULA string ( #7165 bstinson )
  - use patch numbers greater than 1000, just in case


author: Karanbir Singh <kbsingh@centos.org> - 19.31.79.1.el7.centos.4
changelog:
  - trim unneeded whitespace from branding patch
  - skip the mirrorlist section till we can build an api at our end around it


author: Marcela Mašláňová <mmaslano@redhat.com> - 3.1.13-16
changelog:
  - the correct solution is remove smp_flags, they don't work properly on ppc with
    the option mpower7
  - Related: rhbz#1048745


author: Tomáš Mráz <tmraz@redhat.com> - 3.1.13-21
changelog:
  - correct the DST correction when using UTC time specification (#1328832)
  - clear non-job files from at dir and test for write error on fclose
    to fix bogus syslog messages


author: Tomáš Mráz <tmraz@redhat.com> - 3.1.13-23
changelog:
  - fix the ownership of the spool directory (#1414228)
  - document the -n option of atd (#739870)
  - fix handling of the aborted jobs (due to possibly
    temporary conditions) and avoid flooding the syslog


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-24
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch with fixes from covscan
    resolves: rhbz#1531295
  - updated mmkubernetes patch with fixes from covscan
    resolves: rhbz#1539193
  - updated imjournal duplicates patch with fixes from covscan
    resolves: rhbz#1538372
  - updated omelastic enhancement patch with fixes from covscan
    resolves: rhbz#1565214


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-26
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch according to early testing
    resolves: rhbz#1531295
  - added patch fixing pid file name in manpage
    resolves: rhbz#1597264
  - updated json-parsing patch with one more bugfix
    resolves: rhbz#1565219


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-27
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch fixing last update regressions
    resolves: rhbz#1531295
  - added patch fixing deadlock in async logging
    resolves: rhbz#1559408
  - added patch fixing NULL access in worktable create
    resolves: rhbz#1600462
  - now putting release number into configure to have it present
    in error messages


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-28
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch fixing next round of regressions
    resolves: rhbz#1531295
    resolves: rhbz#1602156
  - updated mmkubernetes patch with NULL ret-check
    resolves: rhbz#1539193


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-30
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch with next bugfix
    resolves: rhbz#1531295
  - updated imjournal duplicates patch making slower code optional
    and added corresponding doc patch
    resolves: rhbz#1538372


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-31
changelog:
  RHEL 7.6 ERRATUM
  - added new patch fixing ompipe dropping messages when pipe full
    resolves: rhbz#1591819
  - updated mmkubernetes patch to accept non-kubernetes containers
    resolves: rhbz#1539193
    resolves: rhbz#1609023
  - removed json-parsing patches as the bug is now fixed in liblognorm


author: Daniel P. Berrange <berrange@redhat.com> - 2.0.4-1
changelog:
  - Update to 2.0.4 release (rhbz #845777)
  - Fix License tag to reflect change in 2.0.0 series from BSD to ISC


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.2-2
changelog:
  - added new -y option to iostat command to skip first since boot report if
    displaying multiple reports


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.5-5
changelog:
  - resolves: #1100365
    fixed issue when sa data files weren't correctly overwritten in some cases
  - resolves: #1097294
    count with xz compressed files as well in sa2 script
  - resolves: #1097292
    fix file mode of sysstat cron file
  - resolves: #1128569
    added workaround for dyn-tick kernel feature which makes /proc/stat file
    unreliable under certain circumstances
  - resolves: #1110852
    added better explanation of HISTORY setting to sysstat(5) man page
  - resolves: #1102610
    added possibility to set compress method in /etc/sysconfig/sysstat file


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.5-6
changelog:
  - resolves: #1146081
    fixed issue when cifsiostat and nfsiostat were reporting incorrect statistics
    on a single CPU machines


author: Dave Anderson <anderson@redhat.com> - 2.0.13
changelog:
  - Build requires crash-devel-7.2.0-2 and usage requires crash-7.2.0-2
    because of load_module structure change.
    Resolves: rhbz#1520825


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-54.4
changelog:
  - NovaEvacuate: invoke off action
  - galera: add custom host/port support

    Resolves: rhbz#1304019
    Resolves: rhbz#1304711


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-54.6
changelog:
  - nfsserver: fix systemd status detection
  - Replace NovaCompute with nova-compute-wait which lets systemd
    manage the nova-compute process

    Resolves: rhbz#1304370
    Resolves: rhbz#1304811


author: Frank Ch. Eigler <fche@redhat.com> - 3.0-3
changelog:
  - rhbz1346112 delay tls cert creation
  - rhbz1269062 null elevator
  - rhbz1337416 'count' tapset variable - autocast/@defined


author: David Smith <dsmith@redhat.com> - 3.1-3
changelog:
  - Added patches for:
  - rhbz1425568 task_dentry_path() fix
  - rhbz1431263 arm64 hardware breakpoint crash fix
  - rhbz1430828 replace task_exe_file() with current_exe_file()
  - rhbz1436845 adapt stapdyn to the dyninst 9.3.1 library search model
  - rhbz1433391 workaround parser issue in nfs_proc.stp
  - rhbz1428120 update lookup_bad_addr()


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.0.18-1
changelog:
  - New version
  - Replaced RPM_BUILD_ROOT variables by {buildroot} macros
  - Updated URLs to project home page and source code
  - Dropped mk patch, handled better way in the spec


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.0.19-5
changelog:
  - Used unitdir macro instead of the hardcoded systemd paths
    Related: rhbz#1057268
  - Fixed bogus date in changelog (best effort)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-4.b14
changelog:
  - Runtime native library requirements need to match the architecture of the JDK
  - Resolves: rhbz#1375224


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-0.b14
changelog:
  - Update to aarch64-jdk8u111-b14.
  - Add latest md5sum for java.security file due to jar signing property addition.
  - Drop S8157306 and the CORBA typo fix, both of which appear upstream in u111.
  - Add LCMS 2 patch to fix Red Hat security issue RH1367357 in the local OpenJDK copy.
  - Resolves: rhbz#1350037


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-3.b15
changelog:
  - Add MD5 checksum from RHEL 7.2 security update so the 7.3 one overwrites it.
  - Resolves: rhbz#1382736


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-4.b18
changelog:
  - Update to aarch64-jdk8u111-b18, synced with upstream u111, S8170873 and new AArch64 fixes
  - Replace our correct version of 8159244 with the amendment to the 8u version from 8160122.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-4.b18
changelog:
  - Use java-1.7.0-openjdk to bootstrap on RHEL to allow us to use main build target
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.112-0.b16
changelog:
  - Update to aarch64-jdk8u112-b16.
  - Drop upstreamed patches for 8044762, 8049226, 8154210, 8158260 and 8160122.
  - Re-generate size_t and key size (RH1163501) patches against u112.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-0.b13
changelog:
  - Update to aarch64-jdk8u121-b13.
  - Add MD5 checksum for the new java.security file (EC < 224, DSA < 1024 restricted)
  - Update PR1834/RH1022017 fix to reduce curves reported by SSL to apply against u121.
  - Resolves: rhbz#1410612


author: Jan Pazdziora 5.0.7-1
changelog:
  - Only run chkconfig if we are in the SysV world.
  - rhnsd needs to be marked as forking.
  - When talking to systemctl, we need to say .service.


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-90
changelog:
  - Modify 0159-UPBZ-1255885-udev-waits.patch
    * fix bug in failure path
  - Add 0160-RH-udev-flags.patch
  - Add 0161-RHBZ-1311659-no-kpartx.patch
    * skip_kpartx option disables kpartx running on multipath devices
  - Add 0162-RHBZ-1333331-huawei-config.patch
    * Add default config for Huawei XSG1 array
  - Add 0163-UPBZ-1333492-resize-map.patch
    * restore old size if resize fails
  - Add 0164-RHBZ-1311463-dos-part-rollover.patch
    * fix incorrect partition size due to 4k device size rollover
  - Resolves: bz #1255885, #1311463, #1311659, #1333331, #1333492


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-91
changelog:
  - Add 0165-UPBZ-1341748-MSA-2040-conf.patch
    * Add default config for MSA 2040 array
  - Resolves: bz #1341748


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-92
changelog:
  - Add 0166-RHBZ-1323429-dont-allow-new-wwid.patch
    * don't allow path wwid to change while it is in use
  - Add 0167-RHBZ-1335176-fix-show-cmds.patch
    * and new show multipath format wildcard, 'f' to sho number of failures.
      This will hopefully be useful for tracking what happens to multipath
      devices for bz #1335176
  - Resolves: bz #1323429


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-93
changelog:
  - Modify 0135-RHBZ-1299600-path-dev-uevents.patch
    * trigger uevents when adding wwids for existing devices during startup
  - Refresh 0136-RHBZ-1304687-wait-for-map-add.patch
  - Refresh 0150-RHBZ-1253913-fix-startup-msg.patch
  - Add 0168-RHBZ-1347769-shared-lock.patch
    * make multipath lock the path devices with a shared lock
  - Add 0169-UPBZ-1353357-json-output.patch
    * add mulitpathd json output command
  - Resolves: bz #1299600, #1347769, #1353357


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-95
changelog:
  - Add 0170-UPBZ-1352925-fix-typo.patch
  - Add 0171-UPBZ-1356651-allow-zero-size.patch
    * Allow zero-sized paths to be added to a multipath device
  - Add 0172-RHBZ-1350931-no-active-add.patch
    * Allow paths to be added to a new map if no active paths exist. Also
      fixes 1351430
  - Resolves: bz #1350931, #1351430, #1352925, #1356651


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-96
changelog:
  - Modify 0136-RHBZ-1304687-wait-for-map-add.patch
    * change missing_uev_msg_delay to missing_uev_msg_timeout, and make
      multipathd re-enable table loads if the timeout has passed
  - Refresh 0137-RHBZ-1280524-clear-chkr-msg.patch
  - Refresh 0139-RHBZ-1273173-queue-no-daemon-doc.patch
  - Refresh 0150-RHBZ-1253913-fix-startup-msg.patch
  - Refresh 0154-UPBZ-1291406-disable-reinstate.patch
  - Refresh 0155-UPBZ-1300415-PURE-config.patch
  - Refresh 0156-UPBZ-1313324-dont-fail-discovery.patch
  - Refresh 0161-RHBZ-1311659-no-kpartx.patch
  - Refresh 0167-RHBZ-1335176-fix-show-cmds.patch
  - Add 0173-RH-update-man-page.patch
  - Add 0174-RHBZ-1362396-modprobe.patch
    * make starting the multipathd service modprobe dm-multipath in the
      sysvinit scripts
  - Add 0175-RHBZ-1357382-ordering.patch
    * force multipathd.service to start after systemd-udev-trigger.service
  - Add 0176-RHBZ-1363830-fix-rename.patch
    * initialized a variable to make dm_rename not fail randomly
  - Resolves: bz #1304687, #1362396, #1357382, #1363830


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-97
changelog:
  - Add 0177-libmultipath-correctly-initialize-pp-sg_id.patch
    * This and all the following patches add the rbd patch checker
  - Add 0178-libmultipath-add-rbd-discovery.patch
  - Add 0179-multipath-tools-add-checker-callout-to-repair-path.patch
  - Add 0180-multipath-tools-Add-rbd-checker.patch
  - Add 0181-multipath-tools-Add-rbd-to-the-hwtable.patch
  - Add 0182-multipath-tools-check-for-initialized-checker-before.patch
  - Add 0183-multipathd-Don-t-call-repair-on-blacklisted-path.patch
  - Add 0184-rbd-fix-sync-repair-support.patch
  - Add 0185-rbd-check-for-nonshared-clients.patch
  - Add 0186-rbd-check-for-exclusive-lock-enabled.patch
  - Add 0187-rbd-fixup-log-messages.patch
  - Added BuildRequires on librados2-devel
  - Resolves: bz #1348372


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-98
changelog:
  - Modified 0180-multipath-tools-Add-rbd-checker.patch
    * make the rbd path checker only compile if librados2-devel is installed
  - Make librados2-devel only be BuildRequired on x86_64
  - Resolves: bz #1348372


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-99
changelog:
  - Add 0188-RHBZ-1368501-dont-exit.patch
    * make multipathd not exit if it encounters recoverable errors on startup
  - Resolves: bz #1368501


