# changelog

author: Pavel Zhukov <pzhukov@redhat.com> - 12:4.2.5-55
changelog:
  - Resolves: #1349044 - Add disclamer for chaging /etc/dhcp permission for scripts
  - Fix syntax error in attr


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-7
changelog:
  - conf: Resolve corner case on fc_host deletion (rhbz#1420740)
  - pci: fix link maximum speed detection (rhbz#1455017)
  - qemu: Use correct variable in qemuDomainSetBlockIoTune (rhbz#1455510)
  - virsh: Track when create pkttyagent (rhbz#1374126)
  - conf: add eim attribute to <iommu><driver> (rhbz#1451282, rhbz#1289153)
  - qemu: format eim on intel-iommu command line (rhbz#1451282, rhbz#1289153)
  - rpc: Double buffer size instead of quadrupling buffer size. (rhbz#1440683)
  - rpc: Allow up to 256K records to be returned per domain from virConnectGetAllDomainStats. (rhbz#1440683)
  - nodedev: Increase the netlink socket buffer size to the one used by udev (rhbz#1450960, rhbz#1442307)
  - util: hostcpu: Correctly report total number of vcpus in virHostCPUGetMap (rhbz#1456793)
  - qemu: Report shutdown event details (rhbz#1384007)
  - qemu: json: Fix daemon crash on handling domain shutdown event (rhbz#1384007)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-8
changelog:
  - qemu: mkdir memory_backing_dir on startup (rhbz#1214369)
  - qemu: Don't error out if allocation info can't be queried (rhbz#1452045)
  - daemon: Don't initialize SASL context if not necessary (rhbz#1450095)
  - virDomainXMLOption: Introduce virDomainABIStabilityDomain (rhbz#1450349)
  - virQEMUDriverDomainABIStability: Check for memoryBacking (rhbz#1450349)
  - qemu: process: Save vcpu ordering information on reconnect (rhbz#1451251)
  - audit: Fix the output message for shmem (rhbz#1218603)
  - qemu: Set operation on completed migration job (rhbz#1457052)
  - qemu: Conditionally allow block-copy for persistent domains (rhbz#1459113)
  - virsh: Add support for VIR_DOMAIN_BLOCK_COPY_TRANSIENT_JOB (rhbz#1459113)
  - qemu: Fix serial stub console allocation (rhbz#1434278)
  - conf: Make error reporting in virCPUDefIsEqual optional (rhbz#1441662)
  - conf: Refactor virCPUDefParseXML (rhbz#1441662)
  - conf: Make virDomainSnapshotDefFormat easier to read (rhbz#1441662)
  - conf: Pass xmlopt to virDomainSnapshotDefFormat (rhbz#1441662)
  - qemu: Rename xml_len in virQEMUSaveHeader as data_len (rhbz#1441662)
  - qemu: Fix memory leaks in qemuDomainSaveImageOpen (rhbz#1441662)
  - qemu: Introduce virQEMUSaveData{New,Free} (rhbz#1441662)
  - qemu: Introduce virQEMUSaveDataFinish (rhbz#1441662)
  - qemu: Refactor qemuDomainSaveHeader (rhbz#1441662)
  - qemu: Introduce virQEMUSaveData structure (rhbz#1441662)
  - conf: Introduce virSaveCookie (rhbz#1441662)
  - conf: Add save cookie callbacks to xmlopt (rhbz#1441662)
  - qemu: Implement virSaveCookie object and callbacks (rhbz#1441662)
  - qemu: Store save cookie in save images and snapshots (rhbz#1441662)
  - qemu: Remember CPU def from domain start (rhbz#1441662)
  - qemu: Report the original CPU in migratable xml (rhbz#1441662)
  - qemu: Always send persistent XML during migration (rhbz#1441662)
  - qemu: Send updated CPU in migration cookie (rhbz#1441662)
  - qemu: Store updated CPU in save cookie (rhbz#1441662)
  - qemu: Use updated CPU when starting QEMU if possible (rhbz#1441662)
  - docs: correct improper information about domain states in virsh manpage (rhbz#1408778)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-10
changelog:
  - qemu: Set iface MTU on hotplug (rhbz#1408701)
  - Use a separate buffer for <input> subelements (rhbz#1283251)
  - Use a separate buffer for <disk><driver> (rhbz#1283251)
  - Use a separate buffer for <controller><driver> (rhbz#1283251)
  - Use a separate buffer for <filesystem><driver> (rhbz#1283251)
  - conf: introduce virDomainControllerDriverFormat (rhbz#1283251)
  - conf: add iotlb attribute to iommu (rhbz#1283251)
  - qemu: format device-iotlb on intel-iommu command line (rhbz#1283251)
  - qemuxml2xmltest: add virtio-options test (rhbz#1283251)
  - conf: use a leading space in virDomainVirtioNetDriverFormat (rhbz#1283251)
  - Add virtio-related options to interfaces (rhbz#1283251)
  - add virtio-related options to memballoon (rhbz#1283251)
  - Add virtio-related options to disks (rhbz#1283251)
  - Add virtio-related options to controllers (rhbz#1283251)
  - Add virtio-related options to filesystems (rhbz#1283251)
  - Add virtio-related options to rng devices (rhbz#1283251)
  - Add virtio-related options to video (rhbz#1283251)
  - Add virtio-related options to input devices (rhbz#1283251)
  - qemuxml2argvtest: add virtio-options test case (rhbz#1283251)
  - qemu: format virtio-related options on the command line (rhbz#1283251)
  - qemu: Allow memAccess for hugepages again (rhbz#1214369, rhbz#1458638)
  - qemu: Prefer hugepages over mem source='file' (rhbz#1214369)
  - qemu: Don't try to use hugepages if not enabled (rhbz#1214369)
  - qemu: Introduce qemuDomainDefFromXML helper (rhbz#1460952)
  - qemu: Add qemuDomainMigratableDefCheckABIStability (rhbz#1460952)
  - qemu: Add qemuDomainCheckABIStability (rhbz#1460952)
  - qemu: Use qemuDomainCheckABIStability where needed (rhbz#1460952)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-11
changelog:
  - util: storage: Output parsed network backing store string to debug log (rhbz#1461638)
  - util: storage: Add missing return to virStorageSourceParseBackingJSONGluster (rhbz#1461638)
  - util: storage: make virStorageSourceParseBackingJSONGlusterHost universal (rhbz#1461638)
  - util: storage: Add support for type 'inet' in virStorageSourceParseBackingJSONSocketAddress (rhbz#1461638)
  - util: storage: Split out parsing of TCP network host from JSON pseudoprotocol (rhbz#1461638)
  - util: storage: Report errors when source host data is missing (rhbz#1461638)
  - util: storage: Add JSON parser for new options in iSCSI protocol (rhbz#1461638)
  - util: storage: adapt to changes in JSON format for NBD (rhbz#1461638)
  - util: storage: adapt to changes in JSON format for ceph/rbd (rhbz#1461638)
  - util: storage: adapt to changes in JSON format for ssh (rhbz#1461638)
  - util: storage: adapt to changes in JSON format for sheepdog (rhbz#1461638)
  - qemu: Allow live-updates of coalesce settings (rhbz#1414627)
  - qemu: Pass the number of heads even with -vga qxl (rhbz#1283207)
  - util: storage: Export virStorageIsRelative (rhbz#1461303)
  - storage: Add helper to retrieve the backing store string of a storage volume (rhbz#1461303)
  - qemu: snapshot: Load data necessary for relative block commit to work (rhbz#1461303)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-14.el7_4.1
changelog:
  - qemu: Don't update CPU when checking ABI stability (rhbz#1470582)
  - cpu_x86: Properly disable unknown CPU features (rhbz#1470582)
  - qemu: Add qemuProcessFetchGuestCPU (rhbz#1470582)
  - qemu: Add qemuProcessVerifyCPU (rhbz#1470582)
  - qemu: Rename qemuProcessUpdateLiveGuestCPU (rhbz#1470582)
  - qemu: Add qemuProcessUpdateLiveGuestCPU (rhbz#1470582)
  - qemu: Export virQEMUCapsGuestIsNative (rhbz#1470582)
  - qemu: Move qemuProcessReconnect to the end of qemu_process.c (rhbz#1470582)
  - qemu: Update host-model CPUs on reconnect (rhbz#1470582)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-14.el7_4.2
changelog:
  - qemu: Fix qemuDomainGetBlockInfo allocation value setting (rhbz#1470127)
  - qemuDomainBuildNamespace: Handle special file mount points (rhbz#1471660)


author: Denys Vlasenko <dvlasenk@redhat.com> - 0.2.7-4
changelog:
  - Forward-porting fixes from RHEL6.
  - Enlarge buffer used for formatting date in a string format.
  - Resolves: rhbz#891938.
  - Allow configuration of the maximum number of open files.
  - Resolves: rhbz#738967.


author: Nicolas Chauvet <kwizart@gmail.com> - 1.7.1-1
changelog:
  - Update to 1.7.1

  -* Wed Jul 18 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.7.0-5
  -- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild


author: Richard W.M. Jones <rjones@redhat.com> - 4.01.0-14
changelog:
  - Remove ExclusiveArch.
  - Add ocaml-srpm-macros subpackage containing arch macros.
  - See: RHBZ#1087794


author: Richard W.M. Jones <rjones@redhat.com> - 4.01.0-22
changelog:
  - Update to last 4.01 version from OCaml git.
  - Fix bug in argument parsing
    resolves: rhbz#1139803


author: Richard W.M. Jones <rjones@redhat.com> - 4.01.0-22.2
changelog:
  - Use -fno-strict-aliasing when building the compiler
  - ppc, ppc64, ppc64le: Mark stack as non-executable.
    resolves: rhbz#990521
  - Provides ocaml(runtime) 4.01.1.
    related: rhbz#1098459


author: Jaromir Capik <jcapik@redhat.com> - 3.3.4-8
changelog:
  - Fixing use of uninitialized 'vendor_id' value on ppc (#996590)
  - Fixing bogus date in the changelog


author: Martin Sehnoutka <msehnout@redhat.com> - 3.4.0-0.20160601gitf9185e5.1
changelog:
  - New upstream release
  - Drop patches that are already present in upstream
  - Apply upstream fix for systemd paths
  - Resolves: #1297795


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.0-6.20160601gitf9185e5
changelog:
  - Fix License field capitalization
  - Resolves: rhbz#1577175
  - Add detection of AMD Ryzen w/ Vega graphics
  - Resolves: rhbz#1569542
  - Fix issues found by Coverity Scan
  - Resolves: rhbz#1578007


author: Jarod Wilson <jarod@redhat.com> - 2.2-1.5
changelog:
  - Update mvapich23 (TrueScale) bits to 2.3 release
  - Fix libmpi.a being built w/o -fPIC
  - Resolves: #1625672


author: Avesh Agarwal <avagarwa@redhat.com> - 5.1.0-2
changelog:
  - Fixed initialization crash of IMV and IMC particularly
    attestation imv/imc as libstrongswas was not getting initialized.


author: Avesh Agarwal <avagarwa@redhat.com> - 5.1.1-1
changelog:
  Resolves: #1049523
  Resolves: #1036846
  Resolves: #1007548
  - Modified spec file significantly to reflect the current state of
    the package, as this rebase enables several major modules: TNC
    client and server (IF-TNCCS), IMC-IMV (IF-M), PT-TLS (RFC 6876),
    SWID IMC/IMV, charon daemon and it related libs and modules,
    tnc-pdp, tnc-ifmap plugins.


author: Avesh Agarwal <avagarwa@redhat.com> - 5.1.1-2
changelog:
  Resolves: #1049523
  Resolves: #1036846
  Resolves: #1007548
  - A typo caused a patch not being applied, so fixed that and
    bumping the number number.


author: Avesh Agarwal <avagarwa@redhat.com> - 5.1.1-4
changelog:
  Resolves:#1067119
  - Fixed full hardening for strongswan (full relro and PIE).
    The previous macros had a typo and did not work
    (see bz#1067119).
  - Fixed files permissions for executables and config files to
    correctly reflect their intent.
  - Fixed tnc package description to eliminate rpmlint errors.
  - Fixed pki binary and moved it to /usr/libexece/strongswan as
    others binaries are there too to eliminate rpmlint errors.
  - Fixed systemd service name to "strongimv TNC".
  - Removed the dependency on gmp-devel


author: Marek Kasik <mkasik@redhat.com> - 3.14.3-1
changelog:
  - Update to 3.14.3
  - Add translations update from translation team
  - Add translation fix from upstream
  - Remove unused patches
  - Resolves: #1174568


author: Ian Kent <ikent@redhat.com> - 5.0.7-59
changelog:
  - bz1383910 - Incorrect autofs.schema
    - update and add README for old autofs schema
  - bz1367576 - [RFE] Add browsing support into autofs for AMD format maps
    - fix short memory allocation in lookup_amd_instance().
    - fix count_mounts() function.
    - fix argc off by one in mount_autofs.c.
    - fix _strncmp() usage.
    - fix typos in README.amd-maps.
    - add ref counting to struct map_source.
    - add support for amd browsable option.
    - add function conf_amd_get_map_name().
    - add function conf_amd_get_mount_paths().
    - include amd mount section mounts in master mounts list.
    - check for conflicting amd section mounts.
    - add function conf_amd_get_map_options().
    - capture cache option and its settings during parsing.
    - handle map_option cache for top level mounts.
    - handle amd cache option all in amd type auto mounts.
    - fix bogus check in expire_cleanup().
    - delay submount exit for amd submounts.
  - Resolves: rhbz#1383910 rhbz#1367576


author: Ian Kent <ikent@redhat.com> - 5.0.7-60
changelog:
  - bz1382093 - Improve logging in autofs
     - add the mount requestor's pid to pending_args.
     - create thread-local ID for mount attempts.
     - log functions to prefix messages with attempt_id if available.
     - factor out set_thread_mount_request_log_id().
     - add config option to use mount request log id.
  - Resolves: rhbz#1382093


author: Ian Kent <ikent@redhat.com> - 5.0.7-61
changelog:
  - bz1101782 - autofs configured with sssd is not finding any maps
    - work around sss startup delay.
    - add sss master map wait config option (wait initially 0, disabled).
  - Resolves: rhbz#1101782


author: Ian Kent <ikent@redhat.com> - 5.0.7-62
changelog:
  - bz1367576 - [RFE] Add browsing support into autofs for AMD format maps
    - use autofs_point to store expire timeout where possibe.
  - Related: rhbz#1367576


author: Ian Kent <ikent@redhat.com> - 5.0.7-63
changelog:
  - bz1101782 - autofs configured with sssd is not finding any maps
    - fix work around sss startup delay.
  - bz1367576 - [RFE] Add browsing support into autofs for AMD format maps
    - fix possible NULL derefernce.
  - Related: rhbz#1101782 rhbz#1367576


author: Ian Kent <ikent@redhat.com> - 5.0.7-64
changelog:
  - bz1440769 - autofs is facing scalability issues
    - improve scalability of direct mount path component creation.
  - Resolves: rhbz#1440769


author: Ian Kent <ikent@redhat.com> - 5.0.7-65
changelog:
  - bz1367576 - [RFE] Add browsing support into autofs for AMD format maps
    - fix invalid reference in remount_active_mount().
  - Related: rhbz#1367576


author: Ian Kent <ikent@redhat.com> - 5.0.7-66
changelog:
  - bz1435736 - autofs fails with kernel: automount[3386]:
      segfault at 7f3fb7595ca8 ip 00007f3fb61e353a sp 00007f3fb7595cb0
      error 6 in libc-2.17.so[7f3fb60b7000+1b6000]
    - increase worker thread per-thread stack size.
    - limit getgrgid_r() buffer size.
    - add congigure option for limiting getgrgid_r() stack usage.
    - use above option to limit getgrgid_r() stack usage with configure.
  - Resolves: rhbz#1435736


author: Ian Kent <ikent@redhat.com> - 5.0.7-68
changelog:
  - bz1435736 - autofs fails with kernel: automount[3386]:
      segfault at 7f3fb7595ca8 ip 00007f3fb61e353a sp 00007f3fb7595cb0
      error 6 in libc-2.17.so[7f3fb60b7000+1b6000]
    - fix unset tsd group name handling.
  - Related: rhbz#1435736


author: Ian Kent <ikent@redhat.com> - 5.0.7-69
changelog:
  - bz1435736 - autofs fails with kernel: automount[3386]:
      segfault at 7f3fb7595ca8 ip 00007f3fb61e353a sp 00007f3fb7595cb0
      error 6 in libc-2.17.so[7f3fb60b7000+1b6000]
    - fix a couple of covarity warning resulting in group name handling change.
  - Related: rhbz#1435736


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.2.1.el7]
changelog:
  - [md] Simplify ternary operations (Xiao Ni) [1655046 1627563]
  - [x86] Mark Intel Cascade Lake supported (Steve Best) [1650213 1639980]
  - [net] rtnetlink: give a user socket to get_target_net() (Jiri Benc) [1639635 1630694] {CVE-2018-14646}
  - [net] Add variants of capable for use on on sockets (Jiri Benc) [1639635 1630694] {CVE-2018-14646}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.3.1.el7]
changelog:
  - [mm] userfaultfd: allow get_mempolicy(MPOL_F_NODE|MPOL_F_ADDR) to trigger userfaults (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [mm] userfaultfd: shmem: uffdio_copy: set the page dirty if VM_WRITE is not set (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [mm] userfaultfd: shmem: add i_size checks (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [mm] userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [mm] userfaultfd: shmem: allocate anonymous memory for MAP_PRIVATE shmem (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [mm] userfaultfd: use ENOENT instead of EFAULT if the atomic copy user fails (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [fs] userfaultfd: disable irqs when taking the waitqueue lock (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [fs] userfaultfd.c: remove redundant pointer uwq (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [fs] userfaultfd: remove uffd flags from vma->vm_flags if UFFD_EVENT_FORK fails (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [fs] userfaultfd: hugetlbfs: fix userfaultfd_huge_must_wait() pte access (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [mm] userfaultfd: prevent non-cooperative events vs mcopy_atomic races (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [fs] userfaultfd: convert to use anon_inode_getfd() (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [fs] mm, userfaultfd, thp: avoid waiting when PMD under THP migration (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [net] packet: fix a race in packet_bind() and packet_notifier() (Andrea Claudi) [1643680 1643681] {CVE-2018-18559}
  - [x86] kvm: x86: ensure all MSRs can always be KVM_GET/SET_MSR'd (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: x86: #GP when guest attempts to write MCi_STATUS register w/o 0 (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/hyper-v: inject #GP only when invalid SINTx vector is unmasked (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/hyper-v: remove stale entries from vec_bitmap/auto_eoi_bitmap on vector change (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: x86: hyperv: avoid livelock in oneshot SynIC timers (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: x86: hyperv: add KVM_CAP_HYPERV_SYNIC2 (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: Add kvm_vcpu_get_idx to get vcpu index in kvm->vcpus (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: x86: fix NULL deref in vcpu_scan_ioapic (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: x86: use delivery to self in hyperv synic (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: x86: hyperv: make function static to avoid compiling warning (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: hyper-v: do not do hypercall userspace exits if SynIC is disabled (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V VMBus hypercall userspace exit (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Reject Hyper-V hypercall continuation (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V SynIC timers tracepoints (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V SynIC tracepoints (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Update SynIC timers on guest entry only (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Skip SynIC vector check for QEMU side (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V fix SynIC timer disabling condition (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Reorg stimer_expiration() to better control timer restart (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V unify stimer_start() and stimer_restart() (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Drop stimer_stop() function (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V timers fix incorrect logical operation (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Remove Hyper-V SynIC timer stopping (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V SynIC timers (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V SynIC message slot pending clearing at SINT ack (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Added Hyper-V vcpu_to_hv_vcpu()/hv_vcpu_to_vcpu() helpers (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Rearrange func's declarations inside Hyper-V header (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V kvm exit (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V synthetic interrupt controller (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: split ioapic-handled and EOI exit bitmaps (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/irqchip: kvm_arch_irq_routing_update renaming split (Vitaly Kuznetsov) [1647097 1631439]
  - [pinctrl] cannonlake: Fix HOSTSW_OWN register offset of H variant (Benjamin Tissoires) [1647720 1647717 1609926 1544041]
  - [pinctrl] cannonlake: Fix gpio base for GPP-E (Benjamin Tissoires) [1647720 1647717 1609926 1544041]
  - [pinctrl] cannonlake: Fix community ordering for H variant (Benjamin Tissoires) [1647720 1647717 1609926 1544041]
  - [pinctrl] intel: Do pin translation in other GPIO operations as well (Benjamin Tissoires) [1647720 1647717 1609926 1544041]
  - [pinctrl] intel: Implement intel_gpio_get_direction callback (Benjamin Tissoires) [1647720 1647717 1609926 1544041]
  - [platform] x86: dell-smbios-wmi: Correct a memory leak (Jarod Wilson) [1647706 1640399]
  - [scsi] qedi: Initialize the stats mutex lock (Chad Dupuis) [1646870 1633638]
  - [s390] facilites: use stfle_fac_list array size for MAX_FACILITY_BIT (Hendrik Brueckner) [1646868 1628088]
  - [netdrv] qed: Add missing device config for RoCE EDPM in UFP mode (Chad Dupuis) [1646866 1631593]
  - [netdrv] qed: Do not add VLAN 0 tag to untagged frames in multi-function mode (Chad Dupuis) [1646866 1631593]
  - [netdrv] qed: Fix populating the invalid stag value in multi function mode (Chad Dupuis) [1646866 1631593]
  - [netdrv] qed: Fix link flap issue due to mismatching EEE capabilities (Chad Dupuis) [1645150 1636398]
  - [netdrv] qed: Fix shmem structure inconsistency between driver and the mfw (Chad Dupuis) [1645149 1634156]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.4.1.el7]
changelog:
  - [net] macsec: let the administrator set UP state even if lowerdev is down (Sabrina Dubroca) [1658970 1626004]
  - [net] macsec: update operstate when lower device changes (Sabrina Dubroca) [1658970 1626004]
  - [fs] nfsv4.x: fix lock recovery during delegation recall (Steve Dickson) [1657840 1634086]
  - [fs] cifs: Fix autonegotiate security settings mismatch (Leif Sahlberg) [1657841 1650148]
  - [md] raid1: panic because of using freed memory (Xiao Ni) [1656500 1632575]
  - [pci] Match Root Port's MPS to endpoint's MPSS as necessary (Myron Stowe) [1656395 1524000]
  - [pci] Skip MPS logic for Virtual Functions (VFs) (Myron Stowe) [1656395 1524000]
  - [x86] kvm: vmx: re-add ple_gap module parameter (Gary Hook) [1656393 1652933]
  - [iommu] vt-d: Fix iotlb psi missing for mappings (Peter Xu) [1653592 1623856]
  - [iommu] vt-d: Introduce __mapping_notify_one() (Peter Xu) [1653592 1623856]
  - [scsi] libfc: retry PRLI if we cannot analyse the payload (Chris Leech) [1655045 1631130]
  - [scsi] libfc: Do not drop down to FLOGI for fc_rport_login() (Chris Leech) [1655044 1625721]
  - [scsi] libfc: Do not login if the port is already started (Chris Leech) [1655044 1625721]
  - [scsi] libfc: don't advance state machine for incoming FLOGI (Chris Leech) [1655044 1625721]
  - [gpu] drm/i915: Add short HPD IRQ storm detection for non-MST systems (Lyude Paul) [1654733 1608704]
  - [gpu] drm/i915: Clarify flow for disabling IRQs on storms (Lyude Paul) [1654733 1608704]
  - [gpu] drm/i915: Fix threshold check in intel_hpd_irq_storm_detect() (Lyude Paul) [1654733 1608704]
  - [gpu] drm/i915: Fix NULL deref when re-enabling HPD IRQs on systems with MST (Lyude Paul) [1654733 1608704]
  - [gpu] drm/i915: Fix possible race in intel_dp_add_mst_connector() (Lyude Paul) [1654733 1608704]
  - [iommu] amd: Clear memory encryption mask from physical address (Gary Hook) [1649025 1643293]
  - [security] Make [un]register_lsm_notifier() null ops if !selinux_enabled (Don Dutile) [1648811 1621072]
  - [netdrv] bonding/802.3ad: fix link_failure_count tracking (Jarod Wilson) [1648294 1641660]
  - [block] nvme: do not require GENERIC_HARDIRQ interfaces on s390 (Hendrik Brueckner) [1648239 1637637]
  - [nvme] nvme-pci: add a memory barrier to nvme_dbbuf_update_and_check_event (David Milburn) [1648240 1630481]
  - [x86] kprobes: Use 5-byte NOP when the code might be modified by ftrace (Josh Poimboeuf) [1647816 1577050]
  - [fs] userfaultfd: check VM_MAYWRITE was set after verifying the uffd is registered (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}


author: Akemi Yagi <toracat@centos.org> [3.10.0-957.5.1.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
     addmissing.patch  [puias]
     cpufreq.patch  [puias]
     i386-audit-stop-scri-stack-frame.patch  [puias]
     removejiffies.patch  [puias]
     undorhirqstat.patch  [puias]
     morefixes.patch      [puias+bug#12412]
     upstream-32bit-fixes-7_5.patch [puias+bug#12412]
     clear-32bit-Werror-warnings.patch  [bug#12412]
     qspinlock_types-32bit.patch   [ay]
     i686-7-4.patch [T.Kabe, bug#13890]
     firmware-efi-32bit.patch [ay]
     patch-spec_ctrl_i686.patch [T.Kabe bug#14353]
     686 mods for 7.5 [T.Kabe bug#14703]
     more 686 mods for 7.5 (-862.3.2) [pgreco]
     more 686 mods for 7.5 (-862.11.6) [pgreco, bug#15174]
     Patches updated for 7.6 [kabe, bug#15428]
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Enabled spidev [bug#9955]
  - Add a patch [bug#10447]
  - Enable ATM drivers [bug#10845]
  - Add 9pfs config options [bug#10849]
  - Enable VFIO_PCI_VGA [bug#12435]
  - Rremove initramfs-xxxkdump.img upon kernel removal [bug#12703]
  - Add a patch from [bug#12841]
  - Add a patch from [bug#12818]
  - Enabled RT2800USB_RT3573 [bug#13162]
  - Enable LDM_PARTITION [bug#13526]
  - Add a patch to fix misleading warning [bug#13990]
  - Add BuildRequires: openssl-devel to the with_perf section [bug#13990]
  - Add a patch to fix build errors for EL7.5 [bug#14425]
  - Added a patch to fix alsa potentail crash [bug14779]
  - Apply a patch to fix excessive warnings [bug#14413]
  - Apply a patch to fix mempolicy issue [bug#15115]
  - Add a patch to fix race in virtio_balloon [bug#15216]
  - Add shim requirement to the spec file for x86_64
  - Apply patches that fix ecryptfs issue [see bugs #7369, #15353] provided by @pgreco
  - Add an i686 patch to fix Hyper-V issue [bug#15374]
  - Add an nvme patch [bug#15406]
  - Add a patch that fixes the mouse input issue in VirtualBox guest.
  - Enable NIU and add a patch that fixes build errors submitted by h-masuda [bug#15040]
  - Apply a patch from bug15639
  - Apply a patch from bug15707
  - Apply a patch from bug15742
  - Add a patch that fixes the earlier patch from bug15742


author: Jan Kaluza <jkaluza@redhat.com> - 5.11-14
changelog:
  - fix #1048910 - increase perl scripts magic strength
  - fix #1048082 - add support for QCOW3 images detection


author: Steve Grubb <sgrubb@redhat.com> 2.4.1-4
changelog:
  - Remove golang bindings added under the following bz
  resolves: #1115196 - Add golang bindings for libaudit


author: Steve Grubb <sgrubb@redhat.com> 2.6.5-4
changelog:
  resolves: #1382397 - write_logs option is not correctly handled
  resolves: #1414812 - Setting log_format to NOLOG make auditd core dump


author: Steve Grubb <sgrubb@redhat.com> 2.7.4-1
changelog:
  resolves: #1367703 - auvirt wasn't supporting date keywords
  resolves: #1396792 - augenrules includes files ending in regexp "rules"
  resolves: #1406525 - ausearch with '--raw' parameter outputs garbage character


author: Steve Grubb <sgrubb@redhat.com> 2.7.5-1
changelog:
  resolves: #1437187 - audit rpm postinstall script points to non-existing file
  resolves: #1437426 - Remove "--backlog_wait_time" from auditctl man page & rules
  resolves: #1437626 - PF_PACKET socket address will cause ausearch to segfault
  resolves: #1438997 - SECCOMP records have wrong syscall


author: Akemi Yagi <toracat@centos.org> [3.10.0-327.18.2.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - Add in a patch that fixes missing Unifying device issue [bug#7340]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Add in a patch that fixes waking up from S3 for AMD family [bug#7645]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Add in a patch that fixes crash due to xfrm oops [bug#9646]
  - Enabled spidev [bug#9955]
  - Add in patches from bugs 10073 and 10191 [bug#10073 bug#10191]
  - Add in a patch from bug 10320 [bug#10320]
  - Add patches [bug#10516]
  - Add a patch [bug#10447]
  - Add patches [bug#10033]
  - Remove patch from bug#10191, bug#10320
  - Add a patch [bug#10729]
  - Add patches [bug#10767]


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-20
changelog:
  - Fix: tools: Fixes formatting of remote-nodes in crm_mon and crm_simulate
  - Fix: Corosync: Attempt to retrieve a peers node name if it is not already known
      Resolves: rhbz#720543


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-23
changelog:
  - mcp: Tell systemd not to respawn us if we return 100
  - services: Detect missing agents and permission errors before forking
  - Use native DBus library for systemd support to avoid problematic use of threads
      Resolves: rhbz#720543 (aka. 1057697)


author: David Vossel <dvossel@redhat.com> - 1.1.10-24
changelog:
  - controld: handling startup fencing within the controld agent, not the dlm
      Resolves: rhbz#1064519
  - controld: Do not consider the dlm up until the address list is present
      Resolves: rhbz#1067536


author: David Vossel <dvossel@redhat.com> - 1.1.10-25
changelog:
  - pengine: cl#5187 - Prevent resources in an anti-colocation from even temporarily running on a same node
      Resolves: rhbz#1069284


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-26
changelog:
  - Run automated regression tests after every build
  - Fencing: Send details of stonith_api_time() and stonith_api_kick() to syslog
  - Fencing: Pass the correct options when looking up the history by node name
  - Fencing: stonith_api_time_helper now returns when the most recent fencing operation completed
  - crm_report: Additional dlm detail if dlm_controld is running
  - crmd: Gracefully handle actions that cannot be initiated
  - pengine: Gracefully handle bad values for XML_ATTR_TRANSITION_MAGIC
      Resolves: rhbz#1070916


author: Andrew Beekhof <beekhof@redhat.com> - 1.1.10-27
changelog:
  - crm_resource: Prevent use-of-NULL
  - systemd: Prevent use-of-NULL when determining if an agent exists
  - Fencing: Remove shadow definition and use of variable 'progress'
      Resolves: rhbz#1070916


author: David Vossel <dvossel@redhat.com> - 1.1.10-28
changelog:
  - Fix: pengine: fixes invalid transition caused by clones with more than 10 instances
      Resolves: rhbz#1078504


author: Akira TAGOH <tagoh@redhat.com> - 1.34.1-2
changelog:
  - Fix duplicate file list for modules.cache
  - s/%define/%global/g
  - Fix bogus date in %changelog
  - Do not suppress the detailed build log.


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.15.1.el7]
changelog:
  - [net] udp: fix bcast packet reception (Paolo Abeni) [1506530 1493238]
  - [net] udp: perform source validation for mcast early demux (Paolo Abeni) [1506530 1493238]
  - [net] ipv4: early demux can return an error code (Paolo Abeni) [1506530 1493238]
  - [net] tcp: reset sk_rx_dst in tcp_disconnect() (Jamie Bainbridge) [1520296 1467770]
  - [md] dm cache: fix race condition in the writeback mode overwrite_bio optimisation (Mike Snitzer) [1517795 1512095]
  - [net] packet: in packet_do_bind, test fanout with bind_lock held (Hangbin Liu) [1505430 1505429] {CVE-2017-15649}
  - [net] packet: hold bind lock when rebinding to fanout hook (Hangbin Liu) [1505430 1505429] {CVE-2017-15649}
  - [net] packet: Do not call fanout_release from atomic contexts (Hangbin Liu) [1505430 1505429] {CVE-2017-15649}
  - [net] packet: fix races in fanout_add() (Hangbin Liu) [1505430 1505429] {CVE-2017-15649}
  - [security] keys: Fix handling of stored error in a negatively instantiated user key (David Howells) [1411618 1479727 1411622 1450158] {CVE-2015-8539 CVE-2017-7472}
  - [security] keys: fix keyctl_set_reqkey_keyring() to not leak thread keyrings (David Howells) [1411618 1479727 1411622 1450158] {CVE-2015-8539 CVE-2017-7472}
  - [security] keys: Differentiate uses of rcu_dereference_key() and user_key_payload() (David Howells) [1411618 1479727 1411622 1450158] {CVE-2015-8539 CVE-2017-7472}
  - [security] keys: Use memzero_explicit() for secret data (David Howells) [1411618 1479727 1411622 1450158] {CVE-2015-8539 CVE-2017-7472}
  - [security] keys: Fix an error code in request_master_key() (David Howells) [1411618 1479727 1411622 1450158] {CVE-2015-8539 CVE-2017-7472}


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.16.1.el7]
changelog:
  - [x86] smpboot: Do not use smp_num_siblings in __max_logical_packages calculation (Prarit Bhargava) [1533022 1519503]
  - [x86] topology: Add topology_max_smt_threads() (Prarit Bhargava) [1533022 1519503]
  - [powerpc] spinlock: add gmb memory barrier (Jon Masters) [1519788 1519786] {CVE-2017-5753}
  - [powerpc] Prevent Meltdown attack with L1-D$ flush (Jon Masters) [1519800 1519801] {CVE-2017-5754}
  - [s390] add ppa to system call and program check path (Jon Masters) [1519795 1519798] {CVE-2017-5715}
  - [s390] spinlock: add gmb memory barrier (Jon Masters) [1519788 1519786] {CVE-2017-5753}
  - [s390] introduce CPU alternatives (Jon Masters) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: move vmexit rmb in the last branch before IBRS (Andrea Arcangeli) [1533373 1533250]
  - [x86] spec_ctrl: satisfy the barrier like semantics of IBRS (Andrea Arcangeli) [1533373 1533250]
  - [fs] userfaultfd: clear the vma->vm_userfaultfd_ctx if UFFD_EVENT_FORK fails (Andrea Arcangeli) [1533372 1531287]
  - [x86] kaiser/efi: unbreak tboot (Andrea Arcangeli) [1519795 1532989 1519798 1531559] {CVE-2017-5715}
  - [x86] spec_ctrl: don't call ptrace_has_cap in the IBPB ctx switch optimization (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/efi: unbreak EFI old_memmap (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] cpuidle_idle_call: fix double local_irq_enable() (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] entry: Invoke TRACE_IRQS_IRETQ in paranoid_userspace_restore_all (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] cpu: fix get_scattered_cpu_leaf sorting part #2 (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: show added cpuid flags in /proc/cpuinfo after late microcode update (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] cpu: fix get_scattered_cpu_leaf for IBPB feature (Paolo Bonzini) [1519795 1519798]
  - [x86] spec_ctrl: Eliminate redundant FEATURE Not Present messages (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] mm/kaiser: init_tss is supposed to go in the PAGE_ALIGNED per-cpu section (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: svm: spec_ctrl at vmexit needs per-cpu areas functional (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: skip IBRS/CR3 restore when paranoid exception returns to userland (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: consider the init_mm.pgd a kaiser pgd (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: convert userland visible "kpti" name to "pti" (Andrea Arcangeli) [1519795 1519798]
  - Revert "x86/entry: Use retpoline for syscall's indirect calls" (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: set IBRS during resume from RAM if ibrs_enabled is 2 (Andrea Arcangeli) [1519795 1519798]
  - [x86] kaiser/mm: __load_cr3 in resume from RAM after kernel gs has been restored (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: allow use_ibp_disable only if both SPEC_CTRL and IBPB_SUPPORT are missing (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: Documentation spec_ctrl.txt (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: remove irqs_disabled() check from intel_idle() (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: use enum when setting ibrs/ibpb_enabled (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: undo speculation barrier for ibrs_enabled and noibrs_cmdline (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: introduce ibpb_enabled = 2 for IBPB instead of IBRS (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: introduce SPEC_CTRL_PCP_ONLY_IBPB (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: cleanup s/flush/sync/ naming when sending IPIs (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: set IBRS during CPU init if in ibrs_enabled == 2 (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: use IBRS_ENABLED instead of 1 (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: allow the IBP disable feature to be toggled at runtime (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: always initialize save_reg in ENABLE_IBRS_SAVE_AND_CLOBBER (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: ibrs_enabled() is expected to return > 1 (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: issue a __spec_ctrl_ibpb if a credential check isn't possible (Andrea Arcangeli) [1519795 1519798]
  - [x86] mm/kaiser: disable global pages by default with KAISER (Andrea Arcangeli) [1519795 1519798]
  - Revert "x86/mm/kaiser: Disable global pages by default with KAISER" (Andrea Arcangeli) [1519795 1519798]
  - [x86] ibpb: don't optimize spec_cntrl_ibpb on PREEMPT_RCU (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: clear registers after 32bit syscall stackframe is setup (Andrea Arcangeli) [1519800 1519801]
  - [x86] spec_ctrl: reload spec_ctrl cpuid in all microcode load paths (Andrea Arcangeli) [1519800 1519801]
  - [x86] kaiser/mm: fix pgd freeing in error path (Andrea Arcangeli) [1519800 1519801]
  - [x86] spec_ctrl: Prevent unwanted speculation without IBRS (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Remove trampoline check from paranoid entry path (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Fix paranoid_exit() trampoline clobber (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Simplify trampoline stack restore code (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] dumpstack: Remove raw stack dump (Josh Poimboeuf) [1519795 1519798]
  - [x86] spec_ctrl: remove SPEC_CTRL_DEBUG code (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add noibrs noibpb boot options (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] entry: Use retpoline for syscall's indirect calls (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on 32-bit compatible syscall entrance (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: cleanup unnecessary ptregscall_common function (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: CLEAR_EXTRA_REGS and extra regs save/restore (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on syscall entrance (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: rescan cpuid after a late microcode update (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add debugfs ibrs_enabled ibpb_enabled (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: consolidate the spec control boot detection (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] KVM/spec_ctrl: allow IBRS to stay enabled in host userland (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add debug aid to test the entry code without microcode (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: move stuff_RSB in spec_ctrl.h (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] entry: Stuff RSB for entry to kernel for non-SMEP platform (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] mm: Only set IBPB when the new thread cannot ptrace current thread (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] mm: Set IBPB upon context switch (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] idle: Disable IBRS when offlining cpu and re-enable on wakeup (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] idle: Disable IBRS entering idle and enable it on wakeup (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: implement spec ctrl C methods (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: save IBRS MSR value in save_paranoid for NMI (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] enter: Use IBRS on syscall and interrupts (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: swap rdx with rsi for nmi nesting detection (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: spec_ctrl_pcp and kaiser_enabled_pcp in same cachline (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: use per-cpu knob instead of ALTERNATIVES for ibpb and ibrs (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] enter: MACROS to set/clear IBRS and set IBPB (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] x86: add SPEC_CTRL to MSR and CPUID lists (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] svm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] svm: Set IBPB when running a different VCPU (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] vmx: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] vmx: Set IBPB when running a different VCPU (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] x86: clear registers on VM exit (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] kvm: pad RSB on VM transition (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] cpu/AMD: Control indirect branch predictor when SPEC_CTRL not available (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] feature: Report presence of IBPB and IBRS control (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] feature: Enable the x86 feature to control Speculation (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [tools] objtool: Don't print 'call dest' warnings for ignored functions (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [misc] locking/barriers: prevent speculative execution based on Coverity scan results (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [fs] udf: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [fs] prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [kernel] userns: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [scsi] qla2xxx: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [netdrv] p54: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [netdrv] carl9170: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [media] uvcvideo: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [x86] cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [x86] cpu/AMD: Make the LFENCE instruction serialized (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [misc] locking/barriers: introduce new memory barrier gmb() (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [x86] mm/kaiser: Replace kaiser with kpti to sync with upstream (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add "kaiser" and "nokaiser" boot options (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map the trace idt tables in userland shadow pgd (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: fix RESTORE_CR3 crash in kaiser_stop_machine (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use stop_machine for enable/disable knob (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use atomic ops to poison/unpoison user pagetables (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use invpcid to flush the two kaiser PCID AISD (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use two PCID ASIDs optimize the TLB during enter/exit kernel (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: stop patching flush_tlb_single (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use PCID feature to make user and kernel switches faster (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: If INVPCID is available, use it to flush global mappings (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/64: Fix reboot interaction with CR4.PCIDE (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/64: Initialize CR4.PCIDE early (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Add a 'noinvpcid' boot option to turn off INVPCID (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Add the 'nopcid' boot option to turn off PCID (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: validate trampoline stack (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] entry: Move SYSENTER_stack to the beginning of struct tss_struct (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: isolate the user mapped per cpu areas (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: enable kaiser in build (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: selective boot time defaults (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: handle call to xen_pv_domain() on PREEMPT_RT (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser/xen: Dynamically disable KAISER when running under Xen PV (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add Kconfig (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: avoid false positives during non-kaiser pgd updates (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: Respect disabled CPU features (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: trampoline stack comments (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: stack trampoline (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: remove paravirt clock warning (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: re-enable vsyscalls (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow to build KAISER with KASRL (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow KAISER to be enabled/disabled at runtime (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: un-poison PGDs at runtime (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add a function to check for KAISER being enabled (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add debugfs file to turn KAISER on/off at runtime (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: disable native VSYSCALL (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map virtually-addressed performance monitoring buffers (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map debug IDT tables (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add kprobes text section (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map trace interrupt entry (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map entry stack per-cpu areas (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map dynamically-allocated LDTs (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: make sure static PGDs are 8k in size (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow NX poison to be set in p4d/pgd (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: unmap kernel from userspace page tables (core patch) (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: mark per-cpu data structures required for entry/exit (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: introduce user-mapped per-cpu areas (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add cr3 switches to entry code (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: remove scratch registers (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: prepare assembly for entry/exit CR3 switching (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: Disable global pages by default with KAISER (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Document X86_CR4_PGE toggling behavior (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/tlb: Make CR4-based TLB flushes more robust (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Do not set _PAGE_USER for init_mm page tables (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] increase robusteness of bad_iret fixup handler (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [perf] x86/intel/uncore: Fix memory leaks on allocation failures (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [mm] userfaultfd: hugetlbfs: prevent UFFDIO_COPY to fill beyond the end of i_size (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [fs] userfaultfd: non-cooperative: fix fork use after free (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [mm] userfaultfd: hugetlbfs: remove superfluous page unlock in VM_SHARED case (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [mm] fix bad rss-counter if remap_file_pages raced migration (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.18.1.el7]
changelog:
  - [md] raid5: fix a race condition in stripe batch (Nigel Croxon) [1535883 1496836]
  - [security] selinux: fix double free in selinux_parse_opts_str() (Paul Moore) [1532288 1456843]
  - [fs] nfs: revert "nfs: Move the flock open mode check into nfs_flock()" (Benjamin Coddington) [1531095 1497225]


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.19.1.el7]
changelog:
  - [watchdog] hpwdt: remove indirect call in drivers/watchdog/hpwdt.c (Josh Poimboeuf) [1539649 1535644]
  - [kernel] x86/spec_ctrl: cleanup __ptrace_may_access (Josh Poimboeuf) [1539649 1535644]
  - [x86] bugs: Drop one "mitigation" from dmesg (Josh Poimboeuf) [1539649 1535644]
  - [x86] kvm: vmx: Make indirect call speculation safe (Josh Poimboeuf) [1539649 1535644]
  - [x86] kvm: x86: Make indirect calls in emulator speculation safe (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline: Optimize inline assembler for vmexit_fill_RSB (Josh Poimboeuf) [1539649 1535644]
  - [x86] mce: Make machine check speculation protected (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: fix ptrace IBPB optimization (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: Avoid returns in IBRS-disabled regions (Josh Poimboeuf) [1539649 1535644]
  - [x86] spectre/meltdown: avoid the vulnerability directory to weaken kernel security (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: Document retpolines and ibrs_enabled=3 (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: upgrade GCC retpoline warning to an error (Josh Poimboeuf) [1539649 1535644]
  - [x86] Use IBRS for firmware update path (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: stuff RSB on context switch with SMEP enabled (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: enforce sane combinations of IBRS and retpoline (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: use upstream RSB stuffing function (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: add ibrs_enabled=3 (ibrs_user) (Josh Poimboeuf) [1539649 1535644]
  - [kernel] x86/jump_label: warn on failed jump label patch (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: detect unretpolined modules (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline: Add LFENCE to the retpoline/RSB filling RSB macros (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline: Fill return stack buffer on vmexit (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline/xen: Convert Xen hypercall indirect jumps (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline/hyperv: Convert assembler indirect jumps (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline/ftrace: Convert ftrace assembler indirect jumps (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline/entry: Convert entry assembler indirect jumps (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline/crypto: Convert crypto assembler indirect jumps (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline: Add initial retpoline support (Josh Poimboeuf) [1539649 1535644]
  - [x86] jump_label: add asm support for static keys (Josh Poimboeuf) [1539649 1535644]
  - [x86] asm: Make asm/alternative.h safe from assembly (Josh Poimboeuf) [1539649 1535644]
  - [tools] objtool: Support new GCC 6 switch jump table pattern (Josh Poimboeuf) [1539649 1535644]
  - [tools] objtool: Detect jumps to retpoline thunks (Josh Poimboeuf) [1539649 1535644]
  - [x86] spectre: Add boot time option to select Spectre v2 mitigation (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: print features changed by microcode loading (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: refactor the init and microcode loading paths (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: move initialization of X86_FEATURE_IBPB_SUPPORT (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: remove SPEC_CTRL_PCP_IBPB bit (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: remove ibrs_enabled variable (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: add ibp_disabled variable (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: add X86_FEATURE_IBP_DISABLE (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: remove IBP disable for AMD model 0x16 (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: remove performance measurements from documentation (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: make ipbp_enabled read-only (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: remove ibpb_enabled=2 mode (Josh Poimboeuf) [1539649 1535644]
  - [x86] cpu: Implement CPU vulnerabilites sysfs functions (Josh Poimboeuf) [1539649 1535644]
  - [base] sysfs/cpu: Add vulnerability folder (Josh Poimboeuf) [1539649 1535644]
  - [x86] cpu: Merge bugs.c and bugs_64.c (Josh Poimboeuf) [1539649 1535644]
  - [x86] syscall: int80 must not clobber r12-15 (Josh Poimboeuf) [1539649 1535644]
  - [x86] syscall: change ia32_syscall() to create the full register frame in ia32_do_call() (Josh Poimboeuf) [1539649 1535644]
  - [x86] boot: Add early cmdline parsing for options with arguments (Josh Poimboeuf) [1539649 1535644]
  - [x86] boot: Pass in size to early cmdline parsing (Josh Poimboeuf) [1539649 1535644]
  - [x86] boot: Simplify early command line parsing (Josh Poimboeuf) [1539649 1535644]
  - [x86] boot: Fix early command-line parsing when partial word matches (Josh Poimboeuf) [1539649 1535644]
  - [x86] boot: Fix early command-line parsing when matching at end (Josh Poimboeuf) [1539649 1535644]
  - [scsi] storvsc: Fix scsi_cmd error assignments in storvsc_handle_error (Cathy Avery) [1536978 1502601]
  - [fs] nfs: RPC_MAX_AUTH_SIZE is in bytes ("J. Bruce Fields") [1533378 1495321]
  - [fs] nfsd: give out fewer session slots as limit approaches (Dave Wysochanski) [1533377 1492234]
  - [fs] nfsd: increase DRC cache limit (Dave Wysochanski) [1533377 1492234]
  - [x86] kvm: x86: fix RSM when PCID is non-zero (Paolo Bonzini) [1531662 1530711]
  - [x86] iommu/amd: Reduce delay waiting for command buffer space (Suravee Suthikulpanit) [1531456 1508644]
  - [x86] iommu/amd: Reduce amount of MMIO when submitting commands (Suravee Suthikulpanit) [1531456 1508644]
  - [x86] amd: Remove cmd_buf_size and evt_buf_size from struct amd_iommu (Suravee Suthikulpanit) [1531456 1508644]
  - [x86] amd: Fix the left value check of cmd buffer (Suravee Suthikulpanit) [1531456 1508644]
  - [x86] amd: Don't put completion-wait semaphore on stack (Suravee Suthikulpanit) [1531456 1508644]
  - [x86] kvm: svm: obey guest PAT (Suravee Suthikulpanit) [1530976 1478185]
  - [tty] serial: 8250_pci: Add Amazon PCI serial device ID (Vitaly Kuznetsov) [1530137 1527545]
  - [ata] libata: sata_down_spd_limit should return if driver has not recorded sstatus speed (David Milburn) [1530136 1457140]
  - [fs] nfs: fix a deadlock in nfs client initialization (Scott Mayhew) [1530135 1506382]
  - [fs] nfsv4.0: Fix a lock leak in nfs40_walk_client_list (Scott Mayhew) [1530135 1506382]
  - [fs] nfs: Create a common nfs4_match_client() function (Scott Mayhew) [1530135 1506382]
  - [fs] autofs - revert: take more care to not update last_used on path walk (Ian Kent) [1525994 1489542]
  - [vhost] vhost_net: correctly check tx avail during rx busy polling (Jason Wang) [1523784 1487551]
  - [crypto] shash - Fix has_key setting (Herbert Xu) [1522932 1505817]
  - [block] Fix a race between blk_cleanup_queue() and timeout handling (Ming Lei) [1522698 1513725]
  - [x86] tsc: Force TSC_ADJUST register to value >= zero (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Validate cpumask pointer before accessing it (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Try to adjust TSC if sync test fails (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Prepare warp test for TSC adjustment (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Move sync cleanup to a safe place (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Sync test only for the first cpu in a package (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Verify TSC_ADJUST from idle (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Store and check TSC ADJUST MSR (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Detect random warps (Prarit Bhargava) [1519850 1497055]
  - [x86] kvm: mmu: always terminate page walks at level 1 (Paolo Bonzini) [1500382 1500381] {CVE-2017-12188}
  - [x86] kvm: nVMX: update last_nonleaf_level when initializing nested EPT (Denys Vlasenko) [1500382 1500381] {CVE-2017-12188}
  - [x86] kvm: fix singlestepping over syscall (Paolo Bonzini) [1464480 1464481] {CVE-2017-7518}


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.21.1.el7]
changelog:
  - [x86] platform/uv: Mark tsc_check_sync as an init function (Frank Ramsay) [1547870 1526066]
  - [x86] platform/uv: Add check of TSC state set by UV BIOS (Frank Ramsay) [1547870 1526066]
  - [x86] tsc: Provide a means to disable TSC ART (Frank Ramsay) [1547870 1526066]
  - [x86] tsc: Drastically reduce the number of firmware bug warnings (Frank Ramsay) [1547870 1526066]
  - [x86] tsc: Skip TSC test and error messages if already unstable (Frank Ramsay) [1547870 1526066]
  - [x86] tsc: Add option that TSC on Socket 0 being non-zero is valid (Frank Ramsay) [1547870 1526066]
  - [x86] tsc: Remove the TSC_ADJUST clamp (Frank Ramsay) [1547870 1526066]


author: Akemi Yagi <toracat@centos.org> [3.10.0-693.21.1.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
     addmissing.patch  [puias]
     cpufreq.patch  [puias]
     i386-audit-stop-scri-stack-frame.patch  [puias]
     removejiffies.patch  [puias]
     undorhirqstat.patch  [puias]
     morefixes.patch      [puias+bug#12412]
     upstream-32bit-fixes-7_4.patch [puias+bug#12412]
     clear-32bit-Werror-warnings.patch  [bug#12412]
     qspinlock_types-32bit.patch   [ay]
     i686-7-4.patch [T.Kabe, bug#13890]
     firmware-efi-32bit.patch [ay]
     patch-spec_ctrl_i686.patch [T.Kabe bug#14353]
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Enabled spidev [bug#9955]
  - Add a patch [bug#10447]
  - Enable ATM drivers [bug#10845]
  - Add 9pfs config options [bug#10849]
  - Enable VFIO_PCI_VGA [bug#12435]
  - Rremove initramfs-xxxkdump.img upon kernel removal [bug#12703]
  - Add a patch from [bug#12841]
  - Add a patch from [bug#12818]
  - Enabled RT2800USB_RT3573 [bug#13162]
  - Enable LDM_PARTITION [bug#13526]
  - Add a patch from [bug#13583]
  - Add a patch for xen [bug#13763]
  - Add a patch from [bug#13990]
  - Add BuildRequires: openssl-devel to the with_perf section [bug#13990]
  - Add a xen patch [bug#14347]
  - Add iommu patches [bug#14476]


author: Honza Horak <hhorak@redhat.com> 1:5.5.34-3
changelog:
  - Clean all non-needed doc files properly
    Related: #1044532
  - Disable main.gis-precise test also for AArch64
    Disable perfschema.func_file_io and perfschema.func_mutex for AArch64
    (like it is done for 32-bit ARM)
    Resolves: #1050988
  - Build with -O3 on ppc64 (disabling innodb_prefix_index_restart_server)
    Related: #1051069
  - Move mysql_config to -devel sub-package and remove Require: mariadb
    Resolves: #1050920


author: Honza Horak <hhorak@redhat.com> 5.5.35-1
changelog:
  - Rebase to 5.5.35
    https://kb.askmonty.org/en/mariadb-5535-changelog/
    Also fixes: CVE-2014-0001, CVE-2014-0412, CVE-2014-0437, CVE-2013-5908,
    CVE-2014-0420, CVE-2014-0393, CVE-2013-5891, CVE-2014-0386, CVE-2014-0401,
    CVE-2014-0402
    Resolves: #1054041


author: Honza Horak <hhorak@redhat.com> - 1:5.5.37-1
changelog:
  - Rebase to 5.5.37
    https://kb.askmonty.org/en/mariadb-5537-changelog/
    Also fixes: CVE-2014-2440 CVE-2014-0384 CVE-2014-2432 CVE-2014-2431
    CVE-2014-2430 CVE-2014-2436 CVE-2014-2438 CVE-2014-2419
    Resolves: #1101062


author: Matej Muzila <mmuzila@redhat.com> - 1:5.5.40-1
changelog:
  - Rebase to 5.5.40
    Also fixes: CVE-2014-4274 CVE-2014-4287 CVE-2014-6463 CVE-2014-6464
    CVE-2014-6469 CVE-2014-6484 CVE-2014-6505 CVE-2014-6507 CVE-2014-6520
    CVE-2014-6530 CVE-2014-6551 CVE-2014-6555 CVE-2014-6559 CVE-2014-6564
    Resolves: #1160548


author: Petr Machata <pmachata@redhat.com> - 1.53.0-15
changelog:
  - Fix misunderstanding of Boost.MPI about widths of some
    Boost.Serialization types.  (boost-1.53.0-mpi-version_type.patch)


author: Petr Machata <pmachata@redhat.com> - 1.53.0-18
changelog:
  - Turn off build flags pre-set by Boost distribution.
    (boost-1.53.0-buildflags.patch)
  - Pass RPM_OPT_FLAGS through user-config.jam.


author: Petr Machata <pmachata@redhat.com> - 1.53.0-21
changelog:
  - Fix atomic_cas32 (thanks Jaroslav Škarvada for figuring out where
    the problem is) (boost-1.54.0-interprocess-atomic_cas32-ppc.patch)


author: Jonathan Wakely <jwakely@redhat.com> - 1.53.0-26
changelog:
  - do not use arch-specific BuildRequires (#1268268)
  - support TLS libraries without SSLv3 (#1298227)


author: Jonathan Wakely <jwakely@redhat.com> - 1.53.0-26
changelog:
  - Install unpatched gcc.jam (#1305019).
  - Build libboost_python and libboost_python3 such that they depend on
    their respective libpython (#1302120).
    (boost-1.53.0-python-libpython_dep.patch,
    boost-1.53.0-python-abi_letters.patch)
  - Fix Boost.Python test suite so that PyImport_AppendInittab is called
    before PyInitialize, which broke the test suite with Python 3.
    (boost-1.53.0-python-test-PyImport_AppendInittab.patch)
  - Patch gcc.jam to not add bogus rpaths.


author: Dominik Perpeet <dperpeet@redhat.com> 138-3
changelog:
  - Fix issues with connections between multiple hosts
  - Fix format string type mismatch on some architectures


author: Martin Pitt <mpitt@redhat.com> 154-1
changelog:
  - Rebase to version 154, drop all patches rhbz#1470780
  - This allows ssh keys to be loaded from arbitrary directories
    rhbz#1425887


author: Martin Pitt <mpitt@redhat.com> 154-3
changelog:
  - Update source po for Japanese translations rhbz#1512923
  - Adjust build system to avoid build failure for the above


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-3
changelog:
  - Include xkb layouts from xkeyboard-config converted to console keymaps
  - Add version to vlock provides
    Resolves: #902564


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-8
changelog:
  - Fix vlock doesn't perform PAM account management or credential reinitialization
    Resolves: #1032140


author: Robert Relyea <rrelyea@redhat.com - 1.4.10-13
changelog:
  - Add support for missing readers (broadcom, cherry).
  - mark deprecated readers as unsupported and needing an update


author: Jitka Plesnikova <jplesnik@redhat.com> - 1.42-2
changelog:
  - Add BR perl(File::Spec)
  - Replace PERL_INSTALL_ROOT with DESTDIR
  - Remove deleting empty directories
  - Remove defattr


author: Zeeshan Ali <zeenix@redhat.com> - 3.8.2-7
changelog:
  - Add missing resource files (related: #1028079).
  - Don't ignore removal of src/resources.c (related: #1028079).


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.160-2
changelog:
  - 1383902 - CPU spikes to 100% and timeouts observed in strace when opening yaml extensions using vim


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.160-3
changelog:
  - 1267826 - Include c++11 syntax highlighting in vim
  - 1319760 - [RFE] Vim should support blowfish2, plus ensure that RHEL6 encrypted files can be opened in RHEL7


author: Pavel Šimerda <psimerda@redhat.com> - 3.10.0-19
changelog:
  - Resolves: #1081081 - lnstat man page references iproute-doc when it should
    reference iproute-<ver>


author: Richard Hughes <richard@hughsie.com> 0.1.33-1
changelog:
  - New upstream version
  - Add some translated profile descriptions for the CMYK profiles
  - Add the FOGRA45L and FOGRA47L CMYK and eciRGBv1 profiles
  - Check the generated CCMX matrix for invalid data
  - Do not print a warning if the DBus property does not exist
  - Ensure mbstowcs() has an LC_CTYPE of 'en_US.UTF-8'
  - Always write C-locale floating point values in IT8 files
  - Initialize the value of the CCMX matrix
  - Never promote localized v2 ICC profiles to v4
  - Rename ISOnewspaper26 to IFRA26S_2004_newsprint


author: Richard Hughes <richard@hughsie.com> 0.1.34-1
changelog:
  - New upstream version
  - Add a ICC transform object for simple RGB conversions
  - Add a warning for RGB profiles with unlikely whitepoint values
  - Add Qt DBus annotations
  - Allow clients to call org.freedesktop.DBus.Peer
  - Correct a lot more company names when creating devices
  - Do not automatically add EDID profiles with warnings to devices
  - Increase the delay between patches in the session-helper
  - Install the bash completion support into /usr


author: Richard Hughes <richard@hughsie.com> 1.0.0-1
changelog:
  - New upstream version
  - Add a config option for monitors with identical EDID values
  - Allow a different input and output format in CdTransform
  - Build all installed binaries with PIE
  - Build the colord binary with full RELRO
  - Do not show a warning when using 'colormgr device-get-profile-for-qualifier'
  - Fix crash in cd-iccdump by working around an lcms2 bug
  - Fix using the color sensors on ARM hardware
  - Set the STANDARD_space metadata for the print profiles
  - Show all the translations when dumping an ICC profile


author: Richard Hughes <richard@hughsie.com> 1.0.1-1
changelog:
  - New upstream version
  - Do not unconditionally enable BPC on the color transform
  - Fix profile created time for non-UTC timezones
  - Record the gamma table in the session helper error message


author: Richard Hughes <richard@hughsie.com> 1.0.2-1
changelog:
  - New upstream version
  - Add cd_icc_save_data() so that we can easily set _ICC_PROFILE
  - Add CdIccStore to monitor directories of ICC profiles
  - Add SystemVendor and SystemModel properties to the main interface
  - Allow to specify a non-qualified path when using FindProfileByFilename
  - Allow using the key 'Filename' when using FindProfileByProperty
  - Always return the error if any sync method failed
  - Fix GObject introspection when getting lists
  - Fix GObject introspection when getting metadata


author: Richard Hughes <richard@hughsie.com> 1.0.4-1
changelog:
  - Rebase to a new upstream version to fix small security bug
  - Use %ghost in the to avoid removing databases on upgrades
  - Resolves: #1012832


author: Hans de Goede <hdegoede@redhat.com> - 1.0.11-4
changelog:
  - nouveau-1.0.11-cleanup-reverse-prime-fb: fix gpu not suspending after
    using an external output in a switchable graphics setup
  - Resolves: rhbz#1349821


author: Paul Wouters <pwouters@redhat.com> - 1.4.6-2
changelog:
  - Changed conf.xml to reference softhsm at /usr/lib64/pkcs11/libsofthsm2.so
  - Updated Requires: to softhsm >= 2.0.0b1-2


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-116
changelog:
  - azure-lb: new resource agent
  - CTDB: fix initial probe

    Resolves: rhbz#1516435
    Resolves: rhbz#1512580


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-117
changelog:
  - ocf_attribute_target: add fallback for Pacemaker versions without
    bundle support

    Resolves: rhbz#1520574


author: Martin Preisler <mpreisle@redhat.com> - 1.2.12-1
changelog:
  - Upgrade to the latest upstream release
  - improved HTML report by referencing links
  - fixed validity errors in ARF files
  - fixed CVE parsing
  - fixed injecting xccdf:check-content-ref references in ARF results
  - fixed oscap-docker incompliance reporting (#1387248)
  - fixed oscap-docker man page (#1387166)


author: Martin Preisler <mpreisle@redhat.com> - 1.2.13-1
changelog:
  - Upgrade to the latest upstream release
  - Added --thin-results CLI override to oscap xccdf eval
  - Added --without-syschar CLI override to oscap xccdf eval
  - Remediations are not filtered by applicability
  - Fixed segmentation faults in XCCDF and OVAL processing
  - Added a warning on generating an ARF from XCCDF 1.1


author: Jan Černý <jcerny@redhat.com> - 1.2.14-1
changelog:
  - Upgrade to the latest upstream release
  - Detailed information about ARF files in 'oscap info'
  - Generating remediation scripts from ARF
  - HTML report UX improvements
  - Fixed CPE dictionary to identify RHEVH as RHEL7 (#1420038)
  - Fixed systemd probes crashes inside containers (#1431186)
  - Fixed output on terminals with white background (#1365911)
  - Error handling in oscap-vm (#1391754)
  - Fixed SCE stderr stalling (#1420811)
  - Fixed absolute filepath parsing in OVAL (#1312831, #1312824)
  - Fixed segmentation faults in RPM probes (#1414303, #1414312)
  - Fixed missing header in result-oriented Ansible remediations


author: Martin Preisler <mpreisle@redhat.com> - 1.2.14-2
changelog:
  - RPM probes to return not applicable on non-rpm systems (#1447629)
  - fixed sysctl tests on s390x architecture (#1447649)
  - Revert warning by default in oscap tool, our message categories are not ready for it (#1447341)


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-20
changelog:
  - IPsrcaddr: add proto and table parameters
  - iSCSILogicalUnit: only create iqn when it doesnt exist

    Resolves: rhbz#1504055
    Resolves: rhbz#1598969


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-22
changelog:
  - IPsrcaddr: make proto optional to fix regression when used without
    NetworkManager

    Resolves: rhbz#1504055


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-23
changelog:
  - aws-vpc-move-ip: add multi route-table support and fix issue
    w/multiple NICs

    Resolves: rhbz#1697558


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-30.1
changelog:
  - dhcpd: keep SELinux context in chroot
  - CTDB: add support for v4.9+

    Resolves: rhbz#1731426
    Resolves: rhbz#1731427


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.164-4
changelog:
  - Use lsblk -s and lsblk -O in lvmdump only if these options are supported.
  - Fix typo in report/columns_as_rows config option name recognition (2.02.99).
  - Do not monitor cache-pool metadata when LV is just being cleared.
  - Add allocation/cache_pool_max_chunks to prevent misuse of cache target.
  - Fix number of stripes shown in lvcreate raid10 message when too many.
  - Give error not segfault in lvconvert --splitmirrors when PV lies outside LV.
  - Avoid PV tags when checking allocation against parallel PVs.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.164-5
changelog:
  - Use udev db to check for mpath components before running pvscan for lvmetad.
  - Use devices/allow_changes_with_duplicate_pvs=1 by default.


author: - Andreas Schneider <asn@redhat.com> - 0.6.1-1
changelog:
  - Update to version 0.6.1.
  - resolves: #1056757 - Fix scp mode.
  - resolves: #1053305 - Fix known_hosts heuristic.


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.30.1-13
changelog:
  - Fixed multilib conflicts
    Rewrote lefty IO lib to use getaddrinfo instead of gethostbyname
    (by lefty-getaddrinfo patch)
    Resolves: rhbz#881173


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.30.1-17
changelog:
  - Prevent possible buffer overflow in yyerror()
    Resolves: CVE-2014-1235
  - Fix possible buffer overflow problem in chkNum of scanner
    Resolves: CVE-2014-1236


author: Jakub Hrozek <jhrozek@redhat.com> - 0.5.0.1-25
changelog:
  - Resolves: rhbz#1205557 - Include the latest upstream ding-libs release in 7.2
  - Port the SONAME hack


author: Jakub Hrozek <jhrozek@redhat.com> - 0.5.0.1-27
changelog:
  - Re-add the soname hack
  - Resolves: rhbz#1290382 - Rebase ding-libs to the latest available upstream


author: Michal Židek <mzidek@redhat.com> - 0.6.1-29
changelog:
  - Fix rpmdiff failure for 'Binary stripping'
  - Resolves: rhbz#1480270 - Rebase ding-libs to the latest upstream release


author: Kamil Dudka <kdudka@redhat.com> - 7.29.0-52
changelog:
  - prevent curl --rate-limit from hanging on file URLs (#1281969)
  - fix NTLM password overflow via integer overflow (CVE-2018-14618)
  - fix bad arithmetic when outputting warnings to stderr (CVE-2018-16842)
  - backport options to force TLS 1.3 in curl and libcurl (#1672639)
  - prevent curl --rate-limit from crashing on https URLs (#1683292)


author: Steve Dickson <steved@redhat.com> - 0.2.0-18
changelog:
  - Fixed typo causing rpcbind to run as root (bz 734598)
  - Added /etc/sysconfig/rpcbind config file (bz 861025)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-9
changelog:
  - fixed missing system hang at shutdown if root device is network based
    (RHBZ#1007934)
  - Fixed iptables-save man page completely wrong (RHBZ#1054871)
  - Fixed missing reload action for iptables service (RHBZ#1066007)
  - Fixed regressions from RHEL-6 iptables services (RHBZ#1067670)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-14
changelog:
  - Add cgroup support (RHBZ#1058660)
  - Add wait seonds support for commands (RHBZ#1156411)
  - Add dhcpv6-client in default IPv6 firewall rules (RHBZ#1169036)
  - Add message for init script error returns (RHBZ#1200415)
  - Use flock for wait option (RHBZ#1202435)


author: Tim Waugh <twaugh@redhat.com> - 1:1.6.3-7
changelog:
  - Reverted upstream change to FINAL_CONTENT_TYPE in order to fix
    printing to remote CUPS servers (bug #1013040).


author: Tim Waugh <twaugh@redhat.com> - 1:1.6.3-12
changelog:
  - Return jobs in rank order when handling IPP-Get-Jobs (bug #1046841).
  - dbus notifier: call _exit when handling SIGTERM (STR #4314, bug #1030666).
  - Use '-f' when using rm in %setup section (bug #1046374).


author: Kamil Dudka <kdudka@redhat.com> - 7.19.0-15
changelog:
  - allow to return -1 from the write callback (#857875) 
  - remove the patch for curl-config --static-libs no longer needed
  - run the tests against the just built pycurl, not the system one


author: Kevin Kofler <Kevin@tigcc.ticalc.org> - 4.4.0-2
changelog:
  - update docbook version to make doc-translations build with kdelibs >= 4.5,
    fixes FTBFS (#599843)


author: Václav Pavlín <vpavlin@redhat.com> - 9.49.11-1
changelog:
  - Revert: provide KVM guest count and limit info message (#1014731)
  - add C implementation of reverted patch


author: Lukas Nykryn <lnykryn@redhat.com> - 9.49.12-1
changelog:
  - use iw instead of iwconfig and friends (#915343)
  - don't care about rc.local anymore (#1034156)
  - udev-kvm-check: simplify reading of threshold (#1031568)
  - brandbot: read only first line (#1031490)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.49.13-1
changelog:
  - delete IPX support
  - update ifup/ifdown NetworkManager interaction (#1036701, #1061810)
  - set shmmax and shmall defaults to match rhel6 values (#1056547)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.49.14-1
changelog:
  - update ifup/ifdown NetworkManager interaction (#1036701, #1061810)
  - service: fix action matching
  - service: add condrestart to allowed commands (#1069222)


author: Tomas Hozza <thozza@redhat.com> - 0.11-13
changelog:
  - Use improved NM dispatcher script from upstream (#980036)
  - Added tmpfiles.d config due to improved NM dispatcher script


author: Tomas Hozza <thozza@redhat.com> - 0.11-20
changelog:
  - use systemd macros instead of directly using systemctl (#1058773)
  - Replace the "Fedora /EPEL" comment in dnssec-trigger.conf (#1055949)
  - Use more newer and more advanced dispatcher script (#1034813)


author: Tomas Hozza <thozza@redhat.com> - 0.11-21
changelog:
  - handle IndexError exception in NM script until NM provides better API (#1063735)
  - restart NM when stopping dnssec-trigger daemon instead of handling
    resolv.conf by ourself. (#1061370)


author: Ray Strode <rstrode@redhat.com> 3.8.4-18
changelog:
  - Make sure pam_gnome_keyring gets notified when the password is changed
    in the middle of first login.
    Resolves: #1075714


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.6
changelog:
  - kvm-fix-cirrus_vga-fix-OOB-read-case-qemu-Segmentation-f.patch [bz#1430059]
  - kvm-cirrus-vnc-zap-bitblit-support-from-console-code.patch [bz#1430059]
  - kvm-cirrus-add-option-to-disable-blitter.patch [bz#1430059]
  - kvm-cirrus-fix-cirrus_invalidate_region.patch [bz#1430059]
  - kvm-cirrus-stop-passing-around-dst-pointers-in-the-blitt.patch [bz#1430059]
  - kvm-cirrus-stop-passing-around-src-pointers-in-the-blitt.patch [bz#1430059]
  - kvm-cirrus-fix-off-by-one-in-cirrus_bitblt_rop_bkwd_tran.patch [bz#1430059]
  - Resolves: bz#1430059
    (CVE-2016-9603 qemu-kvm: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.7
changelog:
  - kvm-char-serial-cosmetic-fixes.patch [bz#1452332]
  - kvm-char-serial-Use-generic-Fifo8.patch [bz#1452332]
  - kvm-char-serial-serial_ioport_write-Factor-out-common-co.patch [bz#1452332]
  - kvm-char-serial-fix-copy-paste-error-fifo8_is_full-vs-em.patch [bz#1452332]
  - kvm-char-serial-Fix-emptyness-check.patch [bz#1452332]
  - kvm-char-serial-Fix-emptyness-handling.patch [bz#1452332]
  - kvm-serial-poll-the-serial-console-with-G_IO_HUP.patch [bz#1452332]
  - kvm-serial-change-retry-logic-to-avoid-concurrency.patch [bz#1452332]
  - kvm-qemu-char-ignore-flow-control-if-a-PTY-s-slave-is-no.patch [bz#1452332]
  - kvm-serial-check-if-backed-by-a-physical-serial-port-at-.patch [bz#1452332]
  - kvm-serial-reset-thri_pending-on-IER-writes-with-THRI-0.patch [bz#1452332]
  - kvm-serial-clean-up-THRE-TEMT-handling.patch [bz#1452332]
  - kvm-serial-update-LSR-on-enabling-disabling-FIFOs.patch [bz#1452332]
  - kvm-serial-only-resample-THR-interrupt-on-rising-edge-of.patch [bz#1452332]
  - kvm-serial-make-tsr_retry-unsigned.patch [bz#1452332]
  - kvm-serial-simplify-tsr_retry-reset.patch [bz#1452332]
  - kvm-serial-separate-serial_xmit-and-serial_watch_cb.patch [bz#1452332]
  - kvm-serial-remove-watch-on-reset.patch [bz#1452332]
  - Resolves: bz#1452332
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.8
changelog:
  - kvm-char-change-qemu_chr_fe_add_watch-to-return-unsigned.patch [bz#1452332]
  - Resolves: bz#1452332
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.9
changelog:
  - kvm-spice-fix-spice_chr_add_watch-pre-condition.patch [bz#1452332]
  - Resolves: bz#1452332
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.10
changelog:
  - kvm-nbd-Fully-initialize-client-in-case-of-failed-negoti.patch [bz#1460179]
  - kvm-nbd-Fix-regression-on-resiliency-to-port-scan.patch [bz#1460179]
  - Resolves: bz#1460179
    (CVE-2017-9524 qemu-kvm: Qemu: nbd: segmentation fault due to client non-negotiation [rhel-7.3.z])


author: Dan Horák <dhorak@redhat.com> - 3.7.0-1
changelog:
  - rebased to 3.7.0 (#1507619)
  - fix test-suite run under root (#1267928)
  - Resolves: #1507619, #1267928


author: Josh Stone <jistone@redhat.com> 8.1.2-6
changelog:
  - rhbz1063447: squash testsuite g++ optimization
  - rhbz1030969: backported additional patch to silence new warnings


author: Josef Stribny <jstribny@redhat.com> - 2.0.0.353-22
changelog:
  - Fix FTBFS with new tzdata
    Resolves: rhbz#1144023
  - Fix FTBFS due to a support for RFC 5649 in OpenSSL
    Resolves: rhbz#1145692


author: Josef Stribny <jstribny@redhat.com> - 2.0.0.353-23
changelog:
  - Add missing patch for new tzdata
    Related: rhbz#1144023
  - Add missing patch for RFC 5649 in OpenSSL
    Related: rhbz#1145692


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.598-24
changelog:
  - Rebased to Ruby 2.0.0-p598.
    * Remove Patch19: ruby-2.0.0-p247-Make-stable-Gem-Specification.files-in-
        default-.gems.patch; subsumed
    * Remove Patch20: ruby-2.1.1-fix-test-failures-due-to-expired-certs.patch;
        subsumed
    * Remove Patch21: ruby-2.1.0-test_aes_gcm_wrong_tag-Dont-use-String
        -succ.patch; subsumed
    * Remove Patch22: ruby-2.2.0-fix-error-with-tzdata.patch; subsumed
    Resolves: rhbz#1071187
  - Incorporates fixes for CVE-2014-8080 and CVE-2015-8090.
    Resolves: rhbz#1164000
  - Fix for Proxy Realm feature.
    Resolves: rhbz#1122140
  - Fix off-by-one stack-based buffer overflow in the encodes() function
    (CVE-2014-4975).
    Related: rhbz#1164000


author: Jay Fenlason <fenlason@redhat.com> 2.0.25-5.1.el6
changelog:
  - dapl-2.0.25-signal-handler.patch
    Resolves: bz667742	Error mapping bug in dapls_wait_comp_channel
  - dapl-2.0.25-new-providers.patch
    Resolves: bz636596
  - dapl-2.0.25-dat_ia_open_hang.patch
    Resolves: bz649360
  - dapl-2.0.25-cleanup-cr-linkings-after-dto-error-on-ep.patch
    Resolves: bz626541
  - dapl-2.0.25-verbs-cq-completion-channels-leak.patch
    Resolves: bz637980


author: Jay Fenlason <fenlason@redhat.com> 2.0.25-5.2.el6
changelog:
  - Actually install the signal-handler patch
    Resolves: bz667742	Error mapping bug in dapls_wait_comp_channel


author: Doug Ledford <dledford@redhat.com> - 2.0.32-1
changelog:
  - Update to latest upstream version (2.0.25 -> 2.0.32)
  - Remove 4 patches folded into upstream release
  - Rebuild against new libibverbs and librdmacm
  - Update exclusive arch to accommodate i686 arch
  - Related: bz724896, bz725016


author: Doug Ledford <dledford@redhat.com> - 2.0.34-1
changelog:
  - Update to latest upstream version
  - Rebuild against new libibverbs (FDR link speed capable and IBoE enabled)
  - Related: bz750609


author: Jay Fenlason <fenlason@redhat.com> - 2.0.39-1
changelog:
  - Upgrade to latest version
    Resolves: rhbz#985117
  - Fix a compile problem with NULL not being defined
    Resolves: rhbz#1029509


author: Doug Ledford <dledford@redhat.com> - 2.0.39-5
changelog:
  - Bump and rebuild after retagging the latest libibverbs and librdmacm
    into the build root
  - Related: bz1123996


author: Doug Ledford <dledford@redhat.com> - 2.1.5-1
changelog:
  - Update to latest upstream release
  - Include support for s390x
  - Include support for aarch64
  - Drop old fix for NULL not defined, upstream has it resolved
  - Resolves: bz1182180, bz1197216, bz1172462, bz1044727, bz1056487


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-4
changelog:
  - release 1.3.3.1-4
  - Resolves: bug 1080186 - Creating a glue fails if one above level is a conflict or missing  (DS 47750)
  - Resolves: bug 1145846 - 389-ds 1.3.3.0 does not adjust cipher suite configuration on upgrade, breaks itself and pki-server (DS 47908)
  - Resolves: bug 1117979 - harden the list of ciphers available by default (phase 2) (DS 47838)
                          - provide enabled ciphers as search result (DS 47880)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-5
changelog:
  - util: mdev: Use a local variable instead of a direct pointer access (rhbz#1446455)
  - mdev: Fix daemon crash on domain shutdown after reconnect (rhbz#1446455)
  - qemu: Provide a much clearer message on device hot-plug (rhbz#1450072)
  - virsh: Add --tls description for the virsh man page (rhbz#1448806)
  - conf: Check CPU cache for ABI stability (rhbz#1449595)
  - qemuDomainBuildNamespace: Move /dev/* mountpoints later (rhbz#1449510)
  - qemuDomainCreateDeviceRecursive: pass a structure instead of bare path (rhbz#1449510)
  - qemuDomainCreateDeviceRecursive: Don't try to create devices under preserved mount points (rhbz#1449510)
  - qemuDomainAttachDeviceMknodRecursive: Don't try to create devices under preserved mount points (rhbz#1449510)
  - qemuDomainDetachDeviceUnlink: Don't unlink files we haven't created (rhbz#1449510)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-6
changelog:
  - util: introduce virStringMatch (rhbz#1446980)
  - util: introduce virBufferEscapeRegex (rhbz#1446980)
  - qemu: improve detection of UNIX path generated by libvirt (rhbz#1446980)
  - Adding POWER9 cpu model to cpu_map.xml (rhbz#1450189)
  - qemu: driver: Allow passing disk target as top image with block commit (rhbz#1451394)
  - qemu: monitor: Don't bother extracting vCPU halted state in text monitor (rhbz#1452106)
  - conf: Don't assign value from ..TypeFromString directly to enum (rhbz#1452454)
  - nodedev: Make use of the compile-time missing enum in switch error (rhbz#1452072)
  - conf: nodedev: Split virNodeDeviceDefFormat into more functions (rhbz#1452072)
  - docs: Provide a nodedev driver stub documentation (rhbz#1452072)
  - mdev: Pass a uuidstr rather than an mdev object to some util functions (rhbz#1452072)
  - nodedev: conf: Split PCI sub-capability parsing to separate methods (rhbz#1452072)
  - nodedev: Introduce new mdev_types and mdev nodedev capabilities (rhbz#1452072)
  - nodedev: Introduce the mdev capability to a PCI parent device (rhbz#1452072)
  - nodedev: Introduce mdev capability for mediated devices (rhbz#1452072)
  - docs: Document the mediated devices within the nodedev driver (rhbz#1452072)
  - Do not release unreserved address in qemuDomainAttachRNGDevice (rhbz#1452581)
  - qemu: process: Clear priv->namespaces on VM shutdown (rhbz#1453142)
  - Revert "qemu: propagate bridge MTU into qemu "host_mtu" option" (rhbz#1449346)
  - qemu: Properly check return value of VIR_STRDUP in qemuDomainGetBlockIoTune (rhbz#1433183)
  - rpc: Bump maximum message size to 32M (rhbz#1440683)
  - Split out virDomainIOMMUDefFormat (rhbz#1427005)
  - qemu: allow conditional device property probing (rhbz#1427005)
  - qemu: refactor qemuBuildIOMMUCommandLine (rhbz#1427005)
  - conf: add <ioapic driver> to <features> (rhbz#1427005)
  - qemu: format kernel_irqchip on the command line (rhbz#1427005)
  - conf: add <driver intremap> to <iommu> (rhbz#1427005)
  - qemu: format intel-iommu, intremap on the command line (rhbz#1427005)
  - conf: add caching_mode attribute to iommu device (rhbz#1427005)
  - qemu: format caching-mode on iommu command line (rhbz#1427005)
  - conf: split out virDomainIOMMUDefCheckABIStability (rhbz#1427005)
  - conf: add ABI stability checks for IOMMU options (rhbz#1427005)


author: Jan Synáček <jsynacek@redhat.com> - 1:24.3-21
changelog:
  - fix libjpeg detection fails with gcc7 (#1487557)
  - fix Emacs GUI Toolbar icons missing (#1477745)
  - fix hardening: TLS certificate warnings should be hard errors (#1403643)


author: Carlos O'Donell <carlos@redhat.com> - 2.17-75
changelog:
  - Fix permission of debuginfo source files to allow multiarch
    debuginfo packages to be installed and upgraded (#1170110).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-76
changelog:
  - Fix application crashes during calls to gettimeofday on ppc64
    when kernel exports gettimeofday via VDSO (#1077389).
  - Prevent NSS-based file backend from entering infinite loop
    when different APIs request the same service (CVE-2014-8121, #1182272).


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-1.b13
changelog:
  - Add backports from 8u131 and 8u152 ahead of April CPU.
  - Apply backports before local RPM fixes so they will be the same as when applied upstream
  - Adjust RH1022017 following application of 8173783
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-1.b11
changelog:
  - Update to aarch64-jdk8u131-b11.
  - Drop upstreamed patches for 8147910, 8161993, 8170888 and 8173783.
  - Update generate_source_tarball.sh to remove patch remnants.
  - Cleanup tarball creation documentation to avoid duplication.
  - Add MD5 checksum for the new java.security file (MD5 disabled for JAR signing)
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-2.b13
changelog:
  - Backport "S8153711: [REDO] JDWP: Memory Leak: GlobalRefs never deleted when processing invokeMethod command"
  - Resolves: rhbz#1442162


author: Steve Dickson <steved@redhat.com> 2.0.14-1
changelog:
  - Updated to latest stable upstream version: 2.0.14-stable (bz 727129)
  - Removed the installion of the outdate man pages and the latex raw docs.
  - Corrected where the other doc are installed.


author: Steve Dickson <steved@redhat.com> 2.0.18-1
changelog:
  - Updated to latest stable upstream version: 2.0.18-stable
  - Moved documentation into its own rpm (bz 810138)


author: Ray Strode <rstrode@redhat.com> - 3.14.2-18
changelog:
  - Fix unlock with XDMCP
    Resolves: #1315342
  - Inform remote display about session exiting when using
    XDMCP
    Resolves: #1313059


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-26
changelog:
  - closing a file descriptor in a command substitution caused loss of the output (#1202439)
  - fix: in a login shell "( cmd & )" does nothing (#1217237)
  - exporting fixed with variable corrupted its data (#1192026)
  - fix segfault when handling a trap (#1211540)
  - combining alarm and IFS caused segfault (#1192119)
  - declaration of a two dimemsional associatve array could add an extra 0 element (#1193557)
  - do not inherit invalid variables during shell initializaton (#1211538)
  - case in a for loop inside a subshell caused syntax error (#1241014)


author: Al Stone <ahs3@redhat.com> - 20130725-2
changelog:
  - Fix several rpmlint items (listed below)
  - Add versions to explicit provides for acpixtract, acpidump
  - Not all setup steps used -q
  - Setup executable test script (run-misc-tests.sh) differently
  - Removed unneeded commented out line with macros in it
  - Removed mixed use of spaces and tabs (all spaces now)
  - Corrected source URLs (upstream moved)


author: Al Stone <ahs3@redhat.com> - 20130823-2
changelog:
  - Add in a copy of the GPLv2 text in order to comply with the requirement
    to always redistribute the terms of the license.


author: Dean Nelson <dnelson@redhat.com> - 20130823-3
changelog:
  - Fix run-misc-tests.sh script to properly set the number of BITS to 64 when run
    on a s390x system.


author: Dean Nelson <dnelson@redhat.com> - 20130823-7
changelog:
  - Fix the dangling symlink issue for acpidump(1) and acpixtract(1) man pages
    that was reported in RHBZ 1074681.


author: Dean Nelson <dnelson@redhat.com> - 20130823-8
changelog:
  - Fix run-misc-tests.sh script to properly set the number of BITS to 64 when run
    on a ppc64le system as requested by RHBZ 1125471.


author: Dean Nelson <dnelson@redhat.com> - 20140926-1
changelog:
  - Update to the latest upstream version of acpica as requested by RHBZ 967963.
  - Refresh existing patches and add new ones to enable a clean build.
  - Fix build failures that start before and finish after midnight.


author: Jakub Martisko <jamartis@redhat.com> - 0.13.62-9
changelog:
  - Fix covscan warning
  - "Variable "file" going out of scope leaks the storage it points to."
    has been introduced by the original version of 0001-fix-CVE-2018-7725.patch
  - Related: 1558596


author: Jakub Martisko <jamartis@redhat.com> - 0.13.62-11
changelog:
  - Fix CVE-2018-6541
  - Part of the original patch has already been applied in the past (CVE-2018-7726),
    so the bug should not be reproducible in a way described in the github 
    issue, even without this commit. Applying the rest of the original patch anyway.
  - https://github.com/gdraheim/zziplib/issues/16
  - Related: CVE-2018-6541


author: Tom Lane <tgl@redhat.com> 0.8.3-4
changelog:
  - Do not use -ffast-math; it breaks things and seems quite unlikely to offer
    any useful performance benefit for this type of package, anyway
  Resolves: #629964


author: Tom Lane <tgl@redhat.com> 0.8.4-1
changelog:
  - Update to version 0.8.4 (seems to contain only configure-support updates,
    but might as well adopt it)
  - Fix memory leak due to incorrect test in _is_row_fetched()
  Related: #733413


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.13-1
changelog:
  - New version
    Resolves: rhbz#837749
  - Fixed -i option
    Resolves: rhbz#828844
  - Added virtual provide and FPC ticket link for bundled gnulib
    Resolves: rhbz#821759


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.14-4
changelog:
  - Added group-separator, no-group-separator options decription
  - Aligned output of built-in help
  - Defuzzified gnulib-tests-rm-f patch


author: Michael Schwendt <mschwendt@fedoraproject.org> - 2.0.7-19
changelog:
  - Build with -D_FILE_OFFSET_BITS=64 to get stat64 in pth_high.c
  - Guard the ARM CFLAGS sed substitution.


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-12
changelog:
  - fix CVE-2017-3737 - incorrect handling of fatal error state
  - fix CVE-2017-3738 - AVX2 Montgomery multiplication bug with 1024 bit modulus


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-13
changelog:
  - add S390x assembler updates
  - make CA name list comparison function case sensitive (#1548401)
  - fix CVE-2017-3735 - possible one byte overread with X.509 IPAdressFamily
  - fix CVE-2018-0732 - large prime DH DoS of TLS client
  - fix CVE-2018-0737 - RSA key generation cache timing vulnerability
  - fix CVE-2018-0739 - stack overflow parsing recursive ASN.1 structure


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-16
changelog:
  - fix CVE-2018-0495 - ROHNP - Key Extraction Side Channel on DSA, ECDSA
  - fix incorrect error message on FIPS DSA parameter generation (#1603597)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-16.1
changelog:
  - use SHA-256 in FIPS RSA pairwise key check
  - fix CVE-2018-5407 - EC signature local timing side-channel key extraction


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> - 1.0-1
changelog:
  - New upstream release
  - Remove libtool files
  - Run ldconfig after un/installation to update *.so files
  - Add -devel subpackage to handle include files and examples


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> - 1.1-1
changelog:
  - New upstream release
  - Adjusted docbook xsl path to match the correct stylesheet
  - Remove only *.la files, considering there aren't any *.a files


author: Robert Kuska <rkuska@redhat.com> - 2.7.5-32
changelog:
  - Backport SSLSocket.version function
  - Temporary disable test_gdb on ppc64le rhbz#1260558
  Resolves: rhbz#1259421


author: Christophe Fergeau <cfergeau@redhat.com> 2.8-7
changelog:
  - Adjust selinux policy to allow use of USB redirection
    Resolves: rhbz#1075173
  - Add test page to package
    Resolves: rhbz#959194


author: Victor Toso <victortoso@redhat.com> - 2.0-6.1
changelog:
  - Utilize SSO to authenticate against oVirt engine for foreign menu support
    Resolves: rhbz#1344635


author: Pavel Grunt <pgrunt@redhat.com> - 2.0-6.2
changelog:
  - Adjust timer to refresh ovirt foreign menu
    Resolves: rhbz#1353627
  - Fix crash when disabling the last display
    Resolves: rhbz#1354283


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-2
changelog:
  - RHEL 7.4 erratum
  - Fixes coverity scan issues created by our patches: 
    - fixed resource leaks and a compiler warning in digest backport patch
    - removed needless code from cmnd_no_wait patch causing clang warning
    - format of the last changelog message causes problems to rhpkg push,
      so don't use that as a commit message 
    Resolves: rhbz#1360687


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-3
changelog:
  - RHEL 7.4 eratum
  - Fixes semicolon typo in digest backport patch from the previous build
    Resolves: rhbz#1360687


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-4
changelog:
  - RHEL 7.4 erratum
  - fixed cmnd_no_wait patch
  - backported iolog_flush sudoers default
    Resolves: rhbz#1369856
    Resolves: rhbz#1425853


author: Phil Cameron <pcameron@redhat.com> - 1.1.4-7
changelog:
  - Fixes error in patch Patch03 - this fixes 1283773 and 1539081
    1501821 - Upstream moved to https://github.com/iptraf-ng/iptraf-ng/
    1020552, 1372679 - fix missing /var/lock/iptraf-ng file
    Add BuildRequires:  gcc to spec file.
    1109768 - bad configuration logrotate


author: Pavel Raiskup <praiskup@redhat.com> - 2.4.2-14
changelog:
  - allow root to copy files into NFS in libtoolize (#740079)
  - pre-filter sed's input by dd (#636045)


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-102
changelog:
  - Add 0207-UP-add-libmpathcmd.patch
    * New shared library, libmpathcmd, that sends and receives messages from
      multipathd. device-mapper-multipath now uses this library internally.
  - Add 0208-UPBZ-1430097-multipathd-IPC-changes.patch
    * validation that modifying commands are coming from root.
  - Add 0209-UPBZ-1430097-multipath-C-API.patch
    * New shared library. libdmmp, that presents the information from multipathd
      in a structured manner to make it easier for callers to use
  - Add 0210-RH-fix-uninstall.patch
    * Minor compilation fixes
  - Make 3 new subpackages
    * device-mapper-multipath-devel, libdmmp, and libdmmp-devel. libmpathcmd
      and libmpathprio are in device-mapper-multipath-libs and
      device-mapper-multipath-devel. libdmmp is in its own subpackages
  - Move libmpathprio devel files to device-mapper-multipath-devel
  - Resolves: bz #1430097


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-104
changelog:
  - Change _pkgconfdir from /usr/share/pkgconfig to /usr/lib/pkgconfig
  - Modify 0209-UPBZ-1430097-multipath-C-API.patch
    * change _pkgconfdir and fixed double-closing fd
  - Add 0211-RH-strlen-fix.patch
    * checks that variables are not NULL before passing them to strlen
  - Related: bz #1430097


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-107
changelog:
  - Modify 0197-RHBZ-1394059-max-sectors-kb.patch
    * Make multipath only change max_sectors_kb on creates. On reloads, it
      just makes sure the new path matches the multipath device.
  - Refresh 0198-RHBZ-1372032-detect-path-checker.patch
  - Refresh 0201-RHBZ-1403552-silence-warning.patch
  - Refresh 0206-RHBZ-1239173-pt2-no-paths.patch
  - Refresh 0207-UP-add-libmpathcmd.patch
  - Refresh 0212-RHBZ-1431562-for-read-only.patch
  - Resolves: bz #1394059


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-109
changelog:
  - Add 0214-RHBZ-1392115-set-paths-not-ready.patch
    * Set ENV{SYSTEMD_READY}="0" on multipath path devices
  - Resolves: bz #1392115


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-110
changelog:
  - Add 0215-RHBZ-1444194-fix-check-partitions.patch
    * make sure kpartx partions match the correct device
  - Add 0216-RHBZ-1448562-fix-reserve.patch
    * don't join threads that haven't been created
  - Add 0217-RHBZ-1437329-blacklist-oracle-devs.patch
    * blacklist db2.* devices
  - Add 0218-RHBZ-1448576-3PAR-config.patch
  - Resolves: bz #1444194, #1448562, #1437329, #1448576


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-111
changelog:
  - Remove 0217-RHBZ-1437329-blacklist-oracle-devs.patch
    * Incorrect change, and the bug is already fixed.
  - Move 0218-RHBZ-1448576-3PAR-config.patch to
    0217-RHBZ-1448576-3PAR-config.patch
  - Resolves: bz #1448576


author: Paul Wouters <pwouters@redhat.com> - 3.22-3
changelog:
  - Resolves: rhbz#1475434 Add support for AES-GMAC for ESP (RFC-4543) to libreswan
  - Resolves: rhbz#1300759 Implement RFC-7427 Digital Signature authentication


author: Paul Wouters <pwouters@redhat.com> - 3.22-5
changelog:
  - Resolves: rhbz#1471763 RFE: libreswan MOBIKE support (RFC-4555) [updated]
  - Resolves: rhbz#1471553 libreswan postquantum preshared key (PPK) support
  - Resolves: rhbz#1375776 [IKEv2 Conformance] Test IKEv2.EN.R.1.2.2.1: Receipt of retransmitted CREATE_CHILD_SA reques failed
  - Resolves: rhbz#1375750 SECCOMP support for libreswan [updated for libunbound syscalls]
  - Resolves: rhbz#1300763 Implement draft-ietf-ipsecme-split-dns for libreswan


author: Paul Wouters <pwouters@redhat.com> - 3.23-0.1.rc4
changelog:
  - Resolves: rhbz#1471763 RFE: libreswan MOBIKE support (RFC-4555) [client support]
  - Resolves: rhbz#1457904 rebase libreswan to 3.23 [updated]
  - Resolves: rhbz#1471553 libreswan postquantum preshared key (PPK) support
  - Resolves: rhbz#1492501 Reboot or 'systemctl stop ipsec' brings down _ethernet_ interfaces on _both_ ends of ipv4 ipsec tunnel
  - Resolves: rhbz#1324421 libreswan works not well when setting leftid field to be email address
  - Resolves: rhbz#1136076 After IKE rekeying Pluto sends DPD even if there is active SA


author: Paul Wouters <pwouters@redhat.com> - 3.23-2
changelog:
  - Resolves: rhbz#1457904 rebase libreswan to 3.23 [updated]
  - Resolves: rhbz#1375750 SECCOMP support for libreswan [updated]


author: Paul Wouters <pwouters@redhat.com> - 3.23-4
changelog:
  - Resolves: rhbz#1544143 ipsec newhostkey fails in FIPS mode when RSA key is generated
  - Resolves: rhbz#1553406 IKEv2 liveness false positive on IKEv2 idle connections causes tunnel to be restarted
  - Resolves: rhbz#1572425 shared IKE SA leads to rekey interop issues


author: Paul Wouters <pwouters@redhat.com> - 3.25-1
changelog:
  - Resolves: rhbz#1591817 rebase libreswan to 3.25
  - Resolves: rhbz#1536404 CERT_PKCS7_WRAPPED_X509 error
  - Resolves: rhbz#1544143 ipsec newhostkey fails in FIPS mode when RSA key is generated
  - Resolves: rhbz#1574011 libreswan is missing a Requires: unbound-libs >= 1.6.6


author: Paul Wouters <pwouters@redhat.com> - 3.25-2
changelog:
  - Resolves: rhbz#1597322 Relax deleting IKE SA's and IPsec SA's to avoid interop issues with third party VPN vendors


author: Jeff Moyer <jmoyer@redhat.com> - 58.2-1
changelog:
  - rebase to v58.2
  - remove patches that were backported from later versions
  - we now support >4k faults, so remove rhel-only patches
  - add libpmem dependency, and gate it on x86_64
  - pull in static checker fix for uncheck sscanf result
  - fix up use of uninitialized variable
  - Related: bz#1457566 bz#1471807 bz#1456954


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.15-1
changelog:
  - Resolves: rhbz#1470049 - Rebase libtdb to enable samba rebase to
                             version 4.7.x


author: Petr Oros <poros@redhat.com> - B.02.18-8
changelog:
  - Proper detect vendor_id/device_id for virtual functions
  - Sync SMBIOS with latest specification
  - Resolves: #1445473


author: Petr Menšík <pemensik@redhat.com> - 32:9.9.4-72
changelog:
  - Fix automatic selinux boolean named_write_master_zones (#1569466)
  - Allow starting named with readonly home again


author: Karel Zak <kzak@redhat.com> 2.23.2-23
changelog:
  - fix #1225235 - blockdev --report fails on loop and pmem devices
  - fix #1225053 - [RFE] backport fstrim -a and unit file
  - fix #1131523 - mount does not appear to be correctly documented for default mount options
  - fix #1147526 - Incorrect message printed when su is killed
  - fix #1165702 - make login(1) insensitive to SIGXFSZ and huge lastlog
  - fix #1184558 - logger silently changes facility from kern to user
  - fix #1198243 - blkid does not recognize xfs external log device
  - fix #1208081 - lsblk does not list dm-multipath and partitioned devices
  - fix #1209594 - RHEL7: unshare: add --propagation, use MS_PRIVATE by default
  - fix #1229436 - Remove patch that disables User Namespaces
  - fix #1116100 - Add -Z SELInux option to nsenter


author: Frantisek Kluknavsky <fkluknav@redhat.com> - 1.0.0-24.rc4.dev.gitc6e4a1e.1
changelog:
  - rebase to c6e4a1ebeb1a72b529c6f1b6ee2b1ae5b868b14f
  - https://github.com/opencontainers/runc/pull/1651


author: Pino Toscano <ptoscano@redhat.com> - 1.4.0-9
changelog:
  - Add "Provides: bundled(gnulib)" to augeas-libs, as it embeds gnulib
    (RHBZ#1653766)
  - Anaconda: new lens (RHBZ#1657189)


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.13-10.1
changelog:
  - Prevent lrmd crash when logging certain systemd operation failures
  - Handle systemd shutdown properly
  - Don't delete fence device when deleting an attribute
  - Handle new top output format in HealthCPU resource
  - Implement graceful stopping of pacemaker_remote
  - Update CTS to match applied code patches
  - Resolves: rhbz#1299339
  - Resolves: rhbz#1299340
  - Resolves: rhbz#1299341
  - Resolves: rhbz#1299342
  - Resolves: rhbz#1299348


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.13-10.4
changelog:
  - Fix multiple issues with crm_resource --restart
  - Properly handle descendents of unrunnable clones
  - Resolves: rhbz#1347806
  - Resolves: rhbz#1349493


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.2.6-9
changelog:
  - Python 2 binary package renamed to python2-subprocess32
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Iryna Shcherbina <ishcherb@redhat.com> - 3.2.6-10
changelog:
  - Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Marcel Plch <mplch@redhat.com> - 3.2.6-14
changelog:
  - Backport upstream patch for heap overflow when parsing too many arguments
  - Resolves: rhbz#1619386


author: CentOS Sources <bugs@centos.org> - 2.4.6-88.el7.centos
changelog:
  - Remove index.html, add centos-noindex.tar.gz
  - change vstring
  - change symlink for poweredby.png
  - update welcome.conf with proper aliases


author: David Vossel <dvossel@redhat.com> - 0.16.0-4
changelog:
  - Require log filtering to match function and file exactly.
    No substring matching.

  - Fixes complile time issue with 'make check' unit tests.

    Resolves: rhbz#1018091


author: David Vossel <dvossel@redhat.com> - 0.17.1-1
changelog:
  Fix: ipcs: Correctly allocate receive buffer size
    Fix: ipc_socket: Signalhandler must be resetted to Default, use only cleanup_sigpipe to return from qb_ipc_dgram_sock_setup.
    Fix: trie: allow modifying the trie map during the notify callback
    Fix: fix invalid option when run 'ipcclient -h'
    Fix: epoll: don't miss poll events under high load
    Fix: ipc_shm: fix error handling in qb_ipcs_shm_connect()
    Fix: ringbuffer: fix size in qb_rb_create_from_file()
    Fix: ringbuffer: fix qb_rb_open_2() debug format string
    Fix: trie: fixes regression caused by ref count refactoring
    Fix: ipcc: Properly timeout during recv when timeout value is provided

    Resolves: rhbz#1110043
    Resolves: rhbz#975903


author: Simone Caronni <negativo17@gmail.com> - 16.04.0-2
changelog:
  - Add tests, remove valgrind-devel build requirements (#1262274).
  - Disable tests until dbus-test-runner is available.


author: Harald Hoyer <harald@redhat.com> 033-150
changelog:
  - make dracut-shutdown not fail fatally
  Resolves: rhbz#1067116
  - do PREINIT6 for DHCP6
  Resolves: rhbz#1064365


author: Harald Hoyer <harald@redhat.com> 033-153
changelog:
  - fcoe: wait for lldpad to be ready
  Resolves: rhbz#1080353
  - network: handle "ip=dhcp6" for all interfaces
  Resolves: rhbz#1064365


author: Harald Hoyer <harald@redhat.com> 033-156
changelog:
  - network: set correct lease times for DHCPv6
  Resolves: rhbz#1064365
  - include dm-cache kernel modules
  Resolves: rhbz#1081435


author: Harald Hoyer <harald@redhat.com> 033-160
changelog:
  - add fsck.<filesystem>, if it exists
  Resolves: rhbz#1083654
  - set IPV6INIT=yes if inet6 is found on the interface
  Resolves: rhbz#1083153


author: Matej Cepl <mcepl@redhat.com> - 0.6.1-2
changelog:
  - Fix requires, for reasons why other development files were not
    eliminated see https://github.com/pyca/cryptography/issues/1463.


author: Nathaniel McCallum <npmccallum@redhat.com> - 0.7.2-1
changelog:
  - New upstream release. BSD is now an optional license.
  - Fix test running on python3
  - Add upstream patch to fix test paths


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42.3
changelog:
  - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()
  - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison
  - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
  - fix CVE-2015-0288 - X509_to_X509_REQ NULL pointer dereference
  - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
  - fix CVE-2015-0292 - integer underflow in base64 decoder
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42.5
changelog:
  - drop the AES-GCM restriction of 2^32 operations because the IV is
    always 96 bits (32 bit fixed field + 64 bit invocation field)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42.6
changelog:
  - fix CVE-2015-4000 - prevent the logjam attack on client - restrict
    the DH key size to at least 768 bits (limit will be increased in future)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42.7
changelog:
  - fix CVE-2014-8176 - invalid free in DTLS buffering code
  - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time
  - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent
  - fix CVE-2015-1791 - race condition handling NewSessionTicket
  - fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function
  - fix CVE-2015-3216 - regression in RAND locking that can cause segfaults on
    read in multithreaded applications


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42.8
changelog:
  - improved fix for CVE-2015-1791
  - add missing parts of CVE-2015-0209 fix for corectness although unexploitable


author: Ondrej Vasik <ovasik@redhat.com> - 4.1-18
changelog:
  - Require sil-abyssinica-fonts in supplemental(#994341)
  - Fully specify requirements on subpackages(#971386)


author: Tomas Mraz <tmraz@redhat.com> - 2:4.1.5.1-8
changelog:
  - slightly more meaningful error messages if crypt() returns NULL (#988184)
  - explicit suid permissions


author: Tomas Mraz <tmraz@redhat.com> - 2:4.1.5.1-14
changelog:
  - label the newly created home dir correctly (#1077809)
  - mention that chage -d 0 forces password change (#1135010)
  - improve date parsing and error detecting in chage
  - avoid full group database scanning in newgrp in most common case
  - report error if usermod asked for moving homedir and it does not exist


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-1054.el7]
changelog:
  - [pci] Rework pcie_retrain_link() wait loop (Myron Stowe) [1677010]
  - [pci] Work around Pericom PCIe-to-PCI bridge Retrain Link erratum (Myron Stowe) [1677010]
  - [pci] Factor out pcie_retrain_link() function (Myron Stowe) [1677010]
  - [cpufreq] intel_pstate: Ignore turbo active ratio in HWP (David Arcari) [1711969]
  - [fs] vmcore: Add a kernel parameter novmcoredd (Kairui Song) [1705859]
  - [netdrv] bonding/802.3ad: fix slave link initialization transition states (Jarod Wilson) [1702807]
  - [netdrv] rtw88: new Realtek 802.11ac driver (Stanislaw Gruszka) [1487002 1487018]
  - [kernel] bitfield: fix *_encode_bits() (Stanislaw Gruszka) [1487002 1487018]
  - [kernel] Add primitives for manipulating bitfields both in host- and fixed-endian (Stanislaw Gruszka) [1487002 1487018]
  - [netdrv] phy: turn carrier off on phy attach (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: add generic Realtek PHY driver (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: load driver for all PHYs with a Realtek OUI (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: fix RTL8201F sysfs name (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: Support RTL8366RB variant (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: add missing entry for RTL8211C to mdio_device_id table (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: add support for RTL8211C (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: add missing entry for RTL8211 to mdio_device_id table (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: add support for RTL8211 (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: add suspend/resume callbacks for RTL8211B (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: Use the dummy stubs for MMD register access for rtl8211b (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: use new helpers for paged register access (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: add utility functions to read/write page addresses (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: use the same indentation for all #defines (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: group all register bit #defines for RTL821x_INER (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: rename RTL821x_INER_INIT to RTL8211B_INER_INIT (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: use the BIT and GENMASK macros (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: fix RTL8211F interrupt mode (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: add RTL8201F phy-id and functions (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: rename RTL8211F_PAGE_SELECT to RTL821x_PAGE_SELECT (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: fix enabling of the TX-delay for RTL8211F (Corinna Vinschen) [1706531]
  - [netdrv] phy: add RealTek RTL8211DN phy id (Corinna Vinschen) [1706531]
  - [netdrv] phy: Add support for Realtek RTL8211F (Corinna Vinschen) [1706531]
  - [netdrv] phy: export genphy_config_init() (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: register/unregister multiple drivers properly (Corinna Vinschen) [1706531]
  - [netdrv] phy: Add RTL8201CP phy_driver to realtek (Corinna Vinschen) [1706531]
  - [netdrv] phy: rtl8211: fix interrupt on status link change (Corinna Vinschen) [1706531]
  - [nvme] fix memory leak for power latency tolerance (David Milburn) [1541904]
  - [base] pm / qos: Fix memory leak on resume_latency.notifiers (David Milburn) [1541904]
  - [x86] kvm: x86: use correct privilege level for sgdt/sidt/fxsave/fxrstor access (Paolo Bonzini) [1657358] {CVE-2018-10853}
  - [x86] kvm: x86: pass kvm_vcpu to kvm_read_guest_virt and kvm_write_guest_virt_system (Paolo Bonzini) [1657358] {CVE-2018-10853}
  - [x86] kvm: x86: introduce linear_{read,write}_system (Paolo Bonzini) [1657358] {CVE-2018-10853}
  - [x86] Update stepping values for Whiskey Lake U/Y (David Arcari) [1704810]


author: Petr Lautrbach <plautrba@redhat.com> 3.2.24-1.1
changelog:
  - Stop sending syslog.LOG_DEBUG Messages unless loglevel is set to debug
  - Add the policy rpm string to the user comments of an already reported bug from jfilak@redhat.com
  - Remove at_console lines from policykit so cockpit can use dbus interfaces.
  - Fix handling of target paths that decode screws up
  - Provide the policy rpm in Bugzilla bug reports by jfilak@redhat.com
  - setroubleshootd is set to be run as setroubleshoot user instead of root user
  - translations updated from https://fedora.zanata.org/project/view/setroubleshoot


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-1
changelog:
  - the rebase to krb5 1.13.1 in vers 1.13.1-0 also fixed:
    - Bug 1144498 ("Fix the race condition in the libkrb5 replay cache")
    - Bug 1163402 ("kdb5_ldap_util view_policy does not shows ticket flags on s390x and ppc64")
    - Bug 1185770 ("Missing upstream test in krb5-1.12.2: src/tests/gssapi/t_invalid.c")
    - Bug 1204211 ("CVE-2014-5355 krb5: unauthenticated denial of service in recvauth_common() and other")


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-2
changelog:
  - Add fix for RedHat Bug #1164304 ("Upstream unit tests loads
    the installed shared libraries instead the ones from the build")


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-3
changelog:
  - Add patch to fix Redhat Bug #1222903 ("[SELinux] AVC denials may appear
    when kadmind starts"). The issue was caused by an unneeded |htons()|
    which triggered SELinux AVC denials due to the "random" port usage.


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-4
changelog:
  - the rebase to krb5 1.13.2 in vers 1.13.2-0 also fixed:
    - Redhat Bug #1247761 ("RFE: Minor krb5 spec file cleanup and sync
      with recent Fedora 22/23 changes")
    - Redhat Bug #1247751 ("krb5-config returns wrong -specs path")
    - Redhat Bug #1247608 ('Add support for multi-hop preauth mechs
      via |KDC_ERR_MORE_PREAUTH_DATA_REQUIRED| for RFC 6113 ("A
      Generalized Framework for Kerberos Pre-Authentication")')
  - Removed "krb5-1.10-kprop-mktemp.patch" and
    "krb5-1.3.4-send-pr-tempfile.patch", both are no longer used since
    the rebase to krb5 1.13.1


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-5
changelog:
  - Add a patch to fix RedHat bug #1251586 ("KDC sends multiple
    requests to ipa-otpd for the same authentication") which causes
    the KDC to send multiple retries to ipa-otpd for TCP transports
    while it should only be done for UDP.


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-6
changelog:
  - Add a patch to fix RedHat bug #1252454 ('testsuite complains
    "Lifetime has increased by 32436 sec while 0 sec passed!",
    while rhel5-libkrb5 passes') so that krb5 resolves GSS creds
    if |time_rec| is requested.


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-7
changelog:
  - Obsolete multilib versions of server packages to fix RH
    bug #1251913 ("krb5 should obsolete the multilib versions
    of krb5-server and krb5-server-ldap").
    The following packages are declared obsolete:
    - krb5-server-1.11.3-49.el7.i686
    - krb5-server-1.11.3-49.el7.ppc
    - krb5-server-1.11.3-49.el7.s390
    - krb5-server-ldap-1.11.3-49.el7.i686
    - krb5-server-ldap-1.11.3-49.el7.ppc
    - krb5-server-ldap-1.11.3-49.el7.s390


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-8
changelog:
  - Add a patch to fix RH Bug #1250154 ("[s390x, ppc64, ppc64le]:
    kadmind does not accept ACL if kadm5.acl does not end with EOL")
    The code "accidently" works on x86/AMD64 because declaring a
    variable |char| results in an |unsigned char| by default while
    most other platforms (e.g. { s390x, ppc64, ppc64le, ...})
    default to |signed char| (still have to use lint(1) to clean
    up 38 more instances of this kind of bug).


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-9
changelog:
  - Ammend patch for RedHat bug #1252454 ('testsuite complains
    "Lifetime has increased by 32436 sec while 0 sec passed!",
    while rhel5-libkrb5 passes') to handle the newly introduced
    valgrind hits.


author: Robbie Harwood <rharwood@redhat.com> 1.13.2-9
changelog:
  - Add patch and test case for "KDC does not return proper
    client principal for client referrals"
  - Resolves: #1259846


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-10
changelog:
  - Revert Patch:  PKI TRAC Ticket #2449 - Unable to create system certificates
    in different tokens (edewata)
  - Resolves:  rhbz #1374054 - ipa-replica-install fails setting up certificate
  - Restores:  rhbz #1319557 - pkispawn KRA instance is failing server
  - Removes from Errata:  rhbz #1372041 - Unable to create system certificates
    in different tokens


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-11
changelog:
  - PKI TRAC Ticket #1527 - TPS Enrollment always goes to "ca1" (cfu)
  - PKI TRAC Ticket #1664 - [BUG] Add ability to disallow TPS to enroll a single
    user on multiple tokens. (jmagne)
  - PKI TRAC Ticket #2478 - pkispawn fails as it is not able to find openssl as a
    dependency package (mharmsen)
  - PKI TRAC Ticket #2483 - Unable to read an encrypted email using renewed
    tokens (jmagne)
  - PKI TRAC Ticket #2496 - Cert/Key recovery is successful when the cert serial
    number and key id on the ldap user mismatches (cfu)
  - PKI TRAC Ticket #2505 - Fix packaging duplicates of classes in multiple jar
    files (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-12
changelog:
  - ## RHEL 7.3.z Batch Update 1
  - Bugzilla Bug #1390318 - CA EE: Submit caUserCert request without uid does
    not show proper error message (alee)
  - Bugzilla Bug #1390319 - Failed to start pki-tomcatd Service
    ("ipa-cacert-manage renew" failed?) (edewata)
  - Bugzilla Bug #1390320 - pkispawn fails as it is not able to find openssl as
    a dependency package (mharmsen)
  - Bugzilla Bug #1390321 - two-step externally-signed CA installation fails due
    to missing AuthorityID (ftweedal)
  - Bugzilla Bug #1390322 - Spurious host authority entries created (ftweedal)
  - Bugzilla Bug #1390324 - KRA installation failed against externally-signed CA
    with partial certificate chain (edewata)
  - Bugzilla Bug #1389757 - Problems with FIPS mode (edewata)
  - Bugzilla Bug #1390311 - Fix packaging duplicates of classes in multiple jar
    files (edewata)
  - Bugzilla Bug #1390325 - Typo in comment line of UserPwdDirAuthentication.java
    (edewata)
  - ## RHCS 9.1.z Batch Update 1
  - Bugzilla Bug #1248553 - TPS Enrollment always goes to "ca1" (cfu)
  - Bugzilla Bug #1274096 -  [BUG] Add ability to disallow TPS to enroll a
    single user on multiple tokens. (jmagne)
  - Bugzilla Bug #1379379 - Unable to read an encrypted email using renewed
    tokens (jmagne)
  - Bugzilla Bug #1379749 - Automatic recovery of encryption cert is not working
    when a token is physically damaged and a temporary token is issued (jmagne)
  - Bugzilla Bug #1381375 - Cert/Key recovery is successful when the cert serial
    number and key id on the ldap user mismatches
  - Bugzilla Bug #1381635 - Token format with external reg fails when
    op.format.externalRegAddToToken.revokeCert=true (cfu)
  - Bugzilla Bug #1382762 - PIN_RESET policy is not giving expected results when
    set on a token (jmagne)
  - Bugzilla Bug #1382862 - TPS token enrollment fails to setupSecureChannel
    when TPS and TKS security db is on fips mode. (jmagne)
  - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-13
changelog:
  - ## RHEL 7.3.z Batch Update 1
  - Bugzilla Bug #1389757 - Problems with FIPS mode (edewata)
    (added KRA key recovery via CLI in FIPS mode)
  - ## RHCS 9.1.z Batch Update 1
  - Reverted patches associated with
    Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-14
changelog:
  - Marked the following RHCS 9.1.z bug:
    Bugzilla Bug #1382862 - TPS token enrollment fails to setupSecureChannel
    when TPS and TKS security db is on fips mode. (jmagne)
    as a duplicate of RHEL 7.3.z bug:
    Bugzilla Bug #1389757 - Problems with FIPS mode (edewata)
    and moved the patch from the RHCS 9.1.z bug to the RHEL 7.3.z bug.


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-15
changelog:
  - ## RHEL 7.3.z Batch Update 2
  - Bugzilla Bug #1404173 - user-cert-add --serial CLI request to secure port
    with remote CA shows authentication failure (edewata)
  - Bugzilla Bug #1404175 -  pki ca-cert-request-submit fails presumably because
    of missing authentication even if it should not require any (edewata)
  - Bugzilla Bug #1404178 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI [pki-base] (edewata)
  - Bugzilla Bug #1404172 - Unable to install subordinate CA with HSM in FIPS
    mode (edewata)
  - Bugzilla Bug #1403689 - pkispawn does not change default ecc key size from
    nistp256 when nistp384 is specified in spawn config (jmagne)
  - Bugzilla Bug #1404176 - logging properties and man pages (edewata)
  - ## RHCS 9.1.z Batch Update 2
  - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI [pki-tps] (edewata)
  - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS
    tokendb shows different certificate status (cfu)
  - Bugzilla Bug #1395479 -  TPS throws "err=6" when attempting to format and
    enroll G&D Cards (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-16
changelog:
  - Separate original patches into RHEL and RHCS portions
  - ## RHEL 7.3.z Batch Update 2
  - Bugzilla Bug #1404176 - logging properties and man pages (edewata)
  - Bugzilla Bug #1405328 - TPS throws "err=6" when attempting to format and
    enroll G&D Cards (jmagne)
  - ## RHCS 9.1.z Batch Update 2
  - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and
    enroll G&D Cards (jmagne)
  - Bugzilla Bug #1404900 - RHCS logging properties (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-17
changelog:
  - ## RHCS 9.1.z Batch Update 3
  - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS
    tokendb shows different certificate status (cfu)
  - ## RHEL 7.3.z Batch Update 3
  - Bugzilla Bug #1417063 - ECDSA Certificates Generated by Certificate System
    8.1 fail NIST validation test with parameter field. (cfu)
  - Bugzilla Bug #1417064 - Unable to search certificate requests using the
    latest request ID (edewata)
  - Bugzilla Bug #1417065 - CA Certificate Issuance Date displayed on CA website
    incorrect (alee)
  - Bugzilla Bug #1417066 - update to 7.3 IPA with otpd bugfixes, tomcat will
    not finish start, hangs (ftweedal)
  - Bugzilla Bug #1417067 - pki-tomcat for 10+ minutes before generating cert
    (edewata)
  - Bugzilla Bug #1417190 - Problem with default AJP hostname in IPv6
    environment. (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-18
changelog:
  - ## RHEL 7.3.z Batch Update 4
  - Bugzilla Bug #1429492 - Add profile component that copies CN to SAN
    (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-19
changelog:
  - ## RHEL 7.3.z Batch Update 6
  - Bugzilla Bug #1447095 - RHCS 9.1 RC5 CA in the certificate profiles the
    startTime parameter is not working as expected. (jmagne)


author: Matej Marusak <mmarusak@redhat.com> - 2.1.11-51
changelog:
  - a-a-s-p-data: fix segfault if GPGKeysDir isn't configured
  - spec: turn on --enable-native-unwinder aarch64
  - plugins: a-a-g-machine-id use dmidecode command
  - spec: use dmidecode instead of python-dmidecode
  - Related: #1566707, #1566707, #1260074, #1591141


author: David Vossel <dvossel@redhat.com> - 0.17.1-1.1
changelog:
  Fix bug that prevents ipc server from working in pid with realtime priority.

    Resolves: rhbz#1198718


author: Christine Caulfield <ccaulfie@redhat.com> - 0.17.1-2.1
changelog:
  Increase size of the buffer where we make the socket name to allow for longer PIDs
    Resolves bz#1114852


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.1-2
changelog:
  Detect IPC Shared memory corruption in peek as well as read. Prevents
    the mainloop from spinning if multithreaded IPC (which is currently 
    not supported) is attempted without locking.
    Resolves: rhbz#1422454


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.1-3
changelog:
  Allow IPC system to use filesystem sockets instead of abstract
    sockets if a configuration file exists.
    Resolves: rhbz#1446254


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.1-4
changelog:
  Revert git patch 189ca28 which caused problems with pacemaker CIB
    closing down.
    Resolves: rhbz#1459276


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.1-5
changelog:
  Put backpatch 189ca28 as it's not the culprit
    
    Don't truncate IPC files in the client as it can cause servers to crash.
    I've also had to (for this release) disable one of the tests as it checks
    for truncated files.
    Resolves: rhbz#1459276


author: Martin Stransky <stransky@redhat.com> - 24.4.0-3
changelog:
  - Added a workaround for Bug 1054242 - RHEVM: Extremely high memory
    usage in Firefox 24 ESR on RHEL 6.5


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-8
changelog:
  - Require "selinux-policy-targeted >= 3.13.1-159" as a runtime requirement
  - Require "tomcatjss >= 7.2.1-4" as a build and runtime requirement
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS
    enabled system (edewata)
  - Bugzilla Bug #1447144 - CA brought down during separate KRA instance
    creation (edewata)
  - Bugzilla Bug #1447762 - pkispawn fails occasionally with this failure
    ACCESS_SESSION_ESTABLISH_FAILURE (edewata)
  - Bugzilla Bug #1454450 - SubCA installation failure with 2 step
    installation in fips enabled mode (edewata)
  - Bugzilla Bug #1456597 - Certificate import using pki client-cert-import
    is asking for password when already provided (edewata)
  - Bugzilla Bug #1456940 - Build failure due to Pylint issues (cheimes)
  - Bugzilla Bug #1458043 - Key recovery using externalReg fails
    with java null pointer exception on KRA (alee)
  - Bugzilla Bug #1458379 - Upgrade script for keepAliveTimeout parameter
    (edewata)
  - Bugzilla Bug #1458429 - client-cert-import --ca-cert should
    import CA cert with trust bits "CT,C,C" (edewata)
  - ##########################################################################
  - RHCS 9.2:
  - ##########################################################################
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-9
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret)
    using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne)
  - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC
    non-signing certificate requests (cfu)
  - Bugzilla Bug #1419777 - CC: allow CA to process pre-signed CMC
     revocation non-signing cert requests (cfu)
  - Bugzilla Bug #1458047 - change the way aes clients refer to
    aes keysets (alee)
  - Bugzilla Bug #1458055 - dont reuse IVs in the CMC code
    (alee)
  - Bugzilla Bug #1460028 - In keywrap mode, key recovery on
    KRA with HSM causes KRA to crash (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-10
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1458043 - Key recovery on token fails with
    invalid public key error on KRA (alee)
  - Bugzilla Bug #1460764 - CC: CMC: check HTTPS client
    authentication cert against CMC signer (cfu)
  - Bugzilla Bug #1461533 - Unable to find keys in the p12 file after
    deleting the any of the subsystem certs from it (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-11
changelog:
  - Resolves: rhbz #1469432
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1469432 - CMC plugin default change
  - Resolves CVE-2017-7537
  - Fixes BZ #1470948


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-12
changelog:
  - Resolves: rhbz #1472615,1472617,1469447,1463350,1469449,1472619,1464970,1469437,1469439,1469446
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1472615 - CC: allow CA to process pre-signed CMC non-signing
    certificate requests (cfu)
    [PREVIOUS PATCH:  pki-core-beta.patch]
    [PREVIOUS PATCH:  pki-core-snapshot-4.patch]
  - Bugzilla Bug #1472617 - CMC: cmc.popLinkWitnessRequired=false would cause
    error (cfu)
    [PREVIOUS PATCH:  pki-core-post-beta.patch]
  - Bugzilla Bug #1469447 - CC: CMC: check HTTPS client authentication cert
    against CMC signer (cfu)
    [PREVIOUS PATCH:  pki-core-CMC-check-HTTPS-client-authentication-cert.patch]
  - Bugzilla Bug #1463350 - Access banner validation (edewata)
    [pki-core-server-access-banner-validation.patch]
  - Bugzilla Bug #1469449 - CC: allow CA to process pre-signed CMC renewal
    non-signing cert requests (cfu)
    [PREVIOUS PATCH:  pki-core-snapshot-1.patch]
    [pki-core-pre-signed-CMC-renewal-UniqueKeyConstraint.patch]
  - Bugzilla Bug #1472619 - Platform Dependent Python Import (mharmsen)
    [pki-core-platform-dependent-python-import.patch]
  - Bugzilla Bug #1464970 - CC: CMC: replace id-cmc-statusInfo with
    id-cmc-statusInfoV2 (cfu)
    [pki-core-CMC-id-cmc-statusInfoV2.patch]
  - Bugzilla Bug #1469437 - subsystem-cert-update command lacks --cert option
    (dmoluguw)
    [pki-core-subsystem-cert-update-CLI-cert-option.patch]
  - Bugzilla Bug #1469439 - Fix Key Changeover with HSM to support SCP03
    (jmagne)
    [pki-core-HSM-key-changeover-SCP03-support.patch]
  - Bugzilla Bug #1469446 - CC: need CMC enrollment profiles for system
    certificates (cfu)
    [pki-core-system-cert-CMC-enroll-profile.patch]


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-13
changelog:
  - Resolves: rhbz #1463350
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1463350 - Access banner validation (edewata)
    [pki-core-server-access-banner-retrieval-validation.patch]


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-14
changelog:
  - Require "jss >= 4.4.0-8" as a build and runtime requirement
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Resolves: rhbz #1486870,1485833,1487509,1490241,1491332
  - Bugzilla Bug #1486870 - Lightweight CA key replication fails (regressions)
    [RHEL 7.4.z] (ftweedal)
  - Bugzilla Bug #1485833 - Missing CN in user signing cert would cause error
    in cmc user-signed [rhel-7.4.z] (cfu)
  - Bugzilla Bug #1487509 - pki-server-upgrade fails when upgrading from
    RHEL 7.1 [rhel-7.4.z] (ftweedal)
  - Bugzilla Bug #1490241 - PKCS12: upgrade to at least AES and SHA2 (FIPS)
    [rhel-7.4.z] (ftweedal)
  - Bugzilla Bug #1491332 - TPS UI: need to display tokenType and tokenOrigin
    for token certificates on TPS UI Server [rhel-7.4.z] (edewata)
  - dogtagpki Pagure Issue #2764 - py3: pki.key.archive_encrypted_data:
    TypeError: ... is not JSON serializable (ftweedal)
  - ##########################################################################
  - RHCS 9.2:
  - ##########################################################################
  - Resolves: rhbz #1486870,1485833,1487509,1490241,1491332,1482729,1462271
  - Bugzilla Bug #1462271 - TPS incorrectly assigns "tokenOrigin" and
    "tokenType" certificate attribute for recovered certificates. (cfu)
  - Bugzilla Bug #1482729 - TPS UI: need to display tokenType and tokenOrigin
    for token certificates on TPS UI (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-16
changelog:
  - ###########################################################################
  - ## RHCS 9.2
  - ###########################################################################
  - #Bugzilla Bug #1439228 - externalRegRecover does not support multiple
    - #Bugzilla Bug #1507160 - TPS new configuration to allow the protocol of
    - #Bugzilla Bug #1471996 - Certificate Revocation Reasons not being updated
    - ###########################################################################
  - ## RHEL 7.4
  - ###########################################################################
  - Bugzilla Bug #1500499 - Certificate Revocation Reasons not being updated
    in some cases [rhel-7.4.z] (cfu)
  - Bugzilla Bug #1502527 - CA cert without Subject Key Identifier causes
    issuance failure [rhel-7.4.z] (ftweedal)
  - Bugzilla Bug #1492560 - ipa-replica-install --setup-kra broken on DL0
    [rhel-7.4.z] (ftweedal)
    NOTE: Check-ins for #1492560 all reference the dogtagpki Pagure Issue
          associated with Bugzilla Bug #1402280 - CA Cloning: Failed to
          update number range in few cases (which is not yet fully resolved)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-17
changelog:
  - ###########################################################################
  - ## RHCS 9.2
  - ###########################################################################
  - #Bugzilla Bug #1507160 - TPS new configuration to allow the protocol of


author: Petr Hracek <phracek@redhat.com> - 1:24.3-3
changelog:
  - Fix for emacs bug 112144, style_changed_cb (#922519) 
  - Fix for emacs bug 112131, bell does not work (#562719)


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.8.1.el7]
changelog:
  - [x86] always enable eager FPU by default on non-AMD processors (Paolo Bonzini) [1589051 1589048] {CVE-2018-3665}
  - [net] nf_reset: also clear nfctinfo bits (Florian Westphal) [1588458 1572983]
  - [x86] bugs: Switch the selection of mitigation from CPU vendor to CPU features (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs: Add AMD's SPEC_CTRL MSR usage (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs: Add AMD's variant of SSB_NO (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Fix VM guest SSBD problems (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Eliminate TIF_SSBD checks in IBRS on/off functions (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Disable SSBD update from scheduler if not user settable (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Make ssbd_enabled writtable (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Remove thread_info check in __wrmsr_on_cpu() (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Write per-thread SSBD state to spec_ctrl_pcp (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Add a read-only ssbd_enabled debugfs file (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs/intel: Set proper CPU features and setup RDS (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] kvm: vmx: Emulate MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] kvm: svm: Implement VIRT_SPEC_CTRL support for SSBD (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs: Rework spec_ctrl base and mask logic (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Rework SPEC_CTRL update after late microcode loading (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Make sync_all_cpus_ibrs() write spec_ctrl_pcp value (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs: Unify x86_spec_ctrl_{set_guest, restore_host} (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Rework speculative_store_bypass_update() (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Add virtualized speculative store bypass disable support (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] KVM: Rename KVM SPEC_CTRL MSR functions to match upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Handle HT correctly on AMD (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] cpufeatures: Add FEATURE_ZEN (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle SSBD enumeration (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Use synthetic bits for IBRS/IBPB/STIBP (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [documentation] spec_ctrl: Do some minor cleanups (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Make "seccomp" the default mode for Speculative Store Bypass (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] seccomp: Move speculation migitation control to arch code (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [kernel] seccomp: Add filter flag to opt-out of SSB mitigation (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [kernel] seccomp: Use PR_SPEC_FORCE_DISABLE (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] prctl: Add force disable speculation (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spectre_v2: No mitigation if CPU not affected and no command override (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bug: Add X86_BUG_CPU_MELTDOWN and X86_BUG_SPECTRE_V[12] (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] pti: Rename CONFIG_KAISER to CONFIG_PAGE_TABLE_ISOLATION (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up naming of SPEC_CTRL MSR bits with upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up SSBD changes with upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.11.2.el7]
changelog:
  - [kernel] cpu: hotplug: detect SMT disabled by BIOS (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [documentation] l1tf: Fix typos (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Remove extra newline in vmentry_l1d_flush sysfs file (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Initialize the vmx_l1d_flush_pages' content (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] speculation: l1tf: Unbreak !__HAVE_ARCH_PFN_MODIFY_ALLOWED architectures (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [documentation] Add section about CPU vulnerabilities (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] bugs, kvm: introduce boot-time control of L1TF mitigations (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu: hotplug: Set CPU_SMT_NOT_SUPPORTED early (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu: hotplug: Expose SMT control init function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Allow runtime control of L1D flush (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Serialize L1D flush parameter setter (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Add static key for flush always (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Move l1tf setup function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Handle EPT disabled state proper (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Drop L1TF MSR list approach (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] litf: Introduce vmx status variable (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] bugs: Make cpu_show_common() static (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] bugs: Concentrate bug reporting into a separate function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu: hotplug: Online siblings when SMT control is turned on (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Use MSR save list for IA32_FLUSH_CMD if required (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Separate the VMX AUTOLOAD guest/host number accounting (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Add find_msr() helper function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Split the VMX MSR LOAD structures to have an host/guest numbers (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities, part 3 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu: hotplug: Boot HT siblings at least once, part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: fix typo in l1tf mitigation string (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities, part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Boot HT siblings at least once (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - Revert "x86/apic: Ignore secondary threads if nosmt=force" (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect PAE swap entries against L1TF (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: Extend 64bit swap file size limit (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu/AMD: Remove the pointless detect_ht() call (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] bugs: Move the l1tf function and define pr_fmt properly (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT, part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] topology: Provide topology_smt_supported() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread(), part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] apic: Ignore secondary threads if nosmt=force (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu/AMD: Evaluate smp_num_siblings early (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] CPU/AMD: Do not check CPUID max ext level before parsing SMP info (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu/intel: Evaluate smp_num_siblings early (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu/topology: Provide detect_extended_topology_early() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu/common: Provide detect_ht_early() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu: Remove the pointless CPU printout (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Split do_cpu_down() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] CPU: Modify detect_extended_topology() to return result (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: fix build for CONFIG_NUMA_BALANCING=n (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: sync with latest L1TF patches (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_NUMA PTEs and PMDs against speculation (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [mm] l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Report if too much memory for L1TF workaround (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Limit swap file size to MAX_PA/2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Add sysfs reporting for l1tf (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Make sure the first page is always reserved (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Protect PROT_NONE PTEs against speculation (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Protect swap entries against L1TF (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Increase 32bit PAE __PHYSICAL_PAGE_MASK (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] mm: Fix swap entry comment and macro (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] spec_ctrl: sync with upstream cpu_set_bug_bits() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86]  add support for L1D flush MSR (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-862.11.3.el7]
changelog:
  - [net] tcp: add tcp_ooo_try_coalesce() helper (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: call tcp_drop() from tcp_data_queue_ofo() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: detect malicious patterns in tcp_collapse_ofo_queue() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: avoid collapses in tcp_prune_queue() if possible (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: free batches of packets in tcp_prune_ofo_queue() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] net: add rb_to_skb() and other rb tree helpers (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: fix a stale ooo_last_skb after a replace (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: use an RB tree for ooo receive queue (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: refine tcp_prune_ofo_queue() to not drop all packets (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: increment sk_drops for dropped rx packets (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [x86] x86/syscall: Fix regression when using the last syscall (pkey_free) (Lauro Ramos Venancio) [1589033 1589035] {CVE-2018-3693}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-862.11.4.el7]
changelog:
  - [net] ipv6: fix nospec-related regression in ipv6_addr_prefix() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3693}


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-862.11.5.el7]
changelog:
  - [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-862.11.6.el7]
changelog:
  - [kernel] cpu/hotplug: Fix 'online' sysfs entry with 'nosmt' (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}


author: Akemi Yagi <toracat@centos.org> [3.10.0-862.11.6.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
     addmissing.patch  [puias]
     cpufreq.patch  [puias]
     i386-audit-stop-scri-stack-frame.patch  [puias]
     removejiffies.patch  [puias]
     undorhirqstat.patch  [puias]
     morefixes.patch      [puias+bug#12412]
     upstream-32bit-fixes-7_5.patch [puias+bug#12412]
     clear-32bit-Werror-warnings.patch  [bug#12412]
     qspinlock_types-32bit.patch   [ay]
     i686-7-4.patch [T.Kabe, bug#13890]
     firmware-efi-32bit.patch [ay]
     patch-spec_ctrl_i686.patch [T.Kabe bug#14353]
     686 mods for 7.5 [T.Kabe bug#14703]
     more 686 mods for 7.5 (-862.3.2) [pgreco]
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Enabled spidev [bug#9955]
  - Add a patch [bug#10447]
  - Enable ATM drivers [bug#10845]
  - Add 9pfs config options [bug#10849]
  - Enable VFIO_PCI_VGA [bug#12435]
  - Rremove initramfs-xxxkdump.img upon kernel removal [bug#12703]
  - Add a patch from [bug#12841]
  - Add a patch from [bug#12818]
  - Enabled RT2800USB_RT3573 [bug#13162]
  - Enable LDM_PARTITION [bug#13526]
  - Add a patch to fix misleading warning [bug#13990]
  - Add BuildRequires: openssl-devel to the with_perf section [bug#13990]
  - Add a patch to fix build errors for EL7.5 [bug#14425]
  - Added a patch to fix alsa potentail crash [bug14779]
  - Apply a patch to fix excessive warnings [bug#14413]
  - Apply a patch to fix mempolicy issue [bug#15115]


author: Rex Dieter <rdieter@fedoraproject.org> - 1.11-4
changelog:
  - fix fpath (use autoreconf -f)
  - -devel: tighten deps via %{?_isa}, drop Requires: pkgconfig (add explicit BR: pkgconfig)


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.0.11-56
changelog:
  - fencing: add validate-all action
    Resolves: rhbz#1433948
  - fence_rhevm: add "--disable-http-filter" to be able to explicitly
    use oVirt API version 3
    Resolves: rhbz#1422499


author: Marek Grac <mgrac@redhat.com> - 4.0.11-57
changelog:
  - Set SELinux booleans required for fence agent integration with cluster
    Resolves: rhbz#1427986
  - Add consistency of parameters between STDIN and command-line
    Resolves: rhbz#1403028


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.91-2.6.2.1
changelog:
  - Bump to 2.6.2 and u91b00.
  - Disable system LCMS 2 for now until security of it can be verified.
  - Drop patches for PR2560/RH1245855 as now applied upstream.
  - Sync minor changes from RHEL 6 spec file.
  - Resolves: rhbz#1271923


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.95-2.6.4.0
changelog:
  - Bump to 2.6.4 and u95b00.
  - Backport tarball creation script from OpenJDK 8 RPMs and update fsg.sh to work with it.
  - Drop 8072932or8074489 patch as applied upstream in u91b01.
  - Add MD5 checksums for last two version of the java.security file.
  - Resolves: rhbz#1295768


author: Ray Strode <rstrode@redhat.com> - 3.28.2-15
changelog:
  - sync AllowMultipleSessionsPerUser patch from 7.6 branch
    Resolves: #1664353
  - Create dconf dirs by default
    Resolves: #1664284


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.5
changelog:
  - kvm-vga-add-sr_vbe-register-set.patch [bz#1347527]
  - Resolves: bz#1347527
    (Regression from CVE-2016-3712: windows installer fails to start)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.6
changelog:
  - kvm-virtio-error-out-if-guest-exceeds-virtqueue-size.patch [bz#1359728]
  - Resolves: bz#1359728
    (EMBARGOED CVE-2016-5403 qemu-kvm: Qemu: virtio: unbounded memory allocation on host via guest leading to DoS [rhel-7.2.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.7
changelog:
  - kvm-block-iscsi-avoid-potential-overflow-of-acb-task-cdb.patch [bz#1358996]
  - Resolves: bz#1358996
    (CVE-2016-5126 qemu-kvm: Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl [rhel-7.2.z])


author: Mark Wielaard <mjw@redhat.com> - 3.11.0-20
changelog:
  - Rebase to fedora 3.11.0
    (#1316512 #1306844 #1305962 #1298888 #1296318 #1271754 #1265566 #1265557)


author: Mark Wielaard <mjw@redhat.com> - 3.11.0-21
changelog:
  - Add valgrind-3.11.0-deduppoolalloc.patch (#1328347)
  - Add valgrind-3.11.0-ppc-bcd-addsub.patch (#1331738)
  - Add valgrind-3.11.0-ppc64-vgdb-vr-regs.patch (#1331774)


author: Petr Holasek <pholasek@redhat.com> - 2:1.0.6-5
changelog:
  - Fixed irqbalance web adresses in spec (bz1060810)
  - Default hintpolicy adjusted (bz1060814)
  - Missing autogen.sh call fixed


author: Petr Holasek <pholasek@redhat.com> - 2:1.0.7-2
changelog:
  - fixed unused variable revealed by covscan
  - fixed ignored pid argument (#1155632)
  - warning when irqbalance started under non-root (#1155799)
  - more robust signal handling (#1158937)
  - fixed hostname in manpage (#1162251)


author: Hans de Goede <hdegoede@redhat.com> - 0.6-3
changelog:
  - Fix usbredirserver not listening for ipv6 connections (rhbz#957470)
  - Fix a few (harmless) coverity warnings


author: Hans de Goede <hdegoede@redhat.com> - 0.6-5
changelog:
  - Use the new libusb autodetach kernel driver functionality
  - Fix a usbredirparser bug which causes tcp/ip redir to not work (rhbz#1005015)


author: Victor Toso <victortoso@redhat.com> - 0.6-8
changelog:
  - Fix migration due lack of capabilities from source host
    Resolves: rhbz#1185167
  - New callback to drop isoc packets in order to avoid high memory
    consumption in the client
    Resolves: rhbz#1312913


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.8.15-8
changelog:
  - Fixed crash that can occur if term is resized during irssi init
    (init-resize-crash-fix patch)
    Resolves: rhbz#796457


author: Petr Pisar <ppisar@redhat.com> - 8.32-15
changelog:
  - Fix compiling expression where start-anchored character with more than one
    other case follows circumflex in multiline UTF mode (bug #1110621)
  - Fix character class with a literal quotation (bug #1111091)
  - Fix empty-matching possessive zero-repeat groups in interpreted mode
    (bug #1119320)
  - Fix compiler crash for zero-repeated groups with a recursive back reference
    (bug #1119356)
  - Reset non-matched groups within capturing group up to forced match
    (bug #1161597)
  - Fix static linking (bug #1217111)
  - Package pcredemo.c as a documentation for pcre-devel (bug #1217118)


author: Petr Pisar <ppisar@redhat.com> - 8.32-15.1
changelog:
  - Fix CVE-2015-2328 (infinite recursion compiling pattern with recursive
    reference in a group with indefinite repeat) (bug #1330508)
  - Fix CVE-2015-8385 (buffer overflow caused by named forward reference to
    duplicate group number) (bug #1330508)
  - Fix CVE-2015-8386 (buffer overflow caused by lookbehind assertion)
    (bug #1330508)
  - Fix CVE-2015-3217 (stack overflow caused by mishandled group empty match)
    (bug #1330508)
  - Fix CVE-2015-5073 and CVE-2015-8388 (buffer overflow for forward reference
    within backward assertion with excess closing parenthesis) (bug #1330508)
  - Fix CVE-2015-8391 (inefficient posix character class syntax check)
    (bug #1330508)
  - Fix CVE-2016-3191 (workspace overflow for (*ACCEPT) with deeply nested
    parentheses) (bug #1330508)


author: Miloslav Trmač <mitr@redhat.com> - 2.11-3
changelog:
  - Drop the cron.daily script, systemd default configuration handles the same
    places.
    Resolves: #906455


author: Jiri Kucera <jkucera@redhat.com> - 2.11-6
changelog:
  - Added --fuser option support.
  - Fixed bad URL, Source0, and bogus date in spec.
    Resolves: #1330328


author: Miroslav Grepl <mgrepl@redhat.com> - 2.2.5-12
changelog:
  - Make selinux-policy build working also on another architectures related to sepolicy-manpage generate
  Resolves:#1103292


author: Miroslav Grepl <mgrepl@redhat.com> - 2.2.5-13
changelog:
  - If the user attempts to restorecon the label of a file that does not exist, do not report this as an error
  Resolves:#1082956
  - Make fixfiles_exclude_dirs working if there is a substituion for the given directory
  Resolves:#1082676
  - Add ability to list the actual active modules
  Resolves:#1075023
  - Update XDG_RUNTIME_DIR directory
  Resolves:#1112811
  - Fix semanage man page to talk about  semanage-* (8) man pages.
  Resolves:#1084390


author: Petr Lautrbach <plautrba@redhat.com> 2.2.5-16
changelog:
  - semanage: Use OrderedDict for list of fcontexts
  Resolves: rhbz#1206769
  - fixfiles: Cover file_context.XXX.homedir
  Resolves: rhbz#1186640


author: Petr Lautrbach <plautrba@redhat.com> 2.2.5-17
changelog:
  - Fix handling of Forking daemon, to allow systemd to handle it better
  Resolves: rhbz#1186648
  - Fix typo in semanage args for minimum policy store
  Resolves: rhbz#1208797
  - Allow to define sock file in /etc directory
  Resolves: rhbz#1188360


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-6
changelog:
  - Add LGPLv2+ and GPLv2 to license declaration
  - Correct changelog dates
  - Package additional LDAP scripts as a documentation
  - Package XFS-specific tools


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-3
changelog:
  - qemu: hotplug: Do not try to add secret object for TLS if it does not exist (rhbz#1598015)
  - qemu: monitor: Make qemuMonitorAddObject more robust against programming errors (rhbz#1598015)
  - spec: Explicitly require matching libvirt-libs (rhbz#1600122)
  - virDomainConfNWFilterInstantiate: initialize @xml to avoid random crash (rhbz#1599545)
  - qemuProcessStartPRDaemonHook: Try to set NS iff domain was started with one (rhbz#1470007)
  - qemuDomainValidateStorageSource: Relax PR validation (rhbz#1470007)
  - virStoragePRDefFormat: Suppress path formatting for migratable XML (rhbz#1470007)
  - qemu: Wire up PR_MANAGER_STATUS_CHANGED event (rhbz#1470007)
  - qemu_monitor: Introduce qemuMonitorJSONGetPRManagerInfo (rhbz#1470007)
  - qemu: Fetch pr-helper process info on reconnect (rhbz#1470007)
  - qemu: Fix ATTRIBUTE_NONNULL for qemuMonitorAddObject (rhbz#1598015)
  - virsh.pod: Fix a command name typo in nwfilter-binding-undefine (rhbz#1600329)
  - docs: schema: Add missing <alias> to vsock device (rhbz#1600345)
  - virnetdevtap: Don't crash on !ifname in virNetDevTapInterfaceStats (rhbz#1595184)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-4
changelog:
  - qemu: hotplug: don't overwrite error message in qemuDomainAttachNetDevice (rhbz#1598311)
  - qemu: hotplug: report error when changing rom enabled attr for net iface (rhbz#1599513)
  - qemu: Fix setting global_period cputune element (rhbz#1600427)
  - tests: qemucaps: Add test data for upcoming qemu 3.0.0 (rhbz#1475770)
  - qemu: capabilities: Add capability for werror/rerror for 'usb-device' frontend (rhbz#1475770)
  - qemu: command: Move graphics iteration to its own function (rhbz#1475770)
  - qemu: address: Handle all the video devices within a single loop (rhbz#1475770)
  - conf: Introduce virDomainVideoDefClear helper (rhbz#1475770)
  - conf: Introduce virDomainDefPostParseVideo helper (rhbz#1475770)
  - qemu: validate: Enforce compile time switch type checking for videos (rhbz#1475770)
  - tests: Add capabilities data for QEMU 2.11 x86_64 (rhbz#1475770)
  - tests: Update capabilities data for QEMU 3.0.0 x86_64 (rhbz#1475770)
  - qemu: qemuBuildHostdevCommandLine: Use a helper variable mdevsrc (rhbz#1475770)
  - qemu: caps: Introduce a capability for egl-headless (rhbz#1475770)
  - qemu: Introduce a new graphics display type 'headless' (rhbz#1475770)
  - qemu: caps: Add vfio-pci.display capability (rhbz#1475770)
  - conf: Introduce virDomainGraphicsDefHasOpenGL helper (rhbz#1475770)
  - conf: Replace 'error' with 'cleanup' in virDomainHostdevDefParseXMLSubsys (rhbz#1475770)
  - conf: Introduce new <hostdev> attribute 'display' (rhbz#1475770)
  - qemu: command: Enable formatting vfio-pci.display option onto cmdline (rhbz#1475770)
  - docs: Rephrase the mediated devices hostdev section a bit (rhbz#1475770)
  - conf: Introduce new video type 'none' (rhbz#1475770)
  - virt-xml-validate: Add schema for nwfilterbinding (rhbz#1600330)
  - tools: Fix typo generating adapter_wwpn field (rhbz#1601377)
  - src: Fix memory leak in virNWFilterBindingDispose (rhbz#1603025)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-5
changelog:
  - esx storage: Fix typo lsilogic -> lsiLogic (rhbz#1571759)
  - networkGetDHCPLeases: Don't always report error if unable to read leases file (rhbz#1600468)
  - nwfilter: Resolve SEGV for NWFilter Snoop processing (rhbz#1599973)
  - qemu: Remove unused bypassSecurityDriver from qemuOpenFileAs (rhbz#1589115)
  - qemuDomainSaveMemory: Don't enforce dynamicOwnership (rhbz#1589115)
  - domain_nwfilter: Return early if net has no name in virDomainConfNWFilterTeardownImpl (rhbz#1607831)
  - examples: Add clean-traffic-gateway into nwfilters (rhbz#1603115)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-6
changelog:
  - qemu: Exempt video model 'none' from getting a PCI address on Q35 (rhbz#1609087)
  - conf: Fix a error msg typo in virDomainVideoDefValidate (rhbz#1607825)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-7
changelog:
  - qemu_migration: Avoid writing to freed memory (rhbz#1593137)
  - qemu: hotplug: Fix asynchronous unplug of 'shmem' (rhbz#1618622)
  - tests: rename hugepages to hugepages-default (rhbz#1591235)
  - tests: extract hugepages-numa-default-dimm out of hugepages-numa (rhbz#1591235)
  - tests: rename hugepages-numa into hugepages-numa-default (rhbz#1591235)
  - tests: remove unnecessary XML elements from hugepages-numa-default (rhbz#1591235)
  - tests: extract pages-discard out of hugepages-pages (rhbz#1591235)
  - tests: rename hugepages-pages into hugepages-numa-nodeset (rhbz#1591235)
  - tests: rename hugepages-pages2 into hugepages-numa-default-2M (rhbz#1591235)
  - tests: extract pages-discard-hugepages out of hugepages-pages3 (rhbz#1591235)
  - tests: rename hugepages-pages3 into hugepages-numa-nodeset-part (rhbz#1591235)
  - tests: rename hugepages-pages4 into hugepages-numa-nodeset-nonexist (rhbz#1591235)
  - tests: rename hugepages-pages5 into hugepages-default-2M (rhbz#1591235)
  - tests: rename hugepages-pages6 into hugepages-default-system-size (rhbz#1591235)
  - tests: rename hugepages-pages7 into pages-dimm-discard (rhbz#1591235)
  - tests: rename hugepages-pages8 into hugepages-nodeset-nonexist (rhbz#1591235)
  - tests: introduce hugepages-default-1G-nodeset-2M (rhbz#1591235)
  - tests: introduce hugepages-nodeset (rhbz#1591235)
  - conf: Move hugepage XML validation check out of qemu_command (rhbz#1591235)
  - conf: Move hugepages validation out of XML parser (rhbz#1591235)
  - conf: Introduce virDomainDefPostParseMemtune (rhbz#1591235)
  - tests: sev: Test launch-security with specific QEMU version (rhbz#1612009)
  - qemu: Fix probing of AMD SEV support (rhbz#1612009)
  - qemu: caps: Format SEV platform data into qemuCaps cache (rhbz#1612009)


author: Florian Festi <ffesti@redhat.com> - 4.11.3-18
changelog:
  - Fixed failing upstream test 257 on big endian systems (#1264463)
  - Fixed problems with perl.req script (#1320214, #1275551)
  - Fixed race condition in rpm file deployment when updating an existing file
    (#1320181)
  - Move bdb warnings from stdin to stdout (#1297793)
  - Add --justdb to the erase section of the man page, too (#1310561)
  - Backport support for multi threaded xz compression (#1278924)
  - Update config.guess (#1291377)
  - Add --noplugins option (#1264031)
  - Overwrite a file if it is not marked as config any more (#1290463)
  - Add man page for systemd-inhibit plugin (#1265578)


author: Eric Sandeen <sandeen@redhat.com> 3.1.3-2
changelog:
  - Preserve xattrs on multi-part stream restores (#1034014)
  - Prevent segfault on multi-part stream restores (#1034015)


author: Eric Sandeen <sandeen@redhat.com> 3.1.3-5
changelog:
  - Preserve file capabilities during xfsrestore (#1013345)

  - Preserve xattrs on multi-part stream restores (#1034014)


author: Jan Synáček <jsynacek@redhat.com> - 20160308-7
changelog:
  - ping hung when it cannot receive echo reply (#1362463)
  - arping documentation inconsistency (#1351704)


author: Jan Synáček <jsynacek@redhat.com> - 20160308-9
changelog:
  - IPv4 vs IPv6 inconsistency on return value of ping (#1362388)
  - ping6 does not use device specified with -I parameter (#1371824, #1424965)
  - double cap_free call in ping_common.c (#1410114)
  - ping assumes EACCESS errors are due to broadcast addresses (#1387315)
  - ping -t with multicast address without effect on ppc64 (#1373333)
  - arping -c <n> does not exit when the device is deleted (#1387542)


author: Richard W.M. Jones <rjones@redhat.com> - 0.6.1.1-1
changelog:
  - New upstream version 0.6.1.1.
  - Remove mlvirsh subpackage, no longer upstream.
  - Replace custom configure with RPM macro configure.
  - Use RPM global instead of define.
  - Use built-in RPM OCaml dependency generator.


author: Richard W.M. Jones <rjones@redhat.com> - 0.6.1.2-5
changelog:
  - Modernise the spec file.
  - Add upstream patch to remove unnecessary get_cpu_stats second parameter
    (thanks Hu Tao).


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-9
changelog:
  - Update patch level to upstream fb94901
  - Prevent blocking by performing systemd reloads asynchronously


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-10
changelog:
  - Update patch level to upstream 98b6688
  - Support an intelligent resource restart operation
  - Exclusive discovery implies running the resource is only possible on the listed nodes


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-11
changelog:
  - Update patch level to upstream 7dd9022
  - Ensure all internal caches are updated when nodes are removed from the cluster
    Resolves: rhbz#1162727


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-13
changelog:
  - Update patch level to upstream a433de6
  - Ensure we wait for long running systemd stop operations to complete
    Resolves: rhbz#1165423


author: David Vossel <dvossel@redhat.com> - 1.1.12-18
changelog:
  - clone order constraint require-all option.
  - fix memory leaks in crmd and pacemakerd

    Resolves: rhbz#1176210


author: David Vossel <dvossel@redhat.com> - 1.1.12-19
changelog:
  - Imply stop on actions within containers during host fencing
  - acl correctly implement the reference acl direct

    Resolves: rhbz#1117341


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.101-7.b13
changelog:
  - added patch532 hotspot-1358661.patch - to fix performance of bimorphic inlining may be bypassed by type speculation
  - rhbz1358661
  - added patch301 bz1204159_java8.patch - to fix systemtap on multiple jdks
  - rhbz1204159
  - added patch531 hotspot-8157306.changeset - to fix rare NPE injavac on aarch64
  - rhbz1360863
  - added all virtual provides of java-devel
  - Resolves: rhbz#1216018


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-8.b13
changelog:
  - Replace patch for S8157306 with upstream version, documented & applied on all archs with conditional in patch
  - Resolves: rhbz#1360863


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-8.b13
changelog:
  - Replace patch for S8162384 with upstream version. Document correctly along with SystemTap RH1204159 patch.
  - Resolves: rhbz#1358661


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-9.b15
changelog:
  - Update to aarch64-jdk8u101-b15.
  - Rebase SystemTap tarball on IcedTea 3.1.0 versions so as to avoid patching.
  - Drop additional hunk for 8147771 which is now applied upstream.
  - Resolves: rhbz#1359857


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-0.b14
changelog:
  - Update to aarch64-jdk8u102-b14.
  - Drop 8140620, 8148752 and 6961123, all of which appear upstream in u102.
  - Move 8159244 to 8u111 section as it only appears to be in unpublished u102 b31.
  - Move 8158260 to 8u112 section following its backport to 8u.
  - Resolves: rhbz#1359857


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.102-2.b14
changelog:
  - @prefix@ in tapsetfiles substitued by prefix as necessary to work with systemtap3 (rhbz1371005)
  - Resolves: rhbz#1295754


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.102-2.b14
changelog:
  - declared check_sum_presented_in_spec and used in prep and check
  - it is checking that latest packed java.security is mentioned in listing
  - Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-3.b14
changelog:
  - Rebuild java-1.8.0-openjdk for GCC aarch64 stack epilogue code generation fix (RH1372750)
  - Resolves: rhbz#1359857


author: Petr Šabata <contyk@redhat.com> - 0.9.46-1
changelog:
  - 0.9.46 bump
  - 802.1Qaz fixes to enable support on not CEE DCBX-enabled hardware
  - 802.1Qbg EVB module support
  - lldpad now supports bonded interfaces


author: Gris Ge <fge@redhat.com> 1.4.0-1
changelog:
  - Add Python3 support.
  - New sub rpm package python3-libstoragemgmt.
  - Add support of lmiwbem.
  - Allow plugin test to be run concurrently.
  - Bug fixes:
      * Fix megaraid plugin for dell PERC.
      * Fix local disk rotation speed query on NVMe disk.
      * Fix lsmcli incorrect try-expect on local disk query.
      * Fix all the gcc compile warnings.
      * Fix the obsolete usage of AC_OUTPUT in configure.ac.
  - Library adds:
      * Query serial of local disk:
          lsm_local_disk_serial_num_get()/lsm.LocalDisk.serial_num_get()
      * Query LED status of local disk:
          lsm_local_disk_led_status_get()/lsm.LocalDisk.led_status_get()
      * Query link speed of local disk:
          lsm_local_disk_link_speed_get()/lsm.LocalDisk.link_speed_get()


author: Gris Ge <fge@redhat.com> - 1.5.0-2
changelog:
  - Fix multilib confliction of nfs-plugin by move binrary file to
    another subpackage libstoragemgmt-nfs-plugin-clibs


author: Richard Hughes <richard@hughsie.com> 2.4-1
changelog:
  - Update to new upstream version.
  - Black point detection from the algorithm disclosed by Adobe
  - Added support for transforms on planar data with different stride
  - Added a new plug-in type for optimizing full transforms
  - Linear (gamma 1.0) profiles can now operate in unbounded mode
  - Added "half" float support


author: Doug Ledford <dledford@redhat.com> - 1.0.6-1
changelog:
  - Update to latest upstream release
  - Update RoCE IP GID support
  - Fix flow steering support
  - Related: bz1122333


author: Kamil Dudka <kdudka@redhat.com> - 0.12-0.34.pre6
changelog:
  - update to latest upstream pre-release
  - drop unneeded patches
  - fix autoconf warnings
  - explicitly disable using OpenSSL and GnuTLS


author: Doug Ledford <dledford@redhat.com> - 1.1.8-6
changelog:
  - Add build on s390
  - Drop back to building against libnl instead of libnl3
  - Resolves: bz1182178, bz1177115


author: Doug Ledford <dledford@redhat.com> - 1.1.8-7
changelog:
  - Add checksum offload support
  - Update the various patches to the ones from the official upstream git repo
  - Related: bz1195888


author: Lukas Nykryn <lnykryn@redhat.com> - 208-13
changelog:
  - tmpfiles: minor modernizations (#1147524)
  - install: when looking for a unit file for enabling, search for templates only after traversing all search directories (#1147524)
  - install: remove unused variable (#1147524)
  - bootctl: typo fix in help message (#1147524)
  - logind: ignore failing close() on session-devices (#1147524)
  - sysfs-show.c: return negative error (#1147524)
  - core: only send SIGHUP when doing first kill, not when doing final sigkill (#1147524)
  - cgroup: make sure to properly send SIGCONT to all processes of a cgroup if that's requested (#1147524)
  - core: don't send duplicate SIGCONT when killing units (#1147524)
  - efi: fix Undefined reference efi_loader_get_boot_usec when EFI support is disabled (#1147524)
  - macro: better make IN_SET() macro use const arrays (#1147524)
  - macro: make sure we can use IN_SET() also with complex function calls as first argument (#1147524)
  - core: fix property changes in transient units (#1147524)
  - load-modules: properly return a failing error code if some module fails to load (#1147524)
  - core/unit: fix unit_add_target_dependencies() for units with no dependencies (#1147524)
  - man: there is no ExecStopPre= for service units (#1147524)
  - man: document that per-interface sysctl variables are applied as network interfaces show up (#1147524)
  - journal: downgrade vaccuum message to debug level (#1147524)
  - logs-show: fix corrupt output with empty messages (#1147524)
  - journalctl: refuse extra arguments with --verify and similar (#1147524)
  - journal: assume that next entry is after previous entry (#1147524)
  - journal: forget file after encountering an error (#1147524)
  - man: update link to LSB (#1147524)
  - man: systemd-bootchart - fix spacing in command (#1147524)
  - man: add missing comma (#1147524)
  - units: Do not unescape instance name in systemd-backlight@.service (#1147524)
  - manager: flush memory stream before using the buffer (#1147524)
  - man: multiple sleep modes are to be separated by whitespace, not commas (#1147524)
  - man: fix description of systemctl --after/--before (#1147524)
  - udev: properly detect reference to unexisting part of PROGRAM's result (#1147524)
  - gpt-auto-generator: don't return OOM on parentless devices (#1147524)
  - man: improve wording of systemctl's --after/--before (#1147524)
  - cgroup: it's not OK to invoke alloca() in loops (#1147524)
  - core: don't try to relabel mounts before we loaded the policy (#1147524)
  - systemctl: --kill-mode is long long gone, don't mention it in the man page (#1147524)
  - ask-password: when the user types a overly long password, beep and refuse (#1147524)
  - logind: don't print error if devices vanish during ACL-init (#1147524)
  - tty-ask-password-agent: return negative errno (#1147524)
  - journal: cleanup up error handling in update_catalog() (#1147524)
  - bash completion: fix __get_startable_units (#1147524)
  - core: check the right variable for failed open() (#1147524)
  - man: sd_journal_send does nothing when journald is not available (#1147524)
  - man: clarify that the ExecReload= command should be synchronous (#1147524)
  - conf-parser: never consider it an error if we cannot load a drop-in file because it is missing (#1147524)
  - socket: properly handle if our service vanished during runtime (#1147524)
  - Do not unescape unit names in [Install] section (#1147524)
  - util: ignore_file should not allow files ending with '~' (#1147524)
  - core: fix invalid free() in killall() (#1147524)
  - install: fix invalid free() in unit_file_mask() (#1147524)
  - unit-name: fix detection of unit templates/instances (#1147524)
  - journald: make MaxFileSec really default to 1month (#1147524)
  - bootchart: it's not OK to return -1 from a main program (#1147524)
  - journald: Fix off-by-one error in "Missed X kernel messages" warning (#1147524)
  - man: drop references to removed and obsolete 'systemctl load' command (#1147524)
  - units: fix BindsTo= logic when applied relative to services with Type=oneshot (#1147524)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-15
changelog:
  - core: do not segfault if /proc/swaps cannot be opened (#1151239)
  - man: we don't have 'Wanted' dependency (#1152487)
  - environment: append unit_id to error messages regarding EnvironmentFile (#1147691)
  - udevd: add --event-timeout commandline option (#1154778)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-16
changelog:
  - logind: use correct "who" enum values with KillUnit. (#1155502)
  - logind: always kill session when termination is requested (#1155502)
  - udev: net_id - correctly name netdevs based on dev_port when set (#1155996)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-17
changelog:
  - udev: net_id dev_port is base 10 (#1155996)
  - udev: Fix parsing of udev.event-timeout kernel parameter (#1154778)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-20
changelog:
  - core: introduce new Delegate=yes/no property controlling creation of cgroup subhierarchies (#1139223)
  - core: don't migrate PIDs for units that may contain subcgroups, do this only for leaf units (#1139223)
  - mount: use libmount to enumerate /proc/self/mountinfo (#1161417)
  - mount: monitor for utab changes with inotify (#1161417)
  - mount: add remote-fs dependencies if needed after change (#1161417)
  - mount: check options as well as fstype for network mounts (#1161417)
  - rules: don't enable usb pm for Avocent devices (#1155370)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-20.1
changelog:
  - shared/install: avoid prematurely rejecting "missing" units (#1199981)
  - core: fix enabling units via their absolute paths (#1199981)


author: rmarshall@redhat.com - 8.28-21
changelog:
  - Resolve issues with the recent grubby logic patches that
    appeared on the ppc platform. Fix a problem that occurred
    on systems where no kernel update had ever been installed.
    Resolves: rhbz#1285601
  - Specify the actual prune_debug file in sources.
    Resolves: rhbz#1285601


author: rmarshall@redhat.com - 8.28-23
changelog:
  - Fixes --info flag on s390/s390x.
    Related: rhbz#1285601
  - Fixes --set-default-index on s390/s390x.
    Related: rhbz#1285601
  - Allows prune_debug to run on s390/s390x.
    Resolves: rhbz#1285601


author: Peter Jones <pjones@redhat.com> - 8.28-24
changelog:
  - Ensure "grubby --default-title" takes the bootloader selection into
    account
    Resolves: rhbz#1340893


author: Peter Jones <pjones@redhat.com> - 8.28-25
changelog:
  - Ensure /etc/sysconfig/kernel has a stable mode, now that rpm handles ghost
    files differently.
    Resolves: rhbz#1584313


author: Jan Synáček <jsynacek@redhat.com> - 2.4.39-5
changelog:
  - add documentation reference to service file (#1087288)
  - fix: tls_reqcert try has bad behavior (#1027613)


author: Matúš Honěk <mhonek@redhat.com> - 2.4.40-1
changelog:
  - new upstream release (#1147982)
  - fix: PIE and RELRO check (#1092562)
  - fix: slaptest doesn't convert perlModuleConfig lines (#1184585)
  - fix: OpenLDAP crash in NSS shutdown handling (#1158005)
  - fix: slapd.service may fail to start if binding to NIC ip (#1198781)
  - fix: deadlock during SSL_ForceHandshake when getting connection to replica (#1125152)
  - improve check_password (#1174723, #1196243)
  - provide an unversioned symlink to check_password.so.1.1 (#1174634)
  - add findutils to requires (#1209229)


author: Matúš Honěk <mhonek@redhat.com> - 2.4.40-5
changelog:
  - enhancement: support TLS 1.1 and later (#1231522,#1160467)
  - fix: openldap ciphersuite parsing code handles masks incorrectly (#1231522)
  - fix the patch in commit da1b5c (fix: OpenLDAP crash in NSS shutdown handling) (#1231228)


author: Matúš Honěk <mhonek@redhat.com> - 2.4.40-7
changelog:
  - Merge two MozNSS cipher suite definition patches into one. (#1245279)
  - Use what NSS considers default for DEFAULT cipher string. (#1245279)
  - Remove unnecesary defaults from ciphers' definitions (#1245279)


author: Matúš Honěk <mhonek@redhat.com> - 2.4.40-8
changelog:
  - NSS does not support string ordering (#1231522)
  - implement and correct order of parsing attributes (#1231522)
  - add multi_mask and multi_strength to correctly handle sets of attributes (#1231522)
  - add new cipher suites and correct AES-GCM attributes (#1245279)
  - correct DEFAULT ciphers handling to exclude eNULL cipher suites (#1245279)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.14-2
changelog:
  - Add patch by Stephen Gallagher to include manual pages for
    ldb_connect() and several other functions.


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-14
changelog:
  - fix CVE-2009-3555 - support the safe renegotiation extension and
    do not allow legacy renegotiation on the server by default (#533125)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-15
changelog:
  - fix CVE-2010-0433 - do not pass NULL princ to krb5_kt_get_entry which
    in the RHEL-5 and newer versions will crash in such case (#569774)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-27
changelog:
  - fix for CVE-2013-0169 - SSL/TLS CBC timing attack (#907589)
  - fix for CVE-2013-0166 - DoS in OCSP signatures checking (#908052)
  - enable compression only if explicitly asked for or OPENSSL_DEFAULT_ZLIB
    environment variable is set (fixes CVE-2012-4929 #857051)
  - use secure_getenv() everywhere instead of getenv() (#839735)


author: Matej Habrnal <mhabrnal@redhat.com> - 0.13-13
changelog:
  - add support for Ruby
    - Related: #1334604
  - actualize list of normalization function in satyr
    - Related: #1332869
  - fix defects found by coverity
    - Related: #1336390


author: Ondrej Kozina <okozina@redhat.com> - 0.1.7-5
changelog:
  - patch: Fix failure in invoking btrfs internal comparison of subvolumes
  - patch: Remove references to missing programs from man pages
  - Resolves: #1060806, #1063844


author: Ondrej Kozina <okozina@redhat.com> - 0.1.7-6
changelog:
  - patch: Add norecovery option mounting XFS read-only snapshot
  - patch: Fix ACL modification failure with XFS filesystem
  - patch: Sync SELinux context of .snapshots subvolume (btrfs only)
  - Resolves: #1064111, #1065969, #1069312


author: Ondrej Kozina <okozina@redhat.com> - 0.1.7-7
changelog:
  - patch: fix empty-pre-post cleanup algorithm
  - patch: add conditionals for btrfs library versions
  - Resolves: #1071973 #1142954


author: Ondrej Kozina <okozina@redhat.com> - 0.1.7-9
changelog:
  - patch: fix snapperd abort while passing large data over dbus
  - patch: workaround linkage issue on s390 and ppc64le
  - Resolves: #1229353


author: Ondrej Kozina <okozina@redhat.com> - 0.2.8-1
changelog:
  - Update to snapper 0.2.8
  - patch: rule out race while mounting lvm snapshot
  - Resolves: #1250371 #1262370


author: Rex Dieter <rdieter@fedoraproject.org> 1.1.1-2
changelog:
  - workaround anaconda main menu not visible in F18 Beta TC2 KDE Live (#864058)
  - -DENABLE_INNER_SHADOWS_HACK=0


author: Remi Collet <rcollet@redhat.com> - 5.4.16-35
changelog:
  - core: fix multipart/form-data request can use excessive
    amount of CPU usage CVE-2015-4024
  - fix various functions accept paths with NUL character
    CVE-2015-4025, CVE-2015-4026, #1213407
  - fileinfo: fix denial of service when processing a crafted
    file #1213442
  - ftp: fix integer overflow leading to heap overflow when
    reading FTP file listing CVE-2015-4022
  - phar: fix buffer over-read in metadata parsing CVE-2015-2783
  - phar: invalid pointer free() in phar_tar_process_metadata()
    CVE-2015-3307
  - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
  - phar: fix memory corruption in phar_parse_tarfile caused by
    empty entry file name CVE-2015-4021
  - soap: fix type confusion through unserialize #1222538
  - apache2handler: fix pipelined request executed in deinitialized
    interpreter under httpd 2.4 CVE-2015-3330


author: Remi Collet <rcollet@redhat.com> - 5.4.16-38
changelog:
  - curl: add options to enable TLS #1291667
  - mysqli: fix segfault in mysqli_stmt::bind_result() when
    link is closed #1096800
  - fpm: fix incorrectly defined SCRIPT_NAME variable when
    using Apache #1138563
  - core: fix segfault when a zend_extension is loaded twice #1289457
  - openssl: change default_md algo from MD5 to SHA1 #1073388
  - wddx: fix segfault in php_wddx_serialize_var #1131979


author: Remi Collet <rcollet@redhat.com> - 5.4.16-41
changelog:
  - gd: fix integer overflow in _gd2GetHeader() resulting in
    heap overflow CVE-2016-5766
  - gd: fix integer overflow in gdImagePaletteToTrueColor()
    resulting in heap overflow CVE-2016-5767
  - mbstring: fix double free in _php_mb_regex_ereg_replace_exec
    CVE-2016-5768


author: Remi Collet <rcollet@redhat.com> - 5.4.16-43
changelog:
  - gd: fix DoS vulnerability in gdImageCreateFromGd2Ctx() CVE-2016-10167
  - gd: Signed Integer Overflow gd_io.c CVE-2016-10168


author: Nick Clifton <nickc@redhat.com> 2.27-32.base
changelog:
  - Fix seg-fault parsing DWARF-1 information.  (#1569580)
  - Fix seg-fault parsing DWARF-2 information.  (#1569891)
  - Fix seg-fault parsing COFF files.  (#1571917)


author: Nick Clifton <nickc@redhat.com> 2.27-33.base
changelog:
  - Fix seg-fault parsing ELF files.  (#1578979)
  - Fix seg-fault parsing DWARF-2 information.  (#1579065)
  - Fix seg-fault parsing DWARF-2 information.  (#1579051)
  - Fix seg-fault parsing a PE format file.  (#1579019)


author: Nick Clifton <nickc@redhat.com> 2.27-34.base
changelog:
  - Fix seg-fault parsing corrupt AOUT format files.  (#1579799)
  - Fix seg-fault parsing corrupt DWARF2 debug information.  (#1579802)
  - Fix seg-fault parsing corrupt ELF format files.  (#1579801)


author: Roland Mainz <rmainz@redhat.com> 0.4.1-0
changelog:
  - Rebase gssproxy to 0.4.1 per bug #1132389 ("[RFE] Rebase
    gssproxy to the latest to match expectations of other
    projects").


author: Roland Mainz <rmainz@redhat.com> 0.4.1-1
changelog:
  - Add patch to remove -fno-strict-aliasing (gssproxy ticket #140,
    a dependicy for the fix for bug #1092515 (see below))
  - Add patch to fix bug #1092515 ("gssproxy - PIE and RELRO check")


author: Roland Mainz <rmainz@redhat.com> 0.4.1-2
changelog:
  - The following bugs have been fixed by the rebase to 0.4.1
    in bug ("[RFE] Rebase gssproxy to the latest to match
    expectations of other projects"):
    - Bug #1196371 ("rpc.gssd segfaults in gssproxy (proxymech.so)")
      Upstream tickets { #137, #144 }
    - Bug #1053730 ("KrbLocalUserMapping does not work with
      Apache & GSS-Proxy")
      Upstream ticket #101
    - Bug #1168962 ("gssproxy is not working with httpd on ppc64 and s390x")
      Upstream ticket #146


author: Roland Mainz <rmainz@redhat.com> 0.4.1-3
changelog:
  - Bug #1213852 ("[gssproxy] NFS clients cannot mount with
    sec=krb5 if the NFS server is running gssproxy") was
    fixed by the rebase to 0.4.1 in bug ("[RFE] Rebase
    gssproxy to the latest to match expectations of other
    projects").
    Note that the same bug was also fixed in the kernel with
    "9507271 svcrpc: fix potential GSSX_ACCEPT_SEC_CONTEXT
    decoding failures" (see
    https://bugzilla.redhat.com/show_bug.cgi?id=1213852#c2
    and RH Bug #1120860 ("[NFS] NFS clients cannot mount with
    sec=krb5 if the NFS server is running gssproxy")) to
    handle various corner cases not covered by gssproxy,
    for example individual krb5 ticket fields exceeding
    the kernel's buffer size.


author: Roland Mainz <rmainz@redhat.com> 0.4.1-6
changelog:
  - Remove extra whitespaces from #1208640/#1194299 patches
  - spec file cleanup
  related: #1208640 #1194299


author: Jarod Wilson <jarod@redhat.com> - 2.0.1-1
changelog:
  - Update to libusnic_verbs v2.0.1 and usnic-tools v1.1.0.0
  - Use actual upstream tarballs
  - Call usnic-tools usnic-tools instead of libusnic_verbs-utils
  - Resolves: bz1281635


author: Jarod Wilson <jarod@redhat.com> - 2.0.1-3
changelog:
  - Add missing Requires: libusnic_verbs to usnic-tools sub-package
  - Bump to usnic-tools v1.1.1.0, drop patch that was merged upstream
  - BuildRequires: libibverbs v1.2.0 or later now, and infinipath-psm-devel
  - Related: bz1096997


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-3
changelog:
  - Avoid hang when shutting down unmanaged remote node connections
  - Get correct node name when crm_node or crm_attribute is run on remote node
  - Ignore action when configured as a stonith device parameter
  - Include recent upstream bug fixes
  - Resolves: rhbz#1388489
  - Resolves: rhbz#1410886
  - Resolves: rhbz#1417936
  - Resolves: rhbz#1421700


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-4
changelog:
  - Add support for container bundles
  - Treat systemd reloading state as monitor success
  - Resolves: rhbz#1432722
  - Resolves: rhbz#1436696


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-5
changelog:
  - Keep man pages compressed
  - Bugfixes for container bundles
  - Resolves: rhbz#1410886
  - Resolves: rhbz#1432722


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-7
changelog:
  - Avoid fencing old DC if it is shutting down while another node is joining
  - Improve crmd's handling of repeated fencing failures
  - Correct behavior when guest created by bundle has a node attribute
  - Show Red Hat bugzilla URL rather than upstream when generating cluster report
  - Resolves: rhbz#1430112
  - Resolves: rhbz#1432722


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-9
changelog:
  - Allow cleanup of guest nodes when guest is unmanaged
  - Allow bundles to run on Pacemaker Remote nodes
  - Handle slow IPC clients better
  - Update crmd throttle information when CPUs are hot-plugged in
  - Order pacemaker systemd unit after resource-agents-deps target
  - Resolves: rhbz#1303742
  - Resolves: rhbz#1432722
  - Resolves: rhbz#1435067
  - Resolves: rhbz#1444728
  - Resolves: rhbz#1446669


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-10
changelog:
  - Fix issues when running bundles on Pacemaker Remote nodes
  - Reap orphaned processes when running Pacemaker Remote as pid 1
  - Order remote actions after remote connection recovery
    (fixes regression in RHEL 7.3)
  - Avoid local resource manager daemon (lrmd) crash when an
    in-flight systemd operation is cancelled
  - Resolves: rhbz#1432722
  - Resolves: rhbz#1441603
  - Resolves: rhbz#1448772
  - Resolves: rhbz#1451170


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-4
changelog:
  - Resolves: rhbz#1367813

  - Man: Fix corosync-qdevice-net-certutil link (rhbz#1367813)
  - merge upstream commit 49a9f722bba13e4b2762151b7b96b1d4196fd5e0 (rhbz#1367813)
  - man: mention qdevice incompatibilites in votequorum.5 (rhbz#1367813)
  - merge upstream commit 0da1b7446239424b76b1d5eb7c3640afce9b054e (rhbz#1367813)
  - Qnetd LMS: Fix two partition use case (rhbz#1367813)
  - merge upstream commit b0c850f308d44ddcdf1a1f881c1e1142ad489385 (rhbz#1367813)


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.2.1.el7]
changelog:
  - [x86] aesni: initialize gcm(aes) cryptd child's key/authsize (Sabrina Dubroca) [1744442 1698551]
  - [netdrv] bnx2x: Disable multi-cos feature (Manish Chopra) [1741926 1704157]


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.3.1.el7]
changelog:
  - [net] Bluetooth: Fix faulty expression for minimum encryption key size check (Gopal Tiwari) [1743084 1743085] {CVE-2019-9506}
  - [net] Bluetooth: Fix regression with minimum encryption key size alignment (Gopal Tiwari) [1743084 1743085] {CVE-2019-9506}
  - [net] Bluetooth: Align minimum encryption key size for LE and BR/EDR connections (Gopal Tiwari) [1743084 1743085] {CVE-2019-9506}
  - [net] macvlan: Support bonding events (Davide Caratti) [1751579 1733589]
  - [wireless] mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies() (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [wireless] mwifiex: Mark expected switch fall-through (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [wireless] mwifiex: Fix skipped vendor specific IEs (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [wireless] mwifiex: fix 802.11n/WPA detection (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [wireless] mwifiex: Don't abort on small, spec-compliant vendor IEs (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [wireless] mwifiex: Abort at too short BSS descriptor element (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [wireless] mwifiex: Fix possible buffer overflows at parsing bss descriptor (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [net] sunrpc: Fix possible autodisconnect during connect due to old last_used (Dave Wysochanski) [1749290 1723537]
  - [drm] drm/ast: Fixed reboot test may cause system hanged (Dave Airlie) [1749296 1739971]
  - [block] block: blk_init_allocated_queue() set q->fq as NULL in the fail case (Ming Lei) [1739326 1739327] {CVE-2018-20856}
  - [pci] PCI: hv: Fix a use-after-free bug in hv_eject_device_work() (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: Add pci_destroy_slot() in pci_devices_present_work(), if necessary (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: Add hv_pci_remove_slots() when we unload the driver (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: Fix a memory leak in hv_eject_device_work() (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: support reporting serial number as slot information (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: Remove unused reason for refcount handler (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: Convert hv_pci_dev.refs from atomic_t to refcount_t (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: Remove the bogus test in hv_eject_device_work() (Mohammed Gamal) [1748239 1732924]
  - [fs] NFSv4: Replace closed stateids with the "invalid special stateid" (Steve Dickson) [1744946 1733347]
  - [nvme] nvme-rdma: use dynamic dma mapping per command (David Milburn) [1744444 1637693]
  - [nvme] nvme-rdma: remove redundant reference between ib_device and tagset (David Milburn) [1744444 1637693]
  - [nvme] nvme-rdma: always have a valid trsvcid (David Milburn) [1744443 1717536]
  - [nvme] nvme-rdma: use inet_pton_with_scope helper (David Milburn) [1744443 1717536]
  - [nvme] nvmet-rdma: use generic inet_pton_with_scope (David Milburn) [1744443 1717536]
  - [iommu] x86/hyper-v: add msi_setup_irq/msi_alloc_irq stubs to fix x2apic mode (Vitaly Kuznetsov) [1743324 1736750]
  - [mm] slub: make dead caches discard free slabs immediately (Aristeu Rozanski) [1741920 1649189]
  - [mm] mm: charge/uncharge kmemcg from generic page allocator paths (Aristeu Rozanski) [1741920 1649189]
  - [mm] memcg: do not account memory used for cache creation (Aristeu Rozanski) [1741920 1649189]
  - [mm] memcg: also test for skip accounting at the page allocation level (Aristeu Rozanski) [1741920 1649189]
  - [fs] kmemcg: account certain kmem allocations to memcg (Aristeu Rozanski) [1741920 1649189]
  - [mm] vmalloc: allow to account vmalloc to memcg (Aristeu Rozanski) [1741920 1649189]
  - [mm] slab: add SLAB_ACCOUNT flag (Aristeu Rozanski) [1741920 1649189]
  - [include] memcg: only account kmem allocations marked as __GFP_ACCOUNT (Aristeu Rozanski) [1741920 1649189]
  - [include] mm: get rid of __GFP_KMEMCG (Aristeu Rozanski) [1741920 1649189]
  - [mm] slb: charge slabs to kmemcg explicitly (Aristeu Rozanski) [1741920 1649189]
  - [mm] mm: rename allocflags_to_migratetype for clarity (Rafael Aquini) [1741920 1730471]
  - [x86] cpuidle-haltpoll: disable host side polling when kvm virtualized (Marcelo Tosatti) [1740192 1734501]
  - [kvm] kvm: x86: add host poll control msrs (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: add haltpoll governor (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] governors: unify last_state_idx (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: add poll_limit_ns to cpuidle_device structure (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] add cpuidle-haltpoll driver (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: poll_state: Fix default time limit (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: poll_state: Disregard disable idle states (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: poll_state: Revise loop termination condition (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: menu: Fix wakeup statistics updates for polling state (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: poll_state: Avoid invoking local_clock() too often (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: poll_state: Add time limit to poll_idle() (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: Move polling state initialization code to separate file (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: Remove time measurement in poll state (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: Set polling in poll_idle (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: dont call poll_idle_init() for every cpu (Marcelo Tosatti) [1740192 1734501]
  - [hv] hv: vmbus: Implement Direct Mode for stimer0 (Vitaly Kuznetsov) [1740188 1712344]
  - [kernel] sched: Reduce contention in update_cfs_rq_blocked_load() (Marcelo Tosatti) [1740180 1734515]
  - [ipc] ipc: drop non-RCU allocation (Vladis Dronov) [1740178 1733016]
  - [ipc] ipc/util.c: use kvfree() in ipc_rcu_free() (Vladis Dronov) [1740178 1733016]
  - [ipc] tree wide: use kvfree() than conditional kfree()/vfree() (Vladis Dronov) [1740178 1733016]
  - [ipc] standardize code comments (Waiman Long) [1740178 1373519]
  - [ipc] whitespace cleanup (Waiman Long) [1740178 1373519]
  - [fs] gfs2: gfs2_walk_metadata fix (Andreas Grunbacher) [1737373 1724362]
  - [fs] gfs2: Inode dirtying fix (Andreas Grunbacher) [1737373 1724362]
  - [fs] gfs2: Fix rounding error in gfs2_iomap_page_prepare (Andreas Grunbacher) [1737373 1724362]
  - [fs] iomap: fix page_done callback for short writes (Andreas Grunbacher) [1737373 1724362]
  - [fs] fs: fold __generic_write_end back into generic_write_end (Andreas Grunbacher) [1737373 1724362]
  - [fs] iomap: don't mark the inode dirty in iomap_write_end (Andreas Grunbacher) [1737373 1724362]
  - [fs] gfs2: Fix iomap write page reclaim deadlock (Andreas Grunbacher) [1737373 1724362]
  - [fs] iomap: Add a page_prepare callback (Andreas Grunbacher) [1737373 1724362]
  - [fs] iomap: Fix use-after-free error in page_done callback (Andreas Grunbacher) [1737373 1724362]
  - [fs] fs: Turn __generic_write_end into a void function (Andreas Grunbacher) [1737373 1724362]
  - [fs] iomap: Clean up __generic_write_end calling (Andreas Grunbacher) [1737373 1724362]


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.5.1.el7]
changelog:
  - [netdrv] ixgbe: Prevent u8 wrapping of ITR value to something less than 10us (Ken Cox) [1757350 1750856]


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.6.1.el7]
changelog:
  - [virt] KVM: coalesced_mmio: add bounds checking (Bandan Das) [1746797 1746798] {CVE-2019-14821}
  - [fs] xfs: Fix deadlock between AGI and AGF with RENAME_WHITEOUT (Brian Foster) [1764245 1759117]
  - [powerpc] powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration (Desnes Augusto Nunes do Rosario) [1763625 1720930]
  - [powerpc] powerpc/pseries/mobility: prevent cpu hotplug during DT update (Desnes Augusto Nunes do Rosario) [1763625 1720930]
  - [powerpc] powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild (Desnes Augusto Nunes do Rosario) [1763625 1720930]
  - [crypto] crypto: vmx - ghash: do nosimd fallback manually (Desnes Augusto Nunes do Rosario) [1763621 1739765]
  - [crypto] crypto: vmx - Remove overly verbose printk from AES init routines (Desnes Augusto Nunes do Rosario) [1763621 1739765]
  - [crypto] powerpc: Create disable_kernel_{fp, altivec, vsx, spe}() (Desnes Augusto Nunes do Rosario) [1763621 1739765]
  - [crypto] crypto: vmx - CTR: always increment IV as quadword (Desnes Augusto Nunes do Rosario) [1763621 1739765]
  - [crypto] crypto: vmx - fix copy-paste error in CTR mode (Desnes Augusto Nunes do Rosario) [1763621 1739765]
  - [crypto] vmac - separate tfm and request context (Vladis Dronov) [1763620 1733561]
  - [crypto] crypto: blkcipher - fix crash flushing dcache in error path (Vladis Dronov) [1761804 1741525]
  - [crypto] crypto: remove direct blkcipher_walk dependency on transform (Vladis Dronov) [1761804 1741525]
  - [crypto] crypto: user - prevent operating on larval algorithms (Vladis Dronov) [1761804 1741525]
  - [netdrv] net/mlx5e: Support LAG TX port affinity distribution (Alaa Hleihel) [1759449 1724344]
  - [netdrv] net/mlx5e: Expose new function for TIS destroy loop (Alaa Hleihel) [1759449 1724344]
  - [include] net/mlx5: Add lag_tx_port_affinity capability bit (Alaa Hleihel) [1759449 1724344]
  - [netdrv] net/mlx5e: Re-work TIS creation functions (Alaa Hleihel) [1759449 1724344]
  - [netdrv] net/mlx5e: Disallow tc redirect offload cases we don't support (Alaa Hleihel) [1759003 1721626]
  - [netdrv] net/mlx5e: Support ndo_get_phys_port_name for PF under switchdev mode (Alaa Hleihel) [1759003 1721626]
  - [netdrv] net/mlx5e: Expose same physical switch_id for all representors (Alaa Hleihel) [1759003 1721626]
  - [net] tcp: reset sk_send_head in tcp_write_queue_purge (Marcelo Leitner) [1748357 1748358] {CVE-2019-15239}
  - [x86] kvm: x86: vmx: fix vpid leak (Vitaly Kuznetsov) [1755781 1716188]
  - [kvm] kvm/x86: Move MSR_IA32_ARCH_CAPABILITIES to array emulated_msrs (Paul Lai) [1757757 1708465]
  - [kvm] kvm: x86: Emulate MSR_IA32_ARCH_CAPABILITIES on AMD hosts (Paul Lai) [1757757 1708465]
  - [kvm] kvm: vmx: Tell the nested hypervisor to skip L1D flush on vmentry (Paul Lai) [1757757 1708465]
  - [kvm] kvm: vmx: support MSR_IA32_ARCH_CAPABILITIES as a feature MSR (Paul Lai) [1757757 1708465]
  - [kvm] kvm: x86: Introduce kvm_get_msr_feature() (Paul Lai) [1757757 1708465]
  - [kvm] kvm: x86: Add a framework for supporting MSR-based features (Paul Lai) [1757757 1708465]
  - [nvme] nvme: don't ask blk-mq to handle timed-out request (Ming Lei) [1758051 1750202]
  - [block] blk-mq: mark request as REQ_TIMEOUT when .timeout() is called (Ming Lei) [1758051 1750202]
  - [block] blk-mq: introduce blk_mq_clear_rq_complete() (Ming Lei) [1758051 1750202]
  - [block] blk-mq: remove 'sync' argument from __blk_mq_complete_request() (Ming Lei) [1758051 1750202]
  - [nvme] blk-mq: remove blk_mq_complete_request_sync (Ming Lei) [1763624 1730922]
  - [nvme] nvme: wait until all completed request's complete fn is called (Ming Lei) [1763624 1730922]
  - [nvme] nvme: don't abort completed request in nvme_cancel_request (Ming Lei) [1763624 1730922]
  - [block] blk-mq: introduce blk_mq_tagset_wait_completed_request() (Ming Lei) [1763624 1730922]
  - [block] blk-mq: introduce blk_mq_request_completed() (Ming Lei) [1763624 1730922]
  - [scsi] scsi: qla2xxx: Use correct size in call to dma_free_coherent() in qla2400_sp_unmap() (Himanshu Madhani) [1759447 1668767]
  - [scsi] scsi: qla2xxx: Fix different size DMA Alloc/Unmap (Himanshu Madhani) [1759447 1668767]
  - [scsi] scsi: qla2xxx: Fix DMA unmap leak (Himanshu Madhani) [1759447 1668767]
  - [scsi] scsi: qla2xxx: Prevent memory leak for CT req/rsp allocation (Himanshu Madhani) [1759447 1668767]
  - [scsi] scsi: fnic: fix msix interrupt allocation (Govindarajulu Varadarajan) [1754836 1745053]
  - [scsi] scsi: fnic: print port speed only at driver init or speed change (Govindarajulu Varadarajan) [1754836 1745053]
  - [nvme] nvme-scsi: updating struct nvme_ctrl (Gopal Tiwari) [1752423 1749524]


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.7.1.el7]
changelog:
  - [drm] drm/i915/cmdparser: Fix jump whitelist clearing (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1756815 1756816] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1756815 1756816] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Use explicit goto for error paths (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [x86] tsx: Add config options to set tsx=on|off|auto (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] tsx: Add "auto" option to the tsx= cmdline parameter (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] speculation/taa: Add sysfs reporting for TSX Async Abort (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] speculation/taa: Add mitigation for TSX Async Abort (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] cpu: Add a "tsx=" cmdline option with TSX disabled by default (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] cpu: Add a helper function x86_read_arch_cap_msr() (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] msr: Add the IA32_TSX_CTRL MSR (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [documentation] documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: mmu: Recovery of shattered NX large pages (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [virt] kvm: Add helper function for creating VM worker threads (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: mmu: ITLB_MULTIHIT mitigation (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [kernel] cpu/speculation: Uninline and export CPU mitigations helpers (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] cpu: Add Tremont to the cpu vulnerability whitelist (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: vmx, svm: always run with EFER.NXE=1 when shadow paging is active (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: add tracepoints around __direct_map and FNAME(fetch) (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: remove now unneeded hugepage gfn adjustment (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: make FNAME(fetch) and __direct_map more similar (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: mmu: Do not release the page inside mmu_set_spte() (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: mmu: Remove unused parameter of __direct_map() (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [virt] kvm: Convert kvm_lock to a mutex (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: mmu: drop vcpu param in gpte_access (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [virt] kvm: x86, powerpc: do not allow clearing largepages debugfs entry (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [kernel] sched/fair: Fix endless loop in idle_balance() (Phil Auld) [1766087 1740941]
  - [kernel] sched: Skip double execution of pick_next_task_fair() (Phil Auld) [1766098 1750819]
  - [kernel] sched/fair: Prevent throttling in early pick_next_task_fair() (Phil Auld) [1756267 1740038]
  - [kernel] sched: Check for stop task appearance when balancing happens (Phil Auld) [1756267 1740038]
  - [kernel] sched/core: Fix endless loop in pick_next_task() (Phil Auld) [1756267 1740038]
  - [kernel] sched/fair: Push down check for high priority class task into idle_balance() (Phil Auld) [1756267 1740038]
  - [kernel] sched/rt: Fix picking RT and DL tasks from empty queue (Phil Auld) [1756267 1740038]
  - [kernel] sched/core: Allow __sched_setscheduler() in interrupts when PI is not used (Phil Auld) [1756265 1722234]
  - [kernel] sched, dl: Convert switched_{from, to}_dl() / prio_changed_dl() to balance callbacks (Phil Auld) [1756265 1722234]
  - [kernel] sched,dl: Remove return value from pull_dl_task() (Phil Auld) [1756265 1722234]
  - [kernel] sched, rt: Convert switched_{from, to}_rt() / prio_changed_rt() to balance callbacks (Phil Auld) [1756265 1722234]
  - [kernel] sched,rt: Remove return value from pull_rt_task() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Allow balance callbacks for check_class_changed() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Use replace normalize_task() with __sched_setscheduler() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Handle priority boosted tasks proper in setscheduler() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Fix broken setscheduler() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Consider pi boosting in setscheduler() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Replace post_schedule with a balance callback list (Phil Auld) [1756265 1722234]
  - [kernel] sched: Guarantee task priority in pick_next_task() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Remove some #ifdeffery (Phil Auld) [1756265 1722234]
  - [kernel] sched: Clean up idle task SMP logic (Phil Auld) [1756265 1722234]
  - [kernel] sched: Fix hotplug task migration (Phil Auld) [1756265 1722234]
  - [kernel] sched/fair: Remove idle_balance() declaration in sched.h (Phil Auld) [1756265 1722234]
  - [kernel] sched: Push down pre_schedule() and idle_balance() (Phil Auld) [1756265 1722234]
  - [kernel] sched/fair: Optimize cgroup pick_next_task_fair() (Phil Auld) [1756265 1722234]
  - [kernel] sched/fair: Clean up the __clear_buddies_*() functions (Phil Auld) [1756265 1722234]
  - [kernel] sched: Push put_prev_task() into pick_next_task() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Move rq->idle_stamp up to the core (Phil Auld) [1756265 1722234]
  - [kernel] sched: Fix race in idle_balance() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Remove 'cpu' parameter from idle_balance() (Phil Auld) [1756265 1722234]
  - [kernel] sched/fair: Reset se-depth when task switched to FAIR (Phil Auld) [1756265 1722234]
  - [kernel] sched/fair: Track cgroup depth (Phil Auld) [1756265 1722234]


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.8.1.el7]
changelog:
  - [kernel] sched/fair: Fix low cpu usage with high throttling by removing expiration of cpu-local slices (Phil Auld) [1770738 1752136]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.9.1.el7]
changelog:
  - [kernel] sched: Fix race between task_group and sched_task_group (Oleksandr Natalenko) [1778545 1738415]


author: Akemi Yagi <toracat@centos.org> [3.10.0-1062.9.1.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
     addmissing.patch  [puias]
     cpufreq.patch  [puias]
     i386-audit-stop-scri-stack-frame.patch  [puias]
     removejiffies.patch  [puias]
     undorhirqstat.patch  [puias]
     morefixes.patch      [puias+bug#12412]
     upstream-32bit-fixes-7_5.patch [puias+bug#12412]
     clear-32bit-Werror-warnings.patch  [bug#12412]
     qspinlock_types-32bit.patch   [ay]
     i686-7-4.patch [T.Kabe, bug#13890]
     firmware-efi-32bit.patch [ay]
     patch-spec_ctrl_i686.patch [T.Kabe bug#14353]
     686 mods for 7.5 [T.Kabe bug#14703]
     more 686 mods for 7.5 (-862.3.2) [pgreco]
     more 686 mods for 7.5 (-862.11.6) [pgreco, bug#15174]
     Patches updated for 7.6 [kabe, bug#15428]
     Patches for 7.7 [pgreco, bug#16324]
     Patch bmap [pgreco bug#16610]
     Apply a security fix [bug#16764]
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Enabled spidev [bug#9955]
  - Add a patch [bug#10447]
  - Enable ATM drivers [bug#10845]
  - Add 9pfs config options [bug#10849]
  - Enable VFIO_PCI_VGA [bug#12435]
  - Rremove initramfs-xxxkdump.img upon kernel removal [bug#12703]
  - Add a patch from [bug#12841]
  - Add a patch from [bug#12818]
  - Enabled RT2800USB_RT3573 [bug#13162]
  - Enable LDM_PARTITION [bug#13526]
  - Add a patch to fix misleading warning [bug#13990]
  - Add BuildRequires: openssl-devel to the with_perf section [bug#13990]
  - Add a patch to fix build errors for EL7.5 [bug#14425]
  - Added a patch to fix alsa potentail crash [bug14779]
  - Apply a patch to fix excessive warnings [bug#14413]
  - Add a patch to fix race in virtio_balloon [bug#15216]
  - Add shim requirement to the spec file for x86_64
  - Apply patches that fix ecryptfs issue [see bugs #7369, #15353] provided by @pgreco
  - Add an i686 patch to fix Hyper-V issue [bug#15374]
  - Enable NIU and add a patch that fixes build errors submitted by h-masuda [bug#15040]
  - Apply a patch for acpi issue [bug#16315]
  - Apply a patch to fix ICMP redirects [bug#16521]


author: Petr Viktorin <pviktori@redhat.com> - 2.7.5-63
changelog:
  - Make it more likely for the system allocator to release free()d memory arenas
  Resolves: rhbz#1468410


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-65
changelog:
  - Fix hanging of all threads when trying to access an inaccessible NFS server.
  Resolves: rhbz#1520068


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-68
changelog:
  - Add Conflicts tag with old virtualenv versions due to new behaviour of
    httplib (patch 295)
  Resolves: rhbz#1483438


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-29
changelog:
  - 1166713 1187792 add missing ExecStart, only newer systemd lets that be optional for oneshot services


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-32
changelog:
  - 1235684 apply safe_logout setting to flashnode sessions as well
    but only when logging out by session id, not by flashnode index


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-34
changelog:
  - 1322000 ensure TCP abort on session failure to prevent data corruption with link flap
  - 1294964, 1265073, 1213569 iscsiuio update, fix small ARP table issue
  - 1309488 remove broken sysfs cache code to speed up login of many sessions
  - 1330348 sync with upstream Open-iSCSI for minor fixes


author: Adam Williamson <awilliam@redhat.com> - 3.0-3
changelog:
  - Re-enable ceph deps on ppc64 (it's building again)
  - Disable RDMA support on 32-bit ARM (#1484155)


author: Milan Crha <mcrha@redhat.com> - 3.22.7-4
changelog:
  - Add patch for RH bug #1441608 (Use-after-free when setting summary for component with alarms)
  - Add patch for RH bug #1439590 ([IMAPx] Unsubscribed folders shown after refresh)


author: Milan Crha <mcrha@redhat.com> - 3.22.7-7
changelog:
  - Add patch for RH bug #1504071 (Prefer SSL over STARTTLS for mail when both are set in GOA)
  - Add patch for RH bug #1476329 (Deadlock on exit under e-categories.c:finalize_categories())


author: Javier Martinez Canillas <javierm@redhat.com> - 8.28-26
changelog:
  - Exclude building on i686
    Related: rhbz#1476273
  - Fix grubby removing wrong kernel command line parameter
    Resolves: rhbz#1476273
  - Improve man page for --info option (jstodola)
    Resolves: rhbz#1651673
  - Print default image even if isn't a suitable one
    Resolves: rhbz#1323842


author: Nikola Forró <nforro@redhat.com> - 12.5-13
changelog:
  - fix SIGSEGV crash in smtp_auth_var()
  - add warning message for empty from variable
    resolves: #1113611


author: Petr Pisar <ppisar@redhat.com> - 2.30-17
changelog:
  - Modernize spec file
  - Specify all dependencies
  - Change license to "(Copyright only) and (Artistic or GPL+)" because of
    ppport.h


author: Than Ngo <than@redhat.com> - 4.10.5-2
changelog:
  - bz#970713, CVE-2013-2126, double-free flaw when handling
    damaged full-color in Foveon and sRAW files


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.7-1
changelog:
  - update to 9.2.7 per release notes (#1065845)
    http://www.postgresql.org/docs/9.2/static/release-9-2-7.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.10-1
changelog:
  - update to 9.2.10 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-10.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-9.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-8.html
    (rhbz#1198672 rhbz#1198673)


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.11-1
changelog:
  - update to 9.2.11 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-11.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.12-1
changelog:
  - update to 9.2.12 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-12.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.13-1
changelog:
  - update to 9.2.13 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-13.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.14-1
changelog:
  - update to 9.2.14 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-14.html


author: Pavel Kajaba <pkajaba@redhat.com> - 9.2.15-1
changelog:
  - update to 9.2.15 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-15.html


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.80-2.6.0.0
changelog:
  - Add GConf2-devel dependency for native proxy fallback support.
  - Remove libxslt dependency pulled in from IcedTea builds.
  - Reduce redhat-lsb dependency to redhat-lsb-core (lsb_release)
  - Resolves: rhbz#1235158


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.80-2.6.0.1
changelog:
  - Pass SYSTEM_GSETTINGS="true" to the OpenJDK build to explicitly enable the GSettings API.
  - Resolves: rhbz#1235158


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.91-2.6.2.0
changelog:
  - Bump to 2.6.2 and u91b00.
  - Disable system LCMS 2 for now until security of it can be verified.
  - Sync minor changes from RHEL 6 spec file.
  - Resolves: rhbz#1271921


author: Kevin Howell <khowell@redhat.com> 1.20.3-1
changelog:
  - Cockpit: Implement modal dialog (khowell@redhat.com)
  - Implement bootstrap-select component (khowell@redhat.com)
  - Port cockpit subscriptions-client to dbus (khowell@redhat.com)
  - Move python-rhsm build into subscription-manager (khowell@redhat.com)
  - 1354667: Add identity cert detection to proxy error message generation
    (wpoteat@redhat.com)
  - 1501889: Enable yum plugins after sub-man subcommand is executed
    (jhnidek@redhat.com)
  - 1477958: Use inotify for checking changes of consumer certs
    (jhnidek@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.20.5-1
changelog:
  - Sync zanata translations (khowell@redhat.com)
  - Cockpit - listing of installed products using patternfly-react
    (jhnidek@redhat.com)
  - 1508457: Bump versions in python-rhsm obsoletes (khowell@redhat.com)
  - Implement fallback for settimeout on old m2crypto (khowell@redhat.com)
  - Cockpit: reconcile translated strings (khowell@redhat.com)
  - Cockpit: use translations from root dir (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.20.6-1
changelog:
  - Sync zanata translations (khowell@redhat.com)
  - 1514067: Call virt-what using absolute path (jhnidek@redhat.com)
  - 1487688: Load config settings for cockpit plugin (khowell@redhat.com)
  - Added dependencies to cockpit-bridge and cockpit-shell. (jhnidek@redhat.com)
  - 1462456: Flush stdout and stderr on more places (jhnidek@redhat.com)
  - 1491842: fixed typo in man page. (jhnidek@redhat.com)
  - 1508591: Removed python-rhsm from subscription-manager version
    (jhnidek@redhat.com)
  - 1421010: Subman-GUI shows error dialog (wrong proxy settings)
    (jhnidek@redhat.com)
  - 1500106: subscription-manager status --ondate do not ignore date
    (jhnidek@redhat.com)
  - 1506970: Fixed default custom URL in cockpit plugin (jhnidek@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.20.8-1
changelog:
  - Sync zanata translations (khowell@redhat.com)
  - Add parameter to D-Bus API to pass locale for localization of errors
    (jhnidek@redhat.com)
  - 1463765: Fix wrong Indic-language translations (khowell@redhat.com)
  - 1487600: Cockpit - Save configuration from register dialog
    (jhnidek@redhat.com)
  - 1464571: Improve multiple product certs errors (khowell@redhat.com)
  - Replace cockpit-subscriptions (khowell@redhat.com)
  - 1507158: Provide Host: in http CONNECT header (jhnidek@redhat.com)
  - 1319927: Remove newline from auto enable message (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.20.9-1
changelog:
  - Sync zanata translations (khowell@redhat.com)
  - 1510727: Enable starting of subman GUI, when consumer has been deleted
    (jhnidek@redhat.com)
  - 1304056: Fix D-Bus path of com.redhat.RHSM1.Facts (jhnidek@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.20.10-1
changelog:
  - Update translations from zanata (khowell@redhat.com)
  - 1510024: Handle rhel-alt product tags properly (khowell@redhat.com)
  - 1526622: Do not delete product certificates in protected directory
    (jhnidek@redhat.com)
  - 1527813: subman-gui use new URL of Online Documentation (jhnidek@redhat.com)
  - 1519512: Handle non-UTF8 RPM vendors (khowell@redhat.com)
  - 1526385: Bug fix of autoregistration in subman--cockpit plugin
    (jhnidek@redhat.com)
  - 1527392: Clear credential data in register dialog (jhnidek@redhat.com)
  - 1526385: Fix registration success detection (khowell@redhat.com)
  - 1448313: Do not log error, when rhsmcertd is restarted (jhnidek@redhat.com)
  - 1516439: Cockpit reports error during unregister when candlepin unavailable
    (jhnidek@redhat.com)


author: Pavel Grunt <pgrunt@redhat.com> - 5.0-1
changelog:
  - Rebase to the latest upstream release
    Resolves: rhbz#1413982
  - Rebuild with spice-gtk 0.33
    Resolves: rbhz#1431995
  - Rebuild with correct hardening flags
    Resolves: rhbz#1420780
  - Fix display id inconsistencies in debug logs
    Resolves: rhbz#1368390
  - Provide a dialog for selecting ISOs
    Resolves: rhbz#1414016
  - Always display warning messages
    Resolves: rhbz#1386630
  - Do not print password in the logs
    Resolves: rhbz#1410030
  - Update qemu+ssh URL example
    Resolves: rhbz#1377283
  - Add cli options for precise VM selection in virt-viewer
    Resolves: rhbz#1399077


author: Pavel Grunt <pgrunt@redhat.com> - 5.0-2
changelog:
  - Really enable the hardened build
    Resolves: rhzb#1420780
  - Fixup for precise VM selection
    Resolves: rhbz#1399077


author: Pavel Grunt <pgrunt@redhat.com> - 5.0-3
changelog:
  - Handle initial zoom settings for vnc
    Resolves: rhbz#1436991
  - Allow to control zoom using numpad
    Resolves: rhbz#1337575
  - Support new elements in libvirt xml
    Resolves: rhbz#1411765


author: Pavel Grunt <pgrunt@redhat.com> - 5.0-4
changelog:
  - Fix seamless migration in virt-viewer
    Resolves: rhbz#1442929
  - Make file transfer progressbar smooth again
    Resolves: rhbz#1449572
  - Update translation from internal zanata
    Resolves: rhzb#1378279


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> - 5.0-8
changelog:
  - Show authentication dialog if in kiosk mode and connecting to ovirt
    Resolves: rhbz#1459808
  - Keep the remove-viewer-connect dialog window on top
    Resolves: rhbz#1459800
  - Show overwrite confirmation when saving screenshot file
    Resolves: rhbz#1455832
  - Fix REST endpoint used to load the storagedomains
    Resolves: rhb#1427467


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> - 5.0-9
changelog:
  - Drop downstream specific patch reverting string change
    Related: rhbz#1481243
  - Fix scope declaration of enable_autotools macro
    Resolves: rhbz#1504132
  - Fix wrong date in previous changelog entry
    Resolves: rhbz#1504132
  - Save oVirt uri after connecting to guest
    Resolves: rhbz#1459792
  - Adjust reference to spice-gtk man page
    Resolves: rhbz#1477966


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> - 5.0-10
changelog:
  - Adjust reference to spice-gtk man page for remote-viewer
    Resolves: rhbz#1477966
  - Update translations
    Resolves: rhbz#1481243


author: Dan Horák <dhorak@redhat.com> - 3.0.13-16
changelog:
  - Drop ppc64le from the multilib list
  - Use additional BR: only in ppc64le build
  - Resolves: RHBZ1116945


author: Remi Collet <rcollet@redhat.com> - 5.4.16-29
changelog:
  - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670


author: Remi Collet <rcollet@redhat.com> - 5.4.16-33
changelog:
  - core: use after free vulnerability in unserialize()
    CVE-2014-8142 and CVE-2015-0231
  - core: fix use-after-free in unserialize CVE-2015-2787
  - core: fix NUL byte injection in file name argument of
    move_uploaded_file() CVE-2015-2348
  - date: use after free vulnerability in unserialize CVE-2015-0273
  - enchant: fix heap buffer overflow in enchant_broker_request_dict
    CVE-2014-9705
  - exif: free called on unitialized pointer CVE-2015-0232
  - fileinfo: fix out of bounds read in mconvert CVE-2014-9652
  - gd: fix buffer read overflow in gd_gif_in.c CVE-2014-9709
  - phar: use after free in phar_object.c CVE-2015-2301
  - soap: fix type confusion through unserialize


author: Remi Collet <rcollet@redhat.com> - 5.4.16-34
changelog:
  - fix memory corruption in fileinfo module on big endian
    machines #1082624
  - fix segfault in pdo_odbc on x86_64 #1159892
  - fix segfault in gmp allocator #1154760


author: Jan Horak <jhorak@redhat.com> - 6.7.8.9-15
changelog:
  - Added fix for CVE-2016-5118, CVE-2016-5240, rhbz#1269562,
    rhbz#1326834, rhbz#1334188, rhbz#1269553


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.4.2.el7]
changelog:
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1756815 1756816] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1756815 1756816] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Use explicit goto for error paths (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [x86] tsx: Add config options to set tsx=on|off|auto (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] tsx: Add "auto" option to the tsx= cmdline parameter (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] speculation/taa: Add sysfs reporting for TSX Async Abort (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] speculation/taa: Add mitigation for TSX Async Abort (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] cpu: Add a "tsx=" cmdline option with TSX disabled by default (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] cpu: Add a helper function x86_read_arch_cap_msr() (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] msr: Add the IA32_TSX_CTRL MSR (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [documentation] documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: mmu: Recovery of shattered NX large pages (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [virt] kvm: Add helper function for creating VM worker threads (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: mmu: ITLB_MULTIHIT mitigation (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [kernel] cpu/speculation: Uninline and export CPU mitigations helpers (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] cpu: Add Tremont to the cpu vulnerability whitelist (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: vmx, svm: always run with EFER.NXE=1 when shadow paging is active (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: add tracepoints around __direct_map and FNAME(fetch) (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: remove now unneeded hugepage gfn adjustment (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: make FNAME(fetch) and __direct_map more similar (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: mmu: Do not release the page inside mmu_set_spte() (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: mmu: Remove unused parameter of __direct_map() (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [virt] kvm: Convert kvm_lock to a mutex (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: mmu: drop vcpu param in gpte_access (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [virt] kvm: x86, powerpc: do not allow clearing largepages debugfs entry (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.4.3.el7]
changelog:
  - [drm] drm/i915/cmdparser: Fix jump whitelist clearing (Dave Airlie) [1756882 1756883] {CVE-2019-0155}


author: Akemi Yagi <toracat@centos.org> [3.10.0-1062.4.3.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
     addmissing.patch  [puias]
     cpufreq.patch  [puias]
     i386-audit-stop-scri-stack-frame.patch  [puias]
     removejiffies.patch  [puias]
     undorhirqstat.patch  [puias]
     morefixes.patch      [puias+bug#12412]
     upstream-32bit-fixes-7_5.patch [puias+bug#12412]
     clear-32bit-Werror-warnings.patch  [bug#12412]
     qspinlock_types-32bit.patch   [ay]
     i686-7-4.patch [T.Kabe, bug#13890]
     firmware-efi-32bit.patch [ay]
     patch-spec_ctrl_i686.patch [T.Kabe bug#14353]
     686 mods for 7.5 [T.Kabe bug#14703]
     more 686 mods for 7.5 (-862.3.2) [pgreco]
     more 686 mods for 7.5 (-862.11.6) [pgreco, bug#15174]
     Patches updated for 7.6 [kabe, bug#15428]
     Patches for 7.7 [pgreco, bug#16324]
     Patch bmap [pgreco bug#16610]
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Enabled spidev [bug#9955]
  - Add a patch [bug#10447]
  - Enable ATM drivers [bug#10845]
  - Add 9pfs config options [bug#10849]
  - Enable VFIO_PCI_VGA [bug#12435]
  - Rremove initramfs-xxxkdump.img upon kernel removal [bug#12703]
  - Add a patch from [bug#12841]
  - Add a patch from [bug#12818]
  - Enabled RT2800USB_RT3573 [bug#13162]
  - Enable LDM_PARTITION [bug#13526]
  - Add a patch to fix misleading warning [bug#13990]
  - Add BuildRequires: openssl-devel to the with_perf section [bug#13990]
  - Add a patch to fix build errors for EL7.5 [bug#14425]
  - Added a patch to fix alsa potentail crash [bug14779]
  - Apply a patch to fix excessive warnings [bug#14413]
  - Add a patch to fix race in virtio_balloon [bug#15216]
  - Add shim requirement to the spec file for x86_64
  - Apply patches that fix ecryptfs issue [see bugs #7369, #15353] provided by @pgreco
  - Add an i686 patch to fix Hyper-V issue [bug#15374]
  - Enable NIU and add a patch that fixes build errors submitted by h-masuda [bug#15040]
  - Apply a patch for acpi issue [bug#16315]
  - Apply a patch to fix ICMP redirects [bug#16521]


author: Richard Hughes <richard@hughsie.com> 0.1.6-1
changelog:
  - New upstream version
  - Do not use deprecated GLib functionality
  - Unref the GMainloop after it has been run, not when just quit


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Switch AArch64 to using java-1.8.0-openjdk to bootstrap until RH1482244 is fixed in bootstrap
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Add 8075484/PR3473/RH1490713 which is listed as being in 8u151 but not supplied by Oracle.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Update SystemTap tapsets to version in IcedTea 3.6.0pre02 to fix RH1492139.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Correct fix to RH1191652 root patch so existing COMMON_CCXXFLAGS_JDK is not lost.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - 8188030 is not yet upstream, so it should be listed under upstreamable fixes.
  - 8181055, 8181419, 8145913, 8168318, 8170328 & 8181810 all now in 8u162.
  - Resolves: rhbz#1499207


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - repack policies adapted to new counts and paths
  - note that also c-j-c is needed to make this apply in next update
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - Reverting to java-1.7.0-openjdk on AArch64 as rhel-7.4-z-java-unsafe-candidate using wrong suffix.
  - Resolves: rhbz#1499207


author: Orion Poplawski <orion@cora.nwra.com> - 3.2.10-2
changelog:
  - Add patch to comment out stray module use in modules file when not using
    versioning (bug #895555)
  - Add patch to fix module clear command (bug #895551)
  - Add patch from modules list to add completion to avail command


author: Petr Menšík <pemensik@redhat.com> - 32:9.9.4-38.1
changelog:
  - Fix CVE-2016-9131 (ISC change 4508)
  - Fix CVE-2016-9147 (ISC change 4510)
  - Fix regression introduced by CVE-2016-8864 (ISC change 4530)
  - Fix CVE-2016-9444 (ISC change 4517)


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-31
changelog:
  - save all files changed by the reporter in the reporting GUI
  - Fixes CVE-2015-5302
  - Related: #1266853


author: Matej Habrnal <mhabrnal@redhat.com> - 2.1.11-32
changelog:
  - Save remote name in reported_to
  - Add a function for compressing dumpdirs
  - Introduce global configuration + option for excluded elements
  - attach the URL of the uploaded problem to the relevant report
  - Resolves: #1300780


author: Matej Habrnal <mhabrnal@redhat.com> - 2.1.11-35
changelog:
  * Thu Sep  1 2016 Matej Habrnal <mhabrnal@redhat.com> - 2.1.11-35.el7.centos
  - Translation updates
  - Related: #1304240


author: Prarit Bhargava <prarit@redhat.com> - 2:1.0-0.13.f30da3d
changelog:
  - Update to upstream commit f30da3d, minor fixes, no features [1085134]
  - Add /var/log/mcelog file [1098864]
  - remove .src.rpm file [1038755]


author: Prarit Bhargava <prarit@redhat.com> - 3:120-1.e7e0ac1
changelog:
  - Add Broadwell-U, Broadwell-DE, and Knights Landing/Xeon Phi Support
  - additional general fixes
  - add mcelog.conf and mcelog.triggers man pages
  - update NVR to 120 to match upstream


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.35-1.13.7.0
changelog:
  - Update to IcedTea 1.13.7
  - Regenerate add-final-location-rpaths patch so as to be less disruptive.
  - Add ExcludeArch directive for RH1209326
  - Resolves: rhbz#1209068


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.36-1.13.8.0
changelog:
  - Update to IcedTea 1.13.8
  - Update no_pr2125.patch to work against new version.
  - Resolves: rhbz#1235154


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.2
changelog:
  - Update with newer tarball, including 6763122 fix for TCK regression.
  - Use release + 1 to avoid having a lower version than the 6.7 version.
  - Resolves: rhbz#1271931


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.3
changelog:
  - Update with new IcedTea & b37 tarballs, including Kerberos fixes for TCK regression.
  - Resolves: rhbz#1271931


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.4
changelog:
  - Update with new IcedTea & b37 tarballs, including more Kerberos fixes for TCK regression.
  - Resolves: rhbz#1271931


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.5
changelog:
  - Update with new IcedTea & b37 tarballs, including fix for appletviewer regression.
  - Resolves: rhbz#1271931


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-7
changelog:
  - qemu: avoid rare race when undefining domain (rhbz#1150505)
  - qemu: stop NBD server after successful migration (rhbz#1160212)
  - Require at least one console for LXC domain (rhbz#1155410)
  - remote: Fix memory leak in remoteConnectGetAllDomainStats (rhbz#1158715)
  - CVE-2014-7823: dumpxml: security hole with migratable flag (CVE-2014-7823)
  - Free job statistics from the migration cookie (rhbz#1161124)
  - Fix virDomainChrEquals for spicevmc (rhbz#1162097)
  - network: fix call virNetworkEventLifecycleNew when networkStartNetwork fail (rhbz#1162915)
  - Do not crash on gluster snapshots with no host name (rhbz#1162974)
  - nwfilter: fix deadlock caused updating network device and nwfilter (rhbz#1143780)
  - util: eliminate "use after free" in callers of virNetDevLinkDump (rhbz#1163463)
  - storage: Check for valid fc_host parent at startup (rhbz#1160565)
  - storage: Ensure fc_host parent matches wwnn/wwpn (rhbz#1160565)
  - storage: Don't use a stack copy of the adapter (rhbz#1160926)
  - storage: Introduce virStoragePoolSaveConfig (rhbz#1160926)
  - storage: Introduce 'managed' for the fchost parent (rhbz#1160926)
  - qemu: Always set migration capabilities (rhbz#1163953)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-8
changelog:
  - qemu: Fix crash in tunnelled migration (rhbz#1147331)
  - qemu: Really fix crash in tunnelled migration (rhbz#1147331)
  - qemu: Update fsfreeze status on domain state transitions (rhbz#1160084)
  - qemuPrepareNVRAM: Save domain conf only if domain's persistent (rhbz#1026772)
  - docs: Document NVRAM behavior on transient domains (rhbz#1026772)
  - Fix build in qemu_capabilities (rhbz#1165782)
  - qemu: Support OVMF on armv7l aarch64 guests (rhbz#1165782)
  - qemu: Drop OVMF whitelist (rhbz#1165782)
  - storage: Fix issue finding LU's when block doesn't exist (rhbz#1152382)
  - storage: Add thread to refresh for createVport (rhbz#1152382)
  - storage: qemu: Fix security labelling of new image chain elements (rhbz#1151718)
  - virsh: sync domdisplay help and manual (rhbz#997802)
  - docs: domain: Move docs for storage hosts under the <source> element (rhbz#1164528)
  - test: virstoragetest: Add testing of network disk details (rhbz#1164528)
  - util: storage: Copy hosts of a storage file only if they exist (rhbz#1164528)
  - qemu: Refactor qemuBuildNetworkDriveURI to take a virStorageSourcePtr (rhbz#1164528)
  - tests: Reflow the expected output from RBD disk test (rhbz#1164528)
  - util: split out qemuParseRBDString into a common helper (rhbz#1164528)
  - util: storagefile: Split out parsing of NBD string into a separate func (rhbz#1164528)
  - storage: Allow parsing of RBD backing strings when building backing chain (rhbz#1164528)
  - storage: rbd: qemu: Add support for specifying internal RBD snapshots (rhbz#1164528)
  - storage: rbd: Implement support for passing config file option (rhbz#1164528)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-9
changelog:
  - doc: fix mismatched ACL attribute name (rhbz#1161358)
  - qemu: monitor: Rename and improve qemuMonitorGetPtyPaths (rhbz#1146944)
  - conf: Add channel state for virtio channels to the XML (rhbz#1146944)
  - qemu: Add handling for VSERPORT_CHANGE event (rhbz#1146944)
  - qemu: chardev: Extract more information about character devices (rhbz#1146944)
  - qemu: process: Refresh virtio channel guest state when connecting to mon (rhbz#1146944)
  - event: Add guest agent lifecycle event (rhbz#1146944)
  - examples: Add support for the guest agent lifecycle event (rhbz#1146944)
  - qemu: Emit the guest agent lifecycle event (rhbz#1146944)
  - internal: add macro to round value to the next closest power of 2 (rhbz#1076098)
  - video: cleanup usage of vram attribute and update documentation (rhbz#1076098)
  - QXL: fix setting ram and vram values for QEMU QXL device (rhbz#1076098)
  - caps: introduce new QEMU capability for vgamem_mb device property (rhbz#1076098)
  - qemu-command: use vram attribute for all video devices (rhbz#1076098)
  - qemu-command: introduce new vgamem attribute for QXL video device (rhbz#1076098)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-10
changelog:
  - qemu: add the missing jobinfo type in qemuDomainGetJobInfo (rhbz#1167883)
  - network: Fix upgrade from libvirt older than 1.2.4 (rhbz#1167145)
  - qemu: fix domain startup failing with 'strict' mode in numatune (rhbz#1168866)
  - qemu: Don't track quiesced state of FSs (rhbz#1160084)
  - qemu: fix block{commit,copy} abort handling (rhbz#1135169)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-11
changelog:
  - virsh: vol-upload disallow negative offset (rhbz#1087104)
  - storage: fix crash caused by no check return before set close (rhbz#1087104)
  - qemu: Fix virsh freeze when blockcopy storage file is removed (rhbz#1139567)
  - security: Manage SELinux labels on shared/readonly hostdev's (rhbz#1082521)
  - nwfilter: fix crash when adding non-existing nwfilter (rhbz#1169409)
  - conf: Fix libvirtd crash matching hostdev XML (rhbz#1174053)
  - qemu: Resolve Coverity REVERSE_INULL (rhbz#1172570)
  - CVE-2014-8131: Fix possible deadlock and segfault in qemuConnectGetAllDomainStats() (CVE-2014-8131)
  - qemu: bulk stats: Fix logic in monitor handling (rhbz#1172570)
  - qemu: avoid rare race when undefining domain (rhbz#1150505)
  - Do not format CPU features without a model (rhbz#1151885)
  - Ignore CPU features without a model for host-passthrough (rhbz#1151885)
  - Silently ignore MAC in NetworkLoadConfig (rhbz#1156367)
  - Generate a MAC when loading a config instead of package update (rhbz#1156367)
  - qemu: move setting emulatorpin ahead of monitor showing up (rhbz#1170484)
  - util: Introduce flags field for macvtap creation (rhbz#1081461)
  - network: Bring netdevs online later (rhbz#1081461)
  - qemu: always call qemuInterfaceStartDevices() when starting CPUs (rhbz#1081461)
  - qemu: add a qemuInterfaceStopDevices(), called when guest CPUs stop (rhbz#1081461)
  - conf: replace call to virNetworkFree() with virObjectUnref() (rhbz#1099210)
  - util: new functions for setting bridge and bridge port attributes (rhbz#1099210)
  - util: functions to manage bridge fdb (forwarding database) (rhbz#1099210)
  - conf: new network bridge device attribute macTableManager (rhbz#1099210)
  - network: save bridge name in ActualNetDef when actualType==network too (rhbz#1099210)
  - network: store network macTableManager setting in NetDef actual object (rhbz#1099210)
  - network: setup bridge devices for macTableManager='libvirt' (rhbz#1099210)
  - qemu: setup tap devices for macTableManager='libvirt' (rhbz#1099210)
  - qemu: add/remove bridge fdb entries as guest CPUs are started/stopped (rhbz#1099210)
  - virsh: document block.n.allocation stat (rhbz#1041569)
  - getstats: avoid memory leak on OOM (rhbz#1041569)
  - getstats: improve documentation (rhbz#1041569)
  - getstats: start giving offline block stats (rhbz#1041569)
  - getstats: add block.n.path stat (rhbz#1041569)
  - qemuMonitorJSONBlockStatsUpdateCapacity: Don't skip disks (rhbz#1041569)
  - getstats: prepare monitor collection for recursion (rhbz#1041569)
  - getstats: perform recursion in monitor collection (rhbz#1041569)
  - getstats: prepare for dynamic block.count stat (rhbz#1041569)
  - getstats: add new flag for block backing chain (rhbz#1041569)
  - getstats: split block stats reporting for easier recursion (rhbz#1041569)
  - getstats: crawl backing chain for qemu (rhbz#1041569)
  - logical: Add "--type snapshot" to lvcreate command (rhbz#1166592)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-12
changelog:
  - Fix hotplugging of block device-backed usb disks (rhbz#1175668)
  - qemu: Create memory-backend-{ram, file} iff needed (rhbz#1175397)
  - conf: Don't format actual network definition in migratable XML (rhbz#1177194)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-13
changelog:
  - conf: Fix memory leak when parsing invalid network XML (rhbz#1180136)
  - qxl: change the default value for vgamem_mb to 16 MiB (rhbz#1181052)
  - qemuxml2argvtest: Fix test after change of qxl vgamem_mb default (rhbz#1181052)
  - conf: fix crash when hotplug a channel chr device with no target (rhbz#1181408)
  - qemu: forbid second blockcommit during active commit (rhbz#1135339)
  - qemu_monitor: introduce new function to get QOM path (rhbz#1180574)
  - qemu_process: detect updated video ram size values from QEMU (rhbz#1180574)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-14
changelog:
  - virNetworkDefUpdateIPDHCPHost: Don't crash when updating network (rhbz#1182486)
  - Format CPU features even for host-model (rhbz#1182448)
  - util: Add function virCgroupHasEmptyTasks (rhbz#1161540)
  - util: Add virNumaGetHostNodeset (rhbz#1161540)
  - qemu: Remove unnecessary qemuSetupCgroupPostInit function (rhbz#1161540)
  - qemu: Save numad advice into qemuDomainObjPrivate (rhbz#1161540)
  - qemu: Leave cpuset.mems in parent cgroup alone (rhbz#1161540)
  - qemu: Fix hotplugging cpus with strict memory pinning (rhbz#1161540)
  - util: Fix possible NULL dereference (rhbz#1161540)
  - qemu_driver: fix setting vcpus for offline domain (rhbz#1161540)
  - qemu: migration: Unlock vm on failed ACL check in protocol v2 APIs (CVE-2014-8136)
  - CVE-2015-0236: qemu: Check ACLs when dumping security info from save image (CVE-2015-0236)
  - CVE-2015-0236: qemu: Check ACLs when dumping security info from snapshots (CVE-2015-0236)
  - Check for domain liveness in qemuDomainObjExitMonitor (rhbz#1161024)
  - Mark the domain as active in qemuhotplugtest (rhbz#1161024)
  - Fix vmdef usage while in monitor in qemuDomainHotplugVcpus (rhbz#1161024)
  - Fix vmdef usage while in monitor in BlockStat* APIs (rhbz#1161024)
  - Fix vmdef usage while in monitor in qemu process (rhbz#1161024)
  - Fix vmdef usage after domain crash in monitor on device detach (rhbz#1161024)
  - Fix vmdef usage after domain crash in monitor on device attach (rhbz#1161024)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-16
changelog:
  - qemu: don't setup cpuset.mems if memory mode in numatune is not 'strict' (rhbz#1186094)
  - lxc: don't setup cpuset.mems if memory mode in numatune is not 'strict' (rhbz#1186094)


author: Tomas Hozza <thozza@redhat.com> - 1.14-12
changelog:
  - Fix wget to include Host header on CONNECT as required by HTTP 1.1 (#1203384)
  - Run internal test suite during build (#1295846)
  - Fix -nv being documented as synonym for two options (#1147572)


author: Tomas Hozza <thozza@redhat.com> - 1.14-15
changelog:
  - Added TLSv1_1 and TLSv1_2 as secure-protocol values to help (#1439811)
  - Fixed synchronization in randomly failing unit test Test-proxied-https-auth (#1448440)


author: Rui Matos <rmatos@redhat.com> - 3.8.0-5
changelog:
  - Fix for "seahorse-nautilus broken by glib2 regression related to
    SIGCHLD warnings"
  - Resolves: #1093123


author: Frantisek Kluknavsky <fkluknav@redhat.com> - 1:5.1.0-1
changelog:
  - rebase to 5.1.0, de-ansi patch no longer applicable
  - upstream dropped libmp.so (bsdmp-like interface)
  - silenced bogus date in changelog


author: Brian C. Lane <bcl@redhat.com> - 19.31.72-1
changelog:
  - Check boot args for None (bcl)
    Related: rhbz#1073130
    Resolves: rhbz#1075918
  - network: don't pop HWADDR twice for vlan on s390 (rvykydal)
    Related: rhbz#1061646


author: Ivan Devat <idevat@redhat.com> - 0.9.152-3
changelog:
  - Added support for pacemaker alerts
  - Added support for qdevice/qnetd provided by corosync
  - Fixed sbd calls on python3
  - Fixed bad request when resource removal takes longer than pcs expects
  - Added support for set expected votes on a live cluster
  - Added a wrapper for holding SELinux context when pcsd is started by systemd
  - Resolves: rhbz#1315371 rhbz#1158805 rhbz#1164402 rhbz#1346852 rhbz#1327739 rhbz#1348579 rhbz#1349465


author: Ivan Devat <idevat@redhat.com> - 0.9.152-4
changelog:
  - Added colocation constraint support in web UI
  - Fixed displaying cluster config when cib is provided as a file
  - Removed side effect on /etc/hosts during build
  - Recipient id is used as identifier in alarms
  - Improved quorum device commands syntax
  - Fixed pcs client for running on a remote node
  - Resolves: rhbz#1281364 rhbz#1269242 rhbz#1353607 rhbz#1315371 rhbz#1158805 rhbz#1289418


author: Ivan Devat <idevat@redhat.com> - 0.9.152-5
changelog:
  - Fixed traceback when stopping pcsd shortly after start
  - Fixed removing a dead node from a cluster
  - Added support for clufter's 'dist' parameter
  - Fixed filtering by property name in "pcs property show"
  - Fixed an error in web UI when removing resources takes a long time
  - Fixed occasional missing optional arguments of resources in web UI
  - Improved help for alerts
  - Fixed recreating a remote node resource
  - Fixed exceptions when authenticating cluster nodes
  - Fixed permissions for bash completion file
  - Resolves: rhbz#1348579 rhbz#1225423 rhbz#1357945 rhbz#1302010 rhbz#1301993 rhbz#1346852 rhbz#1231858 rhbz#1315371 rhbz#1303136 rhbz#1329472 rhbz#1359154 rhbz#1349465


author: Ivan Devat <idevat@redhat.com> - 0.9.152-6
changelog:
  - Fixed documentation regarding clufter
  - Added possibility to change order of resources in a group in web UI
  - Added support for unmanaged resources in web UI
  - Added support for booth (cluster ticket manager)
  - Resolves: rhbz#1357945 rhbz#1281391 rhbz#1264360 rhbz#1308514


author: Ivan Devat <idevat@redhat.com> - 0.9.152-7
changelog:
  - Added possibility to hide inactive resources in "pcs resource show" command
  - Fixed exceptions handling when waiting for response from user in command line
  - Fixed nonexisting resource detection in pcsd
  - Fixed SBD_WATCHDOG_TIMEOUT option value validation
  - Removed possibility to change SBD_PACEMAKER
  - Fixed exception when disabling service on systemd systems
  - Added automatic auto_tie_breaker quorum option set whenever it is needed for SBD to work
  - Fixed setting sbd watchdog in config
  - Fixed error handling when upgrading cib schema
  - Improved consistency of syntax 'pcs alert recipient add' command
  - Resolves: rhbz#1298585 rhbz#1354498 rhbz#1346852 rhbz#1164402 rhbz#1315371 rhbz#1366307


author: Ivan Devat <idevat@redhat.com> - 0.9.152-8
changelog:
  - Fixed error message in node maintenance/unmaintenance commands
  - Fixed missing line at the end of booth config 
  - Fixed documentation regarding booth
  - Fixed remove multiple booth resources with "--force" flag
  - Fixed cleanup of ip resource if it fails to create booth resource
  - Added bash completion for booth
  - Fixed display full booth configuration
  - Added ability to display booth config from remote node
  - Added support for ticket options during adding booth ticket
  - Fixed adding node to cluster when booth is not installed
  - Added restart command for booth
  - Fixed check if auto_tie_breaker is required when enabling sbd
  - Improved way of displaying status of unmanaged primitive resources in web UI
  - Resolves: rhbz#1247088 rhbz#1308514 rhbz#1164402 rhbz#1264360


author: Ivan Devat <idevat@redhat.com> - 0.9.152-9
changelog:
  - Added warning when stopping/destroying qdevice instance which is being used 
  - Fiexed removing qdevice from a cluster which uses sbd
  - Fixed re-running "pcs cluster node add" if it failed due to qdevice
  - Fixed documentation regarding booth
  - Added warning when using unknown booth ticket option
  - Added constraint ticket remove command
  - Fixed return code and message when displaying node utilization for nonexistent node
  - Fixed setting utilization attributes in web UI
  - Fixed support for node utilization on remote node
  - Fixed updating of selected group when displaying new resource dialog
  - Fixed group list when managing cluster running older pcs in web UI 
  - Fixed displaying unmanaged status for resources for older pcs in web UI
  - Fixed clone/master/unclone group/ungroup buttons for older pcs in web UI
  - Fixed node standby/unstandby for older pcs in web UI
  - Resolves: rhbz#1158805 rhbz#1308514 rhbz#1305049 rhbz#1158500 rhbz#1231858


author: Ivan Devat <idevat@redhat.com> - 0.9.152-10
changelog:
  - Fixed error when stopping qdevice if is not running
  - Fixed removing qdevice from a cluster
  - Fixed documentation regarding booth
  - Fixed return code when no matching ticket constraint found during remove
  - Resolves: rhbz#1158805 rhbz#1305049


author: Ivan Devat <idevat@redhat.com> - 0.9.152-10.el7_3.1
changelog:
  - Fixed resolving resource agent name containing systemd service instance
  - Added posibility to push only diff of cib in 'cluster cib push'
  - Resolves: rhbz#1408476 rhbz#1404233


author: Matej Muzila <mmuzila@redhat.com> - 1:5.5.41-1
changelog:
  - Rebase to 5.5.41
    Also fix: CVE-2014-6568 CVE-2015-0374 CVE-2015-0381 CVE-2015-0382
    CVE-2015-0391 CVE-2015-0411 CVE-2015-0432
    Resolves: #1186109


author: Ondrej Kozina <okozina@redhat.com> - 0.1.2-1.20130211git676556f
changelog:
  - updated to latest upstream version
  - fixed wrong include: "auto_ptr.h" -> <memory>
  - moved diffutils dependency to client


author: Ondrej Kozina <okozina@redhat.com> - 0.1.3-1.20130418git7ca81a2
changelog:
  - updatet to latest upstream version
  - add support to compare extended attributes ('xadiff' command)
  - add support to revert modificiations in file's extended attributes
  - patch: avoid useless build dependency on libattr-devel


author: Ondrej Kozina <okozina@redhat.com> - 0.1.5-1
changelog:
  - updated to latest upstream
  - allow whitespace in ALLOW_USERS and ALLOW_GROUPS in snapper's config
  - enable new pam module
  - patch: pam module installed in proper libdir


author: Ondrej Kozina <okozina@redhat.com> - 0.1.7-3
changelog:
  - enable btrfs compare using send/receive in libbtrfs
  - patch: adapt sources to change in libtrfs API (btrfs_read_and_process_send_stream)
  - Resolves: #1055579


author: Carlos O'Donell <carlos@redhat.com> - 2.17-106.5
changelog:
  - Fix memory leak in ftell for wide-oriented streams (#1323781).
  - Avoid race condition in _int_free involving fastbins (#1313308).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-106.6
changelog:
  - Fix NULL pointer dereference in stub resolver with unconnectable name
    server addresses (#1323839).


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30.7
changelog:
  - load-fragment: fix parsing values in bytes and prevent returning -ERANGE incorrectly (#1396277)
  - core: fix assertion check (#1396312)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30.8
changelog:
  - tmp.mount.hm4: After swap.target (#3087) (#1298355)
  - make sure all swap units are ordered before the swap target (#1298355)


author: David Vossel <dvossel@redhat.com> - 3.9.5-32
changelog:
  - Fixes iSCSILogicalUnit syntax error
  - Fixes mysql stop operation when db storage is unavailable

    Resolves: rhbz#1118029
    Resolves: rhbz#1138871


author: David Vossel <dvossel@redhat.com> - 3.9.5-33
changelog:
  - Merges latest upstream patches for galera agent
  - Merges latest upstream patchs for exit reason string

    Resolves: rhbz#1116166
    Resolves: rhbz#1128933


author: David Vossel <dvossel@redhat.com> - 3.9.5-34
changelog:
  - Fixes mysql agents behavior when monitoring resource instance
    when environment validation fails.

    Resolves: rhbz#1138871


author: David Vossel <dvossel@redhat.com> - 3.9.5-35
changelog:
  - Introduces docker resource-agent for managing docker containers.
    The docker agent is being released as tech preview.

    Resolves: rhbz#1135026


author: David Vossel <dvossel@redhat.com> - 3.9.5-36
changelog:
  - Fixes cleaning up stale docker containers during stop if
    container instance failed.

    Resolves: rhbz#1135026


author: David Vossel <dvossel@redhat.com> - 3.9.5-37
changelog:
  - Rename docker agent's 'container' arg to 'name' to avoid confusion
    with pacemaker's metadata 'container' argument.
  - Introduce monitor_cmd into docker agent.

    Resolves: rhbz#1135026


author: Josef Ridky <jridky@redhat.com> - 3.3.3-18
changelog:
  - Resolves: #1286330 - set non-blocking connection
  - Resolves: #1299761 - fix amindex: invalid service
  - Resolves: #1306980 - fix problem with handling compressed files


author: Josef Ridky <jridky@redhat.com> - 3.3.3-21
changelog:
  - Resolves: #1417830 - check return value from setreuid method
  - Resolves: #1423040 - fix local authentication issue


author: Marcelo Ricardo Leitner <mleitner@redhat.com> - 1.25-4
changelog:
  - Added patches to avoid hung on shutdown [1330550]
  - Added patch to fix an out-of-bound write with zero-length hardware
    address [1286840]


author: Xin Long <lxin@redhat.com> - 1.25-5
changelog:
  - Added patch to escape some sensitive characters [1383997]
  - Added patch to check port link_up when a port is added for lb runner
    [1393430]


author: Xin Long <lxin@redhat.com> - 1.27-5
changelog:
  - Added patch to fix runner.sys_prio default in man docs [1533813]
  - Added patch to empty LDFLAGS before checking for libnl3 in configure.ac [1533847]
  - Added patch to not crash when trying to print unregistered device name [1563155]


author: Xin Long <lxin@redhat.com> - 1.27-7
changelog:
  - Added an option to force log output to stdout, stderr or syslog [1596917]
  - Fixed s32/u32 data storage on big endian [1545574]
  - Documented ARP Ping link_watch.vlanid option [1645169]
  - Sent LACPDU when port state transitions from DEFAULT to CURRENT [1645169]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-15
changelog:
  - Resolves: rhbz#1517971 - AD Domain goes offline immediately during
                             subdomain initialization - IPA AD Trust
  - Related: rhbz#1482555 - sysdb index improvements - missing ghost
                            attribute indexing, unneeded objectclass index
                            etc..
  - Related: rhbz#1327705 - [RFE] Automatic creation of user private groups
                            on RHEL clients joined to AD via sssd [RHEL 7]
  - Resolves: rhbz#1527149 - AD provider - AD BUILTIN groups are cached with
                             gidNumber = 0
  - Related: rhbz#1461899 - Loading enterprise principals doesn't work with
                            a primed cache
  - Related: rhbz#1473571 - ipa-extdom-extop plugin can exhaust DS worker
                            threads


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-16
changelog:
  - Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
                             with no specific host/hostgroup set
  - Related: rhbz#1441908 - SELINUX: Use getseuserbyname to get IPA seuser
  - Related: rhbz#1327705 - [RFE] Automatic creation of user private groups
                            on RHEL clients joined to AD via sssd [RHEL 7]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-17
changelog:
  - Resolves: rhbz#1523282 - sssd used wrong search base with wrong AD
                             server


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-18
changelog:
  - Resolves: rhbz#1543348 - sssd_be consumes more memory on RHEL 7.4 systems.
  - Resolves: rhbz#1544943 - sssd goes offline when renewing expired ticket


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-19.1
changelog:
  - Resolves: rhbz#1570527 - memory management issue in the sssd_nss_ex interface can cause the ns-slapd process on IPA server to crash [rhel-7.5.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-19.2
changelog:
  - Resolves: rhbz#1579703 - crash in nss_protocol_fill_netgrent. sssd_nss[19234]: segfault at 80 ip 000055612688c2a0 sp 00007ffddf9b9cd0 error 4 in sssd_nss[55612687e000+39000] [rhel-7.5.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-19.4
changelog:
  - Resolves: rhbz#1580281 - Samba can not register sss idmap module because it's using an outdated SMB_IDMAP_INTERFACE_VERSION [rhel-7.5.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-19.5
changelog:
  - Resolves: rhbz#1583746 - The SSSD IPA provider allocates information about external groups on a long lived memory context, causing memory growth of the sssd_be process [rhel-7.5.z]


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-1
changelog:
  - Rebase to nss-util from nss 3.21
  - Resolves: Bug 1297940 - Rebase RHEL 7.3 to NSS-util 3.21 in preparation for Firefox 45


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-4
changelog:
  - Manual merge from the rhel-7.2 branch
  - Fix one alias for naming compatibility with prior release
  - Remove an unused patch


author: Daiki Ueno <dueno@redhat.com> - 3.21.3-1
changelog:
  - Rebase to nss-3.21.3
  - Remove patch for CVE-2016-1950, which is included in the release
  - Related: Bug 1347908


author: Jakub Jelen <jjelen@redhat.com> - 0.16.0-6.20170227git
changelog:
  - Use label from certificate DN if there is none (#1448555)
  - Use Cardholder name in the token label (#1449740)
  - Avoid infinite loop when reading CAC cards (#1473335)
  - Workaround for CAC Alt tokens (#1473418)


author: Jakub Jelen <jjelen@redhat.com> - 0.16.0-8.20170227git
changelog:
  - Copy labels from certificate (#1448555)
  - Avoid infinite loop in CAC driver when reading non-CAC cards (#1473335)
  - Properly parse Simple TLV structures in CAC driver (#1473418)


author: Jakub Jelen <jjelen@redhat.com> - 0.16.0-9.20170227git
changelog:
  - make ECPoint behavior standards compliant by default (#1562572)
  - allow mechanism to be specified in hexadecimal (#1562572)
  - Disable pinpad by default (#1547117, #1547744)


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-1
changelog:
  - Rebase to new upstream release (#1656791)
    - Add Support for HID Crescendo 144K (#1612372)
    - Add Support for CAC Alt tokens (#1645581)
    - Fix usage detection from certificates (#1672898)
    - Fix security issues:
      - CVE-2018-16391
      - CVE-2018-16392
      - CVE-2018-16393
      - CVE-2018-16418
      - CVE-2018-16419
      - CVE-2018-16420
      - CVE-2018-16421
      - CVE-2018-16422
      - CVE-2018-16423
      - CVE-2018-16426
      - CVE-2018-16427


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.18.0-0.2.20190404git9a8fe5f339
changelog:
  - Update to a 1.18 snapshot:
  - clients: only ask secrets for settings that require them (rh #1506536)
  - checkpoint: remove a device from checkpoint if it disappears (rh #1578335)
  - lldp: support more VLAN TLVs (rh #1652211)
  - bridge: add VLAN filtering support (rh #1652910)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.18.0-0.3.20190408git43d9187c14
changelog:
  - infiniband: allow large MTU (rh #1534869) (rh #1653494)
  - sr-iov: tolerate lack of sriov_drivers_autoprobe sysfs property (rh #1695093)


author: Francesco Giudici <fgiudici@redhat.com> - 1:1.18.0-0.4.20190408git43d9187c14
changelog:
  - keyfile: ensure keyfiles don't get a .nmconnection file name extension (rh#1697858)
  - dhcp: preserve legacy dhcp-client-id default for internal dhcp (rh #1695723)


author: Thomas Haller <thaller@redhat.com> - 1:1.18.0-1
changelog:
  - Update to 1.18.0 release
  - cli: fix crash handling gsm secrets (rh #1698495)
  - rules: fix duplicate policy routing rules (rh #1652653)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.18.0-2
changelog:
  - cli: hide certificate blobs unless --show-secrets is passed (rh #1702199)
  - device: fix reapply of MTU (rh #1702657)
  - settings: fix failed assertion when adding connections (rh #1707261)
  - core: ensure software devices are managed when networking gets enabled (rh #1701585)
  - device: restore IPv6 configuration on link up (rh #1548237)
  - dbus: fix return value for LoadConnection and avoid assertion for relative path (rh #1708660)
  - core: fix file permissions of /var/lib/NetworkManager/secret_key (rh #1709849)
  - tc: add suppor for mired action an fq_codel qdisc (rh #1546802)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.18.0-3
changelog:
  - team: don't kill teamd for external devices (rh #1711952)
  - ifcfg-rh: use PKCS#12 private key also as client certificate in reader (rh #1714610)
  - po: update translations (rh #1689962)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.18.0-4
changelog:
  - cli: don't wait forever in the editor on update connection failure (rh #1702203)
  - team: fix setting validate_active, validate_inactive and send_always flags (rh #1720153)


author: Jan Grulich <jgrulich@redhat.com> 0.9.0.8-2
changelog:
  - remove mobile-broadband-mobile-provider-devel as BR
  - add ModemManager as runtime dependency
  - add mobile-broadband-mobile-provider as runtime dependency


author: Brian C. Lane <bcl@redhat.com> 1.0.9-1
changelog:
  - Add python-isomd5sum package with python bindings
  - Add callback and interrupt support to the python library
  - Add RPM_OPT_FLAGS to CFLAGS and update makefile to use CFLAGS from environment


author: Brian C. Lane <bcl@redhat.com> 1.0.10-1
changelog:
  - Fix for gcc type-punned and sizeof pointer warnings. (bcl)
  - Add exit code 2 for user abort (#907600) (bcl)
  - Cleanup TABs and update Copyrights (bcl)
  - Standardize *FLAGS in Makefile (ryan)


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.1
changelog:
  - Remove as many non-standard operators as possible to make the codebase
    closer to upstream for later CVEs
  - Resolves: #1621383 - CVE-2018-16511 ghostscript: missing type check in type
    checker (699659)
  - Resolves: #1649721 - CVE-2018-16539 ghostscript: incorrect access checking
    in temp file handling to disclose contents of files (699658) 
  - Resolves: #1621159 - CVE-2018-15908 ghostscript: .tempfile file permission
    issues (699657)
  - Resolves: #1621381 - CVE-2018-15909 ghostscript: shading_param incomplete
    type checking (699660)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-41
changelog:
  - Resolves: rhbz#1445445 - Smart card login fails if same cert mapped to
                             IdM user and AD user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-43
changelog:
  - Resolves: rhbz#1440132 - fiter_users and filter_groups stop working
                             properly in v 1.15


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-44
changelog:
  - Resolves: rhbz#1457927 - getent failed to fetch netgroup information
                             after changing default_domain_suffix to
                             ADdomin in /etc/sssd/sssd.conf


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-47
changelog:
  - Resolves: rhbz#1430415 - ldap_purge_cache_timeout in RHEL7.3 invalidate
                             most of the entries once the cleanup task kicks in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-48
changelog:
  - Resolves: rhbz#1459846 - krb5: properly handle 'password expired'
                             information retured by the KDC during
                             PKINIT/Smartcard authentication


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-49
changelog:
  - Resolves: rhbz#1450107 - SSSD doesn't handle conflicts between users
                             from trusted domains with the same name when
                             shortname user resolution is enabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-50
changelog:
  - Resolves: rhbz#1457926 - Wrong search base used when SSSD is directly
                             connected to AD child domain


author: Bastien Nocera <bnocera@redhat.com> - 3.26.2-6
changelog:
  + control-center-3.26.2-6
  - Fix Clone MAC not being saved in Ethernet device properties
  - Resolves: #1467295


author: Bastien Nocera <bnocera@redhat.com> - 3.26.2-8
changelog:
  + control-center-3.26.2-8
  - Fix Wi-Fi networks not getting updated
  - Show "Wi-Fi disabled" page when Wi-Fi is disabled
  - Resolves: #1545713


author: Marcelo Ricardo Leitner <mleitner@redhat.com> - 1.25-2
changelog:
  - Updated to 1.25 [1286840 1286063]
  - Added patch teamd-LACP-runner-does-not-set-Agg-bit-on-first-slav.patch [1347818]


author: Hans de Goede <hdegoede@redhat.com> - 2:3.8.2-3
changelog:
  - Add a number of bug-fixes to deal better with high res cams (#873434)
  - Fix cheese-introduction.png being in both cheese and cheese-libs (#893756)
  - Put the COPYING file in the docs for cheese-libs (#893800)
  - Fix the flash when taking a photo being dark grey instead of white (#965813)
  - Fix needing to press the effects button twice to select effects after
    selecting an effect for the first time
  - Various other bug-fixes


author: Hans de Goede <hdegoede@redhat.com> - 2:3.8.2-4
changelog:
  - Fix misbehavior when started without a camera
  - Don't crash when the (last) camera gets unplugged
  - Automatically use a newly plugged camera when going from 0 to 1 cameras
  - Misc. other bugfixes


author: Robbie Harwood <rharwood@redhat.com> 0.6.2-1
changelog:
  - Rebase to latest version since we have krb5-1.15
  - Resolves: #1379836
  - Resolves: #1344518
  - Resolves: #1366782
  - Resolves: #1379005
  - Resolves: #1379482
  - Resolves: #1379616
  - Resolves: #1380490
  - Resolves: #1378600
  - Resolves: #1285012
  - Resolves: #1333813


author: Jiri Kucera <jkucera@redhat.com> - 1.20.7-6
changelog:
  - Remove old scriptlets
    Enable PIE and RELRO
    ./autogen.sh runs too early
    Resolves: #1092527, #1095444


author: Ondrej Vasik <ovasik@redhat.com> - 8.22-13
changelog:
  - call utilities in colorls.* scripts with full path (#1222223)
  - tail: disable inotify in --follow for vxfs (#1109083)
  - remove circular dependency for util-linux (not relevant for RHEL 7 - #1155963)
  - sort: do not look at more than specified keys for mb locales (#1148347)
  - i18n patch: fix buffer overruns and compiler warnings (#1148347)
  - xfs: fix dd sparse false test failure on btrfs and xfs (#1223041)
  - dd: new status=progress level to print stats periodically (#1147701)
  - id/groups - print correct group for session (#1115430)
  - cp,install,mknod,mkfifo,mkdir: separate -Z and --context options
    in --help and manpage (#1084471)
  - ls: clarify --scontext/--context/--lcontext options behaviour
    in info documentation, mention deprecation (#1099508)
  - du: handle bindmount cycles more gracefully (#1238191)
  - mv: prevent possible race condition for hardlinks (#1166570)
  - df: improve filtering of NFS mounts and bind mounts
    (#1197463, #1100026, #1129661)


author: Ondrej Vasik <ovasik@redhat.com> - 8.22-18
changelog:
  - fix xfs build failure in chrooted environment (#1263341)
  - update filesystem lists for stat and tail from latest upstream
    (#1327881, #1280357) 
  - disable id/setgid.sh test(missing chroot feature), fix 
    cp-a-selinux test (#1266500,#1266501)
  - colorls.sh - change detection of interactive shell for ksh
    compatibility (#1321648)
  - fix date --date crash with empty or invalid TZ envvar (#1325786)
  - df -l: do not hang on a dead autofs mount point (#1309247)
  - sort -h: fix functionality of human readable numeric sort for other
    than first field (#1328360)


author: Kamil Dudka <kdudka@redhat.com> - 8.22-19
changelog:
  - timeout: fix race possibly terminating wrong process (#1439465)
  - ls: allow interruption when reading slow directories (#1421802)
  - fold: preserve new-lines in mutlibyte text (#1418505)


author: Kamil Dudka <kdudka@redhat.com> - 8.22-23
changelog:
  - update description of the -a/--all option in df.1 man page (#1553212)
  - sort -M: fix memory leak when using multibyte locale (#1540059)


author: Tomas Popela <tpopela@redhat.com> - 2.20.4-1
changelog:
  - Update to 2.20.4
  - Resolves: rhbz#1576544
  - WebKitWebProcess crashes when a11y is active
  - Resolves: rhbz#1591638


author: Tomas Popela <tpopela@redhat.com> - 2.20.4-2
changelog:
  - webkitgtk4: Crash on Google login page when a11y is active
  - Resolves: rhbz#1503624
  - Revert patch causing rendering glitches


author: Tomas Popela <tpopela@redhat.com> - 2.20.5-1
changelog:
  - Update to 2.20.5 - technically it was not necessary as the only difference
    between 2.20.4 and .5 was the revert of one change, that we already reverted
    while building 2.20.4. But it's better to stay with upstream.
  - Update the labels patch with the version that was pushed upstream.
  - Resolves: rhbz#1576544


author: Jakub Hrozek <jhrozek@redhat.com> 0.8.13-8
changelog:
  - Fix a potential use-after-free in nsswitch module
  - Resolves: rhbz#1036030 - New defect found in nss-pam-ldapd-0.8.13-4.el7


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-9
changelog:
  - Resolves: rhbz#1420576 - 'systemctl status nslcd' always returns FAILURE
                             status even though the service is stopped with
                             'systemctl stop nslcd


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-10
changelog:
  - Resolves: rhbz#1357493 - In RHEL 7, authentication failing when using
                             nslcd + pam_ldap where user has different in
                             nis/passwd and ldap.


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-11
changelog:
  - Resolves: rhbz#1497761 - Incorrect password tries to bind to all domain
                             controllers and locks user out


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-12
changelog:
  - Resolves: rhbz#1425790 - Unable to authenticate with 64 character password
                             using nss-pam-ldapd


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-14
changelog:
  - Resolves: rhbz#1288429 - /etc/tmpfiles.d/nss-pam-ldapd.conf shipped when
                             /etc/tmpfiles.d is reserved for the local
                             administrator


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-15
changelog:
  - Resolves: rhbz#1204202 - fix doc to describe actual uri format in
                             nslcd.conf


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-16
changelog:
  - Resolves: rhbz#1151675 - NSLCD WRAPS LDAP USER UIDNUMBER > 2^31 SO UID
                             IS WRONG (AND A NEGATIVE NUMBER)


author: Marek Polacek <polacek@redhat.com> 4.8.5-36.2
changelog:
  - allow libitm to use HTM (#1674383)
  - fix mode mismatch in prepare_cmp_insn (#1676795, PR target/63442)


author: Pavel Alexeev <Pahan@Hubbitus.info> - 1:1.8.5-11
changelog:
  - Thanks to Ville Skyttä (bz#875343) build against libedit instead of readline
  	what simplify licensing apparently without any loss of functionality


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.9.1.el7]
changelog:
  - [drm] i915/kbl: Remove preliminary_hw_support protection from KBL. (Rob Clark) [1413092 1305702]
  - [netdrv] slip: Fix deadlock in write_wakeup (Steve Best) [1412225 1403497]
  - [netdrv] slip: fix spinlock variant (Steve Best) [1412225 1403497]
  - [kernel] kmod: use system_unbound_wq instead of khelper (Luiz Capitulino) [1411816 1395860]
  - [nvme] switch abort to blk_execute_rq_nowait (David Milburn) [1411669 1392923]
  - [netdrv] ibmveth: calculate gso_segs for large packets (Gustavo Duarte) [1411382 1361958]
  - [netdrv] ibmveth: set correct gso_size and gso_type (Gustavo Duarte) [1411382 1361958]
  - [netdrv] allow macvlans to move to net namespace (Jarod Wilson) [1409829 1368830]
  - [pci] Set Read Completion Boundary to 128 iff Root Port supports it (_HPX) (Myron Stowe) [1406290 1387674]
  - [pci] Export pcie_find_root_port() (Myron Stowe) [1406290 1387674]
  - [rtc] cmos: Initialize hpet timer before irq is registered (Pratyush Anand) [1404184 1299001]
  - [x86] amd: Fix cpu_llc_id for AMD Fam17h systems (Suravee Suthikulpanit) [1402444 1395399]
  - [powerpc] powernv: Fix stale PE primary bus (Steve Best) [1402440 1395275]
  - [misc] cxl: Fix coredump generation when cxl_get_fd() is used (Gustavo Duarte) [1402439 1397943]
  - [pci] cxl: use pcibios_free_controller_deferred() when removing vPHBs (Gustavo Duarte) [1402438 1395323]
  - [scsi] qla2xxx: do not abort all commands in the adapter during EEH recovery (Gustavo Duarte) [1402436 1393254]
  - [scsi] qla2xxx: fix invalid DMA access after command aborts in PCI device remove (Gustavo Duarte) [1402436 1393254]
  - [scsi] qla2xxx: do not queue commands when unloading (Gustavo Duarte) [1402436 1393254]
  - [net] packet: fix race condition in packet_set_ring (Hangbin Liu) [1401852 1401853] {CVE-2016-8655}


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.10.1.el7]
changelog:
  - [block] blk-mq: Fix NULL pointer updating nr_requests (David Milburn) [1416133 1384066]
  - [scsi] cxlflash: Fix crash in cxlflash_restore_luntable() (Gustavo Duarte) [1415146 1400524]
  - [scsi] cxlflash: Improve context_reset() logic (Gustavo Duarte) [1415146 1400524]
  - [scsi] cxlflash: Avoid command room violation (Gustavo Duarte) [1415146 1400524]
  - [x86] Mark Kaby Lake with Kaby Lake PCH as supported (David Arcari) [1415094 1391219]
  - [scsi] be2iscsi: Add checks to validate completions (Maurizio Lombardi) [1414687 1324918]
  - [scsi] be2iscsi: Fix bad WRB index error (Maurizio Lombardi) [1414687 1324918]
  - [scsi] be2iscsi: Add lock to protect WRB alloc and free (Maurizio Lombardi) [1414687 1324918]
  - [mm] meminit: initialise more memory for inode/dentry hash tables in early boot (Yasuaki Ishimatsu) [1413623 1404584]
  - [s390] mem_detect: Revert "add DAT sanity check" (Hendrik Brueckner) [1413600 1391540]
  - [cpufreq] intel_pstate: Fix code ordering in intel_pstate_set_policy() (Prarit Bhargava) [1411818 1398072]
  - [scsi] cxlflash: Improve EEH recovery time (Steve Best) [1402442 1397588]
  - [scsi] cxlflash: Fix to avoid EEH and host reset collisions (Steve Best) [1402442 1397588]
  - [scsi] cxlflash: Remove the device cleanly in the system shutdown path (Steve Best) [1402442 1397588]
  - [scsi] cxlflash: Scan host only after the port is ready for I/O (Steve Best) [1402442 1397588]
  - [x86] kvm: x86: Check memopp before dereference (Mateusz Guzik) [1395805 1395806] {CVE-2016-8630}
  - [vfio] pci: Fix integer overflows, bitmask check (Mateusz Guzik) [1394627 1394991 1394628 1394992] {CVE-2016-9083 CVE-2016-9084}
  - [acpi] acpi / scan: use platform bus type by default for _HID enumeration (Tony Camuso) [1393727 1383505]
  - [acpi] acpi / scan: introduce platform_id device PNP type flag (Tony Camuso) [1393727 1383505]
  - [char] ipmi: Convert the IPMI SI ACPI handling to a platform device (Tony Camuso) [1393727 1383505]
  - [acpi] acpi / ipmi: Cleanup coding styles (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Cleanup some inclusion codes (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Cleanup some initialization codes (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Cleanup several acpi_ipmi_device members (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Add reference counting for ACPI IPMI transfers (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Use global IPMI operation region handler (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Fix race caused by the unprotected ACPI IPMI user (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Fix race caused by the timed out ACPI IPMI transfers (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Fix race caused by the unprotected ACPI IPMI transfers (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Fix potential response buffer overflow (David Arcari) [1393725 1373703]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.11.1.el7]
changelog:
  - [scsi] qla2xxx: Get mutex lock before checking optrom_state (Chad Dupuis) [1418317 1408387]
  - [mm] memcontrol: do not recurse in direct reclaim (Rik van Riel) [1417192 1397330]


author: Akemi Yagi <toracat@centos.org> [3.10.0-514.16.1.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Enabled spidev [bug#9955]
  - Add in patches from bug 10191 [bug#10191]
  - Add in a patch from bug 10320 [bug#10320]
  - Add a patch [bug#10447]
  - Enable ATM drivers [bug#10845]
  - Add 9pfs config options [bug#10849]
  - Enable VFIO_PCI_VGA [bug#12435]
  - Add in a patch [bug#12653]
  - Add mpt3sas patches [big#12600]
  - Add megaraid patches [bug#12601]
  - Rremove initramfs-xxxkdump.img upon kernel removal [bug#12703]
  - Add a patch from [bug#12711]
  - Add a patch from [bug#12841]
  - Add a patch from [bug#12818]
  - Add patches from [bug#10414]


author: Ryan O'Hara <rohara@redhat.com> - 1.2.7-3
changelog:
  - Update spec file.
  - Add option to prevent respawn of child processes.
  - Remove duplicate command-line option code.
  - Use popt to generate usage message.
  - Fix pointer arithmetic for VRRP packets.
  - Fix comparison of primary IP address.
  - Fix loading of SSL certificate.
  - Fix typo in error message.
  - Update FSF address in GPLv2 license.
  - Remove debug message from if_get_by_ifname.


author: Akemi Yagi <toracat@centos.org> [3.10.0-957.10.1.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
     addmissing.patch  [puias]
     cpufreq.patch  [puias]
     i386-audit-stop-scri-stack-frame.patch  [puias]
     removejiffies.patch  [puias]
     undorhirqstat.patch  [puias]
     morefixes.patch      [puias+bug#12412]
     upstream-32bit-fixes-7_5.patch [puias+bug#12412]
     clear-32bit-Werror-warnings.patch  [bug#12412]
     qspinlock_types-32bit.patch   [ay]
     i686-7-4.patch [T.Kabe, bug#13890]
     firmware-efi-32bit.patch [ay]
     patch-spec_ctrl_i686.patch [T.Kabe bug#14353]
     686 mods for 7.5 [T.Kabe bug#14703]
     more 686 mods for 7.5 (-862.3.2) [pgreco]
     more 686 mods for 7.5 (-862.11.6) [pgreco, bug#15174]
     Patches updated for 7.6 [kabe, bug#15428]
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Enabled spidev [bug#9955]
  - Add a patch [bug#10447]
  - Enable ATM drivers [bug#10845]
  - Add 9pfs config options [bug#10849]
  - Enable VFIO_PCI_VGA [bug#12435]
  - Rremove initramfs-xxxkdump.img upon kernel removal [bug#12703]
  - Add a patch from [bug#12841]
  - Add a patch from [bug#12818]
  - Enabled RT2800USB_RT3573 [bug#13162]
  - Enable LDM_PARTITION [bug#13526]
  - Add a patch to fix misleading warning [bug#13990]
  - Add BuildRequires: openssl-devel to the with_perf section [bug#13990]
  - Add a patch to fix build errors for EL7.5 [bug#14425]
  - Added a patch to fix alsa potentail crash [bug14779]
  - Apply a patch to fix excessive warnings [bug#14413]
  - Apply a patch to fix mempolicy issue [bug#15115]
  - Add a patch to fix race in virtio_balloon [bug#15216]
  - Add shim requirement to the spec file for x86_64
  - Apply patches that fix ecryptfs issue [see bugs #7369, #15353] provided by @pgreco
  - Add an i686 patch to fix Hyper-V issue [bug#15374]
  - Add an nvme patch [bug#15406]
  - Enable NIU and add a patch that fixes build errors submitted by h-masuda [bug#15040]
  - Apply a patch from bug15639
  - Apply a patch from bug15707
  - Apply a patch from bug15742
  - Add a patch that fixes the earlier patch from bug15742
  - Add a patch from bug#15830
  - Add a patch from bug#15801


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b07-1
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b07 and Shenandoah merge 2019-06-13.
  - Resolves: rhbz#1724452


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.222.b07-2
changelog:
  - Don't produce javadoc/javadoc-zip sub packages for the debug variant build.
  - Don't perform a bootcycle build for the debug variant build.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b08-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b08.
  - Adjust PR3083/RH134640 to apply after JDK-8182999
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b09-1
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b09-2
changelog:
  - Provide Javadoc debug subpackages for now, but populate them from the normal build.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b09-2
changelog:
  - Use normal_suffix for Javadoc zip filename to copy, as there is is no debug version.
  - Resolves: rhbz#1724452


author: Jarod Wilson <jarod@redhat.com> 1.2.0-1
changelog:
  - Update to libiec61883 v1.2.0 release
  - Rework installtests patch to not require autoreconf
  - Make iso channel allocation work w/o local fw node r/w


author: Jan Synáček <jsynacek@redhat.com> - 0.4.2-3
changelog:
  - Correctly fill FSCreationClassName and FSName
  - Replace thread-unsafe functions
  - Resolves: rhbz#1042843 rhbz#1050841


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 0.4.2-4
changelog:
  - Fix service methods report success before the action is actually finished
  - Add description to service methods
  - Fan provider made thread-safe
  - Resolves: rhbz#1049819 rhbz#1049816 rhbz#1031650


author: Matej Mužila <mmuzila@redhat.com> - 5.3.21-23
changelog:
  - Mention in man page that care should be taken when running db_hotbackup
    with -c option. Resolves: rhbz#1460077


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-29.el7_5.1
changelog:
  - Added security fixes for:
    - CVE-2018-16509 (bug #1621156)
    - CVE-2018-15910 (bug #1621157)
    - CVE-2018-16542 (bug #1621380)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-15
changelog:
  - Use /dev/urandom when generating rndc.key file (#1107568)
  - Allow authentication using TSIG in allow-notify configuration statement (#1067424)
  - Fix race condition when destroying a resolver fetch object (#1072379)
  - Increase defaults for lwresd workers and make workers and client objects number configurable (#1098959)
  - Configure BIND with --with-dlopen=yes to support dynamically loadable DLZ drivers (#1096688)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-17
changelog:
  - Fix error in dyndb API that can cause named to freeze on shutdown (#1142150)
  - Fix error in triggerun scriptlet (#1143033)
  - Remove /var/named/chroot/var/run on bind-chroot update if it is a directory (#1091341)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-18.4
changelog:
  - DNS resolution failure in high load environment with SERVFAIL and "out of memory/success" in the log (#1221180)
  - Increase ISC_SOCKET_MAXEVENTS to 2048 (#1250561)


author: Bruno Wolff III <bruno@wolff.to> - 4.3-0.17.git5c6f0024
changelog:
  - Latest pre 4.3 snapshot
  - Includes fix for mksquashfs hangs
  - Switch to get pre-release updates from the stable branch at kernel.org


author: Bruno Wolff III <bruno@wolff.to> - 4.3-0.18.gitaae0aff4
changelog:
  - Latest pre 4.3 stable snapshot
  - A few minor bug fixes
  - Improvements in getting status info while running unsquashfs


author: Tomas Popela <tpopela@redhat.com> - 12.10.0-12
changelog:
  - Move package from EPEL 7 to RHEL 7, but leave the mono support in EPEL in
    libappindicator-sharp package.
  - Resolves: rhbz#1546657


author: Dan Mashal <dan.mashal@fedoraproject.org> - 0.7.5-5
changelog:
  - Fix RHBZ #925824
  - Update source URL
  - Fix mix of spaces and tabs in spec file
  - Fix bogus changelog date


author: Ray Strode <rstrode@redhat.com> 0.7.5-8
changelog:
  - Don't require desktop notification daemon (breaks a build loop with mutter/gnome-shell)
    Related: #1174722


author: Kamil Dudka <kdudka@redhat.com> - 3.8.6-15
changelog:
  - fix #1483800 - update references to project page
  - fix #1472984 - improve the error message for bad config file mode
  - fix #1465720 - trigger weekly rotations more predictably
  - fix #1461907 - make 'copy' and 'copytruncate' work together


author: Jan Horak <jhorak@redhat.com> - 60.1.0-8
changelog:
  - Fixed homepage and bookmarks (rhbz#1606778)
  - Fixed missing file associations in RHEL6 (rhbz#1613565)


author: Jan Horak <jhorak@redhat.com> - 60.1.0-9
changelog:
  - Do not set user agent (rhbz#1608065)
  - GTK dialogs are localized now (rhbz#1619373)
  - JNLP association works again (rhbz#1607457)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-19.13
changelog:
  - core: use an AF_UNIX/SOCK_DGRAM socket for cgroup agent notification (#1305608)
  - logind: process session/inhibitor fds at higher priority (#1305608)
  - sd-event: expose the event loop iteration counter via sd_event_get_iteration() (#1342173)
  - manager: Only invoke a single sigchld per unit within a cleanup cycle (#1342173)
  - manager: Fixing a debug printf formatting mistake (#1342173)
  - manager: don't skip sigchld handler for main and control pid for services (#3738) (#1342173)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.4-8.el7
changelog:
  - gp-Use-initial-exec-tls-for-libunwind-s-recursion-flag.patch [bz#1339710]
  - Resolves: bz#1339710
    (initalization of 'recursive' tls variable in libunwind stack capturer occasionally triggers deadlock in ceph)


author: Tim Jackson <rpm@timj.co.uk> - 1.0.25-4
changelog:
  - Move udev rules to /lib/udev/rules.d (rhbz #748206)
  - remove %BuildRoot and %clean sections; no longer required


author: Rahul Sundaram <sundaram@fedoraproject.org> - 1.0.26.1-3
changelog:
  - remove vendor tag from desktop file. https://fedorahosted.org/fpc/ticket/247
  - clean up spec to follow current guidelines
  - don't build -tools for RHEL. Bill Nottingham patch. Resolves rhbz#586030


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-14
changelog:
  - mark the 0hourly and dailyjobs crontabs as config
  - properly handle users for whose getpwnam() returns NULL temporarily
  - log when crond is shutting down


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-16
changelog:
  - disable mail from anacron with empty MAILTO
  - crontab: do not block access with PAM when running as root
  - improve the crontab man page
  - do not hardcode system_u selinux user but use the user from
    the current context


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-17
changelog:
  - make anacron not to contradict itself in syslog
    (job output does not have to be necessarily mailed)


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-18
changelog:
  - fix regression - spurious PAM log message from crontab (#1479064)
  - allow empty variables in crontabs (#1439217)


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-14
changelog:
  - ureport: don not fail with multiple entitlement certs
  - ureport: don not use uReport_URL in reporter-rhtsupport
  - Related: #1139987, #1140224


author: Lukas Nykryn <lnykryn@redhat.com> - 219-19.2
changelog:
  - device: rework how we enter tentative state (#1283579)
  - core: Do not bind a mount unit to a device, if it was from mountinfo (#1283579)
  - logind: set RemoveIPC=no by default (#1284588)


author: Tim Waugh <twaugh@redhat.com> - 1:1.6.3-17
changelog:
  - Support for failover without load-balancing (bug #1115219).
  - Fix cupsGetPPD3() so it doesn't give the caller an unreadable file
    (part of fix for CVE-2014-5031, STR #4500).
  - Can no longer reproduce bug #1010580 so removing final-content-type
    patch as it causes issues for some backends (bug #1149245).
  - Start cups.service after network.target (bug #1144780).


author: Tim Waugh <twaugh@redhat.com> - 1:1.6.3-19
changelog:
  - Validate ErrorPolicy in configuration (bug #1196218, STR #4591).
  - Don't use SSLv3 by default (bug #1161172, STR #4476).


author: Tim Waugh <twaugh@redhat.com> - 1:1.6.3-20
changelog:
  - Don't start jobs while cancelling others (bug #1233002, STR #4648).
  - Fix slow resume of jobs after restart (bug #1233006, STR #4646).
  - Fixes for post-install scriptlet (bug #1235035).


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.6.3-23
changelog:
  - 1257051 - cups-lpd man page incomplete
  - 1275790 - spec file includes triggers with overlapping version intervals
  - 1259770 - permission changed after writing to /etc/cups/subscriptions.conf


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.6.3-25
changelog:
  - 1297035 - gnome-settings-daemon leaks file descriptors
  - 1257751 - Email notifications ("lp -m") for printer classes don't work


author: Marek Kasik <mkasik@redhat.com> - 0.26.0-1
changelog:
  - Update to 0.26.0
  - Remove editor subpackage
  - Return libdbus-1 library (not header or pkgconfig files)
  - Resolves: #1386841


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.2-2
changelog:
  - Backport fix for client-side memory error (GNOME/gnome-terminal#1)
  - Bump BuildRequires versions
  - Drop the dark theme override
  - Rebase and restore the scroll speed patches
  - Rebase and restore the patch to allow old ISO 8895 charsets
  - Restore the GConf migration tool
  - Resolves: #1568632


author: Peter Jones <pjones@redhat.com> - 36-6
changelog:
  - Fix device path generation for block devices on nonstandard device path
    roots.
    Related: rhbz#1558937
    Resolves: rhbz#1591853


author: Peter Jones <pjones@redhat.com> - 36-10
changelog:
  - Work around platform ACPI PCI(e) root drivers that don't fill in the
    "driver" symlink in sysfs.
    Resolves: rhbz#1614944


author: Peter Jones <pjones@redhat.com> - 36-11
changelog:
  - Fix device probing with no matching probes where HD() will work
    Resolves: rhbz#1613698
  - Detect partitiond md devices correctly
    Resolves: rhbz#1602414
    Resolves: rhbz#1613370


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-2
changelog:
  - Rebase to upstream 25920dbdbc7594fc944a963036996f724c63a8b8 (1.1.15-rc4)
  - Resolves: rhbz#1304771
    Resolves: rhbz#773656
    Resolves: rhbz#1240330
    Resolves: rhbz#1281450
    Resolves: rhbz#1286316
    Resolves: rhbz#1287315
    Resolves: rhbz#1323544


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-3
changelog:
  - Rebase to upstream e174ec84857e087210b9dacee3318f8203176129 (1.1.15)
  - Resolves: rhbz#1304771
    Resolves: rhbz#1303765
    Resolves: rhbz#1327469
    Resolves: rhbz#1337688
    Resolves: rhbz#1345876
    Resolves: rhbz#1346726


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-8
changelog:
  - Quote timestamp-format correctly in alert_snmp.sh.sample
  - Unregister CIB callbacks correctly
  - Print resources section heading consistently in crm_mon output
  - Resolves: rhbz#773656
  - Resolves: rhbz#1361533


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-10
changelog:
  - Only clear remote node operation history on startup
  - Resend a lost shutdown request
  - Correctly detect and report invalid configurations
  - Don't include manual page for resource agent that isn't included
  - Resolves: rhbz#1288929
  - Resolves: rhbz#1310486
  - Resolves: rhbz#1352039


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-11
changelog:
  - Sanitize readable CIB output collected by crm_report
  - Document crm_report --sos-mode option
  - Speed up crm_report on Pacemaker Remote nodes
  - Avoid sbd fencing when upgrading pacemaker_remote package
  - Resolves: rhbz#1219188
  - Resolves: rhbz#1235434
  - Resolves: rhbz#1323544
  - Resolves: rhbz#1372009


author: Dan Walsh <dwalsh@redhat.com> - 2:2.2.0-2.git0a4dcd6
changelog:
  * Thu Sep 21 2017 Dan Walsh <dwalsh@redhat.com> - 2:2.2.0-2.git0a4dcd6
  - Add support for multiple configuration files.
    oci-umount will still read config file /etc/oci-umount.conf if it
    exists, but will also read config files in /usr/share/oci-umount/oci-umount.d
    and config files in /etc/oci-umount/oci-umount.d.  If the same file name exists
    in both directories, then oci-umount will only use the content in /ect/oci-umount/oci-umount.d.
  - Make Logs less noisy
  - Improve logs output, adding containier id, and needed file information
  - Add support for specifying submounts PATH/* will unmount all mountpoints 
    under PATH in a container
  - Support for oci configuration files to specify when to run the plugin


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-10
changelog:
  - storage: util: Properly ignore errors when backing volume is inaccessible (rhbz#1540022)
  - util: json: Add helper to return string or number properties as string (rhbz#1540290)
  - util: storage: Parse 'lun' for iSCSI protocol from JSON as string or number (rhbz#1540290)
  - util: Introduce virFormatIntPretty (rhbz#1289368)
  - util: Make prefix optional in virBitampString (rhbz#1289368)
  - util: Rename virBitmapString to virBitmapToString (rhbz#1289368)
  - util: Rename virBitmapDataToString to virBitmapDataFormat (rhbz#1289368)
  - util: Don't output too many zeros from virBitmapToString (rhbz#1289368)
  - util: Introduce virBitmapNewString (rhbz#1289368)
  - util: Reintroduce virBitmapSubtract (rhbz#1289368)
  - util: Introduce virBitmapShrink (rhbz#1289368)
  - conf: Sort cache banks in capabilities XML (rhbz#1289368)
  - conf: Format cache banks in capabilities with virFormatIntPretty (rhbz#1289368)
  - tests: Remove executable bits on plain data files (rhbz#1289368)
  - tests: Minor adjustments for test data (rhbz#1289368)
  - tests: Add resctrl-skx-twocaches test case to vircaps2xmltest (rhbz#1289368)
  - util: Fix leak in virStringTrimOptionalNewline (rhbz#1289368)
  - Rename virResctrlInfo to virResctrlInfoPerCache (rhbz#1289368)
  - util: Add virResctrlInfo (rhbz#1289368)
  - conf: Use virResctrlInfo in capabilities (rhbz#1289368)
  - util: Remove now-unneeded resctrl functions (rhbz#1289368)
  - fixup_resctrlinfo (rhbz#1289368)
  - resctrl: Add functions to work with resctrl allocations (rhbz#1289368)
  - conf: Add support for cputune/cachetune (rhbz#1289368)
  - tests: Add virresctrltest (rhbz#1289368)
  - qemu: Add support for resctrl (rhbz#1289368)
  - tests: Clean up and modify some vircaps2xmldata (rhbz#1289368)
  - resctl: stub out functions with Linux-only APIs used (rhbz#1289368)
  - util: Check for empty allocation instead of just NULL pointer (rhbz#1289368)
  - util: Use "resctrl" instead of "resctrlfs" spelling (rhbz#1289368)
  - util: Make it possible for virResctrlAllocSetMask to replace existing mask (rhbz#1289368)
  - util: Remove unused variable in virResctrlGetInfo (rhbz#1289368)
  - util: Don't check if entries under /sys/fs/resctrl/(info/) are directories (rhbz#1289368)
  - util: Add helpers for getting resctrl group allocs (rhbz#1289368)
  - util: Use default group's mask for unspecified resctrl allocations (rhbz#1289368)
  - util: Don't overwrite mask in virResctrlAllocFindUnused (rhbz#1289368)
  - qemu: Restore machinename even without cgroups (rhbz#1289368)
  - util: Extract path formatting into virResctrlAllocDeterminePath (rhbz#1289368)
  - qemu: Restore resctrl alloc data after restart (rhbz#1289368)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-11
changelog:
  - qemu: migration: Refresh device information after transferring state (rhbz#1463168)
  - qemuDomainRemoveMemoryDevice: unlink() memory backing file (rhbz#1461214)
  - util: Fix possible leak in virResctrlAllocMasksAssign (rhbz#1540817)
  - util: Clear unused part of the map in virBitmapShrink (rhbz#1540817)
  - tests: Add test for properly removing cachetune entries (rhbz#1540817)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-12
changelog:
  - util: Check if kernel-provided info is consistent with itself (rhbz#1540780)
  - qemu: Refresh capabilities when creating resctrl allocation (rhbz#1540780)
  - qemu: Expose rx/tx_queue_size in qemu.conf too (rhbz#1541960)
  - util: bitmap: Fix value of 'map_alloc' when shrinking bitmap (rhbz#1540817)
  - qemu: driver: Extract vcpu halted state directly (rhbz#1534585)
  - qemu: Remove unused 'cpuhalted' argument from qemuDomainHelperGetVcpus (rhbz#1534585)
  - qemu: domain: Store vcpu halted state as a tristate (rhbz#1534585)
  - qemu: Limit refresh of CPU halted state to s390 (rhbz#1534585)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.1
changelog:
  - virDomainDeviceValidateAliasForHotplug: Use correct domain defintion (rhbz#1554928)
  - conf: Check for user aliases duplicates only (rhbz#1554962)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.3
changelog:
  - qemu_cgroup: Fix 'rc' argument on virDomainAuditCgroupPath() calls (rhbz#1564996)
  - util: Introduce virStringListMerge (rhbz#1564996)
  - util: Introduce virDevMapperGetTargets (rhbz#1564996)
  - qemu_cgroup: Handle device mapper targets properly (rhbz#1564996)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.4
changelog:
  - lxc: Drop useless check in live device update (rhbz#1557922)
  - Pass oldDev to virDomainDefCompatibleDevice on device update (rhbz#1557922)
  - qemu: Fix updating device with boot order (rhbz#1557922)
  - conf: Fix crash in virDomainDefCompatibleDevice (rhbz#1557922)
  - vmx: check for present/enabled devices earlier (rhbz#1566524)
  - vmx: allocate space for network interfaces if needed (rhbz#1566524)
  - internal: add STRCASEPREFIX (rhbz#1566524)
  - vmx: convert any amount of NICs (rhbz#1566524)
  - qemu: Use dynamic buffer for storing PTY aliases (rhbz#1566525)
  - qemu: avoid denial of service reading from QEMU monitor (CVE-2018-5748) (CVE-2018-5748)
  - qemu: avoid denial of service reading from QEMU guest agent (CVE-2018-1064) (CVE-2018-1064)


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-2
changelog:
  - Rebase to upstream 5cccc41c95d6288eab27d93901b650b071f976dc (1.1.18-rc2)
  - Default record-pending to true
  - Resolves: rhbz#1323546
  - Resolves: rhbz#1376556
  - Resolves: rhbz#1382364
  - Resolves: rhbz#1461976
  - Resolves: rhbz#1474428
  - Resolves: rhbz#1500509
  - Resolves: rhbz#1501903
  - Resolves: rhbz#1501924


author: Petr Kubat <pkubat@redhat.com> - 9.2.18-1
changelog:
  - update to 9.2.18 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-18.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-17.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-16.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.21-1
changelog:
  - update to 9.2.21 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-21.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-20.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-19.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.22-1
changelog:
  - update to 9.2.22 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-22.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.23-1
changelog:
  - update to 9.2.23 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-23.html


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.6
changelog:
  - logging: Don't inhibit shutdown in system daemon (rhbz#1573268)
  - util: don't check for parallel iteration in hash-related functions (rhbz#1581364)
  - cpu: define the 'virt-ssbd' CPUID feature bit (CVE-2018-3639)
  - virNumaGetHugePageInfo: Return page_avail and page_free as ULL (rhbz#1582418)


author: Steve Grubb <sgrubb@redhat.com> 2.3.3-2
changelog:
  - New upstream bugfix/enhancement release
  resolves: #1053804 - ausearch issues found by ausearch-test
  resolves: #1030409 - ausearch help typo for "-x" option


author: Steve Grubb <sgrubb@redhat.com> 2.4-1
changelog:
  resolves: #1115196 - Add golang bindings for libaudit
  resolves: #1105150 - audispd config file parser fails on long input
  resolves: #1104973 - auparse truncating selinux context after first category
  resolves: #1088593 - auditctl man page examples use deprecated syscalls
  resolves: #1087849 - support for setting loginuid immutable
  resolves: #1073063 - AUDIT_SECCOMP events syscall field is not interpretted
  resolves: #975796  - confusing aulast records for bad logins


author: Steve Grubb <sgrubb@redhat.com> 2.4.1-1
changelog:
  resolves: #963353 - aarch64 userspace auditing needs to be written
  resolves: #1150202 - perf trace sleep 1 does not list any syscall information
  resolves: #1142989 - Update audit package to 2.4.1
  resolves: #1155221 - adjust fstatat naming to match kernel uapi


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-5
changelog:
  - macsec: Fix segmentation fault in case macsec.ko is not loaded (rh #1440646)
  - nl80211: Fix race condition in detecting MAC change (rh #1447073)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-5.1
changelog:
  - avoid key reinstallation (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079,
    CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086,
    CVE-2017-13087, CVE-2017-13088)


author: Miloslav Trmač <mitr@redhat.com> - 0.112-12
changelog:
  - Fix a memory leak in PolkitPermission.
    Patch by Rui Matos <tiagomatos@gmail.com>
    Resolves: #1433915


author: Honggang Li <honli@redhat.com> - 4.11.0-5
changelog:
  - Rebase to latest upstream release v4.11.0-5
  - mstconfig support for prio_tag and ttl_wa
  - Resolves: bz1694703


author: Jay Fenlason <fenlason@redhat.com> 3.2-5.el6
changelog:
  - Rebuild against newer infinipath-psm, openmpi, mvapich, mvapich2
    This removes the openmpi-psm subpackage, as openmpi now switches between
     psm and non- at runtime.
  - Correct version numbers for IMB and OSU benchmarkes in the description.
  - Update spec file to fix pkgwrangler warnings.
    Resolves: rhbz557803
    Related: rhbz739138


author: Jay Fenlason <fenlason@redhat.com> 3.2-10
changelog:
  - Add BuildRequires for libibmad-devel
  - Build against mpich, now that we have a mpi-3 version of it.
  - rebuild against new mvapich2
    Resolves: rhbz1011910, rhbz1011915


author: Caolán McNamara <caolanm@redhat.com> - 1.3.2-6
changelog:
  - Resolves: rhbz#573516 have hunspell require hunspell-en to ensure
    at least one dictionary exists


author: Debarshi Ray <rishi@fedoraproject.org> - 3.8.5-8
changelog:
  - Fix the patch to preview encrypted PDFs
  - Fix the patch to protect against spurious view-as signals
    Resolves: #959175


author: Ondrej Holy <oholy@redhat.com> - 3.14.1-1
changelog:
  - Update to 3.14.1
  - Remove obsolete upstream patch
  - Add translations updates from upstream
  - Resolves: #1174557


author: Daiki Ueno <dueno@redhat.com> - 3.33.0-1
changelog:
  - Rebase to NSS 3.33
  - Disable TLS 1.3, temporarily disable failing gtests (Skip13Variants)
  - Temporarily disable race.patch and nss-3.16-token-init-race.patch,
    which causes a deadlock in newly added test cases
  - Remove upstreamed patches: moz-1320932.patch,
    nss-tstclnt-optspec.patch,
    nss-1334976-1336487-1345083-ca-2.14.patch, nss-alert-handler.patch,
    nss-tools-sha256-default.patch, nss-is-token-present-race.patch,
    nss-pk12util.patch, nss-ssl3gthr.patch, and nss-transcript.patch


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-79.el7
changelog:
  - kvm-libcacard-link-against-qemu-error.o-for-error_report.patch [bz#1088176]
  - kvm-error-Add-error_abort.patch [bz#1088176]
  - kvm-blockdev-Fail-blockdev-add-with-encrypted-images.patch [bz#1088176]
  - kvm-blockdev-Fix-NULL-pointer-dereference-in-blockdev-ad.patch [bz#1088176]
  - kvm-qemu-iotests-Test-a-few-blockdev-add-error-cases.patch [bz#1088176]
  - kvm-block-Add-errp-to-bdrv_new.patch [bz#1088176]
  - kvm-qemu-img-Avoid-duplicate-block-device-IDs.patch [bz#1088176]
  - kvm-block-Catch-duplicate-IDs-in-bdrv_new.patch [bz#1088176]
  - kvm-qemu-img-Allow-source-cache-mode-specification.patch [bz#1138691]
  - kvm-qemu-img-Allow-cache-mode-specification-for-amend.patch [bz#1138691]
  - kvm-qemu-img-clarify-src_cache-option-documentation.patch [bz#1138691]
  - kvm-qemu-img-fix-rebase-src_cache-option-documentation.patch [bz#1138691]
  - kvm-qemu-img-fix-img_compare-flags-error-path.patch [bz#1138691]
  - kvm-ac97-register-reset-via-qom.patch [bz#1141667]
  - kvm-virtio-blk-Factor-common-checks-out-of-virtio_blk_ha.patch [bz#1085232]
  - kvm-virtio-blk-Bypass-error-action-and-I-O-accounting-on.patch [bz#1085232]
  - kvm-virtio-blk-Treat-read-write-beyond-end-as-invalid.patch [bz#1085232]
  - kvm-ide-Treat-read-write-beyond-end-as-invalid.patch [bz#1085232]
  - kvm-ide-only-constrain-read-write-requests-to-drive-size.patch [bz#1085232]
  - Resolves: bz#1085232
    (Ilegal guest requests on block devices pause the VM)
  - Resolves: bz#1088176
    (QEMU fail to check whether duplicate ID for block device drive using 'blockdev-add' to hotplug)
  - Resolves: bz#1138691
    (Allow qemu-img to bypass the host cache (check, compare, convert, rebase, amend))
  - Resolves: bz#1141667
    (Qemu crashed if reboot guest after hot remove AC97 sound device)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-80.el7
changelog:
  - kvm-dump-RHEL-specific-fix-for-CPUState-bug-introduced-b.patch [bz#1161563]
  - kvm-dump-guest-memory-Check-for-the-correct-return-value.patch [bz#1157798]
  - kvm-dump-const-qualify-the-buf-of-WriteCoreDumpFunction.patch [bz#1157798]
  - kvm-dump-add-argument-to-write_elfxx_notes.patch [bz#1157798]
  - kvm-dump-add-API-to-write-header-of-flatten-format.patch [bz#1157798]
  - kvm-dump-add-API-to-write-vmcore.patch [bz#1157798]
  - kvm-dump-add-API-to-write-elf-notes-to-buffer.patch [bz#1157798]
  - kvm-dump-add-support-for-lzo-snappy.patch [bz#1157798]
  - kvm-RPM-spec-build-qemu-kvm-with-lzo-and-snappy-enabled-.patch [bz#1157798]
  - kvm-dump-add-members-to-DumpState-and-init-some-of-them.patch [bz#1157798]
  - kvm-dump-add-API-to-write-dump-header.patch [bz#1157798]
  - kvm-dump-add-API-to-write-dump_bitmap.patch [bz#1157798]
  - kvm-dump-add-APIs-to-operate-DataCache.patch [bz#1157798]
  - kvm-dump-add-API-to-write-dump-pages.patch [bz#1157798]
  - kvm-dump-Drop-qmp_dump_guest_memory-stub-and-build-for-a.patch [bz#1157798]
  - kvm-dump-make-kdump-compressed-format-available-for-dump.patch [bz#1157798]
  - kvm-Define-the-architecture-for-compressed-dump-format.patch [bz#1157798]
  - kvm-dump-add-query-dump-guest-memory-capability-command.patch [bz#1157798]
  - kvm-dump-Drop-pointless-error_is_set-DumpState-member-er.patch [bz#1157798]
  - kvm-dump-fill-in-the-flat-header-signature-more-pleasing.patch [bz#1157798]
  - kvm-dump-simplify-write_start_flat_header.patch [bz#1157798]
  - kvm-dump-eliminate-DumpState.page_shift-guest-s-page-shi.patch [bz#1157798]
  - kvm-dump-eliminate-DumpState.page_size-guest-s-page-size.patch [bz#1157798]
  - kvm-dump-select-header-bitness-based-on-ELF-class-not-EL.patch [bz#1157798]
  - kvm-dump-hoist-lzo_init-from-get_len_buf_out-to-dump_ini.patch [bz#1157798]
  - kvm-dump-simplify-get_len_buf_out.patch [bz#1157798]
  - kvm-rename-parse_enum_option-to-qapi_enum_parse-and-make.patch [bz#1087724]
  - kvm-qapi-introduce-PreallocMode-and-new-PreallocModes-fu.patch [bz#1087724]
  - kvm-raw-posix-Add-falloc-and-full-preallocation-option.patch [bz#1087724]
  - kvm-qcow2-Add-falloc-and-full-preallocation-option.patch [bz#1087724]
  - kvm-vga-fix-invalid-read-after-free.patch [bz#1161890]
  - kvm-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch [bz#1140618]
  - kvm-vnc-sanitize-bits_per_pixel-from-the-client.patch [bz#1157645]
  - kvm-spice-call-qemu_spice_set_passwd-during-init.patch [bz#1138639]
  - kvm-block-raw-posix-Try-both-FIEMAP-and-SEEK_HOLE.patch [bz#1160237]
  - kvm-block-raw-posix-Fix-disk-corruption-in-try_fiemap.patch [bz#1160237]
  - kvm-block-raw-posix-use-seek_hole-ahead-of-fiemap.patch [bz#1160237]
  - kvm-raw-posix-Fix-raw_co_get_block_status-after-EOF.patch [bz#1160237]
  - kvm-raw-posix-raw_co_get_block_status-return-value.patch [bz#1160237]
  - kvm-raw-posix-SEEK_HOLE-suffices-get-rid-of-FIEMAP.patch [bz#1160237]
  - kvm-raw-posix-The-SEEK_HOLE-code-is-flawed-rewrite-it.patch [bz#1160237]
  - Resolves: bz#1087724
    ([Fujitsu 7.1 FEAT]: qemu-img should use fallocate() system call for "preallocation=full" option)
  - Resolves: bz#1138639
    (fail to login spice session with password + expire time)
  - Resolves: bz#1140618
    (Should replace "qemu-system-i386" by "/usr/libexec/qemu-kvm" in manpage of qemu-kvm for our official qemu-kvm build)
  - Resolves: bz#1157645
    (CVE-2014-7815 qemu-kvm: qemu: vnc: insufficient bits_per_pixel from the client sanitization [rhel-7.1])
  - Resolves: bz#1157798
    ([FEAT RHEL7.1]: qemu: Support compression for dump-guest-memory command)
  - Resolves: bz#1160237
    (qemu-img convert intermittently corrupts output images)
  - Resolves: bz#1161563
    (invalid QEMU NOTEs in vmcore that is dumped for multi-VCPU guests)
  - Resolves: bz#1161890
    ([abrt] qemu-kvm: pixman_image_get_data(): qemu-kvm killed by SIGSEGV)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-81.el7
changelog:
  - kvm-migration-static-variables-will-not-be-reset-at-seco.patch [bz#1071776]
  - kvm-vfio-pci-Add-debug-config-options-to-disable-MSI-X-K.patch [bz#1098976]
  - kvm-vfio-correct-debug-macro-typo.patch [bz#1098976]
  - kvm-vfio-pci-Fix-MSI-X-debug-code.patch [bz#1098976]
  - kvm-vfio-pci-Fix-MSI-X-masking-performance.patch [bz#1098976]
  - kvm-vfio-Fix-MSI-X-vector-expansion.patch [bz#1098976]
  - kvm-vfio-Don-t-cache-MSIMessage.patch [bz#1098976]
  - Resolves: bz#1071776
    (Migration "expected downtime" does not refresh after reset to a new value)
  - Resolves: bz#1098976
    (2x RHEL 5.10 VM running on RHEL 7 KVM have low TCP_STREAM throughput)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-82.el7
changelog:
  - kvm-hw-pci-fixed-error-flow-in-pci_qdev_init.patch [bz#1046007]
  - kvm-hw-pci-fixed-hotplug-crash-when-using-rombar-0-with-.patch [bz#1046007]
  - Resolves: bz#1046007
    (qemu-kvm aborted when hot plug PCI device to guest with romfile and rombar=0)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-83.el7
changelog:
  - kvm-xhci-add-sanity-checks-to-xhci_lookup_uport.patch [bz#1074219]
  - kvm-Revert-Build-ceph-rbd-only-for-rhev.patch [bz#1140742]
  - kvm-Revert-rbd-Only-look-for-qemu-specific-copy-of-librb.patch [bz#1140742]
  - kvm-Revert-rbd-link-and-load-librbd-dynamically.patch [bz#1140742]
  - kvm-spec-Enable-rbd-driver-add-dependency.patch [bz#1140742]
  - Resolves: bz#1074219
    (qemu core dump when install a RHEL.7 guest(xhci) with migration)
  - Resolves: bz#1140742
    (Enable native support for Ceph)


author: Jeff E. Nelson <jen@redhat.com> - 1.5.3-84.el7
changelog:
  - kvm-qemu-iotests-Test-case-for-backing-file-deletion.patch [bz#1002493]
  - kvm-qemu-iotests-Add-sample-image-and-test-for-VMDK-vers.patch [bz#1134237]
  - kvm-vmdk-Check-VMFS-extent-line-field-number.patch [bz#1134237]
  - kvm-qemu-iotests-Introduce-_unsupported_imgopts.patch [bz#1002493]
  - kvm-qemu-iotests-Add-_unsupported_imgopts-for-vmdk-subfo.patch [bz#1002493]
  - kvm-vmdk-Fix-big-flat-extent-IO.patch [bz#1134241]
  - kvm-vmdk-Check-for-overhead-when-opening.patch [bz#1134251]
  - kvm-block-vmdk-add-basic-.bdrv_check-support.patch [bz#1134251]
  - kvm-qemu-iotest-Make-077-raw-only.patch [bz#1134237]
  - kvm-qemu-iotests-Don-t-run-005-on-vmdk-split-formats.patch [bz#1002493]
  - kvm-vmdk-extract-vmdk_read_desc.patch [bz#1134251]
  - kvm-vmdk-push-vmdk_read_desc-up-to-caller.patch [bz#1134251]
  - kvm-vmdk-do-not-try-opening-a-file-as-both-image-and-des.patch [bz#1134251]
  - kvm-vmdk-correctly-propagate-errors.patch [bz#1134251]
  - kvm-block-vmdk-do-not-report-file-offset-for-compressed-.patch [bz#1134251]
  - kvm-vmdk-Fix-d-and-lld-to-PRI-in-format-strings.patch [bz#1134251]
  - kvm-vmdk-Fix-x-to-PRIx32-in-format-strings-for-cid.patch [bz#1134251]
  - kvm-qemu-img-Convert-by-cluster-size-if-target-is-compre.patch [bz#1134283]
  - kvm-vmdk-Implement-.bdrv_write_compressed.patch [bz#1134283]
  - kvm-vmdk-Implement-.bdrv_get_info.patch [bz#1134283]
  - kvm-qemu-iotests-Test-converting-to-streamOptimized-from.patch [bz#1134283]
  - kvm-vmdk-Fix-local_err-in-vmdk_create.patch [bz#1134283]
  - kvm-fpu-softfloat-drop-INLINE-macro.patch [bz#1002493]
  - kvm-block-New-bdrv_nb_sectors.patch [bz#1002493]
  - kvm-vmdk-Optimize-cluster-allocation.patch [bz#1002493]
  - kvm-vmdk-Handle-failure-for-potentially-large-allocation.patch [bz#1002493]
  - kvm-vmdk-Use-bdrv_nb_sectors-where-sectors-not-bytes-are.patch [bz#1002493]
  - kvm-vmdk-fix-vmdk_parse_extents-extent_file-leaks.patch [bz#1002493]
  - kvm-vmdk-fix-buf-leak-in-vmdk_parse_extents.patch [bz#1002493]
  - kvm-vmdk-Fix-integer-overflow-in-offset-calculation.patch [bz#1002493]
  - kvm-migration-fix-parameter-validation-on-ram-load-CVE-2.patch [bz#1163078]
  - Resolves: bz#1002493
    (qemu-img convert rate about 100k/second from qcow2/raw to vmdk format on nfs system file)
  - Resolves: bz#1134237
    (Opening malformed VMDK description file should fail)
  - Resolves: bz#1134241
    (QEMU fails to correctly read/write on VMDK with big flat extent)
  - Resolves: bz#1134251
    (Opening an obviously truncated VMDK image should fail)
  - Resolves: bz#1134283
    (qemu-img convert from ISO to streamOptimized fails)
  - Resolves: bz#1163078
    (CVE-2014-7840 qemu-kvm: qemu: insufficient parameter validation during ram load [rhel-7.1])


author: Jeff E. Nelson <jen@redhat.com> - 1.5.3-85.el7
changelog:
  - kvm-block-delete-cow-block-driver.patch [bz#1175325]
  - Resolves: bz#1175325
    (Delete cow block driver)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-86.el7
changelog:
  - kvm-vfio-pci-Fix-interrupt-disabling.patch [bz#1180942]
  - kvm-cirrus-fix-blit-region-check.patch [bz#1169456]
  - kvm-cirrus-don-t-overflow-CirrusVGAState-cirrus_bltbuf.patch [bz#1169456]
  - Resolves: bz#1169456
    (CVE-2014-8106 qemu-kvm: qemu: cirrus: insufficient blit region checks [rhel-7.1])
  - Resolves: bz#1180942
    (qemu core dumped when unhotplug gpu card assigned to guest)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-86.el7_1.1
changelog:
  - kvm-pc-add-rhel6.6.0-machine-type.patch [bz#1198958]
  - Resolves: bz#1198958
    (Add rhel-6.6.0 machine type to RHEL 7.1.z to support RHEL 6.6 to RHEL 7.1 live migration)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-86.el7_1.2
changelog:
  - kvm-fdc-force-the-fifo-access-to-be-in-bounds-of-the-all.patch [bz#1219269]
  - Resolves: bz#1219269
    (EMBARGOED CVE-2015-3456 qemu-kvm: qemu: floppy disk controller flaw [rhel-7.1.z])


author: Kalev Lember <kalev@smartlink.ee> - 3.1.1-1
changelog:
  - Update to 3.1.1
  - Dropped CVE-2009-1885 patch.
  - Use dos2unix -k instead of unrecognized option -U
  - Removed the multilib conflict workaround as Xerces_autoconf_config.hpp
    no longer contains the conflicting XERCES_SIZEOF_LONG define.


author: Honggang Li <honli@redhat.com> - 3.3.15-3
changelog:
  - Package up libosmcomp.so.3* to fix dependency issue after rebase
    opensm to release 3.3.21
  - Resolves: bz1670692


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-2 + 0.9.3-9
changelog:
  - slightly change systemd units logic - use sshd-keygen.service (#1066615)
  - log when a client requests an interactive session and only sftp is allowed (#1130198)
  - sshd-keygen - don't generate DSA and ED25519 host keys in FIPS mode (#1143867)


author: Peter Hatina <phatina@redhat.com> - 1.10.3-8
changelog:
  - remove last data source due to HTTP dissector, which was
    spewing too much output
  - Related: #1011339


author: Peter Hatina <phatina@redhat.com> - 1.10.3-9
changelog:
  - security patches
  - Resolves: CVE-2014-2281
              CVE-2014-2282
              CVE-2014-2283
              CVE-2014-2299


author: Peter Hatina <phatina@redhat.com> - 1.10.3-11
changelog:
  - security patches
  - Resolves: CVE-2014-6421
              CVE-2014-6423
              CVE-2014-6424
              CVE-2014-6425
              CVE-2014-6426
              CVE-2014-6427
              CVE-2014-6428
              CVE-2014-6429


author: Akira TAGOH <tagoh@redhat.com> - 1.6.3-10
changelog:
  - Fix a regression imsettings can't detect GNOME running caused by GNOME rebase. (#1533772)
  - Fix unbound variable issue (#1533050)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-9
changelog:
  - fixed potential memory leak on realloc failure when processing 'extend'
    option (#978384)
  - added precise enumeration of configuration files searched to
    snmp_config(5) man page (#978398)
  - set permissions of snmpd.conf and snmptrapd conf to 0600 (#919240)
  - fixed kernel threads in hrSWRunTable (#979329)
  - fixed snmpd crashing in the middle of agentx request processing when
    a subagent disconnects (#969061)
  - updated UCD-SNMP-MIB::dskTable to dynamically add/remove disks if
    'includeAllDisks' is specified in snmpd.conf (#982644)
  - fixed crash in extTable on empty command line (#955609)
  - lowered severity of few debugging messages in dot3statsTable (#915302)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-11
changelog:
  - fixed parsing of integer variable sizes (#953926, #983116)
  - added support of simfs and vzfs to hrStorageTable (#861152, #989498)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-14
changelog:
  - move tmpfiles.d config file to /usr/lib (#881218)
  - fixed dashes in net-snmp-config.h (#1038642)
  - fixed snmpd crashing on monitor trigger evaluation (#1050971)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-17
changelog:
  - fixed various error codes in Python module (#1064338)
  - fixed net-snmp-config.h header file (#1064437)


author: Paul Wouters <pwouters@redhat.com> - 2.0.0b1-2
changelog:
  - Change install directory to /usr/lib*/pkcs11/
  - Install pkcs11 module file
  - Use official upstream tar ball
  - Create ods user to own softhsm/token files
  - Enable migration tools (for epel6 softhsm-v1 installs)
  - Require p11-kit, nss-tools, for SoftHSM PKCS #11 Module file
  - Copy pk11install.c from coolkey package which is not built on all arches
  - Enable hardened build
  - Add upstream official source url
  - Add devel package
  - Excluding i686/ppc (make check fails and we are a leave package)
  - (thanks to Petr for jumping in for the initial build while I was too busy)


author: Paul Wouters <pwouters@redhat.com> - 2.0.0b1-3
changelog:
  - Fix softhsm2-pk11install buid and post call
  - Do not use --with-objectstore-backend-db (causes issues on i686)


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.3-1
changelog:
  - Bumped to 1.5.3
  - Deleted ibus-xx-g-s-disable-preedit.patch as EOL.
  - Deleted ibus-gjs as EOL.
  - Removed imsettings-gnome, im-chooser, libgnomekbd dependencies.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.3-6
changelog:
  - Resolves: #1051389, #1051391, #1051408, #1051397, #1051398, #1051415,
                Updated ibus-HEAD.patch for upstream
  - Resolves: #1050813
    Deleted notify-python in Requires


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.3-12
changelog:
  - Resolves: #1183909 - programs using "PreeditType: OverTheSpot" is stalled
  - Resolves: #1191825 - gtk2's immodules.cache won't be updated in some cases


author: Jon Ciesla <limburgher@gmail.com> - 4.5-5
changelog:
  - Add systemd unit file, BZ 916628.
  - Drop spurious post scripts.
  - Move eveything but man pages and license files top -docs.


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-54.10
changelog:
  - nfsserver: fix nfs-idmapd fails to start due to var-lib-nfs-rpc_pipefs.mount being active

    Resolves: rhbz#1332435


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.1.1.el7]
changelog:
  - [crypto] testmgr: mark rfc4106(gcm(aes)) as fips_allowed (Jarod Wilson) [1197751 1185400]
  - [virt] storvsc: ring buffer failures may result in I/O freeze (Vitaly Kuznetsov) [1197749 1171409]
  - [md] dm-thin: don't allow messages to be sent to a pool target in READ_ONLY or FAIL mode (Mike Snitzer) [1197745 1184592]
  - [kernel] workqueue: fix subtle pool management issue which can stall whole worker_pool (Eric Sandeen) [1197744 1165535]
  - [platform] thinkpad_acpi: support new BIOS version string pattern (Benjamin Tissoires) [1197743 1194830]
  - [x86] ioapic: kcrash: Prevent crash_kexec() from deadlocking on ioapic_lock (Baoquan He) [1197742 1182424]
  - [net] sctp: fix slab corruption from use after free on INIT collisions (Daniel Borkmann) [1196588 1183959] {CVE-2015-1421}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.2.1.el7]
changelog:
  - [char] tpm: Added Little Endian support to vtpm module (Steve Best) [1207051 1189017]
  - [powerpc] pseries: Fix endian problems with LE migration (Steve Best) [1207050 1183198]
  - [iommu] vt-d: Work around broken RMRR firmware entries (Myron Stowe) [1205303 1195802]
  - [iommu] vt-d: Store bus information in RMRR PCI device path (Myron Stowe) [1205303 1195802]
  - [s390] zcrypt: enable s390 hwrng to seed kernel entropy (Hendrik Brueckner) [1205300 1196398]
  - [s390] zcrypt: improve device probing for zcrypt adapter cards (Hendrik Brueckner) [1205300 1196398]
  - [net] team: fix possible null pointer dereference in team_handle_frame (Jiri Pirko) [1202359 1188496]
  - [fs] fsnotify: fix handling of renames in audit (Paul Moore) [1202358 1191562]
  - [net] openvswitch: Fix net exit (Jiri Benc) [1202357 1200859]
  - [fs] gfs2: Move gfs2_file_splice_write outside of #ifdef (Robert S Peterson) [1201256 1193910]
  - [fs] gfs2: Allocate reservation during splice_write (Robert S Peterson) [1201256 1193910]
  - [crypto] aesni: fix "by8" variant for 128 bit keys (Herbert Xu) [1201254 1174971]
  - [crypto] aesni: remove unused defines in "by8" variant (Herbert Xu) [1201254 1174971]
  - [crypto] aesni: fix counter overflow handling in "by8" variant (Herbert Xu) [1201254 1174971]
  - [crypto] aes: AES CTR x86_64 "by8" AVX optimization (Herbert Xu) [1201254 1174971]
  - [kernel] audit: restore AUDIT_LOGINUID unset ABI (Richard Guy Briggs) [1197748 1120491]
  - [kernel] audit: replace getname()/putname() hacks with reference counters (Paul Moore) [1197746 1155208]
  - [kernel] audit: fix filename matching in __audit_inode() and __audit_inode_child() (Paul Moore) [1197746 1155208]
  - [kernel] audit: enable filename recording via getname_kernel() (Paul Moore) [1197746 1155208]
  - [fs] namei: simpler calling conventions for filename_mountpoint() (Paul Moore) [1197746 1155208]
  - [fs] namei: create proper filename objects using getname_kernel() (Paul Moore) [1197746 1155208]
  - [fs] namei: rework getname_kernel to handle up to PATH_MAX sized filenames (Paul Moore) [1197746 1155208]
  - [fs] namei: cut down the number of do_path_lookup() callers (Paul Moore) [1197746 1155208]
  - [fs] execve: use 'struct filename *' for executable name passing (Paul Moore) [1197746 1155208]
  - [infiniband] core: Prevent integer overflow in ib_umem_get address arithmetic (Doug Ledford) [1181177 1179347] {CVE-2014-8159}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.7.2.el7]
changelog:
  - [fs] pipe: fix pipe corruption and iovec overrun on partial copy (Seth Jennings) [1202861 1198843] {CVE-2015-1805}


author: Tim Waugh <twaugh@redhat.com> - 1.0.35-6
changelog:
  - Set cost for text filters to 200 so that the paps filter gets
    preference for the time being (bug #988909).


author: Michal Sekletar <msekleta@redhat.com> - 0.17-71
changelog:
  - resolves: RHBZ #737244 #896583 #947213
  - migrate from xinetd to systemd configuration
  - close pam session correctly when client does not ask for separate error channel
  - fix pty handling which was broken by changes in /bin/login


author: Michal Sekletar <msekleta@redhat.com> - 0.17-72
changelog:
  - unit files must not be marked as config files
  - fix handling of non-native IPv6 connections via AF_INET6 socket


author: William Cohen <wcohen@redhat.com> - 0.9.9-17
changelog:
  - Define some  Intel broadwell default unit masks by names
  - Add support for Harrisonville (Denverton SoC)
  - Add support for Skylake-SP server
  - Add support for Kabylake-U/Y
  - Add support for Kabylake-H/S
  - Make Nehalem, Westmere, and Haswell event names unique.


author: William Cohen <wcohen@redhat.com> - 0.9.9-22
changelog:
  - Update ppc64/ppc64le support. rhbz1385007
  - Add recognition check for POWER8NV and POWER8NVL. rhbz1426426


author: dwalsh <dwalsh@redhat.com> - 0.1.25-2.git2e8377a7
changelog:
  -  Add manifest type conversion to skopeo copy
  -  User can select from 3 manifest types: oci, v2s1, or v2s2
  -   e.g skopeo copy --format v2s1 --compress-blobs docker-archive:alp.tar dir:my-directory


author: dwalsh <dwalsh@redhat.com> - 0.1.29-2.git
changelog:
  - bump to 0.1.29-1
  - Updated containers/image
      docker-archive generates docker legacy compatible images
      Do not create $DiffID subdirectories for layers with no configs
      Ensure the layer IDs in legacy docker/tarfile metadata are unique
      docker-archive: repeated layers are symlinked in the tar file
      sysregistries: remove all trailing slashes
      Improve docker/* error messages
      Fix failure to make auth directory
      Create a new slice in Schema1.UpdateLayerInfos
      Drop unused storageImageDestination.{image,systemContext}
      Load a *storage.Image only once in storageImageSource
      Support gzip for docker-archive files
      Remove .tar extension from blob and config file names
      ostree, src: support copy of compressed layers
      ostree: re-pull layer if it misses uncompressed_digest|uncompressed_size
      image: fix docker schema v1 -> OCI conversion
      Add /etc/containers/certs.d as default certs directory


author: Daiki Ueno <dueno@redhat.com> - 1.4.2-3
changelog:
  - Remove have_bridge_hotkey and need_pygobject3 macros which does no
    longer make sense after F17
  - Add ibus-hangul-dconf-prefix.patch
  - Fix bug 909509 - Hangul Keybaord doesn't be changed in IBusHangul Setup


author: Daiki Ueno <dueno@redhat.com> - 1.4.2-7
changelog:
  - Invoke ibus-setup-hangul with the absolute path.
  - Fix bug 1012732 - Click ibus hangul setup on gnome-shell top bar's
    ibus -> No Response


author: Peter Schiffer <pschiffe@redhat.com> - 12.5-7
changelog:
  - cleaned .spec file
  - resolves: #805410
    fixed SIGSEGV crash in which_protocol() function
  - updated get-upstream-tarball.sh script and added it as additional source


author: Peter Schiffer <pschiffe@redhat.com> - 12.5-9
changelog:
  - related: #912785
    used -D_FILE_OFFSET_BITS=64 flag at the compile time
  - return error code when TMPDIR is set to an invalid path while sending email
  - added missing -v option to the usage message


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-7
changelog:
  - Resolves: #1256840 [webui] majority of required fields is no longer marked as
    required
    - fix missing information in object metadata
  - Resolves: #1256842 [webui] no option to choose trust type when creating a
    trust
    - webui: add option to establish bidirectional trust
  - Resolves: #1256853 Clear text passwords in KRA install log
    - Removed clear text passwords from KRA install log.
  - Resolves: #1257072 The "Standard Vault" MUST not be the default and must be
    discouraged
    - vault: change default vault type to symmetric
  - Resolves: #1257163 renaming certificatte profile with --rename option leads
    to integrity issues
    - certprofile: prevent rename (modrdn)


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-8
changelog:
  - Resolves: #1254689 Storing big file as a secret in vault raises traceback
    - vault: Limit size of data stored in vault
  - Resolves: #1255880 ipactl status should distinguish between different
    pki-tomcat services
    - ipactl: Do not start/stop/restart single service multiple times


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-9
changelog:
  - Resolves: #1257074 The KRA agent cert is stored in a PEM file that is not
    tracked
    - cert renewal: Include KRA users in Dogtag LDAP update
    - cert renewal: Automatically update KRA agent PEM file
  - Resolves: #1257163 renaming certificatte profile with --rename option leads
    to integrity issues
    - certprofile: remove 'rename' option
  - Resolves: #1257968 kinit stop working after ipa-restore
    - Backup: back up the hosts file
  - Resolves: #1258926 Remove 'DNSSEC is experimental' warnings
    - DNSSEC: remove "DNSSEC is experimental" warnings
  - Resolves: #1258929 Uninstallation of IPA leaves extra entry in /etc/hosts
    - Installer: do not modify /etc/hosts before user agreement
  - Resolves: #1258944 DNSSEC daemons may deadlock when processing more than 1
    zone
    - DNSSEC: backup and restore opendnssec zone list file
    - DNSSEC: remove ccache and keytab of ipa-ods-exporter
    - DNSSEC: prevent ipa-ods-exporter from looping after service auto-restart
    - DNSSEC: Fix deadlock in ipa-ods-exporter <-> ods-enforcerd interaction
    - DNSSEC: Fix HSM synchronization in ipa-dnskeysyncd when running on DNSSEC
      key master
    - DNSSEC: Fix key metadata export
    - DNSSEC: Wrap master key using RSA OAEP instead of old PKCS v1.5.
  - Resolves: #1258964 revert to use ldapi to add kra agent in KRA install
    - Using LDAPI to setup CA and KRA agents.
  - Resolves: #1259848 server closes connection and refuses commands after
    deleting user that is still logged in
    - ldap: Make ldap2 connection management thread-safe again
  - Resolves: #1259996 AttributeError: 'NameSpace' object has no attribute
    'ra_certprofile' while ipa-ca-install
    - load RA backend plugins during standalone CA install on CA-less IPA master


author: Gris Ge <fge@redhat.com> 1.37-17
changelog:
  - Fix help documents of sg_requests, sg_senddiag and sg_write_buffer.
    (RHBZ #1359282, #1359286, #1359292)


author: Alex Wood <awood@redhat.com> 1.14.2-1
changelog:
  - 1195446: Only set global socket timeout on RHEL 5. (alikins@redhat.com)
  - Cleanup up connection logging. (alikins@redhat.com)


author: William Poteat <wpoteat@redhat.com> 1.14.3-1
changelog:
  - 1225600: Default config entry needs to include the substitution string
    (wpoteat@redhat.com)
  - Add F22 to Fedora branches. (awood@redhat.com)


author: Alex Wood <awood@redhat.com> 1.15.1-1
changelog:
  - Move Python.h include to be first include (alikins@redhat.com)
  - 1092564: Provide LDFLAGS to setup.py to enable hardened build.
    (awood@redhat.com)
  - Bump version to 1.15 (wpoteat@redhat.com)
  - Do not process proxy environment variables if host is in no_proxy
    (martin.matuska@axelspringer.de)


author: Chris Rog <crog@redhat.com> 1.15.2-1
changelog:
  - Added releaser configuration for RHEL 7.2 (crog@redhat.com)
  - Use non-deprecated Tito properties. (awood@redhat.com)


author: Adrian Likins <alikins@redhat.com> 1.15.3-1
changelog:
  - Define global_ld_flags when not already defined. (awood@redhat.com)
  - Adding tests for 202s from alikins/AsyncBind (csnyder@redhat.com)
  - Updates to accomodate candlepin/virt-who/csnyder/new_report_api
    (csnyder@redhat.com)
  - Adding jobStatus helper methods from alikins/AsyncBind (csnyder@redhat.com)
  - HypervisorCheckIn now uses the new API, if available (csnyder@redhat.com)


author: Chris Rog <crog@redhat.com> 1.15.4-3
changelog:
  - Add user-agent to rhsm requests. (alikins@redhat.com)
  - 1247890: KeyErrors are now caught when checking manager capabilities
    (csnyder@redhat.com)


author: Chris Rog <crog@redhat.com> 1.15.4-4
changelog:
  - Adds RateLimitExceededException which is raised in response to 429 from the
    remote host (csnyder@redhat.com)


author: Paolo Bonzini <pbonzini@redhat.com> - 1.7.0-3
changelog:
  - Correct license for libiscsi-utils, prefer %global to %define
  - Add Requires
  - Remove %clean section


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.0-3
changelog:
  - Fixed issues reported by coverity (bz #1026820)
  - Do not mark /etc/ld.so.conf.d/ as config (bz #1011126)
  - Resolves: #1026820 
  - Resolves: #1011126


author: Mark Wielaard <mjw@redhat.com> - 3.12.0-8
changelog:
  - Add valgrind-3.12.0-powerpc-register-pair.patch (#1437030)
  - Add valgrind-3.12.0-ppc64-isa-3_00.patch (#1437032)


author: Mark Wielaard <mjw@redhat.com> - 3.13.0-9
changelog:
  - valgrind 3.13.0 (fedora).
  - Update description.
  - Drop all upstreamed patches.
  - Add valgrind-3.13.0-ppc64-check-no-vsx.patch
  - Add valgrind-3.13.0-epoll_pwait.patch (#1462258)
  - Add valgrind-3.13.0-ppc64-diag.patch
  - Add valgrind-3.13.0-arm64-hwcap.patch (#1464211)
  - Add valgrind-3.13.0-arm-index-hardwire.patch (#1466017)
  - Add valgrind-3.13.0-ucontext_t.patch
  - Add valgrind-3.13.0-gdb-8-testfix.patch
  - Add valgrind-3.13.0-disable-vgdb-child.patch
  - Add --error-exitcode=1 to /bin/true check.
  - Add valgrind-3.13.0-xml-socket.patch
  - Add valgrind-3.13.0-ppc64-vex-fixes.patch
  - Add valgrind-3.13.0-amd64-eflags-tests.patch
  - Add valgrind-3.13.0-suppress-dl-trampoline-sse-avx.patch
  - Add valgrind-3.13.0-static-tls.patch
  - Workaround gdb/python bug in testsuite (#1434601)


author: Mark Wielaard <mjw@redhat.com> - 3.13.0-11
changelog:
  - Make building of libmpi wrapper explicit (#1530219)
  - Add valgrind-3.13.0-debug-alt-file.patch
    and valgrind-3.13.0-build-id-phdrs.patch (#1589844)
  - Add valgrind-3.13.0-s390-cgijnl.patch (#1589848)
  - Add valgrind-3.13.0-ppc64-mtfprwa-constraint.patch (#1589852)


author: Mark Wielaard <mjw@redhat.com> - 3.13.0-13
changelog:
  - Improved valgrind-3.13.0-arm64-hwcap.patch (#1593686)
  - Add valgrind-3.13.0-arm64-ptrace.patch (#1593682)


author: Peter Jones <pjones@redhat.com> - 0.10-1
changelog:
  - Update package to 0.10.
  - Fixes a build error due to different cflags in the builders vs updstream
    makefile.


author: Thomas Woerner <twoerner@redhat.com> - 2.3.4-8
changelog:
  - mwm: do not see outline of window when moving (RHBZ#1080548)
    Clone of RHBZ#997241
  - Fixed rendering issues seen while scrolling window (RHBZ#1134365)
    (MotifZone bug #1654)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-34
changelog:
  - mod_proxy_fcgi: honor Timeout / ProxyTimeout (#1222328)
  - do not show all vhosts twice in httpd -D DUMP_VHOSTS output (#1225820)
  - fix -D[efined] or <Define>[d] variables lifetime accross restarts (#1227219)
  - mod_ssl: do not send NPN extension with not configured (#1226015)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-35
changelog:
  - mod_remoteip: correct the trusted proxy match test (#1179306)
  - mod_dav: send complete response when resource is created (#1235383)
  - apachectl: correct the apachectl status man page (#1231924)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-36
changelog:
  - Revert fix for #1162152, it is not needed in RHEL7
  - mod_proxy_ajp: fix settings ProxyPass parameters for AJP backends (#1242416)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-37
changelog:
  - core: fix chunk header parsing defect (CVE-2015-3183)
  - core: replace of ap_some_auth_required with ap_some_authn_required
    and ap_force_authn hook (CVE-2015-3185)


author: Simo Sorce <ssorce@redhat.com> - 2.0.6-1
changelog:
  - New upstream release
  - Fixes various bugs with talloc_free_children and freeing complex
    hierarchies with many siblinbgs.


author: Felipe Borges <feborges@redhat.com> -1.10.5-3
changelog:
  - Add osinfo ontology to the default TrackerNamespace
  - Whitelist "openat" sys call in seccomp
  - Resolves: #1435340


author: Carlos Garnacho <cgarnach@redhat.com> - 1.10.5-4
changelog:
  - Remove WITHOUT ROWID optimizations from fts5 to preserve compat with sqlite 3.7.x
  - Resolves: #1451669


author: Carlos Garnacho <cgarnach@redhat.com> - 1.10.5-5
changelog:
  - Update to upstream 1.10.6, backporting all fixes as of yet for UNIQUE constraint nie:url errors
  - Resolves: #1430769


author: Carlos Garnacho <cgarnach@redhat.com> - 1.10.5-6
changelog:
  - Backport 1.10.6 nie:url UNIQUE constraint fixes to 1.10.5
  - Fix the previous changelog entry
  - Resolves: #1430769


author: Milan Crha <mcrha@redhat.com> - 1.0-8
changelog:
  - Add patch for OpenChange bug #397 (crash under MAPIUninitialize)
  - Disable build of python and mapiproxy


author: Miroslav Lichvar <mlichvar@redhat.com> 1.4-2.20140718gitbdb6a3
changelog:
  - add timemaster (#1085580)
  - send peer messages to correct address
  - make NTP SHM segment number configurable
  - update UDS handling to allow running multiple ptp4l/phc2sys instances
  - fix warnings from static analysis


author: Miroslav Lichvar <mlichvar@redhat.com> 1.4-3.20140718gitbdb6a3
changelog:
  - fix resetting of linreg servo (#1165045)
  - fix phc2sys automatic mode with multiple interfaces (#1108795)


author: Miroslav Lichvar <mlichvar@redhat.com> 1.8-5
changelog:
  - add support for active-backup bonding (#1002657)
  - add support for IP over InfiniBand (#1472880)
  - fix handling of unknown/invalid management TLVs in pmc (#1459446 #1459449)


author: Miroslav Lichvar <mlichvar@redhat.com> 1.8-6
changelog:
  - add support for bonding to timemaster (#1549015)
  - improve timemaster to restart terminated processes (#1527170)
  - start ptp4l, timemaster and phc2sys after network-online target (#1541991)
  - don't forward management requests to UDS port (#1520366)


author: Miroslav Lichvar <mlichvar@redhat.com> 2.0-1
changelog:
  - update to 2.0 (#1623919)
  - add support for more accurate synchronization to phc2sys (#1643977)
  - add support for active-backup team interface (#1650672)
  - limit unicast message rate per address and grant duration


author: Akemi Yagi <toracat@centos.org> [3.10.0-514.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Enabled spidev [bug#9955]
  - Add in patches from bug 10191 [bug#10191]
  - Add in a patch from bug 10320 [bug#10320]
  - Add a patch [bug#10447]
  - Enable ATM drivers [bug#10845]
  - Add 9pfs config options [bug#10849]


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-26 + 0.9.3-9
changelog:
  - Drop glob patch for sftp client preventing listing many files (#1310303)
  - Fix race condition between audit messages from different processes (#1310684)
  - Make systemd service forking to properly report state (#1291172)
  - Get rid of rpm triggers for openssh-5.x (#1312013)
  - Generate the host keys when the key files are empty (#1266043)
  - pam_ssh_agent_auth: authorized_keys_command option (#1317858)
  - Don't use MD5 digest from pam_ssh_agent_auth in FIPS mode (#1317952)


author: Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-27 + 0.9.3-9
changelog:
  - Coverity and RPMDiff build issues (#1334326)
  - CVE-2015-8325: privilege escalation via user's PAM environment and UseLogin=yes (#1329191)
  - Check for real location of .k5login file (#1328243)
  - close ControlPersist background process stderr (#1335540)


author: Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-28 + 0.9.3-9
changelog:
  - SFTP force permission collision with umask (#1344614)
  - Make closefrom() ignore FD's to /dev/ devices on s390 (#1318760)
  - Create a default value for AuthenticationMethods any (#1237129)
  - Fix ssh-copy-id with LogLevel=quiet (#1349556)
  - Expose more information to PAM (#1312304)
  - Move MAX_DISPLAYS to a configuration option (#1341302)
  - Add a wildcard option to PermitOpen directive (host) (#1344106)


author: Debarshi Ray <rishi@fedoraproject.org> - 3.14.4-2
changelog:
  - Use newer WebKit
  - Refresh the credentials during startup and network changes
  Resolves: #1174600, #1189888


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.7-1
changelog:
  - Skip btrfs min size tests on Fedora 25 (vtrefny)
  - Make sure the loop device doesn't disappear during tests (vpodzime)
  - Close the loop device when autoclear is (un)set (vpodzime)
  - Do not enforce Python 3 for running tests in CI (vpodzime)
  - Revert "Use different BTRFS_MIN_MEMBER_SIZE on aarch64" (vtrefny)
  - Use both 'old' and 'new' sysfs files to read zRAM stats (vtrefny)
  - Check if libparted-fs-resize pkgconfig is available (vpodzime)
  - Do not try to get name for inactive partitions (vtrefny)
  - Skip tests for getting free regions on CentOS/RHEL (vpodzime)
  - Free the container holding the specs of free regions (vpodzime)
  - Open loop devices as O_RDONLY when getting flags (vpodzime)
  - Resolve maximum partition size when we know its start (vpodzime)
  - Use --id instead of --part-type when setting partition id (vpodzime)
  - Fix mdadm command for removing failed device from an array (vtrefny)
  - Skip bcache tests on CentOS/RHEL 7 (vpodzime)
  - Use six.assertRaisesRegex in the FS tests (vpodzime)
  - Use mkdtemp() instead of TemporaryDirectory() (vpodzime)
  - Fix installation without specifying --exec-prefix (vpodzime)
  - Add options to force mkfs.ext4/vfat to create a FS on the whole device (vpodzime)
  - Skip the test for device escrow on CentOS/RHEL (vpodzime)
  - Define DEVNULL on our own if not in subprocess (vpodzime)
  - Remove the patches from the spec file (vpodzime)
  - Sync the spec file with downstream (vpodzime)
  - Stop skipping zRAM stats tests (vtrefny)
  - Add more tests for zRAM stats (vtrefny)
  - Fix reading zRAM properties from sysfs (vtrefny)


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.8-1
changelog:
  - Temporarily skip vfat generic resize test on rawhide (vtrefny)
  - Use "safeprobe" in "bd_fs_wipe" (vtrefny)
  - Add a generic filesystem resize function (vtrefny)
  - Add a function to get mountpoint for a device (vtrefny)
  - Add a function to get filesystem type for a device (vtrefny)
  - Only include the LVM DBus config when shipping LVM DBus (vpodzime)
  - Skip the LVM DBus vgreduce tests on Rawhide (vpodzime)
  - Do not build the lvm-dbus plugin on RHEL/CentOS (vpodzime)
  - Give zRAM more time to settle before trying to remove a device (vpodzime)
  - Put zram tests adding/removing devices into a separate class (vpodzime)
  - Skip LVM cache and RAID tests on Rawhide (vpodzime)
  - Fix the skip_on decorator factory for tests (vpodzime)
  - Use 'blkid -p' instead of lsblk to get device's FS type (vpodzime)
  - Improve the lvm_set_global_config test (vpodzime)
  - Pass '-y' to pvresize (vpodzime)
  - Create a copy of os.environ for a child process (vpodzime)
  - Revert "Use the "C.UTF-8" locale instead of just "C"" (vpodzime)
  - Fix how we create vfat FS in tests (vpodzime)
  - Skip the test if requiring unavailable locales (vpodzime)
  - Use the "C.UTF-8" locale instead of just "C" (vpodzime)
  - Add functions for working with ext2 and ext3 filesystems (vtrefny)
  - Link to gobject when lvm or btrfs is enabled (andreas)
  - Link to libm where needed (andreas)
  - Add a function for cleaning a device (vtrefny)
  - Add few code exaples to documentation (vtrefny)
  - Use a special exception for no fs signature when doing wipe (vpodzime)
  - One more incompatible os.symlink() call (vpodzime)
  - Do not use pass-by-name in the os.symlink() call (vpodzime)
  - Ignore previous errors when falling back to using ioctl() (vpodzime)
  - Use ioctl() call to teardown loop devices (vpodzime)
  - Resolve the device to remove for mdadm (vpodzime)
  - Add a function for getting device symlinks (vpodzime)
  - Use the new resolve_device() function where appropriate (vpodzime)
  - Add the resolve_device() function to the utils library (vpodzime)
  - First try to read the 'autoclear' flag from /sys/ (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.9-1
changelog:
  - Fix hardcoded reference to gcc (timo.gurr)
  - Catch and ignore partial failures in LVM tests' cleanups (vpodzime)
  - Fix hardcoded reference to pkg-config (timo.gurr)
  - Make GObject introspection optional (vpodzime)
  - Do not link libraries required by plugins to the GI files (vpodzime)
  - Make sure the whole build status image is shown (vpodzime)
  - Show CI status in README (at the GH repo's front page) (vpodzime)
  - Always require the libudev pkg (tgurr)
  - Make sure we give kernel time to fully setup zram device(s) (vpodzime)
  - fs_test.py: Close FDs when calling utilities (tasleson)
  - crypto.c: Correct segmentation fault (tasleson)


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.10-1
changelog:
  - Only enable partition size tolerance with alignment (vpodzime)
  - Limit the requested partition size to maximum possible (vpodzime)
  - Do not verify vfat FS' size after generic resize (vpodzime)
  - Specify tolerance for partition size (kailueke)
  - Only use the exact constraint if not using any other (vpodzime)
  - Check resulting FS size in tests for generic FS resize (vpodzime)
  - Query setting FS label support and generic relabeling (kailueke)
  - Do not strictly require all FS utilities (vpodzime)
  - Compile everything with the C99 standard (vpodzime)
  - Add partition resize function (kailueke)
  - Generic Check and Repair Functions (kailueke)
  - Query functions for FS resize and repair support (kailueke)
  - Update the project/source URL in the spec file (vpodzime)
  - Add functions for opening/closing TrueCrypt/VeraCrypt volumes (vpodzime)
  - Adapt to a change in behaviour in new libmount (vpodzime)
  - Try RO mount also if we get EACCES (vpodzime)
  - Size in bytes for xfs_resize_device (kailueke)
  - src/plugins/Makefile.am: Remove hard coded include path in /usr prefix (tristan.vanberkom)
  - Fixed include for libvolume_key.h (tristan.vanberkom)
  - Ignore parted warnings if possible (squimrel)
  - bcache tests: Remove FEELINGLUCKY checks (tasleson)
  - kbd.c: Code review corrections (tasleson)
  - kbd.c: Make bd_kbd_bcache_create work without abort (tasleson)


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.11-1
changelog:
  - Make the KbdZRAMDevicesTestCase inherit from KbdZRAMTestCase (vpodzime)
  - Allow non-source directory builds (kailueke)
  - Add a way to disable runtime dependency checks (vpodzime)
  - Link to GObject even if no plugin is activated (kailueke)
  - Skip zram tests on Rawhide (vpodzime)
  - Keep most utilities available for tests (vpodzime)
  - Use new libmount function to get (un)mount error message (vtrefny)
  - Update the documentation URL (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.12-1
changelog:
  - Own directories /etc/libblockdev and /etc/libblockdev/conf.d (vtrefny)
  - Wait for resized partition (kailueke)
  - Make sure the device is opened for libparted (vpodzime)
  - Fix label check in swap_test (vtrefny)
  - Use "run_tests" script for running tests from Makefile (vtrefny)
  - Add a script for running tests (vtrefny)
  - Tests: Move library initialization to setUpClass method (vtrefny)
  - Stop skipping FAT resize tests on rawhide (vtrefny)
  - Close filesystem before closing the partition during FAT resize (vtrefny)
  - Use mountpoint for "xfs_info" calls (vtrefny)
  - Use libmount cache when parsing /proc/mounts (vtrefny)
  - Add some space for the CI status (vpodzime)
  - Confirm the force when creating PVs in FS tests (vpodzime)
  - Skip vgremove tests on 32bit Debian (vtrefny)
  - Fix names of backing files in tests (vtrefny)
  -  Fix checking for available locales (vtrefny)
  - Skip dependency checking in mpath tests on Debian (vtrefny)
  - Skip zRAM tests on Debian (vtrefny)
  - Skip the test for device escrow on Debian too (vtrefny)
  - Skip free region tests on Debian too (vtrefny)
  - Fix redirecting command output to /dev/null in tests (vtrefny)
  - Try harder to unmount devices in test cleanup (vtrefny)
  - Require only plugins that are needed for given test (vtrefny)
  - Try to get distribution info from "PrettyName" if "CPEName" isn't available (vtrefny)
  - Use -ff when creating PVs in FS tests (vpodzime)
  - Sync spec with downstream (vpodzime)


author: Ondrej Mular <omular@redhat.com> - 0.9.162-5.el7_5.1
changelog:
  - Fixed CVE-2018-1086 pcs: Debug parameter removal bypass, allowing information disclosure
  - Fixed CVE-2018-1079 pcs: Privilege escalation via authorized user malicious REST call
  - Fixed CVE-2018-1000119 rack-protection: Timing attack in authenticity_token.rb
  - Resolves: rhbz#1557253


author: Pingfan Liu <piliu@redhat.com> 2.0.15-3
changelog:
  - makedumpfile: x86_64: Take care of init_level4_pgt rename in kernel
  - makedumpfile: ppc64: get the info of mem reserved for crashkernel
  - makedumpfile: Fix SECTION_MAP_MASK for kernel >= v.13


author: Pingfan Liu <piliu@redhat.com> 2.0.15-5
changelog:
  - Revert "Update kdump anaconda addon"
  - Revert "Update kdump anaconda addon: fix the md5sum in source file"


author: Pingfan Liu <piliu@redhat.com> 2.0.15-7
changelog:
  - mkdumprd: apply dracut "--hostonly-cmdline" and "--no-hostonly-default-device"
  - Change dump_to_rootfs to use "--mount" instead of "root=X"
  - kdumpctl: move is_fadump_capable() to kdump-lib.sh
  - module-setup: fix 99kdumpbase network dependency
  - mkdumprd: change for_each_block_target() to use get_kdump_targets()
  - kdump-lib.sh: introduce get_kdump_targets()
  - kdump-lib.sh: fix improper get_block_dump_target()
  - kdumpctl: remove "root=X" for kdump boot
  - kdumpctl: fix a bug in remove_cmdline_param()


author: Pingfan Liu <piliu@redhat.com> 2.0.15-9
changelog:
  - makedumpfile: Fix 'kernel_version' variable being uninitialized & introduce minor reorganization
  - makedumpfile: Fix segmentation fault when using --split on a vmcore
  - dracut-module-setup.sh: check whether to include multipath-hostonly or not


author: Pingfan Liu <piliu@redhat.com> 2.0.15-10
changelog:
  - kexec-tools.spec: require dracut >= 033-522 to make 99kdump module installed correctly
  - kdump.sysconfig.ppc64(le): remove "root=" param from ppc64(le) 2nd kernel's command line
  - Revert "kdumpctl: sanity check of nr_cpus for x86_64 in case running out of vectors"


author: Pingfan Liu <piliu@redhat.com> 2.0.15-11
changelog:
  - dracut-module-setup.sh: temporary install /bin/grep to work around dracut's bug
  - kdump.sysconfig/x86_64: Add nokaslr to kdump kernel cmdline
  - kdumpctl: skip selinux-relabel for dracut_args --mount dump target


author: Pingfan Liu <piliu@redhat.com> 2.0.15-13
changelog:
  * Thu Feb 1 2018 Pingfan Liu <piliu@redhat.com> 2.0.15-12
  - makedumpfile/sadump: Fix a problem of PTI enabled kernel
  - makedumpfile: Fix physical-to-virtual conversion in 'exclude_segment()'


author: Tim Waugh <twaugh@redhat.com> 1.4-4
changelog:
  - Applied patches from Jiri Popelka:
    - Fix off-by-one error in call to readlink.
    - Fix possible buffer overrun found by coverity.


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20-2
changelog:
  - Fixed invalid UTF-8 byte sequence error in PCRE mode
    (by pcre-backported-fixes patch)
    Resolves: rhbz#1217080
  - Fixed buffer overrun for grep -F
    Resolves: CVE-2015-1345
  - Fixed \w and \W behaviour in multibyte locales
    Resolves: rhbz#1159012
  - Documented --fixed-regexp option
    Resolves: rhbz#1103259
  - Updated pcre buildrequires to require pcre-devel >= 7.8-7
    Related: rhbz#1217080


author: Andreas Schneider <asn@redhat.com> - 4.9.1-1
changelog:
  - resolves: #1649434 - Update to version 4.9.1
  - resolves: #1648852 - Fix out of bound array access in ctdb
  - resolves: #1647960 - Fix segfault in the debug system with hardended build
  - resolves: #1644328 - Fix segfault if wrong 'passdb backend' is configured
  - resolves: #1650452 - Add smbc_setOptionProtocols()
  - resolves: #1659513 - Fix testparm/pdbedit crash
  - resolves: #1529301 - Added new 'net ads spn' command
  - resolves: #1595277 - Fix manpage for 'net ads lookup'
  - resolves: #1600274 - Fix vfs_audit log which does not show full path names
  - resolves: #1623140 - Fix handling the 'disable netbios' option
  - resolves: #1624227 - Connect to spoolss with the correct version information
  - resolves: #1659533 - Fix new file and folder creation with vfs_glusterfs
  - resolves: #1579401 - Implement 'net ads leave --keep-account'
  - resolves: #1624227 - Fix spoolss client operations against newer Windows
                         versions
  - resolves: #1656405 - Fix looking up local system accounts


author: Andreas Schneider <asn@redhat.com> - 4.9.1-2
changelog:
  - resolves: #1674403 - Fix panic when setting 'force group' on a share with
                         an active connections
  - resolves: #1670720 - Fix installation of samba-python
  - resolves: #1669476 - Fix user lookup via UPN


author: Andreas Schneider <asn@redhat.com> - 4.9.1-3
changelog:
  - resolves: #1479451 - Fix 'net' command auth with Kerberos
  - resolves: #1686158 - Fix printing with CUPS
  - resolves: #1662408 - Fix username/password printing with CUPS


author: Andreas Schneider <asn@redhat.com> - 4.9.1-4
changelog:
  - resolves: #1690222 - Fix --max-protocol documentation of smbclient
  - resolves: #1518353 - Fix 'net ads join -Uadmin@forestdomain'
  - resolves: #1696524 - Fix CVE-2019-3880


author: Andreas Schneider <asn@redhat.com> - 4.9.1-8
changelog:
  - resolves: #1754838 - Fix username/password auth with smbspool
  - resolves: #1754835 - Fix builtin groups creation.


author: Andreas Schneider <asn@redhat.com> - 4.9.1-9
changelog:
  - resolves: #1759445 - Fix trusted domain enumeration in windind caused
                         a Active Directory update


author: Lokesh Mandvekar <lsm5@redhat.com> - 0.7.4-1
changelog:
  - Resolves: #1664009 - bump to v0.7.4
  - remove unused devel and unit-test* packages
  - update go build env


author: Jakub Martisko <jamartis@redhat.com> - 3.4.2-7
changelog:
  - fix issue with creation of srpm where __isa_bits on noarch leads to an error
  - Related: rhbz#1176026


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-5
changelog:
  - Skip the fips checks if the action is newslot or delslot.
  - Resolves: Bug 1156406 - NSS fails to access sql:/etc/pki/nssdb in system FIPS mode


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-6
changelog:
  - Update fix for flaws reported by coverity scan  
  - Resolves: Bug 1154764 - Defects found in nss-softokn


author: Robert Relyea <rrelyea@redhat.com> - 3.16.2.3-7
changelog:
  - Use RHEL-7 dracut semantics rather than RHEL-6
  - fix dependencies so nss-softokn pulls in nss-softokn-freebl
  - keep dummy libfreebl3.chk for dracut kernel.


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-8
changelog:
  - fix permissions on dracut install file.
  - Resolves: Bug 1169957 - curl unable to download url when url is https and environment is dracut


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-10
changelog:
  - Use the TLS 1.2 mechanisms for PKCS #11 added for V2.40
  - Resolves: Bug 1216909 - Need to support SHA384 TLS cipher suites


author: Robert Relyea <rrelyea@redhat.com> - 3.16.2.3-11
changelog:
  - Make sure we have enough space for generating keyblocks for ciphers with HMAC_SHA384 (TLS).
  - Resolves: Bug 1216909 - Need to support SHA384 TLS cipher suites


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-13
changelog:
  - Pick up upstream freebl patch for CVE-2015-2730
  - Check for P == Q or P ==-Q before adding P and Q


author: Tomas Hozza <thozza@redhat.com> - 1.4.20-20
changelog:
  - Install tmpfiles configuration into /usr/lib/tmpfiles.d (#1180995)
  - Fix root key management to comply to RFC5011 (#1180267)


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-7
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event
    set (RHEL) (edewata)
  - Bugzilla Bug #1522938 - CC: Missing faillure resumption detection and
    audit event logging at startup (jmagne)
  - Bugzilla Bug #1523410 -  Unable to have non "pkiuser" owned CA instance
    (alee)
  - Bugzilla Bug #1525306 - CC: missing CMC request and response record
    (cfu)
  - Bugzilla Bug #1532933 - Installing subsystems with external CMC
    certificates in HSM environment shows import error (edewata)
  - Bugzilla Bug #1535797 - ExternalCA: Failures when installed with hsm
    (edewata)
  - Bugzilla Bug #1539125 - restrict default cipher suite to those ciphers
    permitted in fips mode (mharmsen)
  - Bugzilla Bug #1539198 - Inconsistent CERT_REQUEST_PROCESSED
    outcomes. (edewata)
  - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in
    SharedToken scenario's (cfu)
  - Bugzilla Bug #1541526 - CMC: Revocation works with an unknown
    revRequest.issuer (cfu)
  - Bugzilla Bug #1541853 - ProfileService: config values with
    backslashes have backslashes removed (ftweedal)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,
    - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit
    - # Bugzilla Bug #1501436 - TPS CS.cfg should be reflected with the


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-8
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1542210 - pki console configurations that involves ldap
    passwords leave the plain text password in debug logs (jmagne)
  - Bugzilla Bug #1543242 - Regression in lightweight CA key replication
    (ftweedal)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-9
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event
    set (RHEL) (edewata)
  - Bugzilla Bug #1532867 - Inconsistent key ID encoding (edewata)
  - Bugzilla Bug #1540687 - CC: External OCSP Installation failure with HSM
    and FIPS (edewata)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,
    - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit event


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-10
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1550581 - CMCAuth throws
    org.mozilla.jss.crypto.TokenException: Unable to insert certificate into
    temporary database [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1551067 - [MAN] Add --skip-configuration
    and --skip-installation into pkispawn man page. [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1552241 - Make sslget aware of TLSv1_2 ciphers
    [rhel-7.5.z] (cheimes, mharmsen)
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry
    in a certifcate [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for
    standard conformance [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1554727 - Permit additional FIPS ciphers to be enabled
    by default for RSA . . . [rhel-7.5.z] (mharmsen, cfu)
  - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools
    CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1557883 - Console: Adding ACL from pki-console gives
    StringIndexOutOfBoundsException [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1558919 - Not able to generate certificate request
    with ECC using pki client-cert-request [rhel-7.5.z] (akahat)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1560233 - libtps does not directly depend on libz


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-14
changelog:
  - Updated "jss" build and runtime requirements (mharmsen)
  - Updated "tomcatjss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1593585 - Need proper default subjectDN for CMC request
    authenticated through SharedToken [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1594128 - CMC: Audit Events needed for failures in
    SharedToken scenario's [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1595606 - AuditVerify failure due to line breaks
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1596525 - Address ECC profile overrides [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1596551 - X500Name.directoryStringEncodingOrder overridden
    by CSR encoding [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry in a
    certifcate [rhel-7.5.z] (ftweedal)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-15
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1600905 - pki console configurations that involves ldap
    passwords leave the plain text password in signed audit logs
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1611245 - Certificate generation happens with partial
    attributes in CMCRequest file [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1611250 - Better understanding of
    NSS_USE_DECODED_CKA_EC_POINT for ECC [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1612880 - CMC Revocations throws exception with
    same reqIssuer & certissuer [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1614837 - ipa-replica-install --setup-kra broken on
    DL0 with latest version [rhel-7.5.z] (abokovoy)
  - Bugzilla Bug #1614839 - CC: Enable all config audit events
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1615266 - ECC keys not supported for signing audit
    logs [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1539933 - keyGen fails when only Identity


author: Ryan McCabe <rmccabe@redhat.com> - 0.3.2-13
changelog:
  - fence_virtd: Make the libvirt backend survive libvirtd restarts
    Resolves: rhbz#1384181
  - fence_xvm/fence_virt: Add support for the validate-all status
    Resolves: rhbz#1447700


author: Joe Orton <jorton@redhat.com> - 2.4.6-13
changelog:
  - mod_ssl: sanity-check use of "SSLCompression" (#1036666)
  - mod_proxy_http: fix brigade memory usage (#1040447)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-17
changelog:
  - mod_dav: add security fix for CVE-2013-6438 (#1077907)
  - mod_log_config: add security fix for CVE-2014-0098 (#1077907)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-18
changelog:
  - mod_cgid: add security fix for CVE-2014-0231 (#1120607)
  - mod_proxy: add security fix for CVE-2014-0117 (#1120607)
  - mod_deflate: add security fix for CVE-2014-0118 (#1120607)
  - mod_status: add security fix for CVE-2014-0226 (#1120607)
  - mod_cache: add secutiry fix for CVE-2013-4352 (#1120607)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-19
changelog:
  - mod_proxy_fcgi: determine if FCGI_CONN_CLOSE should be enabled
    instead of hardcoding it (#1170217)
  - mod_proxy: support Unix Domain Sockets (#1170286)


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.0.11-90
changelog:
  - fence_gce: new fence agent
    Resolves: rhbz#1568753
  - fence_rhevm: dont require --ssl parameter when using --ssl-insecure
    Resolves: rhbz#1544093
  - fence_mpath: fix preemptive abort
    Resolves: rhbz#1556857
  - fence-agents-all: dont show manpage-tags in metadata
    Resolves: rhbz#1553908
  - fence_scsi: dont write duplicates to .dev-file
    Resolves: rhbz#1575973
  - fence_impilan: add iLO5-support
    Resolves: rhbz#1579391


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-1
changelog:
  - rebase to v4.2.1
    Resolves: rhbz#1236395
  - fence_mpath: add watchdog support
    Resolves: rhbz#1504202


author: Avesh Agarwal <avagarwa@redhat.com> - 0.9.8.0-2
changelog:
  - Fixed rhbz#921061
  - Fixed rhbz#999353
  - Fixed rhbz#1035786
  - Fixed rhbz#1014830
  - Fixes 1035786 (and its duplicate 1040924)
  - Fixed 926225
  - Fixed dependency to libreswan.
  - Created a new sub package NetworkManager-openswan-gnome
  - Various other spec file fixes.
  - Additional code changes are as follows:
  - Fixed an issue where proper network stack is not loaded unless
    _stackmanager is run before starting pluto daemon service.
  - Fixed the termination operation of pluto daemon to comply with
    libreswan changes.
  - Fixed various debug messages.
  - Fixed initiation of pluto daemon by this plugin to reflect the
    changes in libreaswan.
  - Fixed defaults values for more parameters to help the VPN
    connection stay more reliable.
  - Rewrote pluto watch API which watches the pluto process for its status.
    Fixed memory leak issues as not all child processes were reaped correctly.
    Also g_spwan_close_pid was not being called after children were reaped.
    Also modified debugs and added more to help with debugging in the future.
  - Fixed an issue where nm-openswan service is searching for ipsec binary in
    both /sbin and /usr/sbin leading to same operation twice, as /sbin is just
    symlink to /usr/sbin, so removed /sbin from the search paths.
  - Fixed some libreswan related macro changes.
  - Fixed netmask issue when sending IP information to the nm openswan
    plugin service.
  - Fixed the current code as it does not set the default route field
    NM_VPN_PLUGIN_IP4_CONFIG_NEVER_DEFAULT when sending VPN information
    to nm-openswan plugin. This fix sets the field to TRUE.
  - Fixed some issues found by coverity scan.
  - Fixed an issue where writing configuration on stdin should not end with
    \n as it gives error. It used to work previously, but not with latest
    NetworkManager versions.
  - libreswan related fixes, as some macros have been modified after forking
    to libreswan from openswan.
  - openswan/libreswan does not provide tun0 interface, so fixed the code
    where it sends tun0 interface.
  - Fix prcoessing of nm-openswan-dialog.ui file and added more error notifications.
  - Fixed dead code based on coverity scan.
  - Fixed gnomekeyring lib dependencies.
  - Fixed Networkmanager and related lib dependencies.
  - Fixed gtk label max width issue by setting it to 35.
  - NM-openswan was missing support for nm-openswan-auth-dialog.desktop.in.in.
    So added a new nm-openswan-auth-dialog.desktop.in.in, and modified related
    Makefile and configure.ac files.


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-7
changelog:
  - Fixing sysinfo - devices with length exceeding 15 chars are not displayed in vmstat -d
  - Resolves: #1169349


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-9
changelog:
  - Fixes showing same cgroups for threads under process by adding format option
  - Resolves: rhbz#1284087


author: Honza Horak <hhorak@redhat.com> 1:5.5.34-1
changelog:
  - Rebase to 5.5.34
  - Obsolete mysql packages
    Resolves: #1043971
  - Don't test EDH-RSA-DES-CBC-SHA cipher, it seems to be removed from openssl
    which now makes mariadb/mysql FTBFS because openssl_1 test fails
    Resolves: #1048881
  - Check if socket file is not being used by another process at a time
    of starting the service
    Resolves: #1045435


author: Milan Broz <mbroz@redhat.com> - 0.13.0-1
changelog:
  - Update to 0.13.0 (#890770)
  - Remove no longer provided onepin-opensc-pkcs11.so.
  - Add iasecc-tool, openpgp-tool and sc-hsm-tool.


author: Stef Walter <stefw@redhat.com> - 0.13.0-4
changelog:
  - Use the standard name format for p11-kit module configs
  - Put the p11-kit module config is the system location


author: Colin Walters <walters@verbum.org> 0.10.23-17
changelog:
  - Hack the gtk-doc to remove plugin docs that are not shipped
  - Drop mythtv, opencv sources that are no longer buildable


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-86.el7_1.3
changelog:
  - kvm-atomics-add-explicit-compiler-fence-in-__atomic-memo.patch [bz#1233643]
  - Resolves: bz#1233643
    ([abrt] qemu-kvm: bdrv_error_action(): qemu-kvm killed by SIGABRT)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-86.el7_1.4
changelog:
  - kvm-ide-Check-array-bounds-before-writing-to-io_buffer-C.patch [bz#1243689]
  - kvm-ide-atapi-Fix-START-STOP-UNIT-command-completion.patch [bz#1243689]
  - kvm-ide-Clear-DRQ-after-handling-all-expected-accesses.patch [bz#1243689]
  - Resolves: bz#1243689
    (EMBARGOED CVE-2015-5154 qemu-kvm: qemu: ide: atapi: heap overflow during I/O buffer memory access [rhel-7.1.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-86.el7_1.5
changelog:
  - kvm-i8254-fix-out-of-bounds-memory-access-in-pit_ioport_.patch [bz#1243726]
  - Resolves: bz#1243726
    (CVE-2015-3214 qemu-kvm: qemu: i8254: out-of-bounds memory access in pit_ioport_read function [rhel-7.1.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-86.el7_1.6
changelog:
  - kvm-rtl8139-avoid-nested-ifs-in-IP-header-parsing-CVE-20.patch [bz#1248764]
  - kvm-rtl8139-drop-tautologous-if-ip-.-statement-CVE-2015-.patch [bz#1248764]
  - kvm-rtl8139-skip-offload-on-short-Ethernet-IP-header-CVE.patch [bz#1248764]
  - kvm-rtl8139-check-IP-Header-Length-field-CVE-2015-5165.patch [bz#1248764]
  - kvm-rtl8139-check-IP-Total-Length-field-CVE-2015-5165.patch [bz#1248764]
  - kvm-rtl8139-skip-offload-on-short-TCP-header-CVE-2015-51.patch [bz#1248764]
  - kvm-rtl8139-check-TCP-Data-Offset-field-CVE-2015-5165.patch [bz#1248764]
  - Resolves: bz#1248764
    (CVE-2015-5165 qemu-kvm: Qemu: rtl8139 uninitialized heap memory information leakage to guest [rhel-7.1.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-86.el7_1.7
changelog:
  - kvm-CVE-2015-1779-incrementally-decode-websocket-frames.patch [bz#1205050]
  - kvm-CVE-2015-1779-limit-size-of-HTTP-headers-from-websoc.patch [bz#1205050]
  - Resolves: bz#1205050
    (CVE-2015-1779 qemu-kvm: qemu: vnc: insufficient resource limiting in VNC websockets decoder [rhel-7.1.z])


author: Jeff E. Nelson <jen@redhat.com> - 1.5.3-86.el7_1.8
changelog:
  - kvm-qtest-ide-test-disable-flush-test.patch [bz#1273098]
  - Resolves: bz#1273098
    (qemu-kvm build failure race condition in tests/ide-test)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-52
changelog:
  - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter
  - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak
  - fix CVE-2015-3196 - race condition when handling PSK identity hint


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-55
changelog:
  - fix CVE-2016-0702 - side channel attack on modular exponentiation
  - fix CVE-2016-0705 - double-free in DSA private key parsing
  - fix CVE-2016-0797 - heap corruption in BN_hex2bn and BN_dec2bn


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-56
changelog:
  - fix 1-byte memory leak in pkcs12 parse (#1312112)
  - document some options of the speed command (#1312110)
  - fix high-precision timestamps in timestamping authority
  - enable SCTP support in DTLS 
  - use correct digest when exporting keying material in TLS1.2 (#1289620)
  - fix CVE-2016-0799 - memory issues in BIO_printf
  - add support for setting Kerberos service and keytab in
    s_server and s_client


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-57
changelog:
  - fix CVE-2016-2105 - possible overflow in base64 encoding
  - fix CVE-2016-2106 - possible overflow in EVP_EncryptUpdate()
  - fix CVE-2016-2107 - padding oracle in stitched AES-NI CBC-MAC
  - fix CVE-2016-2108 - memory corruption in ASN.1 encoder
  - fix CVE-2016-2109 - possible DoS when reading ASN.1 data from BIO


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-60
changelog:
  - fix CVE-2016-2177 - possible integer overflow
  - fix CVE-2016-2178 - non-constant time DSA operations
  - fix CVE-2016-2179 - further DoS issues in DTLS
  - fix CVE-2016-2180 - OOB read in TS_OBJ_print_bio()
  - fix CVE-2016-2181 - DTLS1 replay protection and unprocessed records issue
  - fix CVE-2016-2182 - possible buffer overflow in BN_bn2dec()
  - fix CVE-2016-6302 - insufficient TLS session ticket HMAC length check
  - fix CVE-2016-6304 - unbound memory growth with OCSP status request
  - fix CVE-2016-6306 - certificate message OOB reads
  - mitigate CVE-2016-2183 - degrade all 64bit block ciphers and RC4 to
    112 bit effective strength


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-60.1
changelog:
  - fix CVE-2017-3731 - DoS via truncated packets with RC4-MD5 cipher
  - fix CVE-2016-8610 - DoS of single-threaded servers via excessive alerts


author: Jan Grulich <jgrulich@redhat.com> - 4.10.5-7
changelog:
  - Fix installed files for -java subpkg
    Resolves: bz#1253143, build failure when java is installed in build enviroment


author: Jan Grulich <jgrulich@redhat.com> - 4.10.5-8
changelog:
  - Properly remove kross-java files
    Resolves: bz#1253143, build failure when java is installed in build enviroment


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-4.b04
changelog:
  - Backport "8075942, PR3602: ArrayIndexOutOfBoundsException in sun.java2d.pisces.Dasher.goTo"
  - Resolves: rhbz#1582032


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-4.b04
changelog:
  - Backport "8203182, PR3603: Release session if initialization of SunPKCS11 Signature fails"
  - Resolves: rhbz#1568033


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-5.b04
changelog:
  - Add "8206406, PR3610, RH1597825: StubCodeDesc constructor publishes partially-constructed objects on StubCodeDesc::_list"
  - Resolves: rhbz#1597825


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-6.b04
changelog:
  - Add "8146115, PR3508, RH1463098: Improve docker container detection and resource configuration usage"
  - Resolves: rhbz#1463098


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-7.b13
changelog:
  - Update to aarch64-jdk8u181-b13 and aarch64-shenandoah-jdk8u181-b13.
  - Remove 8187577/PR3578 now applied upstream.
  - Resolves: rhbz#1594249


author: Petr Oros <poros@redhat.com> - B.02.18-1
changelog:
  - Rebase to lshw-B.02.18
  - Sync with upstream git
  - Apply patches from beaker-fork
  - Resolves: #1368704


author: Christina Fu <cfu@redhat.com> - 4.2.6-35
changelog:
  - Bugzilla Bug #1040640 - Incorrect OIDs for SHA2 algorithms
    (cfu for jnimeh@gmail.com)
  - Bugzilla Bug #1133718 - Key strength validation is not performed for RC4
    algorithm (nkinder)
  - Bugzilla Bug #816396 - Provide Tomcat support for TLS v1.1 and
    TLS v1.2 via NSS through JSS (cfu)


author: Thomas Spura <tomspur@fedoraproject.org> - 2.2.1-1
changelog:
  - update to upstream release 2.2.1 (fixes CVE-2012-2374)
  - fix typo for epel6 macro bug #822972 (Florian La Roche)


author: Tom Hughes <tom@compton.nu> - 20120410-1
changelog:
  - Update to 20120410 release
  - Drop the 0. from the version - the dates are the upstream versions
  - Remove explicit dependencies on elfutils-libelf


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-5
changelog:
  - added standalone manpage for sudo.conf and sudo-ldap.conf
  - spec file cleanup
    Resolves: rhbz#881258


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-6
changelog:
  - fixed alias cycle detection code
  - added debug messages for tracing of netgroup matching
  - fixed aborting on realloc when displaying allowed commands
  - sssd: filter netgroups in the sudoUser attribute
  - parse uids/gids more strictly
  - added debug messages to trace netgroup matching
    Resolves: rhbz#1026904
    Resolves: rhbz#1026890
    Resolves: rhbz#1007014
    Resolves: rhbz#1026894
    Resolves: rhbz#1000389
    Resolves: rhbz#994566


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-11
changelog:
  - Fixed incorrect login shell path construction in sesh
    (thanks fkrska@redhat.com for the patch)
    Resolves: rhbz#1065418


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-12
changelog:
  - RHEL 7.1 erratum
    - don't retry authentication when ctrl-c pressed
    - fix double-quote processing in Defaults options
    - handle the "(none)" hostname correctly
    - SSSD: fix sudoUser netgroup specification filtering
    - SSSD: list correct user when -U <user> -l specified
    - SSSD: show rule names on long listing (-ll)
    - fix infinite loop when duplicate entries are specified on the
      sudoers nsswitch.conf line
    Resolves: rhbz#1084488
    Resolves: rhbz#1088464
    Resolves: rhbz#1088825
    Resolves: rhbz#1092499
    Resolves: rhbz#1093099
    Resolves: rhbz#1096813
    Resolves: rhbz#1147497
    Resolves: rhbz#1147557


author: Ray Strode <rstrode@redhat.com> 2.32.1-4
changelog:
  - drop /etc/skel entry. libgnome creates it by default if it's
    not around and it needs it anyway. Better not to clutter users
    home directories just because they install glade.


author: Karel Zak <kzak@redhat.com> 2.23.2-29
changelog:
  - fix #1029385 - lack of non-ascii support
  - fix #1092520 - util-linux - PIE and RELRO check
  - fix #1153770 - backport lsipc
  - fix #1248003 - mount only parses <param>=<value> lines from fstab fs_spec field available from blkid block device
  - fix #1271850 - mount -a doesn't catch a typo in /etc/fstab and a typo in /etc/fstab can make a system not reboot properly
  - fix #1281839 - [RFE]Bind mounts should be handled gracefully by the operating system
  - fix #1290689 - util-linux: /bin/login does not retry getpwnam_r with larger buffers, leading to login failure
  - fix #1296366 - Bash completion for more(1) handles file names with spaces incorrectly
  - fix #1296521 - RHEL7: update audit event in hwclock
  - fix #1298384 - RFE: add SCHED_DEADLINE support to chrt
  - fix #1304246 - fdisk 'f' subcommand updates partition ranges wrongly
  - fix #1304426 - [rfe] /bin/su should be improved to reduce stack use
  - fix #1326615 - util-linux/lscpu: Fix model and model name on Power Systems
  - fix #1327886 - Backport blkdiscard's "-z" flag to RHEL
  - fix #1332084 - [RFE] Inclusion of lsns command in util-linux Package
  - fix #1335671 - extra quotes around UUID confuses findfs in RHEL (but not in Fedora)
  - fix #1344222 - logger port option in help is misleading
  - fix #1344482 - util-linux fails valid_pmbr() size checks if device is > 2.14TB, Device label type: dos instead of gpt
  - fix #587393 - [RFE] Make sure util-linux is ready for writable overlays


author: Karel Zak <kzak@redhat.com> 2.23.2-32
changelog:
  - improve patch for chrt(1) deadline support #1298384
  - fix #1007734 - blkid shows devices as /dev/block/$MAJOR:$MINOR
  - fix #1349536 - Extended partition loop in MBR partition table leads to DOS


author: Peter Jones <pjones@redhat.com> - 0.8.0-4
changelog:
  - Fix buffer overflow when remove_from_boot_order removes nothing (lennysz)
    Resolves: rhbz#1168019


author: Doug Ledford <dledford@redhat.com> - 1.0.6-3
changelog:
  - Undo pseudoprovide workaround as it's no longer needed due to
    a change in the libibverbs requirements


author: Honza Horak <hhorak@redhat.com> - 5.2.5-1
changelog:
  - Update to 5.2.5
  - Enlarge buffer size for query string when getting info about tables
    Related: #948619


author: Marcin Juszkiewicz <mjuszkiewicz redhat com> - 5.2.5-4
changelog:
  - Build failed because whether to use lib64 or not is done by checking
    list of known 64-bit architectures. So added AArch64 to that list.
    Resolves: #1041348


author: Wim Taymans <wtaymans@redhat.com> - 0.10.23-21
changelog:
  - Remove insecure NSF plugin
  - vmncdec: Sanity-check width/height before using it
  Resolves: rhbz#1400838


author: Wim Taymans <wtaymans@redhat.com> - 0.10.23-22
changelog:
  - h264parse: Ensure codec_data has the required size when reading number of SPS
  Resolves: rhbz#1400838


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-10
changelog:
  - Add missing av_permission values (#1025931)
  - Set an appropriate errno in booleans.c (#1402140)
  - Change matchpathcon usage to match with matchpathcon manpage (#1412797)


author: Simo Sorce <simo@redhat.com> 1.3.1-1
changelog:
  - Various bugfixes and minor new features
  - resolves: #1258168
  - resolves: #1258171
  - resolves: #1258172
  - resolves: #1258456


author: Kalev Lember <kalevlember@gmail.com> - 2.0.2-2
changelog:
  - Remove glib-compile-schemas scriptlets: the schemas are no longer installed
  - Add ldconfig calls to the libwebkit2gtk subpackage
  - Remove rpath from MiniBrowser
  - Re-enable full debuginfo (#861452)


author: Tomas Popela <tpopela@redhat.com> - 2.0.4-6
changelog:
  - Enable higher compression for output rpms
  - Resolves: rhbz#1039590
  - Avoid video player to set system volume to 100%
  - Resolves: rhbz#1029783


author: Tomas Hozza <thozza@redhat.com> - 0.11-22
changelog:
  - Improved text in the GUI panel in Hotspot sign-on mode (#1254473)
  - Build all binaries with PIE hardening (#1092526)


author: Peter Robinson <pbrobinson@fedoraproject.org> 0.10.2-1
changelog:
  - 0.10.2 release
  - http://ftp.gnome.org/pub/GNOME/sources/gupnp-dlna/0.10/gupnp-dlna-0.10.2.news

   * Wed Apr 10 2013 Peter Robinson <pbrobinson@fedoraproject.org> 0.10.1-1
  - 0.10.1 release
  - http://ftp.gnome.org/pub/GNOME/sources/gupnp-dlna/0.10/gupnp-dlna-0.10.1.news


author: Frank Ch. Eigler <fche@redhat.com> - 2.6-3
changelog:
  - Added probinson's patch BZ1141919 for enabling more ppc64/aarch64 facilities,
    with some staplog.c followup


author: Frank Ch. Eigler <fche@redhat.com> - 2.6-6
changelog:
  - rhbz1164373 (fix ppc64 kprobes via KERNEL_RELOC_SYMBOL)
  - rhbz1119335 (document STAP_FIPS_OVERRIDE in staprun.8)
  - rhbz1127591 (ppc64 hcall_* tracepoint blacklisting)


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-6.1.13.3
changelog:
  - updated to icedtea 1.13.3
  - updated to openjdk-6-src-b31-15_apr_2014
  - renmoved upstreamed patch7, 1.13_fixes.patch
  - renmoved upstreamed patch9, 1051245.patch
  - Resolves: rhbz#1099563


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-6.1.13.4
changelog:
  - moved to  icedteaver 1.13.4
  - moved to openjdkver b32 and openjdkdate 15_jul_2014
  - added upstreamed patch patch9 rh1115580-unsyncHashMap.patch
  - Resolves: rhbz#1115870
  - forwardported from rhel 6.6, patch10, add-final-location-rpaths.patch (rh1059925)
   - Work when capabilities are set on the binary
   - Include hardcoded install path as well as $ORIGIN in RPATH
   - Don't Expect LD_LIBRARY_PATH to be set in the launcher


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.33-1.13.5.0
changelog:
  - Update to IcedTea 1.13.5
  - Remove upstreamed patches.
  - Regenerate add-final-location-rpaths patch against new release.
  - Change versioning to match java-1.7.0-openjdk so revisions work.
  - Use xz for tarballs to reduce file size.
  - No need to explicitly disable system LCMS any more (bug fixed upstream).
  - Add icedteasnapshot to setup lines so they work with pre-release tarballs.
  - Resolves: rhbz#1148902


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.34-1.13.6.0
changelog:
  - Update to IcedTea 1.13.6
  - Remove upstream patch type_hsx23_patch4.patch.
  - Regenerate add-final-location-rpaths patch against new release.
  - Apply pr2125.patch in generate_rhel_zip.sh to remove unwanted elliptic curves.
  - Add no_pr2125.patch to avoid repeating the procedure during the IcedTea build.
  - Avoid duplicating the OpenJDK build version by making more use of %{openjdkver}.
  - Add US_export_policy.jar and local_policy.jar to packages.
  - Resolves: rhbz#1180293


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.34-1.13.6.1
changelog:
  - Update to latest 1.13.6 release candidate tarball
  - Fixes a number of issues found with b34:
  - * OJ51, PR2187: Sync patch for 4873188 with 7 version
  - * OJ52, PR2185: Application of 6786276 introduces compatibility issue
  - * OJ53, PR2181: strict-aliasing warnings issued on PPC32
  - * OJ54, PR2182: 6911104 reintroduces test fragment removed in existing 6964018 backport
  - * S6730740, PR2186: Fix for 6729881 has apparently broken several 64 bit tests: "Bad address"
  - * S7031830, PR2183: bad_record_mac failure on TLSv1.2 enabled connection with SSLEngine
  - Regenerate add-final-location-rpaths patch against new release.
  - Resolves: rhbz#1180293


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.35-1.13.7.0
changelog:
  - Update to IcedTea 1.13.7
  - Regenerate add-final-location-rpaths patch so as to be less disruptive.
  - Resolves: rhbz#1209067


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.36-1.13.8.0
changelog:
  - Update to IcedTea 1.13.8
  - Update no_pr2125.patch to work against new version.
  - Resolves: rhbz#1235153


author: Nikola Forró <nforro@redhat.com> - 1.5.1-11
changelog:
  - Fix decoding of chroma-subsampled images
  - Add patches for CVE-2016-9573 and CVE-2016-9675
  - Fix Coverity issues
    Resolves: #1419772


author: Avesh Agarwal <avagarwa@redhat.com> - 5.2.0-1
changelog:
  Resolves: #1120371
  - Rebase to new upstream release 5.2.0
  - IMA/TPM based remote attestation
  - Aikgen tool to generate an Attestation Identity Key bound
    to a TPM
  - PT-EAP transport protocol (RFC 7171) for TNC
  - Enabled support for acert for checking X509 attribute certificate
  - Updates local patches
  - Spec file update
  - openac tool replaced with pki --acert


