# changelog

author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-10
changelog:
  - Bump version to 1.3.6.1-10
  - Resolves: Bug 1444938 - nsslapd-allowed-sasl-mechanisms doesn't reset to default val 
  - Resolves: Bug 1111400 - logconv.pl lists sasl binds with no dn as anonymous 
  - Resolves: Bug 1377452 - Integer overflow in performance counters
  - Resolves: Bug 1441790 - ldapserch for nsslapd-errorlog-level returns incorrect values
  - Resolves: Bug 1444431 - ERR - symload_report_error - Netscape Portable Runtime error -5975
  - Resolves: Bug 1447015 - Adjust db2bak.pl help and man page to reflect changes introduced to the script


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-11
changelog:
  - Bump version to 1.3.6.1-11
  - Resolves: Bug 1410207 - Utility command had better use INFO log level for the output
  - Resolves: Bug 1049190 - Better input argument validation and error messages for db2index and db2index.pl


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-13
changelog:
  - Bump version to 1.3.6.1-13
  - Resolves: Bug 1444938 - Fix backport issue from build 1.3.6.1-10 (part 2)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-14
changelog:
  - Bump version to 1.3.6.1-14
  - Resolves: Bug 1450910 - Modifying "nsslapd-cache-autosize" parameter using ldapmodify command is failing.
  - Resolves: Bug 1450893 - When nsslapd-cache-autosize is not set in dse.ldif, ldapsearch does not show the default value
  - Resolves: Bug 1449098 - ns-slapd crashes in role cache creation
  - Resolves: Bug 1441522 - AddressSanitizer: heap-use-after-free in libreplication-plugin.so
  - Resolves: Bug 1437492 - "ERR - cos-plugin - cos_cache_query_attr - cos attribute krbPwdPolicyReference failed schema check" in error log
  - Resolves: Bug 1429770 - ds-logpipe.py crashes for non-existing users
  - Resolves: Bug 1451657 - -v option is not working for db2ldif.pl


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-15
changelog:
  - Bump version to 1.3.6.1-15
  - Resolves: Bug 1429770 - ds-logpipe.py crashes for non-existing users
  - Resolves: Bug 1444938 - nsslapd-allowed-sasl-mechanisms doesn't reset to default values without a restart
  - Resolves: Bug 1450896 - Manual resetting of nsslapd-dbcachesize using ldapmodify 
  - Resolves: Bug 1357682 - RHDS fails to start with message: "Failed to delete old semaphore for stats file"
  - Resolves: Bug 1452739 - Zero value of nsslapd-cache-autosize-split makes dbcache to be equal 0


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-16
changelog:
  - Bump version to 1.3.6.1-16
  - Resolves: Bug 1444938 - nsslapd-allowed-sasl-mechanisms doesn't reset to default values without a restart
  - Resolves: Bug 1447015 - Adjust db2bak.pl help and man page to reflect changes introduced to the script
  - Resolves: Bug 1450896 - Manual resetting of nsslapd-dbcachesize using ldapmodify
  - Resolves: Bug 1454921 - Fixup memberof task throws error "memberof_fix_memberof_callback: Weird
  - Resolves: Bug 1456774 - ipa-replica server fails to upgrade


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-17
changelog:
  - Bump version to 1.3.6.1-17
  - Resolves: Bug 1476161 - replication halt - pending list first CSN not committed, pending list increasing
  - Resolves: Bug 1476162 - Change the retrochangelog default cache size


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-18
changelog:
  - Bump version to 1.3.6.1-18
  - Require srvcore 4.1.3
  - Resolves: Bug 1479757 - dse.ldif and fsync
  - Resolves: Bug 1479755 - backup fails if changelog is enabled
  - Resolves: Bug 1479756 - Locked account provides different return code if password is correct


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.19-1
changelog:
  - Bump version to 1.3.6.19-1
  - Remove old mozldap and db4 requirements
  - Resolves: Bug 1483865 - Crash while binding to a server during replication online init


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-19
changelog:
  - Bump version to 1.3.6.1-19
  - Remove old mozldap and db4 requirements
  - Resolves: Bug 1483865 - Crash while binding to a server during replication online init


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-20
changelog:
  - Bump verions to 1.3.6.1-20
  - Resolves: Bug 1489693 - PasswordCheckSyntax attribute fails to validate cn, sn, uid
  - Resovles: Bug 1492829 - patch should of been applied to 7.4 but got missed
  - Resolves: Bug 1486128 - Performance issues with RHDS 10 - NDN cache investigation
  - Resolves: Bug 1489694 - crash in send_ldap_result
  - Resolves: Bug 1491778 - crash when adding invalid repl agmt
  - Resolves: Bug 1492830 - password expired control not sent
  - Resolves: Bug 1492833 - sasl-mechanisms removed during upgrade


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-21
changelog:
  - Bump verions to 1.3.6.1-21
  - Resolves: Bug 1498958 - unable to retrieve specific cosAttribute when subtree password policy is configured


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-23
changelog:
  - Bump version to 1.3.6.1-23
  - Resolves: Bug 1504536 - [memberOf Plugin] bulk deleting users causes deadlock when there are multiple backends
  - Resolves: Bug 1503001 - Adding a database entry fails if the same database was deleted after an import
  - Resolves: Bug 1506912 - Improve valueset sort performance during valueset purging


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-24
changelog:
  - Bump version to 1.3.6.1-24
  - Resolves: Bug 1508978 - replicated MODRDN fails breaking replication
  - Resolves: Bug 1511940 - heap corruption during import
  - Resolves: Bug 1510319 - [abrt] 389-ds-base: SLL_Next(): ns-slapd killed by SIGSEGV 
  - Resolves: Bug 1509347 - cleanallruv task is not logging any information


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-25
changelog:
  - Bump version to 1.3.6.1-25
  - Resolves: Bug 1526928 - search with CoS attribute is getting slower after modifying/adding CosTemplate
  - Resolves: Bug 1523505 - opened connection are hanging, no longer poll
  - Resolves: Bug 1523507 - IPA server replication broken, after DS stop-start, due to changelog reset


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-27
changelog:
  - Bump version to 1.3.6.1-27
  - Resolves: Bug 1536343 - Indexing of internationalized matching rules is failing
  - Resolves: Bug 1535539 - CVE-2017-15135 - Authentication bypass due to lack of size check in slapi_ct_memcmp function
  - Resolves: Bug 1540105 - CVE-2018-1054 - remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-28
changelog:
  - Bump version to 1.3.6.1-28
  - Resolves: Bug 1540105 - CVE-2018-1054 - remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-2
changelog:
  - core: fix persisting managed state of device (rh #1440171)
  - proxy: fix use-after-free (rh #1450459)
  - device: don't wrongly delay startup complete waiting for carrier (rh #1450444)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-3
changelog:
  - dhcp: don't add route to DHCP4 server (rh #1448987)
  - libnm: fix NUL termination of device's description (rh #1443114)
  - libnm, core: ensure valid UTF-8 in device properties (rh #1443114)
  - core: fix device's UDI property on D-Bus (rh #1443114)
  - ifcfg-rh: omit empty next hop for routes in legacy format (rh #1452648)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.8.0-4
changelog:
  - device: update external configuration before commit (rh #1449873)
  - bluetooth: fix crash on connecting to a NAP (rh #1454385)
  - device: release removed devices from master on cleanup (rh #1448907)
  - core: activate slaves using ifindex order by default (rh #1452585)
  - nmcli: fix crash when setting 802-1x.password-raw (rh #1456362)
  - po: update translations (rh #1382625)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-5
changelog:
  - ifcfg-rh: fix writing legacy NETMASK value (rh #1445414)
  - tui: fix crash during connect (rh #1456826)
  - libnm: fix libnm rejecting VLAN ID 4095 (rh #1456911)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-6
changelog:
  - connectivity: fix periodic connectivity check (rh #1458399)
  - bond: improve option matching on daemon restart (rh #1457909)
  - device: fix touching device after external activation (rh #1457242)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-7
changelog:
  - bond: fix crash comparing mode while generating bond connection (rh #1459580)
  - connectivity: fix route penalty if WWAN and BT device using ip-ifindex (rh #1459932)
  - device: persist nm-owned in run state (rh #1376199)
  - device: fix assuming master device on restart (rh #1452062)
  - device: apply route metric penality only when the default route exists (rh #1459604)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.8.0-8
changelog:
  - cli: fix output of iface in overview output (rh#1460219)
  - ppp: unexport NMPPPManager instance on dispose (rh#1459579)
  - cli: remove spurious device names from wifi subcommands output (rh#1460527)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-9
changelog:
  - device: don't change MTU unless explicitly configured (rh #1460760)
  - core: don't remove external IPv4 addresses (rh #1459813)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-11
changelog:
  - core: fix wrongly delaying startup-complete for unrealized devices (rh#1498807)
  - core: fix unfreezing signals when unrealizing device fails (rh#1498755)


author: Ray Strode <rstrode@redhat.com> - 0.6.35-11
changelog:
  - address minor bug in previous patch
    Related: #1220904

  - fix memory leak in log handler
    Resolves: #1292543


author: Ray Strode <rstrode@redhat.com> - 0.6.42-2
changelog:
  - Update to 0.6.44
    Related: #1424623
  - export password expiration policy from shadow
    Resolves: #1334464


author: Ray Strode <rstrode@redhat.com> - 0.6.45-1
changelog:
  - Update to 0.6.45 so password expiration policy is wrapped by libaccountsservice
    Related: #1424623 #1334464


author: Ray Strode <rstrode@redhat.com> - 0.6.45-2
changelog:
  - Don't tread explicitly requested users as cached
    Fixes UncacheUser operation.
    Resolves: 1446620
    Related: #1432602


author: Marcela Mašláňová <mmaslano@redhat.com> - 3.1.13-16
changelog:
  - the correct solution is remove smp_flags, they don't work properly on ppc with
    the option mpower7
  - Related: rhbz#1048745


author: Tomáš Mráz <tmraz@redhat.com> - 3.1.13-21
changelog:
  - correct the DST correction when using UTC time specification (#1328832)
  - clear non-job files from at dir and test for write error on fclose
    to fix bogus syslog messages


author: Tomáš Mráz <tmraz@redhat.com> - 3.1.13-22.2
changelog:
  - fix handling of the aborted jobs (due to possibly
    temporary conditions) and avoid flooding the syslog


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-12
changelog:
  - Add patch for Dovecot, mailbox and quote support (RHBZ#1064387)
  - Add patch for Keepalived, virtual server fixes (RHBZ#1064388)
  - Add patch for Krb5, parse braces in values (RHBZ#1066419)


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-13
changelog:
  - aug_save: return error when unlink fails (RHBZ#1091143)
  - augtool: add aliases to autocomplete (RHBZ#1100076)
  - augtool: remove unused dump-xml arg (RHBZ#1100106)
  - Automounter: parse hostnames with hyphens (RHBZ#1075162)
  - Cgconfig: parse other valid controllers (RHBZ#1112543)
  - Chrony: add lens (RHBZ#1071947)
  - docs: update man page with new commands (RHBZ#1100077)
  - Exports: permit colons for IPv6 client addresses (RHBZ#1067030)
  - Httpd: parse continued, quoted lines (RHBZ#1100551)
  - Ldso: parse hwcap lines (RHBZ#1102629)
  - NagiosCfg: parse nrpe.cfg with Nrpe (RHBZ#1102623)
  - Rmt: add lens (RHBZ#1100549)
  - Services: permit colons in service name (RHBZ#1121527)
  - Shellvars: support arithmetic expansion (RHBZ#1100550)
  - Syslog: parse TCP loghosts (RHBZ#1129386)
  - Syslog: parse IPv6 loghost addresses (RHBZ#1129388)
  - Systemd: parse /etc/sysconfig/*.systemd (RHBZ#1083022)
  - Systemd: parse quoted environment vars (RHBZ#1100547)


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-14
changelog:
  - Kdump: parse new options, EOL comments (RHBZ#1139298)
  - Rsyslog: parse property filters and templates (RHBZ#1138402)
  - Systemd: parse semicolons inside entry values (RHBZ#1139498)
  - Systemd: parse environment variables where value is quoted (RHBZ#1138508)


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-16
changelog:
  - Iptables: parse /etc/sysconfig/iptables.save (RHBZ#1144651)
  - Lvm: parse /etc/lvm/lvm.conf (RHBZ#1145495)
  - Shadow: add lens (RHBZ#1145249)


author: Dominic Cleal <dcleal@redhat.com> - 1.4.0-1
changelog:
  - Rebase to Augeas 1.4.0
  - Revert some changes for better compatibility with 1.1.0-17:
    * Dhcpd: keep 1.1.0 behaviour, add Dhcpd_140 for 1.4.0 features
    * Dnsmasq: revert splitting of address/server options
    * Dovecot: restore quotes within values
    * Jaas: revert semicolon and line break changes
    * Slapd: keep 1.1.0 behaviour, add Slapd_140 for 1.4.0 features
    * Sshd: keep 1.1.0 behaviour, add Sshd_140 for 1.4.0 features
    * Syslog: restore tree without protocol for UDP hosts
    * UpdateDB: keep Simplevars to load config by default


author: Caolán McNamara <caolanm@redhat.com> - 1:5.0.6.2-6
changelog:
  - Resolves: rhbz#1401082 gnome hangs opening certain docx
  - Resolves: rhbz#1421726 drop use of CAIRO_OPERATOR_DIFFERENCE


author: David Tardon <dtardon@redhat.com> - 1:5.0.6.2-7
changelog:
  - Resolves: rhbz#1431539 gnome-documents needs libreofficekit
  - Resolves: rhbz#1435535 CVE-2017-3157 Arbitrary file disclosure in
    Calc and Writer


author: Ian Kent <ikent@redhat.com> - 5.0.7-61
changelog:
  - bz1101782 - autofs configured with sssd is not finding any maps
    - work around sss startup delay.
    - add sss master map wait config option (wait initially 0, disabled).
  - Resolves: rhbz#1101782


author: Ian Kent <ikent@redhat.com> - 5.0.7-62
changelog:
  - bz1367576 - [RFE] Add browsing support into autofs for AMD format maps
    - use autofs_point to store expire timeout where possibe.
  - Related: rhbz#1367576


author: Ian Kent <ikent@redhat.com> - 5.0.7-63
changelog:
  - bz1101782 - autofs configured with sssd is not finding any maps
    - fix work around sss startup delay.
  - bz1367576 - [RFE] Add browsing support into autofs for AMD format maps
    - fix possible NULL derefernce.
  - Related: rhbz#1101782 rhbz#1367576


author: Ian Kent <ikent@redhat.com> - 5.0.7-64
changelog:
  - bz1440769 - autofs is facing scalability issues
    - improve scalability of direct mount path component creation.
  - Resolves: rhbz#1440769


author: Ian Kent <ikent@redhat.com> - 5.0.7-65
changelog:
  - bz1367576 - [RFE] Add browsing support into autofs for AMD format maps
    - fix invalid reference in remount_active_mount().
  - Related: rhbz#1367576


author: Ian Kent <ikent@redhat.com> - 5.0.7-66
changelog:
  - bz1435736 - autofs fails with kernel: automount[3386]:
      segfault at 7f3fb7595ca8 ip 00007f3fb61e353a sp 00007f3fb7595cb0
      error 6 in libc-2.17.so[7f3fb60b7000+1b6000]
    - increase worker thread per-thread stack size.
    - limit getgrgid_r() buffer size.
    - add congigure option for limiting getgrgid_r() stack usage.
    - use above option to limit getgrgid_r() stack usage with configure.
  - Resolves: rhbz#1435736


author: Ian Kent <ikent@redhat.com> - 5.0.7-68
changelog:
  - bz1435736 - autofs fails with kernel: automount[3386]:
      segfault at 7f3fb7595ca8 ip 00007f3fb61e353a sp 00007f3fb7595cb0
      error 6 in libc-2.17.so[7f3fb60b7000+1b6000]
    - fix unset tsd group name handling.
  - Related: rhbz#1435736


author: Ian Kent <ikent@redhat.com> - 5.0.7-69
changelog:
  - bz1435736 - autofs fails with kernel: automount[3386]:
      segfault at 7f3fb7595ca8 ip 00007f3fb61e353a sp 00007f3fb7595cb0
      error 6 in libc-2.17.so[7f3fb60b7000+1b6000]
    - fix a couple of covarity warning resulting in group name handling change.
  - Related: rhbz#1435736


author: Ian Kent <ikent@redhat.com> - 5.0.7-70.el7_4
changelog:
  - bz1503945 - autofs option parsing for maps with fstype=autofs no longer
    works [rhel-7.4.z]
    - revert fix argc off by one in mount_autofs.c.
  - bz1503946 - autofs map entry options field does not accept dot character
    [rhel-7.4.z]
    - allow dot in OPTIONSTR value lexer pattern.
    - handle additional nfs versions in mount_nfs.c.
  - Resolves: rhbz#1503945 rhbz#1503946


author: Ian Kent <ikent@redhat.com> - 5.0.7-70.el7_4.1
changelog:
  - bz1515311 - Automount cannot access host shares after a reboot [rhel-7.4.z]
    - reset master map list on startup retry.
  - Resolves: rhbz#1515311


author: Ian Kent <ikent@redhat.com> - 5.0.7-60
changelog:
  - bz1382093 - Improve logging in autofs
     - add the mount requestor's pid to pending_args.
     - create thread-local ID for mount attempts.
     - log functions to prefix messages with attempt_id if available.
     - factor out set_thread_mount_request_log_id().
     - add config option to use mount request log id.
  - Resolves: rhbz#1382093


author: Petr Spacek <pspacek@redhat.com> - 9.0-1
changelog:
  - update to latest upstream version
  - related: #1292145 Rebase bind-dyndb-ldap to latest upstream version


author: Petr Spacek <pspacek@redhat.com> - 10.0-1
changelog:
  - update to latest upstream version
  - resolves: #1292145 Rebase bind-dyndb-ldap to latest upstream version


author: Tomas Krizek <tkrizek@redhat.com> - 11.1-1
changelog:
  - update to letest upstream version
  - resolves: #1393889 Rebase to bind-dyndb-ldap 11+
  - resolves: #1165796 bind-dyndb-ldap crashes if server is shutting down and connection to LDAP is down
  - resolves: #1413805 bind-dyndb-ldap default schema is shipped with syntax error


author: Nick Clifton <nickc@redhat.com> 2.25.1-25-base
changelog:
  - Fix GOLD so that it will not warn about references to hidden symbols in shared objects.
    (#1326710)


author: Nick Clifton <nickc@redhat.com> 2.25.1-32.base
changelog:
  - Revert part of the objdump speed up patch which was preventing proper function name lookup.
    (#1465318)


author: Nick Clifton <nickc@redhat.com> 2.25.1-32.base.1
changelog:
  - Revert part of the objdump speed up patch which was preventing proper function name lookup.
    (#1479773)


author: Nick Clifton <nickc@redhat.com> 2.25.1-32.base.2
changelog:
  - Fix a seg-fault in the PowerPC linker when discarding .plt sections when -pie is used and undefined weak symbols are present.  
    (#1515347)
  - Add SCV, RFSCV amd LNIA instructions to Power9 port of gas.
    (#1449585)


author: Don Zickus <dzickus@redhat.com> 5.41-1
changelog:
  - Update to 5.41
  - obexd fixes to prevent crashes
  - add /etc/bluetooth/main.conf config file
  Resolves: #1313363, #1336476, #1338895


author: David Arcari <darcari@redhat.com> 5.44-1
changelog:
  - Update to 5.44
  - Ship btattach tool
  - Configure systemctl settings for bluez-obex correctly
  - Add Provides: bluez-obexd
  Resolves: #1434581, #1401501


author: Lars Kellogg-Stedman <lars@redhat.com> 0.7.9-6
changelog:
  - add power-state-change module to cloud_final_modules (rhbz#1252477)
  - remove 'tee' command from logging configuration (rhbz#1424612)
  - limit permissions on def_log_file (rhbz#1424612)
  - Bounce network interface for Azure when using the built-in path. (rhbz#1434109)
  - OpenStack: add 'dvs' to the list of physical link types. (rhbz#1442783)


author: Lars Kellogg-Stedman <lars@redhat.com> 0.7.9-7
changelog:
  - Add missing sysconfig unit test data (rhbz#1438082)
  - Fix dual stack IPv4/IPv6 configuration for RHEL (rhbz#1438082)
  - sysconfig: Raise ValueError when multiple default gateways are present. (rhbz#1438082)
  - Bounce network interface for Azure when using the built-in path. (rhbz#1434109)
  - Do not write NM_CONTROLLED=no in generated interface config files (rhbz#1385172)


author: Lars Kellogg-Stedman <lars@redhat.com> 0.7.9-9
changelog:
  - RHEL/CentOS: Fix default routes for IPv4/IPv6 configuration. (rhbz#1438082)
  - azure: ensure that networkmanager hook script runs (rhbz#1440831 rhbz#1460206)
  - Fix ipv6 subnet detection (rhbz#1438082)


author: Ryan McCabe <rmccabe@redhat.com> 0.7.9-9.3
changelog:
  - Disable NetworkManager management of resolv.conf if nameservers
    are specified by configuration.
    Resolves: rhbz#1537439


author: Ryan McCabe <rmccabe@redhat.com> 0.7.9-9.4
changelog:
  - sysconfig: Fix rendering of default gateway for ipv4
    Resolves: rhbz#1540094
  - sysconfig: Correct rendering for dhcp on ipv6
    Resolves: rhbz#1540093


author: Dominik Perpeet <dperpeet@redhat.com> 138-3
changelog:
  - Fix issues with connections between multiple hosts
  - Fix format string type mismatch on some architectures


author: Martin Pitt <mpitt@redhat.com> 138-10
changelog:
  - Backport upstream patches to fix integration tests
  - Fix unit test failure in mock with nspawn
  - Fix created timer units so that they can actually get enabled and started
    rhbz#1478832
  - Fix connecting to remote servers with non-standard ssh port rhbz#1478828


author: Jiri Vanek <jvanek@redhat.com> - 1.1-3
changelog:
  - commented requires on lua posix to stop blocking composes.
  - changed it to 644 to dont mislead by executable flags
  - Resolves: rhbz#1296430


author: Jiri Vanek <jvanek@redhat.com> - 1.1-5
changelog:
  - posttrans silenced, the error is appearing only in state, when there is nothing to copy
  - Resolves: rhbz#1296430


author: Jiri Vanek <jvanek@redhat.com> - 2.2-1
changelog:
  - added "jre/lib/security/blacklisted.certs" to cared files
  - moved to newest release 2.1
  - moved to new upstream at pagure.io
  - added new script of copy_jdk_configs_fixFiles.sh 
  - copy_jdk_configs.lua  aligned to it
  - Resolves: rhbz#1427463


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-2
changelog:
  - Resolves: rhbz#1363654

  - Config: Flag config uidgid entries (rhbz#1363654)
  - merge upstream commit f837f95dfe96d60f2367e900efd4def7a07b2a89 (rhbz#1363654)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-3
changelog:
  - Related: rhbz#1363654

  - Enhance spec so corosync-qdevice subpackage depends on same version of
    the corosync and corosynclib packages.


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-4
changelog:
  - Resolves: rhbz#1367813

  - Man: Fix corosync-qdevice-net-certutil link (rhbz#1367813)
  - merge upstream commit 49a9f722bba13e4b2762151b7b96b1d4196fd5e0 (rhbz#1367813)
  - man: mention qdevice incompatibilites in votequorum.5 (rhbz#1367813)
  - merge upstream commit 0da1b7446239424b76b1d5eb7c3640afce9b054e (rhbz#1367813)
  - Qnetd LMS: Fix two partition use case (rhbz#1367813)
  - merge upstream commit b0c850f308d44ddcdf1a1f881c1e1142ad489385 (rhbz#1367813)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-6
changelog:
  - Resolves: rhbz#1371880

  - libvotequorum: Bump version (rhbz#1371880)
  - merge upstream commit 96f91f23a6a413535cc2f0e8492e2300373fed40 (rhbz#1371880)
  - votequorum: Don't update expected_votes display if value is too high (rhbz#1371880)
  - merge upstream commit 596433066805af029be1292a37a35ce31307f0bf (rhbz#1371880)
  - votequorum: simplify reconfigure message handling (rhbz#1371880)
  - merge upstream commit 4a385f2e94c7168dbd92168c54a80ee97a3c2140 (rhbz#1371880)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-7
changelog:
  - Related: rhbz#1371880

  - Fix build on RHEL7.3 latest (rhbz#1371880)
  - merge upstream commit 19e48a6eee20d5f34f79a3b8d4e1c694169c1d7b (rhbz#1371880)
  - Enable aarch64 build (bz#1422598)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-8
changelog:
  - Resolves: rhbz#1434528
  - Resolves: rhbz#1434529
  - Resolves: rhbz#1434534

  - cfg: Prevents use of uninitialized buffer (rhbz#1434528)
  - merge upstream commit 52e6ae57ea06d0bef61c5c9250881bef1372ead2 (rhbz#1434528)
  - man: Fix typos in man page (rhbz#1434529)
  - merge upstream commit b642904ea9640bd7a1573a8c0d2c5bcb43a10dfc (rhbz#1434529)
  - Fix typo: Destorying -> Destroying (rhbz#1434529)
  - merge upstream commit 117d9e4eb77ef9941fdeaf17ddfd892514da8143 (rhbz#1434529)
  - init: Add doc URIs to the systemd service files (rhbz#1434529)
  - merge upstream commit 21a728785027483786e41c19f6aff57a95b80aa5 (rhbz#1434529)
  - man: Modify man-page according to command usage (rhbz#1434529)
  - merge upstream commit 79898e8cb1715e79b7467b91661b7341e2664550 (rhbz#1434529)
  - Totempg: remove duplicate memcpy in mcast_msg func (rhbz#1434528)
  - merge upstream commit 4a8e9d80409590cb42732ae3105b5ae71fda52c1 (rhbz#1434528)
  - upstart: Add softdog module loading example (rhbz#1434529)
  - merge upstream commit 75474d69bebea6c9c4ef2252476ce738cf92f0f4 (rhbz#1434529)
  - Remove deprecated doxygen flags (rhbz#1434529)
  - merge upstream commit b252013e42007ea7284ae54d035a30ca40f20fc0 (rhbz#1434529)
  - Remove redundant header file inclusion (rhbz#1434528)
  - merge upstream commit d6c7ade277a4a23d84c56d7fde6b60b377a1023b (rhbz#1434528)
  - Qdevice: fix spell errors in qdevice (rhbz#1434529)
  - merge upstream commit d9caa09c45d4560c89a1ad873087c0476cabab46 (rhbz#1434529)
  - doc: document watchdog_device parameter (rhbz#1434529)
  - merge upstream commit a5f97ae1b99063383d8f45168125b34232b91faf (rhbz#1434529)
  - Logsys: Change logsys syslog_priority priority (rhbz#1434534)
  - merge upstream commit 609cc0cc100aa1070d97b405273373682da0e270 (rhbz#1434534)
  - logconfig: Do not overwrite logger_subsys priority (rhbz#1434534)
  - merge upstream commit c866a2f8603b44e89eb21a6cf7d88134af2e8b66 (rhbz#1434534)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-9
changelog:
  - Resolves: rhbz#1445001

  - Main: Call mlockall after fork (rhbz#1445001)
  - merge upstream commit 238e2e62d8b960e7c10bfa0a8281d78ec99f3a26 (rhbz#1445001)
  - Disable aarch64 build (bz#1422598)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-9.1
changelog:
  - Resolves: rhbz#1477461

  - main: Add option to set priority (rhbz#1477461)
  - merge upstream commit a008448efb2b1d45c432867caf08f0bcf2b4b9b0 (rhbz#1477461)
  - main: Add support for libcgroup (rhbz#1477461)
  - merge upstream commit c56086c701d08fc17cf6d8ef603caf505a4021b7 (rhbz#1477461)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-9.2
changelog:
  - Resolves: rhbz#1484264

  - totem: Propagate totem initialization failure (rhbz#1484264)
  - merge upstream commit 0413a8f4672352171f0df731b7d9c1fe20acbc4c (rhbz#1484264)
  - totemcrypto: Refactor symmetric key importing (rhbz#1484264)
  - merge upstream commit a885868181c07ba9ab5cdfdad1d66d387b2a4428 (rhbz#1484264)
  - totemcrypto: Use different method to import key (rhbz#1484264)
  - merge upstream commit 5dadebd21862074deaeb9a337fc9e49f5e9f692a (rhbz#1484264)
  - totemcrypto: Fix compiler warning (rhbz#1484264)
  - merge upstream commit fdeed33f514e0056e322a45d9a0a04ca4b9a2709 (rhbz#1484264)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-10
changelog:
  - Resolves: rhbz#1439205
  - Resolves: rhbz#1461450
  - Resolves: rhbz#1469170
  - Resolves: rhbz#1476214

  - main: Don't ask libqb to handle segv, it doesn't work (rhbz#1439205)
  - merge upstream commit c0da36a6c0ecf7bc7def252a06336a7088e68086 (rhbz#1439205)
  - totem: Propagate totem initialization failure (rhbz#1461450)
  - merge upstream commit 0413a8f4672352171f0df731b7d9c1fe20acbc4c (rhbz#1461450)
  - totemcrypto: Refactor symmetric key importing (rhbz#1461450)
  - merge upstream commit a885868181c07ba9ab5cdfdad1d66d387b2a4428 (rhbz#1461450)
  - totemcrypto: Use different method to import key (rhbz#1461450)
  - merge upstream commit 5dadebd21862074deaeb9a337fc9e49f5e9f692a (rhbz#1461450)
  - main: Add option to set priority (rhbz#1469170)
  - merge upstream commit a008448efb2b1d45c432867caf08f0bcf2b4b9b0 (rhbz#1469170)
  - main: Add support for libcgroup (rhbz#1476214)
  - merge upstream commit c56086c701d08fc17cf6d8ef603caf505a4021b7 (rhbz#1476214)
  - totemcrypto: Fix compiler warning (rhbz#1461450)
  - merge upstream commit fdeed33f514e0056e322a45d9a0a04ca4b9a2709 (rhbz#1461450)


author: Jan Friesse <jfriesse@redhat.com> 2.4.3-2
changelog:
  - Resolves: rhbz#1536219

  - logging: Make blackbox configurable (rhbz#1536219)
  - merge upstream commit 8af39f66e56e319b6b93804c0400e6e29737a90f (rhbz#1536219)
  - logging: Close before and open blackbox after fork (rhbz#1536219)
  - merge upstream commit 995ed0bd814ff3eacf6c09534841e6ce39ab6614 (rhbz#1536219)


author: Pavel Raiskup <praiskup@redhat.com> - 2.11-17
changelog:
  - fix small memory leak in copyin.c (#919454)
  - remove %defattr and install 'cpio' to real %{_bindir}
  - CovScan: add %{?_rawbuild}


author: Pavel Raiskup <praiskup@redhat.com> - 2.11-20
changelog:
  - fix another bogus date in changelog
  - update config.guess/config.sub for aarm64 build (#925189)
  - run autoreconf instead of autoheader


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-8
changelog:
  - fix a bug in C++ ref-to-ptr conversion (#1344807)
  - fix combiner handling of jumps on aarch64 (#1344672,
    PR rtl-optimization/52714)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-9
changelog:
  - backport OpenMP 4.5 support to libgomp (library only; #1357060,
    PRs libgomp/68579, libgomp/64625)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-11
changelog:
  - on aarch64 emit scheduling barriers before stack deallocation in
    function epilogues (#1362635, PR target/63293)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-12
changelog:
  - fix up std::rethrow_exception (#1375711, PR libstdc++/62258)
  - use _Unwind_GetIPInfo in __gcc_personality_v0 (#1387402, PR libgcc/78064)
  - fix vec_vsx_ld/st on ppc64le (#1389801, PR target/72863, PR target/78084)
  - fix ICE in gfc_compare_derived_types (#1369183)
  - fix EH from C++ thunks (#1427412, PR ipa/68184)
  - on ppc64{,le} emit nop after recursive call if the current function
    is replaceable (#1420723, PR target/79439)
  - on aarch64 with -frounding-math use fnmul only with -(a*b) and not
    with (-a)*b (#1418446, PR target/66731)
  - constrain std::valarray functions and operators (#1416214,
    PR libstdc++/69116)
  - fix gimplification of aggregate assignments when lhs is used
    (#1396298, PR middle-end/72747, PR c/78408)
  - fix aarch64 TLS with -mcmodel=large (#1389276, PR target/78796)
  - fix aarch64 reloading of floating point constants into general purpose
    registers (#1349067, PR target/70549)
  - fix DW_AT_decl_line on DW_TAG_enumeration_type for C enumeration
    definitions following forward declarations (#1423460, PR c/79969)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-13
changelog:
  - add -mstack-protector-guard={tls,global}, -mstack-protector-guard-reg=
    and -mstack-protector-guard-offset= options on ppc* (#1415952,
    PR target/78875)


author: Ondrej Kozina <okozina@redhat.com> - 1.6.7-1
changelog:
  - Update to cryptsetup 1.6.7.
  - patch: avoid use of kernel crypto API socket which is known
    to be broken in RHEL7.0 kernel (7.1+ is fine).
  - Resolves: #1206170


author: Andreas Schneider <asn@redhat.com> - 4.6.2-7
changelog:
  - resolves: #1461336 - Fix smbclient username parsing
  - resolves: #1460937 - Fix username normalization with winbind


author: Andreas Schneider <asn@redhat.com> - 4.6.2-10
changelog:
  - resolves: #1484423 - Require at least krb5 version 1.15.1
  - resolves: #1484713 - Fix password changes for users via smbpasswd
  - resolves: #1484723 - Be more graceful on FSCTL_VALIDATE_NEGOTIATE_INFO
                         returned errors


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-34
changelog:
  - acknowledge the --no-sessionid/CURLOPT_SSL_SESSIONID_CACHE option
    (required by the fix for CVE-2016-5419)


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-37
changelog:
  - fix tight loop in non-blocking TLS handhsake over proxy (#1388162)
  - handle cookies with numerical IPv6 address (#1341503)
  - make libcurl recognize chacha20-poly1305 and SHA384 cipher-suites (#1374740)
  - curl -E: allow to escape ':' in cert nickname (#1376062)
  - run automake in %prep to avoid patching Makefile.in files from now on


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.49.31-1
changelog:
  - ipv6: wait for all global IPv6 addresses to leave the "tentative" state
  - source_config: tell NetworkManger to load ifcfg file even for NM_CONTROLLED=no
  - ifup-aliases: inherit ARPCHECK from parent device
  - rhel-dmesg: don't start in containers
  - ifup-eth: fix typo in error message (#1038776)
  - sysctl.conf: steal comments about /usr,/etc,... from fedora's sysctl.conf
  - rwtab: /var/lib/nfs needs to copy the files
  - functions: improve killing loops
  - ipcalc: detect invalid mask
  - ifup: set valid_lft and preferred_lft to forever for static ip
  - service: use systemd mangle for given service
  - ifup-post: check resolve.conf also with DNS2
  - ifdown-post: remove resolv.conf only in specific cases
  - spec: ghost /var/log/dmesg
  - network-functions: is_available_wait should wait even in the case that is_available returns 2
  - autorelabel: turn quota off before relabeling
  - autorelabel: call dracut-initramfs-restore before forced reboot


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.38-1
changelog:
  - ifdown-eth: we need to flush global scope as well
  - killproc/status: add missing '-b <binary>' option
  - specfile: mark 'rwtab' and 'statetab' as config files
  - spec: we need newer lvm
  - rwtab: add /var/lib/systemd/timers
  - ifup-eth: remove quote marks
  - 9.70-sync: Move everything to github
  - 9.70-sync: rwtab updated
  - 9.70-sync: service file updated
  - 9.70-sync: syconfig.txt updated
  - 9.70-sync: systemd/rhel-import-state updated
  - 9.70-sync: sysconfig/network-scripts/* updated - part 2
  - 9.70-sync: sysconfig/network-scripts/* updated - part 1
  - 9.70-sync: rc.d/init.d/network updated
  - 9.70-sync: rc.d/init.d/netconsole updated
  - 9.70-sync: rc.d/init.d/functions updated
  - 9.70-sync: ipv6-6to4.howto example updated
  - 9.70-sync: examples/networking/ifcfg-bridge updated
  - network: load NetworkManager connection via dbus
  - network: check for running NetworkManager via dbus


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.39-1
changelog:
  - sysconfig.txt: mention previously introduced NO_DHCP_HOSTNAME option
  - DHCP_FQDN and DHCP_SEND_HOSTNAME introduced
  - re-add missing $HOSTNAME initialization
  - ifup: add support for VLAN_EGRESS_PRIORITY_MAP
  - rhel-autorelabel: synchronize cached writes before reboot


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-104
changelog:
  - Change _pkgconfdir from /usr/share/pkgconfig to /usr/lib/pkgconfig
  - Modify 0209-UPBZ-1430097-multipath-C-API.patch
    * change _pkgconfdir and fixed double-closing fd
  - Add 0211-RH-strlen-fix.patch
    * checks that variables are not NULL before passing them to strlen
  - Related: bz #1430097


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-107
changelog:
  - Modify 0197-RHBZ-1394059-max-sectors-kb.patch
    * Make multipath only change max_sectors_kb on creates. On reloads, it
      just makes sure the new path matches the multipath device.
  - Refresh 0198-RHBZ-1372032-detect-path-checker.patch
  - Refresh 0201-RHBZ-1403552-silence-warning.patch
  - Refresh 0206-RHBZ-1239173-pt2-no-paths.patch
  - Refresh 0207-UP-add-libmpathcmd.patch
  - Refresh 0212-RHBZ-1431562-for-read-only.patch
  - Resolves: bz #1394059


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-109
changelog:
  - Add 0214-RHBZ-1392115-set-paths-not-ready.patch
    * Set ENV{SYSTEMD_READY}="0" on multipath path devices
  - Resolves: bz #1392115


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-110
changelog:
  - Add 0215-RHBZ-1444194-fix-check-partitions.patch
    * make sure kpartx partions match the correct device
  - Add 0216-RHBZ-1448562-fix-reserve.patch
    * don't join threads that haven't been created
  - Add 0217-RHBZ-1437329-blacklist-oracle-devs.patch
    * blacklist db2.* devices
  - Add 0218-RHBZ-1448576-3PAR-config.patch
  - Resolves: bz #1444194, #1448562, #1437329, #1448576


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-111
changelog:
  - Remove 0217-RHBZ-1437329-blacklist-oracle-devs.patch
    * Incorrect change, and the bug is already fixed.
  - Move 0218-RHBZ-1448576-3PAR-config.patch to
    0217-RHBZ-1448576-3PAR-config.patch
  - Resolves: bz #1448576


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-111.1
changelog:
  - Add 0218-RHBZ-1510837-add-feature-fix.patch
    * handle null feature string
  - Add 0219-RHBZ-1510834-unpriv-sgio.patch
    * add unpriv_sgio configuration option to set unpriv_sgio on multipath device
      and paths
  - Add 0220-RHBZ-1510834-prkey.patch
    * allow setting reservation_key to "file" to set and read keys from
      prkey_file. Also add new multipathd commands to modify the prkey file.
  - Add 0221-RHBZ-1510839-nimble-config.patch
  - Resolves: bz #1510834, #1510837, #1510839


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-111.2
changelog:
  - Modify Add 0220-RHBZ-1510834-prkey.patch
    * Improve error checking for mpathpersist
  - Resolves: bz #1510834


author: Peter Rajnoha <prajnoha@redhat.com> - 0.6.2-2
changelog:
  - Improve documentation and messages on output file preallocation
    when using thin_repair and thin_restore.


author: Peter Rajnoha <prajnoha@redhat.com> - 0.7.0-0.1-rc3
changelog:
  - Update to latest upstream release including various bug fixes and new features.
  - New thin_show_duplicates command.
  - Add '--skip-mappings' and '--format custom' options to thin_dump.


author: Peter Rajnoha <prajnoha@redhat.com> - 0.7.0-0.1-rc6
changelog:
  - Don't open devices as writeable if --clear-needs-check-flag is not set.
  - Fix cache metadata format version 2 superblock packing.


author: Pavel Zhukov <pzhukov@redhat.com> - 12:4.2.5-55
changelog:
  - Resolves: #1349044 - Add disclamer for chaging /etc/dhcp permission for scripts
  - Fix syntax error in attr


author: Petr Menšík <pemensik@redhat.com> - 2.76-1
changelog:
  - Rebase to 2.76 (#1375527)
  - Include also dhcp_release6 (#1375569)
  - Fix compilation warnings
  - Correct manual about interface aliases, warn if used without --bind*


author: Petr Menšík <pemensik@redhat.com> - 2.76-2
changelog:
  - Fix a few coverity warnings
  - package is dual-licensed GPL v2 or v3
  - don't include /etc/dnsmasq.d in triplicate, ignore RPM backup files instead


author: Petr Menšík <pemensik@redhat.com> - 2.76-2.1
changelog:
  - Fix CVE-2017-14491
  - Fix CVE-2017-14492
  - Fix CVE-2017-14493
  - Fix CVE-2017-14494
  - Fix CVE-2017-14496
  - Fix CVE-2017-14495
  - extra fixes


author: Lukáš Nykrýn <lnykryn@redhat.com> - 033-487
changelog:
  - add upstream tests
  - dracut.sh: fail hard, if we find modules and modules.dep is missing
  Resolves: rhbz#1298656
  - add dracut.pc pkg-config file
  Resolves: rhbz#1397853
  - systemd/dracut-cmdline.sh: unset "UNSET" $root
  Releated: rhbz#1365667
  - dracut.conf.5.asc: add Warning about leading and trailing spaces in lists
  - fips/module-setup.sh: make tcrypt non-optional


author: Lukáš Nykrýn <lnykryn@redhat.com> - 033-495
changelog:
  - ifup: don't ifup team master indefinitely
  Resolves: rhbz#1416958
  - write-ifcfg: do't write MTU twice for regular eth devices
  Resolves: rhbz#1366163
  - network/ifup: write override file before dhcp_do
  Resolves: rhbz#1415004


author: Lukáš Nykrýn <lnykryn@redhat.com> - 033-499
changelog:
  - module-setup.sh: Add ARM specific driver to initramfs image
  Resolves: #1459277
  - Revert "systemd/dracut-initqueue.sh: don't go into emergency"
  Resolves: #1396865
  - udev-rules: pull in 40-redhat-cpu-hotplug.rules
  Resolves: #1460707


author: Petr Stodulka <pstodulk@redhat.com> -1.8.3.1-9
changelog:
  - add control of GSSAPI credential delegation to enable HTTP(S)-SSO
    authentication
    Resolves: #1369173


author: Marek Grac <mgrac@redhat.com> - 4.0.11-57
changelog:
  - Set SELinux booleans required for fence agent integration with cluster
    Resolves: rhbz#1427986
  - Add consistency of parameters between STDIN and command-line
    Resolves: rhbz#1403028


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.0.11-66.3
changelog:
  - fence_compute/fence_scsi: fix issue with some parameters
    (for ABI compatibility)
    Resolves: rhbz#1497241


author: David King <dking@redhat.com> - 0.8.4-2
changelog:
  - Sync bzip2 dependency with Fedora package
  - Make the libs subpackage depend on the base package for libostree
  - Fix multilib issues with XML-based documentation


author: Colin Walters <walters@verbum.org> - 0.8.7-2
changelog:
  - Fix libostree bundling:
    Ensure we do not Provide or Require libostree.
    Move the shared library into flatpak-libs so flatpak always
    depends on it.
    Keep the shared library filename as libostree, but put it
    under a private directory.  Renaming the file on disk did not
    really do much since the dynamic linker and RPM work from the
    soname.
    Resolves: #1476905
  - Tweak build to work both with and without BZ#1392354


author: David King <dking@redhat.com> - 0.8.7-3
changelog:
  - Fix crasher in xdg-desktop-portal
  - Tweak spec file so it still builds even though we need to
    autoreconf.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.12-1
changelog:
  - Upgrade to upstream v3.0.12 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.7 or later minor release
    Resolves: Bug#1358989 FreeRADIUS stops reading the accounting packets from the
                          detail file
    Resolves: Bug#1269217 FreeRADIUS triggers mprotect with large radius reply
    Resolves: Bug#1344183 radiusd crashed in rbtree_find() after receiving a packet
    Resolves: Bug#1370431 FreeRADIUS fails to establish LDAP connections under
                          load
    Resolves: Bug#1397981 [abrt] freeradius: radiusd killed by SIGSEGV


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.12-2
changelog:
  - Do not fail logrotate if radiusd is not running.
    Resolves: Bug#1365226 error running non-shared postrotate script for
                          /var/log/radius/radius.log of
                          '/var/log/radius/radius.log '
  - Fix output to log file specified with -l option.
    Resolves: Bug#1421207 radiusd does not work with log file specified by -l
                          option
  - Fix long hostnames interpreted as IP addresses.
    Resolves: Bug#1420359 radclient does not detect 4. level and higher domain
                          name as a domain name
  - Avoid clashes with libtool library symbols.
    Resolves: Bug#1391960 undefined symbol: get_vtable in
                          /usr/lib64/libtdsodbc.so.0 with freeradius-unixODBC
  - Remove mentions of Auth-Type = System from docs.
    Resolves: Bug#1420293 Freeradius does not know Auth-Type = System
  - Improve ip/v4/v6/addr documentation.
    Resolves: Bug#1179736 add description for ipaddr = hostname from DNS with A
                          and AAAA entries


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-1
changelog:
  - Upgrade to upstream v3.0.13 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release
    Resolves: Bug#1329181 freeradius-python fix libpython2.7.so dependency at
                          compile time
    Resolves: Bug#1425869 Radiusd does not trigger modules.sql.fail trap if it
                          can't connect to mysql server
    Resolves: Bug#1427829 Stack overflow when passing bare IPv6 to radclient


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-2
changelog:
  - Fix some issues found with static analyzers.
    Resolves: Bug#1432103 FreeRADIUS fails covscan checks
  - Revert rlm_eap_tnc removal, because the tncfhh package is still in RHEL.
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-3
changelog:
  - Explicitly disable rlm_cache_memcached to avoid error when the module's
    dependencies are installed, and it is built, but not packaged.
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release
  - Prevent segfaults by adding a missing handling of connection errors in
    rlm_ldap.
    Resolves: Bug#1437409 [abrt] freeradius: radiusd killed by SIGSEGV
  - Make radtest use Cleartext-Password for EAP, fixing its support for eap-md5.
    Resolves: Bug#1436619 radtest does not work with eap-md5


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-4
changelog:
  - Disable internal OpenSSL cache.
    Resolves: Bug#1458746 CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass
  - Check sizeof(*packet), not sizeof(packet) in EAP-PWD
    Resolves: Bug#1459073 Potential buffer overflow in FreeRADIUS EAP-PWD
  - Parse port as well as address for dhcpclient destination
    Resolves: Bug#1457825 dhcpclient does no accept IP:PORT


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-5
changelog:
  - Refer to correct package version in configuration comments for Bug#1458746
    (CVE-2017-9148) fix.
    Related: Bug#1458746  CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-6
changelog:
  - Avoid race condition when creating session cache file
    Resolves: Bug#1458746 CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-7
changelog:
  - Resolves: Bug#1469409 CVE-2017-10978 freeradius: Out-of-bounds read/write due
                          to improper output buffer size check in make_secret()
  - Resolves: Bug#1469413 CVE-2017-10983 freeradius: Out-of-bounds read in
                          fr_dhcp_decode() when decoding option 63
  - Resolves: Bug#1469414 CVE-2017-10984 freeradius: Out-of-bounds write in
                          data2vp_wimax()
  - Resolves: Bug#1469417 CVE-2017-10985 freeradius: Infinite loop and memory
                          exhaustion with 'concat' attributes
  - Resolves: Bug#1469418 CVE-2017-10986 freeradius: Infinite read in
                          dhcp_attr2vp()
  - Resolves: Bug#1469421 CVE-2017-10987 freeradius: Buffer over-read in
                          fr_dhcp_decode_suboptions()


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-8
changelog:
  - Avoid misinterpreting zero-size malloc in data2vp_extended() fix.
  - Related: Bug#1469414 CVE-2017-10984 freeradius: Out-of-bounds write in
                         data2vp_wimax()


author: Ray Strode <rstrode@redhat.com> - 3.22.3-4
changelog:
  - Drop reference to wayland in config file
  - use autosetup to simplify spec maintenance
    Related: #1386862


author: Ray Strode <rstrode@redhat.com> 3.22.3-8
changelog:
  - Reap transient login screens when they are no longer needed
  - Jump to login screen if we end up on a blank VT
    Resolves: #1301028


author: Ray Strode <rstrode@redhat.com> - 3.22.3-10
changelog:
  - Add patches to try to maintain some semblance of compatibility
    when live upgrading between 7.3 and 7.4
    Related: #1448786


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-21
changelog:
  - Added security fixes for:
    - CVE-2013-5653 (bug #1380327)
    - CVE-2016-7977 (bug #1380415)
    - CVE-2016-7978 (bug #1382300)
    - CVE-2016-7979 (bug #1382305)
    - CVE-2016-8602 (bug #1383940)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-25
changelog:
  - Added security fix for CVE-2017-7207 (bug #1434353)
  - Added explicit requirement for lcms2 version we are build with (bug #1436273)


author: Carlos O'Donell <carlos@redhat.com> - 2.17-190
changelog:
  - Add transparent lock elision for default POSIX mutexes on
    Intel hardware with support for Intel TSX (#841653).
  - Update dynamic loader trampoline for Intel Skylake server (#1421155).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-191
changelog:
  - Add transparent lock elision for default POSIX mutexes on
    IBM POWER hardware with support for IBM POWER HTM (#731835).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-192
changelog:
  - Exclude lock elision support for older Intel hardware with
    Intel TSX that has hardware errata (#841653).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-196.2
changelog:
  - Update HWCAP bits for IBM POWER9 DD2.1 (#1515114)
  - Improve memcpy performance for POWER9 DD2.1 (#1516402)


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 1.8.9-2
changelog:
  - Remove bundled JARs and classes
  - Add workaround for rhbz#971483
  - Add Public Domain to licenses
  - Install ASL 2.0 license text, resolves: rhbz#858257


author: Peter Jones <pjones@redhat.com> - 2.02-0.60
changelog:
  - Fix ppc64 deciding /boot/efi might somehow be the CHRP partition if it
    exists.  This is also why the bug we fixed in 0.59 showed up at all.
    Resolves: rhbz#1443809
    Resolves: rhbz#1442970
  - Fix a regexp problem where rpm spec parser un-escapes things that
    don't need escaping, which causes our s/-mcpu=power8/-mcpu=power6/
    to fail.
    Related: rhbz#1443809


author: Peter Jones <pjones@redhat.com> - 2.02-0.61
changelog:
  - Fix some minor ia32 booting bugs
    Related: rhbz#1310763
    Related: rhbz#1411748
    Related: rhbz#1300009
  - Add support for non-Ethernet network cards
    Related: rhbz#1232432
  - Add support for http booting
    Resolves: rhbz#1232432
  - Fix efi module subpackage obsoletes/provides
    Resolves: rhbz#1447723
  - Make ppc modules subpackages use different directories on the filesystem.
    Resolves: rhbz#1455243


author: Peter Jones <pjones@redhat.com> - 2.02-0.65.1
changelog:
  - More precise requires and obsoletes on the -tools* subpackages to avoid
    issues with mixing and matching repos the subpackages are split between.
    Resolves: rhbz#1499669


author: CentOS Sources <bugs@centos.org> - 2.02-0.65.el7.centos.2
changelog:
  - Roll in CentOS Secureboot keys
  - Move the edidir to be CentOS, so people can co-install fedora, rhel and centos


author: Fabiano Fidêncio <fidencio@redhat.com> - 2.7.1-5
changelog:
  - Bump http-parser release number to avoid people pulling EPEL package instead
    of RHEL package
    Resolves: rhbz#1480321


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-60
changelog:
  - Resolves: #1414258 - Crash during restart or at startup in mod_ssl,
    in certinfo_free() function registered by ssl_stapling_ex_init()


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-61
changelog:
  - Related: #1414258 - Crash during restart or at startup in mod_ssl,
    in certinfo_free() function registered by ssl_stapling_ex_init()


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-62
changelog:
  - Resolves: #1397241 - Backport Apache Bug 53098 - mod_proxy_ajp:
    patch to set worker secret passed to tomcat


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-64
changelog:
  - Resolves: #1442872 - apache user is not created during httpd installation
    when apache group already exist with GID other than 48


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-67.2
changelog:
  - Resolves: #1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw()
    authentication bypass
  - Resolves: #1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer dereference
  - Resolves: #1463207 - CVE-2017-7679 httpd: mod_mime buffer overread
  - Resolves: #1463205 - CVE-2017-7668 httpd: ap_find_token() buffer overread
  - Resolves: #1470748 - CVE-2017-9788 httpd: Uninitialized memory reflection
    in mod_auth_digest


author: CentOS Sources <bugs@centos.org> - 2.4.6-67.el7.centos.2
changelog:
  - Remove index.html, add centos-noindex.tar.gz
  - change vstring
  - change symlink for poweredby.png
  - update welcome.conf with proper aliases


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-17.el7
changelog:
  - Resolve: #1455946 Provide a tooling automating the configuration 
    of Smart Card authentication on a FreeIPA master
    - server certinstall: update KDC master entry
    - pkinit manage: introduce ipa-pkinit-manage
    - server upgrade: do not enable PKINIT by default
    - Extend the advice printing code by some useful abstractions
    - Prepare advise plugin for smart card auth configuration
  - Resolve: #1461053 allow to modify list of UPNs of a trusted forest
    - trust-mod: allow modifying list of UPNs of a trusted forest
    - WebUI: add support for changing trust UPN suffixes


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-18.el7
changelog:
  - Resolves: #1449189 ipa-kra-install timeouts on replica
    - kra: promote: Get ticket before calling custodia


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-19.el7
changelog:
  - Resolves: #1462112 ipaserver installation fails in FIPS mode: OpenSSL
    internal error, assertion failed: Digest MD4 forbidden in FIPS mode!
    - ipa-sam: replace encode_nt_key() with E_md4hash() 
    - ipa_pwd_extop: do not generate NT hashes in FIPS mode
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces 
    - Fix local IP address validation 
    - ipa-dns-install: remove check for local ip address
    - refactor CheckedIPAddress class
    - CheckedIPAddress: remove match_local param
    - Remove ip_netmask from option parser
    - replica install: add missing check for non-local IP address
    - Remove network and broadcast address warnings


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-20.el7
changelog:
  - Resolves: #1452216 Replica installation grants HTTP principal
    access in WebUI
    - Make sure we check ccaches in all rpcserver paths


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7
changelog:
  - Resolves: #1470125 Replica install fails to configure IPA-specific
    temporary files/directories
    - replica install: drop-in IPA specific config to tmpfiles.d
  - Resolves: #1469978 bind package is not automatically updated during
    ipa-server upgrade process
    - Bumped Required version of bind-dyndb-ldap and bind package


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1
changelog:
  - Resolves: #1473272 Provide a tooling automating the configuration
    of Smart Card authentication on a FreeIPA master
    - smart-card advises: configure systemwide NSS DB also on master
    - smart-card advises: add steps to store smart card signing CA cert
    - Allow to pass in multiple CA cert paths to the smart card advises
    - add a class that tracks the indentation in the generated advises
    - delegate the indentation handling in advises to dedicated class
    - advise: add an infrastructure for formatting Bash compound statements
    - delegate formatting of compound Bash statements to dedicated classes
    - Fix indentation of statements in Smart card advises
    - Use the compound statement formatting API for configuring PKINIT
    - smart card advises: use a wrapper around Bash `for` loops
    - smart card advise: use password when changing trust flags on HTTP cert
    - smart-card-advises: ensure that krb5-pkinit is installed on client
  - Resolves: #1477046 Use CommonNameToSANDefault in default profile 
    (new installs only)
    - Add CommonNameToSANDefault to default cert profile
  - Resolves: #1475664 NULL LDAP context in call to ldap_search_ext_s
    during search in cn=ad,cn=trusts,dc=example,dc=com
    - NULL LDAP context in call to ldap_search_ext_s during search


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1.1
changelog:
  - Resolves: #1477046 Use CommonNameToSANDefault in default profile
    (new installs only)
    - Restore old version of caIPAserviceCert for upgrade only


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-21.el7.2
changelog:
  - Resolves: #1486794 - [ipa-replica-install] - 406 Client Error: Failed to
    validate message: Incorrect number of results (0) searching forpublic
    key for host
      - Always check peer has keys before connecting
  - Resolves: #1489300 - Unable to set ca renewal master on replica
      - Fix ipa config-mod --ca-renewal-master
  - Resolves: #1489815 - TypeError in renew_ca_cert prevents from swiching
    back to self-signed CA
      - Backport PR 988 to ipa-4-5 Fix Certificate renewal (with ext ca)
  - Resolves: #1489817 - ipa-server-upgrade failes with "This entry already exists"
      - Backport PR 1008 to ipa-4-5 Fix ipa-server-upgrade: This entry already exists
  - Resolves: #1490331 - FreeIPA/IdM installations which were upgraded from
    versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
    thus startup of Web UI fails
      - Adds whoami DS plugin in case that plugin is missing
  - Resolves: #1491545 - IPA WebUI does not work after upgrade from IPA 4.4 to 4.5
      - Fixing how sssd.conf is updated when promoting a client to replica
  - Resolves: #1492616 - ipa-otptoken-import - XML file is missing PBKDF2
    parameters!
      - ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace
  - Resolves: #1493153 - Updating from RHEL 7.3 fails with Server-Cert not found
    (ipa-server-upgrade)
      - Backport 4-5: Fix ipa-server-upgrade with server cert tracking


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-21.el7.2.2
changelog:
  - Resolves: #1493410 ipa-server-upgrade timeouts on wait_for_open ports
    expecting IPA services listening on IPv6 ports
      - Make sure upgrade also checks for IPv6 stack
      - control logging of host_port_open from caller
      - log progress of wait_for_open_ports
  - Resolves: #1493411 ipa help command returns traceback when no cache
    is present
      - Store help in Schema before writing to disk
      - Disable pylint in get_help function because of type confusion.


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-13.el7
changelog:
  - Resolves: #1451804 "AttributeError: 'tuple' object has no attribute 'append'"
    error observed during ipa upgrade with latest package. 
    - ipa-server-install: fix uninstall
  - Resolves: #1445390 ipa-[ca|kra]-install with invalid DM password break
    replica 
    - ca install: merge duplicated code for DM password
    - installutils: add DM password validator
    - ca, kra install: validate DM password


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-14.el7
changelog:
  - Resolves: #1438731 Extend ipa-server-certinstall and ipa-certupdate to 
    handle PKINIT certificates/anchors
    - certdb: add named trust flag constants
    - certdb, certs: make trust flags argument mandatory
    - certdb: use custom object for trust flags
    - install: trust IPA CA for PKINIT
    - client install: fix client PKINIT configuration
    - install: introduce generic Kerberos Augeas lens
    - server install: fix KDC PKINIT configuration
    - ipapython.ipautil.run: Add option to set umask before executing command
    - certs: do not export keys world-readable in install_key_from_p12
    - certs: do not export CA certs in install_pem_from_p12
    - server install: fix KDC certificate validation in CA-less
    - replica install: respect --pkinit-cert-file
    - cacert manage: support PKINIT
    - server certinstall: support PKINIT
  - Resolves: #1444432 CA-less pkinit not installable with --pkinit-cert-file
    option
    - certs: do not export CA certs in install_pem_from_p12
    - server install: fix KDC certificate validation in CA-less
  - Resolves: #1451228 ipa-kra-install fails when primary KRA server has been
    decommissioned
    - ipa-kra-install: fix pkispawn setting for pki_security_domain_hostname 
  - Resolves: #1451712 KRA installation fails on server that was originally
    installed as CA-less
    - ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
  - Resolves: #1441499 ipa cert-show does not raise error if no file name
    specified
    - ca/cert-show: check certificate_out in options
  - Resolves: #1449522 Deprecate `ipa pkinit-anonymous` command in FreeIPA 4.5+
    - Remove pkinit-anonymous command
  - Resolves: #1449523 Provide an API command to retrieve PKINIT status
    in the FreeIPA topology
    - Allow for multivalued server attributes
    - Refactor the role/attribute member reporting code
    - Add an attribute reporting client PKINIT-capable servers
    - Add the list of PKINIT servers as a virtual attribute to global config
    - Add `pkinit-status` command
    - test_serverroles: Get rid of MockLDAP and use ldap2 instead
  - Resolves: #1452216 Replica installation grants HTTP principal access in WebUI
    - Fix rare race condition with missing ccache file
  - Resolves: #1455045 Simple service uninstallers must be able to handle
    missing service files gracefully
    - only stop/disable simple service if it is installed
  - Resolves: #1455541 after upgrade login from web ui breaks
    - krb5: make sure KDC certificate is readable
  - Resolves: #1455862 "ipa: ERROR: an internal error has occurred" on executing
    command "ipa cert-request --add" after upgrade
    - Change python-cryptography to python2-cryptography


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-15.el7
changelog:
  - Resolves: #1442233 IPA client commands fail when pointing to replica 
    - httpinstance: wait until the service entry is replicated
  - Resolves: #1456769 ipaAnchorUUID index incorrectly configured and then
    not indexed
    - Fix index definition for ipaAnchorUUID
  - Resolves: #1438016 gssapi errors after IPA server upgrade
    - Avoid possible endless recursion in RPC call
    - rpc: preparations for recursion fix
    - rpc: avoid possible recursion in create_connection
  - Resolves: #1446087 services entries missing krbCanonicalName attribute.
    - Changing cert-find to do not use only primary key to search in LDAP.
  - Resolves: #1452763 ipa certmaprule change not reflected in krb5kdc workers
    - ipa-kdb: reload certificate mapping rules periodically
  - Resolves: #1455541 after upgrade login from web ui breaks
    - kdc.key should not be visible to all 
  - Resolves: #1435606 Add pkinit_indicator option to KDC configuration
    - ipa-kdb: add pkinit authentication indicator in case of a successful
      certauth
  - Resolves: #1455945 Enabling OCSP checks in mod_nss breaks certificate
    issuance when ipa-ca records are not resolvable
    - Turn off OCSP check
  - Resolves: #1454483 rhel73 ipa ui - cannot del server - IPA Error 903 -
    server_del - TypeError: 'NoneType' object is not iterable
    - fix incorrect suffix handling in topology checks


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-16.el7
changelog:
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces
    - Only warn when specified server IP addresses don't match intf
  - Resolves: #1438016 gssapi errors after IPA server upgrade
    - Bump version of python-gssapi
  - Resolves: #1457942 certauth: use canonical principal for lookups
    - ipa-kdb: use canonical principal in certauth plugin
  - Resolves: #1459153 Do not send Max-Age in ipa_session cookie to avoid
    breaking older clients
    - Add code to be able to set default kinit lifetime
    - Revert setting sessionMaxAge for old clients


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-22.el7
changelog:
  - Resolves: #1506528 In case full PKINIT configuration is failing during
    server/replica install the error message should be more meaningful.
      - Less confusing message for PKINIT configuration during install
  - Resolves: #1506526 Use X509v3 Basic Constraints "CA:TRUE" instead of
    "CA:FALSE" IPA CA CSR
      - Include the CA basic constraint in CSRs when renewing a CA
  - Resolves: #1506913 ipa-replica-install might fail because of an already
    existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
      - Checks if replica-s4u2proxy.ldif should be applied
  - Resolves: #1506525 server-del doesn't remove dns-server configuration
    from ldap
      - server.py: Removes dns-server configuration from ldap


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-14
changelog:
  - Add cgroup support (RHBZ#1058660)
  - Add wait seonds support for commands (RHBZ#1156411)
  - Add dhcpv6-client in default IPv6 firewall rules (RHBZ#1169036)
  - Add message for init script error returns (RHBZ#1200415)
  - Use flock for wait option (RHBZ#1202435)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-16
changelog:
  - Fix important coverity findings: missing include for flock and use bash for
    init script (RHBZ#1264399)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-17
changelog:
  - Fixed init script not to fail on missing restorecon (RHBZ#1246380)
  - Adapted man page snipplet for TRACE to use proper logging backend names
    (RHBZ#1261238)
  - Warn about use of DROP in nat table (RHBZ#1298879)
  - Fixed modules unload in init script (RHBZ#1324102)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-18
changelog:
  - Add support for --wait options to restore commands (RHBZ#1438597)
  - Do not set changed flag for rule check operations with module targets
    (RHBZ#1438597)
  - Add version option to restore commands (RHBZ#1438597)


author: Phil Sutter - 1.4.21-18.2
changelog:
  - Prevent iptables.service and ip6tables.service from running in parallel
    (RHBZ#1491963)
  - Don't restart services upon upgrade (RHBZ#1491961)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20130517-4.gitc4bce43
changelog:
  - ipxe-Use-next-server-from-filename-s-settings-block.patch [bz#1062644]
  - Resolves: bz#1062644
    (pxe boot fails if next-server details come from a different dhcp server)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20130517-5.gitc4bce43.el7
changelog:
  - ipxe-Enable-infrastructure-to-specify-an-autoboot-device-.patch [bz#1031518]
  - ipxe-Allow-prefix-to-specify-a-PCI-autoboot-device-locati.patch [bz#1031518]
  - ipxe-Store-boot-bus-dev.fn-address-as-autoboot-device-loc.patch [bz#1031518]
  - ipxe-Ignore-PCI-autoboot-device-location-if-set-to-00-00..patch [bz#1031518]
  - ipxe-Revert-Remove-2-second-startup-wait.patch [bz#857123]
  - ipxe-Allow-ROM-banner-timeout-to-be-configured-independen.patch [bz#857123]
  - ipxe-Customize-ROM-banner-timeout.patch [bz#857123]
  - Resolves: bz#1031518
    (iPXE does not honor specified boot device)
  - Resolves: bz#857123
    (Guests never get an iPXE prompt)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20130517-6.gitc4bce43.el7
changelog:
  - ipxe-import-EfiRom-from-edk2-BaseTools-RHEL-only.patch [bz#1084561]
  - ipxe-add-custom-Makefile-for-EfiRom-RHEL-only.patch [bz#1084561]
  - ipxe-redhat-build-and-install-combined-legacy-UEFI-roms-f.patch [bz#1084561]
  - Resolves: bz#1084561
    (RFE: ship UEFI drivers for ipxe in RHEL-7.y)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20160127-2.git6366fa7a.el7
changelog:
  - ipxe-Enable-IPv6-protocol-in-non-QEMU-builds.patch [bz#1350167]
  - Resolves: bz#1350167
    (ipxe: enable IPV6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20160127-3.git6366fa7a.el7
changelog:
  - ipxe-Add-pci_find_next_capability.patch [bz#1242850]
  - ipxe-Add-virtio-1.0-constants-and-data-structures.patch [bz#1242850]
  - ipxe-Add-virtio-1.0-PCI-support.patch [bz#1242850]
  - ipxe-Add-virtio-net-1.0-support.patch [bz#1242850]
  - ipxe-Renumber-virtio_pci_region-flags.patch [bz#1242850]
  - ipxe-Fix-virtio-pci-logging.patch [bz#1242850]
  - Resolves: bz#1242850
    (Ipxe can not recognize "network device" when enable virtio-1 of virtio-net-pci)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20160127-4.git6366fa7a.el7
changelog:
  - ipxe-Send-TCP-keepalives-on-idle-established-connections.patch [bz#1322056]
  - ipxe-enable-e1000e-rom.patch [bz#1361534]
  - Resolves: bz#1322056
    (ipxe freeze during HTTP download with last RPM)
  - Resolves: bz#1361534
    (RFE: Integrate e1000e implementation in downstream QEMU)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20160127-5.git6366fa7a.el7
changelog:
  - ipxe-Strip-802.1Q-VLAN-0-priority-tags.patch [bz#1316329]
  - Resolves: bz#1316329
    ([RFE] Properly Handle 8021.Q VID 0 Frames, as new vlan model in linux kernel does.)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20170123-1.git4e85b27.el7_4.1
changelog:
  - ipxe-Support-VIRTIO_NET_F_IOMMU_PLATFORM.patch [bz#1481180]
  - Resolves: bz#1481180
    (iommu platform support for ipxe [rhel-7.4.z])


author: Rafael Aquini <aquini@redhat.com> - 20160830-49.git7534e19
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update QCA6174/hw3.0/board-2.bin file to support ath10k devices (rhbz 1368159)


author: Rafael Aquini <aquini@redhat.com> - 20170217-50.git6d3bc88
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - chelsio: Update to the latest firmware released version (rhbz 1395322)
  - iwlwifi: Update to the latest firmware released version (rhbz 1385749)
  - ath10k: Update to the latest firmware released version (rhbz 1385743)
  - hfi1: Update to the latest firmware released version (rhbz 1382805)


author: Rafael Aquini <aquini@redhat.com> - 20170307-51.git87714d8
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - chelsio: Update to the latest firmware released version (rhbz 1385911)
  - drm: Update for radeon and amdgpu latest firmware released version (rhbz 1425197)


author: Rafael Aquini <aquini@redhat.com> - 20170328-52.git44d8e8d
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - nfp: add firmware for Netronome Ethernet Driver (rhbz 1432592)


author: Rafael Aquini <aquini@redhat.com> - 20170530-54.gitdf40d15
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - opa: HFI firmware problems with new OPA switch firmware (rhbz 1452253)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.2
changelog:
  - Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
  - Update jstack tapset to handle AArch64
  - Handle unsupported architectures by calling the error function rather than a parse failure
  - ABS_JAVA_HOME_DIR is no longer used in the updated tapsets
  - Resolves: rhbz#1373986


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.3
changelog:
  - Backport "8173783: IllegalArgumentException: jdk.tls.namedGroups"
  - Apply backports before local RPM fixes so they will be the same as when applied upstream
  - Adjust RH1022017 following application of 8173783
  - Resolves: rhbz#1422738


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.1
changelog:
  - Bump to 2.6.10 and u141b00.
  - Add more detailed output to fsg.sh and generate_source_tarball.sh.
  - Update md5sum list with checksum for the new java.security file.
  - Drop 8173783 backport which is now applied upstream.
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.3
changelog:
  - Add support for using RSAandMGF1 with the SHA hash algorithms in the PKCS11 provider 
  - Resolves: rhbz#1273760


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.4
changelog:
  - Fix merge error with "native2ascii changes file permissions of input file"
  - Resolves: rhbz#1446700


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.141-2.6.10.5
changelog:
  - make to use latest c-j-c and so fix persisting issues with java.security and other configfiles
  - aligned with this change, applied repackReproduciblePolycies.sh
  - 1183793 is missing blocker
  - Resolves: rhbz#1448880


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.151-2.6.11.1
changelog:
  - Bump to 2.6.11 and u151b00.
  - Update java-access-bridge-security.patch to apply against 2.6.11.
  - Drop 7177216 merge fix which is applied upstream.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.161-2.6.12.0
changelog:
  - Bump to 2.6.12 and u161b00.
  - Update SystemTap tapsets to version in IcedTea 2.6.12pre01 to fix RH1492139.
  - Drop 8185716 patch, now applied upstream.
  - Update location of OpenJDK zlib system library source code in remove-intree-libraries.sh
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.161-2.6.12.0
changelog:
  - Add missing implementation of Matcher::pass_original_key_for_aes() on AArch64 (PR3497)
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.0
changelog:
  - Bump to 2.6.13 and u171b01.
  - Update java-1.7.0-openjdk-java-access-bridge-security.patch to apply after 8186080
  - Drop PR3497 AArch64 patch now applied upstream.
  - Update RC4 patch (8076221/PR2809) to apply after 8148108 (DH lower limit increase)
  - Fix file path in rh1022017.patch.
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.0
changelog:
  - Extend pr3393-rh1273760.patch so Token.getMechanismInfo can handle CK_MECHANISM
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.0
changelog:
  - Update to new tarball with AArch64 return value fixes, dropping local patch.
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.0
changelog:
  - Fix missing return statement in src/os_cpu/linux_zero/vm/os_linux_zero.cpp (non-LP64 only)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.2
changelog:
  - Rebuild with RPM optimisation flags disabled due to issues on x86 multilib
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.0
changelog:
  - Bump to 2.6.14 and u181b00.
  - Drop 8197981 Zero 32-bit patch now applied upstream.
  - Update RC4 patch (8076221/PR2809) to apply after 8175075 (disable 3DES)
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.1
changelog:
  - Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add missing ones
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.3
changelog:
  - Bump release number to an unused one as rhel-7.5-z-java-unsafe-candidate wrongly using .el7
  - Resolves: rhbz#1559766


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.181-2.6.14.5
changelog:
  - added depndence on latest c-j-c who do not have the incorrect jre-abrt handling
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-8.b12
changelog:
  - Restore cacerts symlink as some broken apps hardcode the path (see RH1448802)
  - Resolves: rhbz#1319875


author: Zhengyu Gu <zgu@redhat.com> - 1:1.8.0.131-10.b12
changelog:
  - Added 8181055-pr3394-rh1448880.patch to fix a corner case of previous change
  - Resolves: rhbz#1448880


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.131-11.b12
changelog:
  - make to use latest c-j-c and so fix persisting issues with java.security and other configfiles
  - 1183793 is missing blocker
  - Resolves: rhbz#1448880


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-12.b12
changelog:
  - Add backports from 8u152 (8179084/RH1455694, 8181419/RH1463144, 8175887) ahead of July CPU.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-1.b15
changelog:
  - Update to aarch64-jdk8u141-b15 and aarch64-shenandoah-jdk8u141-b15.
  - Update location of OpenJDK system library source code in remove-intree-libraries.sh
  - Drop upstreamed patches for 6515172, 8144566, 8155049, 8165231, 8174164, 8174729 and 8175097.
  - Update PR1983, PR2899 and PR2934 (SunEC + system NSS) to accomodate 8175110.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-2.b16
changelog:
  - Update to aarch64-jdk8u141-b16 and aarch64-shenandoah-jdk8u141-b16.
  - Revert change to remove-intree-libraries.sh following backout of 8173207
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.144-0.b01
changelog:
  - Update to aarch64-jdk8u144-b01 and aarch64-shenandoah-jdk8u144-b01.
  - Exclude 8175887 from Shenandoah builds as it has been included in that repo.
  - Resolves: rhbz#1481947


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Switch AArch64 to using java-1.8.0-openjdk to bootstrap until RH1482244 is fixed in bootstrap
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Add 8075484/PR3473/RH1490713 which is listed as being in 8u151 but not supplied by Oracle.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Update SystemTap tapsets to version in IcedTea 3.6.0pre02 to fix RH1492139.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Correct fix to RH1191652 root patch so existing COMMON_CCXXFLAGS_JDK is not lost.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - 8188030 is not yet upstream, so it should be listed under upstreamable fixes.
  - 8181055, 8181419, 8145913, 8168318, 8170328 & 8181810 all now in 8u162.
  - Resolves: rhbz#1499207


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - repack policies adapted to new counts and paths
  - note that also c-j-c is needed to make this apply in next update
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - Reverting to java-1.7.0-openjdk on AArch64 as rhel-7.4-z-java-unsafe-candidate using wrong suffix.
  - Resolves: rhbz#1499207


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.151-5.b12
changelog:
  - Backport "8180048: Interned string and symbol table leak memory during parallel unlinking" (gnu_andrew)
  - Resolves: rhbz#1515212


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.161-0.b12
changelog:
  - Update to aarch64-jdk8u161-b12 and aarch64-shenandoah-jdk8u161-b12 (mbalao)
  - Drop upstreamed patches for 8075484 (RH1490713), 8153711 (RH1284948),
    8162384 (RH1358661), 8164293 (RH1459641), 8173941, 8175813 (RH1448880),
    8175887 and 8180048 (RH1449870).(mbalao)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-0.b12
changelog:
  - Switch bootstrap back to java-1.7.0-openjdk on all architectures, depending on RH1482244 fix
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-0.b12
changelog:
  - Replace tarballs with version including AArch64 fix for 8174962 (S8194686)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-0.b13
changelog:
  - Update to b13 including Zero fix for 8174962 (S8194739) and restoring tzdata2017c update
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.162-0.b12
changelog:
  - Update to aarch64-jdk8u162-b12 and aarch64-shenandoah-jdk8u162-b12.
  - Remove upstreamed patches for 8181055/PR3394/RH1448880,
  -  8181419/PR3413/RH1463144, 8145913/PR3466/RH1498309,
  -  8168318/PR3466/RH1498320, 8170328/PR3466/RR1498321 and
  -  8181810/PR3466/RH1498319.
  - Resolves: rhbz#1559766


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.171-1.b10
changelog:
  - Backported from fedora: aarch64BuildFailure.patch, rhbz_1536622-JDK8197429-jdk8.patch, rhbz_1540242.patch
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-1.b10
changelog:
  - Cleanup from previous commit.
  - Remove unused upstream patch 8167200.hotspotAarch64.patch.
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-3.b10
changelog:
  - Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add misisng ones
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-3.b10
changelog:
  - Fix jconsole.desktop.in subcategory, replacing "Monitor" with "Profiling" (PR3550)
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-7.b10
changelog:
  - Bump release number to be greater than RHEL 7.6 package to allow build with .el7 suffix
  - Resolves: rhbz#1559766


author: Elio Maldonado <emaldona@redhat.com> - 4.4.0-1
changelog:
  - Bugzilla Bug #1394414 - Rebase jss to 4.4.0 in RHEL 7.4
  - ## JSS 4.4.0 includes the following patches ported from downstream:
  - Mozilla Bugzilla #507536 - Add IPv6 functionality to JSS
  - Mozilla Bugzilla #1307872 - Expose NSS calls for OCSP settings
  - Mozilla Bugzilla #1307882 - RFE ecc - add ecc curve name support in JSS and
    CS interface
  - Mozilla Bugzilla #1307993 - Expose updated certificate verification function
    in JSS
  - Mozilla Bugzilla #1308000 - Incorrect socket accept error message due to bad
    pointer arithmetic
  - Mozilla Bugzilla #1308001 - Verification should fail when a revoked
    certificate is added
  - Mozilla Bugzilla #1308004 - Warnings should be cleaned up in JSS build
  - Mozilla Bugzilla #1308006 - DRM failed to recovery keys when in FIPS mode
    (HSM + NSS)
  - Mozilla Bugzilla #1308008 - Defects revealed by Coverity scan
  - Mozilla Bugzilla #1308009 - Add support for PKCS5v2; support for secure PKCS12
  - Mozilla Bugzilla #1308012 - DRM: during archiving and recovering, wrapping
    unwrapping keys should be done in the token
  - Mozilla Bugzilla #1308013 - JSS - HSM token name was mistaken for
    manufacturer identifier
  - Mozilla Bugzilla #1308017 - Un-deprecate previously deprecated methods in
    JSS 4.2.6
  - Mozilla Bugzilla #1308019 - Provide Tomcat support for TLS v1.1 and
    TLS v1.2 via NSS through JSS
  - Mozilla Bugzilla #1308026 - JSS certificate validation does not pass up exact
    error from NSS
  - Mozilla Bugzilla #1308027 - Merge pki-symkey into jss
  - Mozilla Bugzilla #1308029 - Resolve Javadoc build issues
  - Mozilla Bugzilla #1308047 - support ECC encryption key archival and recovery
  - Mozilla Bugzilla #1313122 - Remove bypass tests as latest NSS has removed
    PKCS#11 bypass support
  - Mozilla Bugzilla #1328675 - Simple problem unwrapping AES sym keys on token
  - Mozilla Bugzilla #1345174 - Cannot create system certs when using LunaSA HSM
    in FIPS Mode and ECC algorithms
  - Mozilla Bugzilla #1345613 - expose AES KeyWrap and add some useful OID
    functions
  - Mozilla Bugzilla #1346410 - Load JSS libraries appropriately
  - ## JSS 4.4.0 includes the following changes for building and testing:
  - Mozilla Bugzilla #1331765 - Simplify JSS Makefile build and test
  - Mozilla Bugzilla #1346420 - Document steps required to use the proper
    libjss4.so when running certain HMAC Algorithms tests


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-4
changelog:
  - Bugzilla Bug #1394414 - Rebase jss to 4.4.0 in RHEL 7.4
  - Updated build requirements for NSPR
  - Updated build and runtime requirements for NSS
  - ## 'jss-post-rebase.patch' resolves the following issues ported from
    - Mozilla Bugzilla #1337092 - CMC conformance update: Implement required ASN.1
    code for RFC5272+ (cfu)
  - Mozilla Bugzilla #1347394 - Eclipse project files for JSS (edewata)
  - Mozilla Bugzilla #1347429 - Deprecated SSL 3.0 cipher names in SSLSocket
    class. (edewata)
  - Mozilla Bugzilla #1348856 - SSL alert callback (edewata)
  - Mozilla Bugzilla #1349278 - SSL cipher enumeration (edewata)
  - Mozilla Bugzilla #1349349 - Problem with Password.readPasswordFromConsole().
    (edewata)
  - Mozilla Bugzilla #1349831 - Revise top-level README file (mharmsen)
  - Mozilla Bugzilla #1349836 - Changes to JSS Version Block (mharmsen)
  - Mozilla Bugzilla #1350130 - Missing
    CryptoManager.verifyCertificateNowCUNative() implementation. (emaldona)


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-5
changelog:
  - Mozilla Bugzilla #1355268 - JSS 4.4 is incompatible with versions of
    idm-console-framework < 1.1.17-4
  - Red Hat Bugzilla #1435076 - Remove unused legacy lines from JSS spec files


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-6
changelog:
  - Mozilla Bugzilla #1352476 - RFE: Document on the README how to create a
    release tag (mharmsen)
  - Mozilla Bugzilla #1355358 - CryptoStore: add methods for importing and
    exporting EncryptedPrivateKeyInfo (ftweedal)
  - Mozilla Bugzilla #1359731 - CryptoStore.importPrivateKey enhancements
    (ftweedal)


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-7
changelog:
  - Bump NSS dependencies from 4.28.3 to 4.28.4-6 to pick-up fix in
    Mozilla Bugzilla #1360207 - Fix incorrect if (ss->...) in SSL_ReconfigFD


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-8
changelog:
  - Bugzilla #1488846 - Fix HmacTest code for AES encrypt/unwrap [rhel-7.4.z]
    (jmagne)
  - Bugzilla #1490494 - PKCS12: (JSS) upgrade to at least AES and SHA2 (FIPS)
    [RHEL-7.4.z] (ftweedal)
  - Bugzilla #1490740 - PK11Store.getEncryptedPrivateKeyInfo() segfault if
    export fails [rhel-7.4.z] (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-9
changelog:
  - Bugzilla #1505690 - new JSS failures: HMAC Unwrap and KeyWrapping
    FIPSMODE [rhel-7.4.z] (jmagne)


author: Rafael Aquini <aquini@redhat.com> [3.10.0-686.el7]
changelog:
  - [fs] nfsv4.1: Keep a reference on lock states while checking (Scott Mayhew) [1458721]
  - [fs] nfsv4.1: Handle NFS4ERR_OLD_STATEID in nfs4_reclaim_open_state (Scott Mayhew) [1458721]
  - [fs] nfsv4: Don't call close if the open stateid has already been cleared (Scott Mayhew) [1458721]
  - [fs] nfsv4: Fix CLOSE races with OPEN (Scott Mayhew) [1458721]
  - [fs] nfsv4.1: Fix a regression in DELEGRETURN (Scott Mayhew) [1458721]
  - [fs] nfs: nfs_rename() - revalidate directories on -ERESTARTSYS (Benjamin Coddington) [1459404]
  - [fs] revert "nfs: nfs_rename() handle -ERESTARTSYS dentry left behind" (Benjamin Coddington) [1459404]
  - [s390] pci: moving check and allocation of device_rh ahead (Wei Xu) [1455117]
  - [netdrv] cxgb4: handle serial flash interrupt (Sai Vemuri) [1462266]
  - [netdrv] cxgb4: fix to bring link down after adapter crash (Sai Vemuri) [1462266]
  - [netdrv] cxgb4: handle interrupt raised when FW crashes (Sai Vemuri) [1462266]
  - [security] keys: Change the name of the dead type to ".dead" to prevent user access (David Howells) [1439264] {CVE-2017-6951}
  - [security] keys: Protect request_key() against a type with no match function (David Howells) [1433216] {CVE-2017-2647}
  - [security] keys: Disallow keyrings beginning with '.' to be joined as session keyrings (David Howells) [1389309] {CVE-2016-9604}


author: Rafael Aquini <aquini@redhat.com> [3.10.0-687.el7]
changelog:
  - [fs] mntns: Remove incorrect put_mnt_ns ("Eric W. Biederman") [1463072]
  - [md] dm raid: fix oops on upgrading to extended superblock format (Mike Snitzer) [1464274]
  - [md] dm io: fix duplicate bio completion due to missing ref count (Mike Snitzer) [1461519]
  - [net] gro_cells: mark napi struct as not busy poll candidates (Eelco Chaudron) [1460078]
  - [x86] boot/kaslr: Skip kernel text relocation if no kaslr action is done (Baoquan He) [1458738]
  - [char] tpm/tpm_crb: enter the low power state upon device suspend (Jerry Snitselaar) [1463001]
  - [input] wacom: fix Wacom Cintiq 27QHD max pressure (Aristeu Rozanski) [1461910]
  - [kernel] nohz: Fix spurious warning when hrtimer and clockevent get out of sync (Frederic Weisbecker) [1366043]
  - [kernel] nohz: Fix buggy tick delay on IRQ storms (Frederic Weisbecker) [1366043]
  - [kernel] nohz: Reset next_tick cache even when the timer has no regs (Frederic Weisbecker) [1366043]
  - [kernel] nohz: Fix collision between tick and other hrtimers, again (Frederic Weisbecker) [1366043]
  - [kernel] nohz: Add hrtimer sanity check (Frederic Weisbecker) [1366043]
  - [kernel] revert "nohz: Fix collision between tick and other hrtimers" (Frederic Weisbecker) [1366043]
  - [powerpc] do not make the entire heap executable (Denys Vlasenko) [1330064]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-688.el7]
changelog:
  - [s390] move _text symbol to address higher than zero (Jiri Olsa) [1464800]
  - [netdrv] cxgb4: notify uP to route ctrlq compl to rdma rspq (Sai Vemuri) [1463324]
  - [powerpc] Add HAVE_PERF_USER_STACK_DUMP support (Jiri Olsa) [1449182]
  - [tools] perf report: Ensure the perf DSO mapping matches what libdw sees (Jiri Olsa) [1449182]
  - [tools] perf report: Include partial stacks unwound with libdw (Jiri Olsa) [1449182]
  - [tools] perf: libdw support for powerpc (Jiri Olsa) [1449182]
  - [firmware] efi/esrt: Cleanup bad memory map log messages (Prarit Bhargava) [1380812]
  - [firmware] efi/esrt: Fix typo in pr_err() message (Prarit Bhargava) [1380812]
  - [firmware] efi/esrt: Use memremap not ioremap to access ESRT table in memory (Prarit Bhargava) [1380812]
  - [firmware] efi: Work around ia64 build problem with ESRT driver (Prarit Bhargava) [1380812]
  - [firmware] efi/esrt: Don't preformat name (Prarit Bhargava) [1380812]
  - [firmware] efi: Make efi/esrt.c driver explicitly non-modular (Prarit Bhargava) [1380812]
  - [firmware] efi/esrt: Fix some compiler warnings (Prarit Bhargava) [1380812]
  - [firmware] efi: Add esrt support (Prarit Bhargava) [1380812]
  - [firmware] efi: Rename efi_guid_unparse to efi_guid_to_str (Prarit Bhargava) [1380812]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-690.el7]
changelog:
  - [mm] fix new crash in unmapped_area_topdown() (Larry Woodman) [1463241] {CVE-2017-1000364}
  - [mm] larger stack guard gap, between vmas (Larry Woodman) [1463241] {CVE-2017-1000364}
  - [mm] Revert "enlarge stack guard gap" (Larry Woodman) [1463241] {CVE-2017-1000364}
  - [crypto] testmgr - Reenable sha1/aes in FIPS mode (Herbert Xu) [1465234]
  - [crypto] testmgr - mark more algorithms as FIPS compliant (Herbert Xu) [1465234]
  - [target] tcmu: break up free_device callback (Mike Christie) [1430225]
  - [target] tcmu: perfom device add and del synchronously (Mike Christie) [1430225]
  - [target] tcmu: use idr for se_device dev index (Mike Christie) [1430225]
  - [target] tcmu: prep for sync add/rm device support (Mike Christie) [1430225]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-691.el7]
changelog:
  - [redhat] spec: Update dracut dependency to enable more algorithms as FIPS compliant (Rafael Aquini) [1466097]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-692.el7]
changelog:
  - [pci] Avoid FLR for Intel 82579 NICs (Jarod Wilson) [966840]
  - [net] netfilter: nf_ct_dccp/sctp: fix memory leak after netns cleanup (Davide Caratti) [1458687]
  - [net] netfilter: udplite: Remove duplicated udplite4/6 declaration (Davide Caratti) [1458687]
  - [net] netfilter: nat: merge udp and udplite helpers (Davide Caratti) [1458687]
  - [net] netfilter: merge udp and udplite conntrack helpers (Davide Caratti) [1458687]
  - [netdrv] mlx5: Tolerate irq_set_affinity_hint() failures (Kamal Heib) [1465830]
  - [netdrv] bonding: Restore old symlink names in sysfs to preserve ABI (Neil Horman) [1461892]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-693.el7]
changelog:
  - [x86] crypto: sha1-ssse3 - Disable avx2 (Benjamin Coddington) [1346106]
  - [net] geneve: fix hlist corruption (Jiri Benc) [1464292]
  - [net] vxlan: fix hlist corruption (Jiri Benc) [1464292]
  - [net] vxlan: fix use-after-free on deletion (Jiri Benc) [1464292]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.1.1.el7]
changelog:
  - [fs] dentry name snapshots (Miklos Szeredi) [1471131 1470403] {CVE-2017-7533}
  - [fs] fix the regression from "direct-io: Fix negative return from dio read beyond eof" (Eric Sandeen) [1475669 1473549]
  - [fs] direct-io: Fix negative return from dio read beyond eof (Eric Sandeen) [1475669 1473549]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.4.1.el7]
changelog:
  - [fs] nfsv4: Add missing nfs_put_lock_context() (Benjamin Coddington) [1487271 1476826]
  - [fs] nfs: discard nfs_lockowner structure (Benjamin Coddington) [1487271 1476826]
  - [fs] nfsv4: enhance nfs4_copy_lock_stateid to use a flock stateid if there is one (Benjamin Coddington) [1487271 1476826]
  - [fs] nfsv4: change nfs4_select_rw_stateid to take a lock_context inplace of lock_owner (Benjamin Coddington) [1487271 1476826]
  - [fs] nfsv4: change nfs4_do_setattr to take an open_context instead of a nfs4_state (Benjamin Coddington) [1487271 1476826]
  - [fs] nfsv4: add flock_owner to open context (Benjamin Coddington) [1487271 1476826]
  - [fs] nfs: remove l_pid field from nfs_lockowner (Benjamin Coddington) [1487271 1476826]
  - [x86] platform/uv/bau: Disable BAU on single hub configurations (Frank Ramsay) [1487159 1487160 1472455 1473353]
  - [x86] platform/uv/bau: Fix congested_response_us not taking effect (Frank Ramsay) [1487159 1472455]
  - [fs] cifs: Disable encryption capability for RHEL 7.4 kernel (Sachin Prabhu) [1485445 1485445]
  - [fs] sunrpc: Handle EADDRNOTAVAIL on connection failures (Dave Wysochanski) [1484269 1479043]
  - [fs] include/linux/printk.h: include pr_fmt in pr_debug_ratelimited (Sachin Prabhu) [1484267 1472823]
  - [fs] printk: pr_debug_ratelimited: check state first to reduce "callbacks suppressed" messages (Sachin Prabhu) [1484267 1472823]
  - [net] packet: fix tp_reserve race in packet_set_ring (Stefano Brivio) [1481938 1481940] {CVE-2017-1000111}
  - [fs] proc: revert /proc/<pid>/maps [stack:TID] annotation (Waiman Long) [1481724 1448534]
  - [net] ping: check minimum size on ICMP header length (Matteo Croce) [1481578 1481573] {CVE-2016-8399}
  - [ipc] mqueue: fix a use-after-free in sys_mq_notify() (Davide Caratti) [1476128 1476126] {CVE-2017-11176}
  - [netdrv] brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx() (Stanislaw Gruszka) [1474778 1474784] {CVE-2017-7541}


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.5.1.el7]
changelog:
  - [netdrv] i40e: point wb_desc at the nvm_wb_desc during i40e_read_nvm_aq (Stefan Assmann) [1491972 1484232]
  - [netdrv] i40e: avoid NVM acquire deadlock during NVM update (Stefan Assmann) [1491972 1484232]
  - [mm] Fix Kernel bug during boot with memory cgroups enabled (Larry Woodman) [1491970 1483747]
  - [fs] nfsv4: Ensure we don't re-test revoked and freed stateids (Dave Wysochanski) [1491969 1459733]
  - [netdrv] bonding: commit link status change after propose (Jarod Wilson) [1491121 1469790]
  - [mm] page_alloc: ratelimit PFNs busy info message (Jonathan Toppins) [1491120 1383179]
  - [netdrv] cxgb4: avoid crash on PCI error recovery path (Gustavo Duarte) [1489872 1456990]
  - [scsi] Add STARGET_CREATED_REMOVE state to scsi_target_state (Ewan Milne) [1489814 1468727]
  - [net] tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 (Davide Caratti) [1488341 1487061] {CVE-2017-14106}
  - [net] tcp: fix 0 divide in __tcp_select_window() (Davide Caratti) [1488341 1487061] {CVE-2017-14106}
  - [net] sctp: Avoid out-of-bounds reads from address storage (Stefano Brivio) [1484356 1484355] {CVE-2017-7558}
  - [net] udp: consistently apply ufo or fragmentation (Davide Caratti) [1481530 1481535] {CVE-2017-1000112}
  - [net] udp: account for current skb length when deciding about UFO (Davide Caratti) [1481530 1481535] {CVE-2017-1000112}
  - [net] ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output (Davide Caratti) [1481530 1481535] {CVE-2017-1000112}
  - [net] udp: avoid ufo handling on IP payload compression packets (Stefano Brivio) [1490263 1464161]
  - [pci] hv: Use vPCI protocol version 1.2 (Vitaly Kuznetsov) [1478256 1459202]
  - [pci] hv: Add vPCI version protocol negotiation (Vitaly Kuznetsov) [1478256 1459202]
  - [pci] hv: Use page allocation for hbus structure (Vitaly Kuznetsov) [1478256 1459202]
  - [pci] hv: Fix comment formatting and use proper integer fields (Vitaly Kuznetsov) [1478256 1459202]
  - [net] ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt() (Stefano Brivio) [1477007 1477010] {CVE-2017-7542}
  - [net] ipv6: avoid overflow of offset in ip6_find_1stfragopt (Sabrina Dubroca) [1477007 1477010] {CVE-2017-7542}
  - [net] xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder (Hannes Frederic Sowa) [1435672 1435670] {CVE-2017-7184}
  - [net] xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window (Hannes Frederic Sowa) [1435672 1435670] {CVE-2017-7184}
  - [net] l2cap: prevent stack overflow on incoming bluetooth packet (Neil Horman) [1489788 1489789] {CVE-2017-1000251}


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.6.1.el7]
changelog:
  - [netdrv] mlx5: Avoid using pending command interface slots (Don Dutile) [1497604 1463367]
  - [x86] amd: Limit cpu_core_id fixup to families older than F17h (Suravee Suthikulpanit) [1497603 1477397]
  - [x86] cpu/amd: Fix Zen SMT topology (Suravee Suthikulpanit) [1497603 1477397]
  - [x86] cpu/amd: Bring back Compute Unit ID (Suravee Suthikulpanit) [1497603 1477397]
  - [x86] cpu/amd: Fix Bulldozer topology (Suravee Suthikulpanit) [1497603 1477397]
  - [x86] cpu/amd: Clean up cpu_llc_id assignment per topology feature (Suravee Suthikulpanit) [1497603 1477397]
  - [x86] cpu: Get rid of compute_unit_id (Suravee Suthikulpanit) [1497603 1477397]
  - [x86] amd: Derive L3 shared_cpu_map from cpu_llc_shared_mask (Suravee Suthikulpanit) [1497238 1477399]
  - [net] ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER (Matteo Croce) [1497121 1468935]
  - [fs] gfs2: Fix debugfs glocks dump (Andreas Grunbacher) [1497078 1493067]
  - [fs] gfs2: Replace rhashtable_walk_init with rhashtable_walk_enter (Andreas Grunbacher) [1497078 1493067]
  - [fs] gfs2: Deduplicate gfs2_{glocks,glstats}_open (Andreas Grunbacher) [1497078 1493067]
  - [cpufreq] intel_pstate: Fix unsafe HWP MSR access (Steve Best) [1497058 1457552]
  - [s390] af_iucv: correctly copy SKB data (add missing hunk from 04d0ec) (Hendrik Brueckner) [1494354 1459782]
  - [sound] alsa: timer: Use common error handling code in alsa_timer_init() (Jaroslav Kysela) [1465998 1465999] {CVE-2017-1000380}
  - [sound] alsa: timer: Adjust a condition check in snd_timer_resolution() (Jaroslav Kysela) [1465998 1465999] {CVE-2017-1000380}
  - [sound] alsa: timer: Follow standard EXPORT_SYMBOL() declarations (Jaroslav Kysela) [1465998 1465999] {CVE-2017-1000380}
  - [sound] alsa: timer: Wrap with spinlock for queue access (Jaroslav Kysela) [1465998 1465999] {CVE-2017-1000380}
  - [sound] alsa: timer: Improve user queue reallocation (Jaroslav Kysela) [1465998 1465999] {CVE-2017-1000380}
  - [sound] alsa: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT (Jaroslav Kysela) [1465998 1465999] {CVE-2017-1000380}
  - [sound] alsa: timer: Fix race between read and ioctl (Jaroslav Kysela) [1465998 1465999] {CVE-2017-1000380}
  - [sound] alsa: timer: Info leak in snd_timer_user_tinterrupt() (Jaroslav Kysela) [1465998 1465999] {CVE-2017-1000380}
  - [sound] alsa: timer: remove some dead code (Jaroslav Kysela) [1465998 1465999] {CVE-2017-1000380}
  - [sound] alsa: timer: Reject user params with too small ticks (Jaroslav Kysela) [1465998 1465999] {CVE-2017-1000380}


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.7.1.el7]
changelog:
  - [mm] page_cgroup: Fix Kernel bug during boot with memory cgroups enabled (Larry Woodman) [1491970 1483747]
  - Revert: [mm] Fix Kernel bug during boot with memory cgroups enabled (Larry Woodman) [1491970 1483747]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.8.1.el7]
changelog:
  - [x86] kvm: x86: Fix potential preemption when get the current kvmclock timestamp (Marcelo Tosatti) [1503459 1496522]
  - [x86] kvm: x86: remove irq disablement around KVM_SET_CLOCK/KVM_GET_CLOCK (Marcelo Tosatti) [1503459 1496522]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.9.1.el7]
changelog:
  - [fs] ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff() (Bill O'Donnell) [1504115 1458728]
  - [fs] ext4: fix off-by-in loop termination in ext4_find_unwritten_pgoff() (Bill O'Donnell) [1501387 1469363]
  - [fs] ext4: fix SEEK_HOLE (Bill O'Donnell) [1501387 1469363]
  - [fs] xfs: Move handling of missing page into one place in xfs_find_get_desired_pgoff() (Bill O'Donnell) [1498736 1460446]
  - [fs] xfs: Fix off-by-in in loop termination in xfs_find_get_desired_pgoff() (Bill O'Donnell) [1498736 1460446]
  - [fs] xfs: Fix missed holes in SEEK_HOLE implementation (Bill O'Donnell) [1498736 1460446]
  - [fs] xfs: fix off-by-one on max nr_pages in xfs_find_get_desired_pgoff() (Eryu Guan) [1502731 1458997]
  - [nvme] Test unit Ready broken for nvme drvices (David Milburn) [1502733 1478457]
  - [hv] vmbus: Increase the time between retries in vmbus_post_msg() (Mohammed Gamal) [1495763 1491843]
  - [hv] vmbus: Fix error code returned by vmbus_post_msg() (Mohammed Gamal) [1495763 1467258]
  - [netdrv] netvsc: propagate MAC address change to VF slave (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] netvsc: delay setup of VF device (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] netvsc: make sure and unregister datapath (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] netvsc: fix rtnl deadlock on unregister of vf (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] netvsc: transparent VF management (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] hv_netvsc: Fix the carrier state error when data path is off (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] hv_netvsc: Fix the queue index computation in forwarding case (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] netvsc: handle select_queue when device is being removed (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] netvsc: report per-channel stats in ethtool statistics (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] netvsc: account for packets/bytes transmitted after completion (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] netvsc: group all per-channel state together (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] netvsc: enhance transmit select_queue (Vitaly Kuznetsov) [1500321 1477784]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.10.1.el7]
changelog:
  - [mm] mm, hugetlb: use pte_present() instead of pmd_present() in follow_huge_pmd() (Rafael Aquini) [1505164 1472460]
  - [mm] fix invalid node in alloc_migrate_target() (Rafael Aquini) [1505164 1472460]
  - [mm] add !pte_present() check on existing hugetlb_entry callbacks (Rafael Aquini) [1505164 1472460]
  - [fs] ceph: avoid accessing freeing inode in ceph_check_delayed_caps() (Ilya Dryomov) [1505163 1489426]
  - [fs] nfsd: Fix general protection fault in release_lock_stateid() (J. Bruce Fields) [1505160 1500815]
  - [fs] cifs: Reconnect expired SMB sessions (Leif Sahlberg) [1501526 1477052]
  - [fs] cifs: Separate SMB2 header structure (Leif Sahlberg) [1501526 1429710]


author: Akemi Yagi <toracat@centos.org> [3.10.0-693.11.1.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
     addmissing.patch  [puias]
     cpufreq.patch  [puias]
     i386-audit-stop-scri-stack-frame.patch  [puias]
     removejiffies.patch  [puias]
     undorhirqstat.patch  [puias]
     morefixes.patch      [puias+bug#12412]
     upstream-32bit-fixes-7_4.patch [puias+bug#12412]
     clear-32bit-Werror-warnings.patch  [bug#12412]
     qspinlock_types-32bit.patch   [ay]
     i686-7-4.patch [T.Kabe, bug#13890]
     firmware-efi-32bit.patch [ay]
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Enabled spidev [bug#9955]
  - Add a patch [bug#10447]
  - Enable ATM drivers [bug#10845]
  - Add 9pfs config options [bug#10849]
  - Enable VFIO_PCI_VGA [bug#12435]
  - Rremove initramfs-xxxkdump.img upon kernel removal [bug#12703]
  - Add a patch from [bug#12841]
  - Add a patch from [bug#12818]
  - Enabled RT2800USB_RT3573 [bug#13162]
  - Enable LDM_PARTITION [bug#13526]
  - Add a patch from [bug#13583]
  - Add a patch for xen [bug#13763]
  - Add a patch from [bug#13990]
  - Add BuildRequires: openssl-devel to the with_perf section [bug#13990]


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.11.3.el7]
changelog:
  - [x86] spec_ctrl: Prevent unwanted speculation without IBRS (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Remove trampoline check from paranoid entry path (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Fix paranoid_exit() trampoline clobber (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Simplify trampoline stack restore code (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] dumpstack: Remove raw stack dump (Josh Poimboeuf) [1519795 1519798]
  - [x86] spec_ctrl: remove SPEC_CTRL_DEBUG code (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add noibrs noibpb boot options (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] entry: Use retpoline for syscall's indirect calls (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on 32-bit compatible syscall entrance (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: cleanup unnecessary ptregscall_common function (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: CLEAR_EXTRA_REGS and extra regs save/restore (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on syscall entrance (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: rescan cpuid after a late microcode update (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add debugfs ibrs_enabled ibpb_enabled (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: consolidate the spec control boot detection (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] KVM/spec_ctrl: allow IBRS to stay enabled in host userland (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add debug aid to test the entry code without microcode (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: move stuff_RSB in spec_ctrl.h (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] entry: Stuff RSB for entry to kernel for non-SMEP platform (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] mm: Only set IBPB when the new thread cannot ptrace current thread (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] mm: Set IBPB upon context switch (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] idle: Disable IBRS when offlining cpu and re-enable on wakeup (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] idle: Disable IBRS entering idle and enable it on wakeup (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: implement spec ctrl C methods (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: save IBRS MSR value in save_paranoid for NMI (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] enter: Use IBRS on syscall and interrupts (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: swap rdx with rsi for nmi nesting detection (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: spec_ctrl_pcp and kaiser_enabled_pcp in same cachline (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: use per-cpu knob instead of ALTERNATIVES for ibpb and ibrs (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] enter: MACROS to set/clear IBRS and set IBPB (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] x86: add SPEC_CTRL to MSR and CPUID lists (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] svm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] svm: Set IBPB when running a different VCPU (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] vmx: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] vmx: Set IBPB when running a different VCPU (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] x86: clear registers on VM exit (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] kvm: pad RSB on VM transition (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] cpu/AMD: Control indirect branch predictor when SPEC_CTRL not available (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] feature: Report presence of IBPB and IBRS control (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] feature: Enable the x86 feature to control Speculation (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [tools] objtool: Don't print 'call dest' warnings for ignored functions (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [misc] locking/barriers: prevent speculative execution based on Coverity scan results (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [fs] udf: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [fs] prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [kernel] userns: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [scsi] qla2xxx: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [netdrv] p54: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [netdrv] carl9170: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [media] uvcvideo: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [x86] cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [x86] cpu/AMD: Make the LFENCE instruction serialized (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [misc] locking/barriers: introduce new memory barrier gmb() (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [x86] mm/kaiser: Replace kaiser with kpti to sync with upstream (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add "kaiser" and "nokaiser" boot options (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map the trace idt tables in userland shadow pgd (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: fix RESTORE_CR3 crash in kaiser_stop_machine (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use stop_machine for enable/disable knob (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use atomic ops to poison/unpoison user pagetables (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use invpcid to flush the two kaiser PCID AISD (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use two PCID ASIDs optimize the TLB during enter/exit kernel (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: stop patching flush_tlb_single (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use PCID feature to make user and kernel switches faster (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: If INVPCID is available, use it to flush global mappings (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/64: Fix reboot interaction with CR4.PCIDE (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/64: Initialize CR4.PCIDE early (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Add a 'noinvpcid' boot option to turn off INVPCID (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Add the 'nopcid' boot option to turn off PCID (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: validate trampoline stack (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] entry: Move SYSENTER_stack to the beginning of struct tss_struct (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: isolate the user mapped per cpu areas (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: enable kaiser in build (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: selective boot time defaults (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: handle call to xen_pv_domain() on PREEMPT_RT (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser/xen: Dynamically disable KAISER when running under Xen PV (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add Kconfig (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: avoid false positives during non-kaiser pgd updates (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: Respect disabled CPU features (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: trampoline stack comments (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: stack trampoline (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: remove paravirt clock warning (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: re-enable vsyscalls (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow to build KAISER with KASRL (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow KAISER to be enabled/disabled at runtime (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: un-poison PGDs at runtime (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add a function to check for KAISER being enabled (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add debugfs file to turn KAISER on/off at runtime (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: disable native VSYSCALL (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map virtually-addressed performance monitoring buffers (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map debug IDT tables (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add kprobes text section (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map trace interrupt entry (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map entry stack per-cpu areas (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map dynamically-allocated LDTs (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: make sure static PGDs are 8k in size (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow NX poison to be set in p4d/pgd (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: unmap kernel from userspace page tables (core patch) (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: mark per-cpu data structures required for entry/exit (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: introduce user-mapped per-cpu areas (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add cr3 switches to entry code (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: remove scratch registers (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: prepare assembly for entry/exit CR3 switching (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: Disable global pages by default with KAISER (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Document X86_CR4_PGE toggling behavior (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/tlb: Make CR4-based TLB flushes more robust (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Do not set _PAGE_USER for init_mm page tables (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] increase robusteness of bad_iret fixup handler (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [perf] x86/intel/uncore: Fix memory leaks on allocation failures (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [mm] userfaultfd: hugetlbfs: prevent UFFDIO_COPY to fill beyond the end of i_size (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [fs] userfaultfd: non-cooperative: fix fork use after free (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [mm] userfaultfd: hugetlbfs: remove superfluous page unlock in VM_SHARED case (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [mm] fix bad rss-counter if remap_file_pages raced migration (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.11.4.el7]
changelog:
  - [x86] spec_ctrl: allow use_ibp_disable only if both SPEC_CTRL and IBPB_SUPPORT are missing (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: Documentation spec_ctrl.txt (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: remove irqs_disabled() check from intel_idle() (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: use enum when setting ibrs/ibpb_enabled (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: undo speculation barrier for ibrs_enabled and noibrs_cmdline (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: introduce ibpb_enabled = 2 for IBPB instead of IBRS (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: introduce SPEC_CTRL_PCP_ONLY_IBPB (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: cleanup s/flush/sync/ naming when sending IPIs (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: set IBRS during CPU init if in ibrs_enabled == 2 (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: use IBRS_ENABLED instead of 1 (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: allow the IBP disable feature to be toggled at runtime (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: always initialize save_reg in ENABLE_IBRS_SAVE_AND_CLOBBER (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: ibrs_enabled() is expected to return > 1 (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: issue a __spec_ctrl_ibpb if a credential check isn't possible (Andrea Arcangeli) [1519795 1519798]
  - [x86] mm/kaiser: disable global pages by default with KAISER (Andrea Arcangeli) [1519795 1519798]
  - Revert "x86/mm/kaiser: Disable global pages by default with KAISER" (Andrea Arcangeli) [1519795 1519798]
  - ibpb: don't optimize spec_cntrl_ibpb on PREEMPT_RCU (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: clear registers after 32bit syscall stackframe is setup (Andrea Arcangeli) [1519800 1519801]
  - [x86] spec_ctrl: reload spec_ctrl cpuid in all microcode load paths (Andrea Arcangeli) [1519800 1519801]
  - [x86] kaiser/mm: fix pgd freeing in error path (Andrea Arcangeli) [1519800 1519801]


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.11.5.el7]
changelog:
  - [x86] kaiser/mm: convert userland visible "kpti" name to "pti" (Andrea Arcangeli) [1519795 1519798]
  - Revert "x86/entry: Use retpoline for syscall's indirect calls" (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: set IBRS during resume from RAM if ibrs_enabled is 2 (Andrea Arcangeli) [1519795 1519798]
  - [x86] kaiser/mm: __load_cr3 in resume from RAM after kernel gs has been restored (Andrea Arcangeli) [1519795 1519798]


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.11.6.el7]
changelog:
  - [x86] spec_ctrl: Eliminate redundant FEATURE Not Present messages (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] mm/kaiser: init_tss is supposed to go in the PAGE_ALIGNED per-cpu section (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: svm: spec_ctrl at vmexit needs per-cpu areas functional (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: skip IBRS/CR3 restore when paranoid exception returns to userland (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: consider the init_mm.pgd a kaiser pgd (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}


author: Akemi Yagi <toracat@centos.org> [3.10.0-693.11.6.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
     addmissing.patch  [puias]
     cpufreq.patch  [puias]
     i386-audit-stop-scri-stack-frame.patch  [puias]
     removejiffies.patch  [puias]
     undorhirqstat.patch  [puias]
     morefixes.patch      [puias+bug#12412]
     upstream-32bit-fixes-7_4.patch [puias+bug#12412]
     clear-32bit-Werror-warnings.patch  [bug#12412]
     qspinlock_types-32bit.patch   [ay]
     i686-7-4.patch [T.Kabe, bug#13890]
     firmware-efi-32bit.patch [ay]
     patch-spec_ctrl_i686.patch [T.Kabe bug#14353]
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Enabled spidev [bug#9955]
  - Add a patch [bug#10447]
  - Enable ATM drivers [bug#10845]
  - Add 9pfs config options [bug#10849]
  - Enable VFIO_PCI_VGA [bug#12435]
  - Rremove initramfs-xxxkdump.img upon kernel removal [bug#12703]
  - Add a patch from [bug#12841]
  - Add a patch from [bug#12818]
  - Enabled RT2800USB_RT3573 [bug#13162]
  - Enable LDM_PARTITION [bug#13526]
  - Add a patch from [bug#13583]
  - Add a patch for xen [bug#13763]
  - Add a patch from [bug#13990]
  - Add BuildRequires: openssl-devel to the with_perf section [bug#13990]


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.12.1.el7]
changelog:
  - [net] netfilter: x_tables: don't use seqlock when fetching old counters (Florian Westphal) [1509176 1503702]
  - [net] netfilter: x_tables: make xt_replace_table wait until old rules are not used anymore (Florian Westphal) [1509176 1503702]


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.14.1.el7]
changelog:
  - [fs] ext4: Don't clear SGID when inheriting ACLs (Lukas Czerner) [1517829 1473480]
  - [fs] ext4: preserve i_mode if __ext4_set_acl() fails (Lukas Czerner) [1517829 1473480]
  - [x86] x86/smpboot: Fix __max_logical_packages estimate (Prarit Bhargava) [1517803 1474709]
  - [x86] x86/topology: Avoid wasting 128k for package id array (Prarit Bhargava) [1517803 1474709]
  - [x86] perf/x86/intel/uncore: Cache logical pkg id in uncore driver (Prarit Bhargava) [1517803 1474709]
  - [netdrv] bonding: fix slave stuck in BOND_LINK_FAIL state (Jarod Wilson) [1516169 1496837]
  - [crypto] x86/sha1 - Fix reads beyond the number of blocks passed (Herbert Xu) [1515838 1469200]
  - [edac] skx_edac: Handle systems with segmented PCI busses (Yasuyuki Kobayashi) [1515111 1500572]
  - [scsi] virtio_scsi: let host do exception handling (Paolo Bonzini) [1515107 1501309]
  - [mm] Fix panic due to NULL pointer dereference in __memcg_kmem_get_cache() (Larry Woodman) [1515105 1490495]
  - [s390] mm: fix write access check in gup_huge_pmd() (Hendrik Brueckner) [1513316 1506126]
  - [fs] xfs: reinit btree pointer on attr tree inactivation walk (Carlos Maiolino) [1512812 1469296]
  - [s390] s390/3270: fix allocation of tty3270_screen structure (Daniel Vacek) [1508355 1495587]
  - [s390] s390/3270: fix use after free of tty3270_screen structure (Daniel Vacek) [1508355 1495587]
  - [s390] s390/3270: fix return value check in tty3270_resize_work() (Daniel Vacek) [1508355 1495587]
  - [scsi] sd: Implement blacklist option for WRITE SAME w/ UNMAP (Ewan Milne) [1507043 1462594]
  - [lib] assoc_array: Fix a buggy node-splitting case (David Howells) [1502624 1501286] {CVE-2017-12193}
  - [security] keys: prevent KEYCTL_READ on negative key (David Howells) [1498369 1498371] {CVE-2017-12192}


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.15.1.el7]
changelog:
  - [net] udp: fix bcast packet reception (Paolo Abeni) [1506530 1493238]
  - [net] udp: perform source validation for mcast early demux (Paolo Abeni) [1506530 1493238]
  - [net] ipv4: early demux can return an error code (Paolo Abeni) [1506530 1493238]
  - [net] tcp: reset sk_rx_dst in tcp_disconnect() (Jamie Bainbridge) [1520296 1467770]
  - [md] dm cache: fix race condition in the writeback mode overwrite_bio optimisation (Mike Snitzer) [1517795 1512095]
  - [net] packet: in packet_do_bind, test fanout with bind_lock held (Hangbin Liu) [1505430 1505429] {CVE-2017-15649}
  - [net] packet: hold bind lock when rebinding to fanout hook (Hangbin Liu) [1505430 1505429] {CVE-2017-15649}
  - [net] packet: Do not call fanout_release from atomic contexts (Hangbin Liu) [1505430 1505429] {CVE-2017-15649}
  - [net] packet: fix races in fanout_add() (Hangbin Liu) [1505430 1505429] {CVE-2017-15649}
  - [security] keys: Fix handling of stored error in a negatively instantiated user key (David Howells) [1411618 1479727 1411622 1450158] {CVE-2015-8539 CVE-2017-7472}
  - [security] keys: fix keyctl_set_reqkey_keyring() to not leak thread keyrings (David Howells) [1411618 1479727 1411622 1450158] {CVE-2015-8539 CVE-2017-7472}
  - [security] keys: Differentiate uses of rcu_dereference_key() and user_key_payload() (David Howells) [1411618 1479727 1411622 1450158] {CVE-2015-8539 CVE-2017-7472}
  - [security] keys: Use memzero_explicit() for secret data (David Howells) [1411618 1479727 1411622 1450158] {CVE-2015-8539 CVE-2017-7472}
  - [security] keys: Fix an error code in request_master_key() (David Howells) [1411618 1479727 1411622 1450158] {CVE-2015-8539 CVE-2017-7472}


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.16.1.el7]
changelog:
  - [x86] smpboot: Do not use smp_num_siblings in __max_logical_packages calculation (Prarit Bhargava) [1533022 1519503]
  - [x86] topology: Add topology_max_smt_threads() (Prarit Bhargava) [1533022 1519503]
  - [powerpc] spinlock: add gmb memory barrier (Jon Masters) [1519788 1519786] {CVE-2017-5753}
  - [powerpc] Prevent Meltdown attack with L1-D$ flush (Jon Masters) [1519800 1519801] {CVE-2017-5754}
  - [s390] add ppa to system call and program check path (Jon Masters) [1519795 1519798] {CVE-2017-5715}
  - [s390] spinlock: add gmb memory barrier (Jon Masters) [1519788 1519786] {CVE-2017-5753}
  - [s390] introduce CPU alternatives (Jon Masters) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: move vmexit rmb in the last branch before IBRS (Andrea Arcangeli) [1533373 1533250]
  - [x86] spec_ctrl: satisfy the barrier like semantics of IBRS (Andrea Arcangeli) [1533373 1533250]
  - [fs] userfaultfd: clear the vma->vm_userfaultfd_ctx if UFFD_EVENT_FORK fails (Andrea Arcangeli) [1533372 1531287]
  - [x86] kaiser/efi: unbreak tboot (Andrea Arcangeli) [1519795 1532989 1519798 1531559] {CVE-2017-5715}
  - [x86] spec_ctrl: don't call ptrace_has_cap in the IBPB ctx switch optimization (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/efi: unbreak EFI old_memmap (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] cpuidle_idle_call: fix double local_irq_enable() (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] entry: Invoke TRACE_IRQS_IRETQ in paranoid_userspace_restore_all (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] cpu: fix get_scattered_cpu_leaf sorting part #2 (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: show added cpuid flags in /proc/cpuinfo after late microcode update (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] cpu: fix get_scattered_cpu_leaf for IBPB feature (Paolo Bonzini) [1519795 1519798]
  - [x86] spec_ctrl: Eliminate redundant FEATURE Not Present messages (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] mm/kaiser: init_tss is supposed to go in the PAGE_ALIGNED per-cpu section (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: svm: spec_ctrl at vmexit needs per-cpu areas functional (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: skip IBRS/CR3 restore when paranoid exception returns to userland (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: consider the init_mm.pgd a kaiser pgd (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: convert userland visible "kpti" name to "pti" (Andrea Arcangeli) [1519795 1519798]
  - Revert "x86/entry: Use retpoline for syscall's indirect calls" (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: set IBRS during resume from RAM if ibrs_enabled is 2 (Andrea Arcangeli) [1519795 1519798]
  - [x86] kaiser/mm: __load_cr3 in resume from RAM after kernel gs has been restored (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: allow use_ibp_disable only if both SPEC_CTRL and IBPB_SUPPORT are missing (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: Documentation spec_ctrl.txt (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: remove irqs_disabled() check from intel_idle() (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: use enum when setting ibrs/ibpb_enabled (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: undo speculation barrier for ibrs_enabled and noibrs_cmdline (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: introduce ibpb_enabled = 2 for IBPB instead of IBRS (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: introduce SPEC_CTRL_PCP_ONLY_IBPB (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: cleanup s/flush/sync/ naming when sending IPIs (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: set IBRS during CPU init if in ibrs_enabled == 2 (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: use IBRS_ENABLED instead of 1 (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: allow the IBP disable feature to be toggled at runtime (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: always initialize save_reg in ENABLE_IBRS_SAVE_AND_CLOBBER (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: ibrs_enabled() is expected to return > 1 (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: issue a __spec_ctrl_ibpb if a credential check isn't possible (Andrea Arcangeli) [1519795 1519798]
  - [x86] mm/kaiser: disable global pages by default with KAISER (Andrea Arcangeli) [1519795 1519798]
  - Revert "x86/mm/kaiser: Disable global pages by default with KAISER" (Andrea Arcangeli) [1519795 1519798]
  - [x86] ibpb: don't optimize spec_cntrl_ibpb on PREEMPT_RCU (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: clear registers after 32bit syscall stackframe is setup (Andrea Arcangeli) [1519800 1519801]
  - [x86] spec_ctrl: reload spec_ctrl cpuid in all microcode load paths (Andrea Arcangeli) [1519800 1519801]
  - [x86] kaiser/mm: fix pgd freeing in error path (Andrea Arcangeli) [1519800 1519801]
  - [x86] spec_ctrl: Prevent unwanted speculation without IBRS (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Remove trampoline check from paranoid entry path (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Fix paranoid_exit() trampoline clobber (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Simplify trampoline stack restore code (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] dumpstack: Remove raw stack dump (Josh Poimboeuf) [1519795 1519798]
  - [x86] spec_ctrl: remove SPEC_CTRL_DEBUG code (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add noibrs noibpb boot options (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] entry: Use retpoline for syscall's indirect calls (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on 32-bit compatible syscall entrance (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: cleanup unnecessary ptregscall_common function (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: CLEAR_EXTRA_REGS and extra regs save/restore (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on syscall entrance (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: rescan cpuid after a late microcode update (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add debugfs ibrs_enabled ibpb_enabled (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: consolidate the spec control boot detection (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] KVM/spec_ctrl: allow IBRS to stay enabled in host userland (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add debug aid to test the entry code without microcode (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: move stuff_RSB in spec_ctrl.h (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] entry: Stuff RSB for entry to kernel for non-SMEP platform (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] mm: Only set IBPB when the new thread cannot ptrace current thread (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] mm: Set IBPB upon context switch (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] idle: Disable IBRS when offlining cpu and re-enable on wakeup (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] idle: Disable IBRS entering idle and enable it on wakeup (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: implement spec ctrl C methods (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: save IBRS MSR value in save_paranoid for NMI (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] enter: Use IBRS on syscall and interrupts (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: swap rdx with rsi for nmi nesting detection (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: spec_ctrl_pcp and kaiser_enabled_pcp in same cachline (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: use per-cpu knob instead of ALTERNATIVES for ibpb and ibrs (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] enter: MACROS to set/clear IBRS and set IBPB (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] x86: add SPEC_CTRL to MSR and CPUID lists (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] svm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] svm: Set IBPB when running a different VCPU (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] vmx: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] vmx: Set IBPB when running a different VCPU (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] x86: clear registers on VM exit (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] kvm: pad RSB on VM transition (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] cpu/AMD: Control indirect branch predictor when SPEC_CTRL not available (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] feature: Report presence of IBPB and IBRS control (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] feature: Enable the x86 feature to control Speculation (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [tools] objtool: Don't print 'call dest' warnings for ignored functions (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [misc] locking/barriers: prevent speculative execution based on Coverity scan results (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [fs] udf: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [fs] prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [kernel] userns: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [scsi] qla2xxx: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [netdrv] p54: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [netdrv] carl9170: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [media] uvcvideo: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [x86] cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [x86] cpu/AMD: Make the LFENCE instruction serialized (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [misc] locking/barriers: introduce new memory barrier gmb() (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [x86] mm/kaiser: Replace kaiser with kpti to sync with upstream (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add "kaiser" and "nokaiser" boot options (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map the trace idt tables in userland shadow pgd (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: fix RESTORE_CR3 crash in kaiser_stop_machine (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use stop_machine for enable/disable knob (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use atomic ops to poison/unpoison user pagetables (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use invpcid to flush the two kaiser PCID AISD (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use two PCID ASIDs optimize the TLB during enter/exit kernel (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: stop patching flush_tlb_single (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use PCID feature to make user and kernel switches faster (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: If INVPCID is available, use it to flush global mappings (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/64: Fix reboot interaction with CR4.PCIDE (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/64: Initialize CR4.PCIDE early (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Add a 'noinvpcid' boot option to turn off INVPCID (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Add the 'nopcid' boot option to turn off PCID (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: validate trampoline stack (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] entry: Move SYSENTER_stack to the beginning of struct tss_struct (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: isolate the user mapped per cpu areas (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: enable kaiser in build (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: selective boot time defaults (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: handle call to xen_pv_domain() on PREEMPT_RT (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser/xen: Dynamically disable KAISER when running under Xen PV (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add Kconfig (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: avoid false positives during non-kaiser pgd updates (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: Respect disabled CPU features (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: trampoline stack comments (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: stack trampoline (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: remove paravirt clock warning (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: re-enable vsyscalls (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow to build KAISER with KASRL (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow KAISER to be enabled/disabled at runtime (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: un-poison PGDs at runtime (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add a function to check for KAISER being enabled (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add debugfs file to turn KAISER on/off at runtime (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: disable native VSYSCALL (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map virtually-addressed performance monitoring buffers (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map debug IDT tables (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add kprobes text section (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map trace interrupt entry (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map entry stack per-cpu areas (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map dynamically-allocated LDTs (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: make sure static PGDs are 8k in size (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow NX poison to be set in p4d/pgd (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: unmap kernel from userspace page tables (core patch) (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: mark per-cpu data structures required for entry/exit (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: introduce user-mapped per-cpu areas (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add cr3 switches to entry code (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: remove scratch registers (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: prepare assembly for entry/exit CR3 switching (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: Disable global pages by default with KAISER (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Document X86_CR4_PGE toggling behavior (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/tlb: Make CR4-based TLB flushes more robust (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Do not set _PAGE_USER for init_mm page tables (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] increase robusteness of bad_iret fixup handler (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [perf] x86/intel/uncore: Fix memory leaks on allocation failures (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [mm] userfaultfd: hugetlbfs: prevent UFFDIO_COPY to fill beyond the end of i_size (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [fs] userfaultfd: non-cooperative: fix fork use after free (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [mm] userfaultfd: hugetlbfs: remove superfluous page unlock in VM_SHARED case (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [mm] fix bad rss-counter if remap_file_pages raced migration (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.2.1.el7]
changelog:
  - [nvme] nvmet-rdma: occasionally flush ongoing controller teardown (Slava Shwartsman) [1479850 1467998]
  - [nvme] Free bio_aux struct when done with bio (David Milburn) [1474679 1455553]
  - [mm] thp: respect MPOL_PREFERRED policy with non-local node (Larry Woodman) [1479763 1476709]
  - [char] ipmi: use rcu lock around call to intf->handlers->sender() (Tony Camuso) [1479761 1419765]
  - [x86] vmware: Use tsc_khz value for calibrate_cpu() (Prarit Bhargava) [1479246 1475716]
  - [netdrv] cxgb4: reduce resource allocation in kdump kernel (Sai Vemuri) [1478255 1379762]
  - [netdrv] cxgb4: fix a NULL dereference (Sai Vemuri) [1478255 1379762]
  - [netdrv] cxgb4: fix BUG() on interrupt deallocating path of ULD (Mauricio Oliveira) [1475671 1465554]
  - [netdrv] bonding: Fix transmit load balancing in balance-alb mode (Jarod Wilson) [1475670 1473481]
  - [fs] xfs: use ->b_state to fix buffer I/O accounting release race (Brian Foster) [1478254 1452228]
  - [net] dst: Fix an intermittent pr_emerg warning about lo becoming free (Xin Long) [1475675 1458111]
  - [powerpc] eeh: Fix partial hotplug criterion (Gustavo Duarte) [1475672 1458508]
  - [powerpc] eeh: Fix wrong argument passed to eeh_rmv_device() (Gustavo Duarte) [1475672 1458508]
  - [crypto] api - Move alg ref count init to crypto_check_alg (Herbert Xu) [1475668 1473593]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.2.2.el7]
changelog:
  - [net] l2cap: prevent stack overflow on incoming bluetooth packet (Neil Horman) [1489788 1489789] {CVE-2017-1000251}


author: Akemi Yagi <toracat@centos.org> [3.10.0-693.2.2.el7.centos.plus rc1]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
     addmissing.patch  [puias]
     cpufreq.patch  [puias]
     i386-audit-stop-scri-stack-frame.patch  [puias]
     removejiffies.patch  [puias]
     undorhirqstat.patch  [puias]
     morefixes.patch      [puias+bug#12412]
     upstream-32bit-fixes-7_4.patch [puias+bug#12412]
     clear-32bit-Werror-warnings.patch  [bug#12412]
     qspinlock_types-32bit.patch   [ay]
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Enabled spidev [bug#9955]
  - Add a patch [bug#10447]
  - Enable ATM drivers [bug#10845]
  - Add 9pfs config options [bug#10849]
  - Enable VFIO_PCI_VGA [bug#12435]
  - Rremove initramfs-xxxkdump.img upon kernel removal [bug#12703]
  - Add a patch from [bug#12841]
  - Add a patch from [bug#12818]
  - Enabled RT2800USB_RT3573 [bug#13162]
  - Enable LDM_PARTITION [bug#13526]
  - Add a patch from [bug#13583]
  - Add a patch for xen [bug#13763]


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.18.1.el7]
changelog:
  - [md] raid5: fix a race condition in stripe batch (Nigel Croxon) [1535883 1496836]
  - [security] selinux: fix double free in selinux_parse_opts_str() (Paul Moore) [1532288 1456843]
  - [fs] nfs: revert "nfs: Move the flock open mode check into nfs_flock()" (Benjamin Coddington) [1531095 1497225]


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.19.1.el7]
changelog:
  - [watchdog] hpwdt: remove indirect call in drivers/watchdog/hpwdt.c (Josh Poimboeuf) [1539649 1535644]
  - [kernel] x86/spec_ctrl: cleanup __ptrace_may_access (Josh Poimboeuf) [1539649 1535644]
  - [x86] bugs: Drop one "mitigation" from dmesg (Josh Poimboeuf) [1539649 1535644]
  - [x86] kvm: vmx: Make indirect call speculation safe (Josh Poimboeuf) [1539649 1535644]
  - [x86] kvm: x86: Make indirect calls in emulator speculation safe (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline: Optimize inline assembler for vmexit_fill_RSB (Josh Poimboeuf) [1539649 1535644]
  - [x86] mce: Make machine check speculation protected (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: fix ptrace IBPB optimization (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: Avoid returns in IBRS-disabled regions (Josh Poimboeuf) [1539649 1535644]
  - [x86] spectre/meltdown: avoid the vulnerability directory to weaken kernel security (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: Document retpolines and ibrs_enabled=3 (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: upgrade GCC retpoline warning to an error (Josh Poimboeuf) [1539649 1535644]
  - [x86] Use IBRS for firmware update path (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: stuff RSB on context switch with SMEP enabled (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: enforce sane combinations of IBRS and retpoline (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: use upstream RSB stuffing function (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: add ibrs_enabled=3 (ibrs_user) (Josh Poimboeuf) [1539649 1535644]
  - [kernel] x86/jump_label: warn on failed jump label patch (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: detect unretpolined modules (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline: Add LFENCE to the retpoline/RSB filling RSB macros (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline: Fill return stack buffer on vmexit (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline/xen: Convert Xen hypercall indirect jumps (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline/hyperv: Convert assembler indirect jumps (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline/ftrace: Convert ftrace assembler indirect jumps (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline/entry: Convert entry assembler indirect jumps (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline/crypto: Convert crypto assembler indirect jumps (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline: Add initial retpoline support (Josh Poimboeuf) [1539649 1535644]
  - [x86] jump_label: add asm support for static keys (Josh Poimboeuf) [1539649 1535644]
  - [x86] asm: Make asm/alternative.h safe from assembly (Josh Poimboeuf) [1539649 1535644]
  - [tools] objtool: Support new GCC 6 switch jump table pattern (Josh Poimboeuf) [1539649 1535644]
  - [tools] objtool: Detect jumps to retpoline thunks (Josh Poimboeuf) [1539649 1535644]
  - [x86] spectre: Add boot time option to select Spectre v2 mitigation (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: print features changed by microcode loading (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: refactor the init and microcode loading paths (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: move initialization of X86_FEATURE_IBPB_SUPPORT (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: remove SPEC_CTRL_PCP_IBPB bit (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: remove ibrs_enabled variable (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: add ibp_disabled variable (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: add X86_FEATURE_IBP_DISABLE (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: remove IBP disable for AMD model 0x16 (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: remove performance measurements from documentation (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: make ipbp_enabled read-only (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: remove ibpb_enabled=2 mode (Josh Poimboeuf) [1539649 1535644]
  - [x86] cpu: Implement CPU vulnerabilites sysfs functions (Josh Poimboeuf) [1539649 1535644]
  - [base] sysfs/cpu: Add vulnerability folder (Josh Poimboeuf) [1539649 1535644]
  - [x86] cpu: Merge bugs.c and bugs_64.c (Josh Poimboeuf) [1539649 1535644]
  - [x86] syscall: int80 must not clobber r12-15 (Josh Poimboeuf) [1539649 1535644]
  - [x86] syscall: change ia32_syscall() to create the full register frame in ia32_do_call() (Josh Poimboeuf) [1539649 1535644]
  - [x86] boot: Add early cmdline parsing for options with arguments (Josh Poimboeuf) [1539649 1535644]
  - [x86] boot: Pass in size to early cmdline parsing (Josh Poimboeuf) [1539649 1535644]
  - [x86] boot: Simplify early command line parsing (Josh Poimboeuf) [1539649 1535644]
  - [x86] boot: Fix early command-line parsing when partial word matches (Josh Poimboeuf) [1539649 1535644]
  - [x86] boot: Fix early command-line parsing when matching at end (Josh Poimboeuf) [1539649 1535644]
  - [scsi] storvsc: Fix scsi_cmd error assignments in storvsc_handle_error (Cathy Avery) [1536978 1502601]
  - [fs] nfs: RPC_MAX_AUTH_SIZE is in bytes ("J. Bruce Fields") [1533378 1495321]
  - [fs] nfsd: give out fewer session slots as limit approaches (Dave Wysochanski) [1533377 1492234]
  - [fs] nfsd: increase DRC cache limit (Dave Wysochanski) [1533377 1492234]
  - [x86] kvm: x86: fix RSM when PCID is non-zero (Paolo Bonzini) [1531662 1530711]
  - [x86] iommu/amd: Reduce delay waiting for command buffer space (Suravee Suthikulpanit) [1531456 1508644]
  - [x86] iommu/amd: Reduce amount of MMIO when submitting commands (Suravee Suthikulpanit) [1531456 1508644]
  - [x86] amd: Remove cmd_buf_size and evt_buf_size from struct amd_iommu (Suravee Suthikulpanit) [1531456 1508644]
  - [x86] amd: Fix the left value check of cmd buffer (Suravee Suthikulpanit) [1531456 1508644]
  - [x86] amd: Don't put completion-wait semaphore on stack (Suravee Suthikulpanit) [1531456 1508644]
  - [x86] kvm: svm: obey guest PAT (Suravee Suthikulpanit) [1530976 1478185]
  - [tty] serial: 8250_pci: Add Amazon PCI serial device ID (Vitaly Kuznetsov) [1530137 1527545]
  - [ata] libata: sata_down_spd_limit should return if driver has not recorded sstatus speed (David Milburn) [1530136 1457140]
  - [fs] nfs: fix a deadlock in nfs client initialization (Scott Mayhew) [1530135 1506382]
  - [fs] nfsv4.0: Fix a lock leak in nfs40_walk_client_list (Scott Mayhew) [1530135 1506382]
  - [fs] nfs: Create a common nfs4_match_client() function (Scott Mayhew) [1530135 1506382]
  - [fs] autofs - revert: take more care to not update last_used on path walk (Ian Kent) [1525994 1489542]
  - [vhost] vhost_net: correctly check tx avail during rx busy polling (Jason Wang) [1523784 1487551]
  - [crypto] shash - Fix has_key setting (Herbert Xu) [1522932 1505817]
  - [block] Fix a race between blk_cleanup_queue() and timeout handling (Ming Lei) [1522698 1513725]
  - [x86] tsc: Force TSC_ADJUST register to value >= zero (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Validate cpumask pointer before accessing it (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Try to adjust TSC if sync test fails (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Prepare warp test for TSC adjustment (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Move sync cleanup to a safe place (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Sync test only for the first cpu in a package (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Verify TSC_ADJUST from idle (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Store and check TSC ADJUST MSR (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Detect random warps (Prarit Bhargava) [1519850 1497055]
  - [x86] kvm: mmu: always terminate page walks at level 1 (Paolo Bonzini) [1500382 1500381] {CVE-2017-12188}
  - [x86] kvm: nVMX: update last_nonleaf_level when initializing nested EPT (Denys Vlasenko) [1500382 1500381] {CVE-2017-12188}
  - [x86] kvm: fix singlestepping over syscall (Paolo Bonzini) [1464480 1464481] {CVE-2017-7518}


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.21.1.el7]
changelog:
  - [x86] platform/uv: Mark tsc_check_sync as an init function (Frank Ramsay) [1547870 1526066]
  - [x86] platform/uv: Add check of TSC state set by UV BIOS (Frank Ramsay) [1547870 1526066]
  - [x86] tsc: Provide a means to disable TSC ART (Frank Ramsay) [1547870 1526066]
  - [x86] tsc: Drastically reduce the number of firmware bug warnings (Frank Ramsay) [1547870 1526066]
  - [x86] tsc: Skip TSC test and error messages if already unstable (Frank Ramsay) [1547870 1526066]
  - [x86] tsc: Add option that TSC on Socket 0 being non-zero is valid (Frank Ramsay) [1547870 1526066]
  - [x86] tsc: Remove the TSC_ADJUST clamp (Frank Ramsay) [1547870 1526066]


author: Akemi Yagi <toracat@centos.org> [3.10.0-693.21.1.el7.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
     addmissing.patch  [puias]
     cpufreq.patch  [puias]
     i386-audit-stop-scri-stack-frame.patch  [puias]
     removejiffies.patch  [puias]
     undorhirqstat.patch  [puias]
     morefixes.patch      [puias+bug#12412]
     upstream-32bit-fixes-7_4.patch [puias+bug#12412]
     clear-32bit-Werror-warnings.patch  [bug#12412]
     qspinlock_types-32bit.patch   [ay]
     i686-7-4.patch [T.Kabe, bug#13890]
     firmware-efi-32bit.patch [ay]
     patch-spec_ctrl_i686.patch [T.Kabe bug#14353]
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Enabled spidev [bug#9955]
  - Add a patch [bug#10447]
  - Enable ATM drivers [bug#10845]
  - Add 9pfs config options [bug#10849]
  - Enable VFIO_PCI_VGA [bug#12435]
  - Rremove initramfs-xxxkdump.img upon kernel removal [bug#12703]
  - Add a patch from [bug#12841]
  - Add a patch from [bug#12818]
  - Enabled RT2800USB_RT3573 [bug#13162]
  - Enable LDM_PARTITION [bug#13526]
  - Add a patch from [bug#13583]
  - Add a patch for xen [bug#13763]
  - Add a patch from [bug#13990]
  - Add BuildRequires: openssl-devel to the with_perf section [bug#13990]
  - Add a xen patch [bug#14347]
  - Add iommu patches [bug#14476]


author: Pingfan Liu <piliu@redhat.com> - 2.0.14-10
changelog:
  - kdumpctl: call strip_comments only when necessary to speedup
  - Revert "kdumpctl: improve "while read" time for /etc/kdump.conf"


author: Pingfan Liu <piliu@redhat.com> - 2.0.14-12
changelog:
  - kdump.sysconfig.x86_64: remove kaslr in kdump kernel cmdline
  - Revert commit b590153 kdump.sysconfig/x86_64: Add nokaslr to kdump kernel cmdline


author: Pingfan Liu <piliu@redhat.com> - 2.0.14-14
changelog:
  - kdump.conf.5: clarify the fence_kdump_nodes option
  - kdumpctl: for fence_kdump, the ipaddr of this node should be excluded from list


author: Pingfan Liu <piliu@redhat.com> - 2.0.14-15
changelog:
  - Revert "pc64/ppc64le: drop cpu online rule in 40-redhat.rules in kdump initramfs"
  - udev rules: mask cpu hotplug rules


author: Tony Camuso <tcamuso@redhat.com> - 20-9
changelog:
  - Must be bumped to 20-9 due to changes and version bumps in the
    7.2-z stream.
    Resolves: rhbz#1320204


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-10
changelog:
  - weak-modules: deprecate --delete-modules switch.
  - weak-modules: implement some pathes configuration from cmdline.
  - weak-modules: redesign to reuse depmod -aeE functionality
    (with some preparation changes).
    This is an updated version of the script which doesn't support
    multiple installation of the same out-of-tree module (stored in the
    'extra' subdirectory). But it more correctly checks dependencies
    between the modules.
    Resolves: rhbz#1367942


author: Tony Camuso <tcamuso@redhat.com> - 20-10
changelog:
  - Rename patches so they are not specific to the build. This was
    causing problems with z-stream builds.
    Resolves: rhbz#1416498


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-12
changelog:
  - weak-modules: fix coverity introduced by latest changes
  - weak-modules: fix "permission denied" on some upgrades.
    Resolves: rhbz#1416566


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-15.el7_4.2
changelog:
  - libkmod-elf: resolve CRC if module is built with MODULE_REL_CRCS.
  - weak-modules: process only weak-updates related depmod output.
    Resolves: rhbz#1482385


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-15.el7_4.3
changelog:
  - weak-modules: implement dry run by symlink restoration.
  - weak-modules: fix dry-run for non-lib-modules installation.
    Resolves: rhbz#1489696.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-15.el7_4.5
changelog:
  - weak-modules: use function to generate weak_updates_dir
  - weak-modules: implement dry-run on the tempdir
    Resolves: rhbz#1511943.


author: Eugene Syromiatnikov <esyr@redhat.com> 8.10.10.21_dup7.4-1
changelog:
  - 0413ea41707374d85a707b850cd0b318d3d5d132
  - Resolves: #bz1525991, #bz1525992
  - qed module for Driver Update Program


author: Eugene Syromiatnikov <esyr@redhat.com> 8.10.10.21_dup7.4-1
changelog:
  - 0413ea41707374d85a707b850cd0b318d3d5d132
  - Resolves: #bz1525991, #bz1525992
  - qede module for Driver Update Program


author: Eugene Syromiatnikov <esyr@redhat.com> 8.10.7.0_dup7.4-1
changelog:
  - 0413ea41707374d85a707b850cd0b318d3d5d132
  - Resolves: #bz1525991, #bz1525992
  - qedf module for Driver Update Program


author: Eugene Syromiatnikov <esyr@redhat.com> 8.10.4.0_dup7.4-1
changelog:
  - 0413ea41707374d85a707b850cd0b318d3d5d132
  - Resolves: #bz1525991, #bz1525992
  - qedi module for Driver Update Program


author: Eugene Syromiatnikov <esyr@redhat.com> 8.10.10.0_dup7.4-1
changelog:
  - 0413ea41707374d85a707b850cd0b318d3d5d132
  - Resolves: #bz1525991, #bz1525992
  - qedr module for Driver Update Program


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-26
changelog:
  - closing a file descriptor in a command substitution caused loss of the output (#1202439)
  - fix: in a login shell "( cmd & )" does nothing (#1217237)
  - exporting fixed with variable corrupted its data (#1192026)
  - fix segfault when handling a trap (#1211540)
  - combining alarm and IFS caused segfault (#1192119)
  - declaration of a two dimemsional associatve array could add an extra 0 element (#1193557)
  - do not inherit invalid variables during shell initializaton (#1211538)
  - case in a for loop inside a subshell caused syntax error (#1241014)


author: Siteshwar Vashisht <svashisht@redhat.com> - 20120801-35
changelog:
  - Add configuration option to enable signal bubbling for backward compatibility
    Resolves: #1484937


author: Karel Zak <kzak@redhat.com> 2.23.2-36
changelog:
  - fix #1344102 - fdisk does not handle 4kN devices correctly in 'Blocks' calculation
  - fix #1344720 - when fdisk detects gpt table, expected menu items seem to be missing in the 'm' output
  - fix #1323916 - logger unnecessarily splits messages sent via stdin into 1024 byte chunks
  - fix #1344726 - [RFE] fdisk: output UID from gpt in fdisk when detecting that a gpt partition table is present
  - fix #1362662 - fdisk -l fails/stops on first passive/not ready device, works on RHEL6
  - fix #1369436 - losetup man page incorrect syntax for Setup loop device
  - fix #1392656 - [LLNL 7.4 Bug] fix buffer overflows in util-linux with upstream patch
  - fix #1370959 - [FJ7.3 Bug]: man 8 umount is wrong.
  - fix #1357746 - mount -av" report NFS "successfully mounted" but it is not.
  - fix #1417722 - umount -a results in selinux being reported as Disabled
  - fix #1402825 - RHEL7: "sfdisk -s" can't list the disk size
  - fix #1403973 - /usr/bin/more crash on repeat search on failed regex match
  - fix #1403971 - /usr/bin/more crash in end_it due to double free
  - fix #1358095 - ipcs shows wrong gid information
  - fix #1358097 - ipcs shows strange status message in ja locale
  - fix #1378100 - fix swapon discard option parsing
  - fix #1416467 - [RFE] Add support for posix_fallocate(3) call in fallocate(1) utility
  - fix #1358755 - Backport request for zramctl on util-linux v2.23.2
  - fix #1392661 - [LLNL 7.4 Bug] add zfs patches to util-linux
  - fix #1360764 - SMT: "Threads Per Core" will automatically change when odd or even number of vcpu are enabled online.
  - fix #1397709 - [7.4 FEAT] Refresh code for lscpu to support s390x cpu topology
  - fix #1402183 - [HPE 7.3 Bug] fdisk -l does not list non-BTT NVDIMM devices


author: Karel Zak <kzak@redhat.com> 2.23.2-41
changelog:
  - fix #1451704 - IMSM RAID on 4k disks not assembled on boot
  - force gettext messages refresh (for #1358097 bugfix)


author: Karel Zak <kzak@redhat.com> 2.23.2-43.el7_4.1
changelog:
  - fix #1499760 - gvfs-udisks2-volume-monitor generates huge amount of audit log with access denied messages


author: Lukas Nykryn <lnykryn@redhat.com> - 219-35
changelog:
  - tmpfiles: add new 'e' action which cleans up a dir without creating it (#1225739)
  - util:bind_remount_recursive(): handle return 0 of set_consume() (#1433687)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-37
changelog:
  - core: add support for the "pids" cgroup controller (#1337244)
  - core: add new DefaultTasksMax= setting for system.conf (#1337244)
  - logind: add a new UserTasksMax= setting to logind.conf (#1337244)
  - core: support percentage specifications on TasksMax= (#1337244)
  - core: reinstate propagation of stop/restart jobs via RequsiteOf dependencies (#1436021)
  - core: when propagating restart requests due to deps, downgrade restart to try-restart (#1436021)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-39
changelog:
  - tests: set tasks_max to infinity (#1337244)
  - Avoid forever loop for journalctl --list-boots command (#4278) (#1294516)
  - sd-journal: return SD_JOURNAL_INVALIDATE only if journal files were actually deleted/moved (#5580) (#1446140)
  - load-fragment: don't print error about incorrect syntax when IPv6 is disabled (#1377055)
  - core: manager: add some missing dbus properties (#1427927)
  - core: manager: expose DefaultLimit* as properties on dbus (#1427927)
  - fstab-generator: remove bogus condition (#1446171)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-40
changelog:
  - readahead-collect: don't print warning message when handling symlink (#1387095)
  - tmpfiles: don't recursively descend into journal directories in /var (#1411199)
  - tmpfiles: also set acls on /var/log/journal (#1411199)
  - tmpfiles: set acls on system.journal explicitly (#1411199)
  - sysctl: configure kernel parameters in the order they occur in each sysctl configuration files (#4205) (#1382244)
  - units: drop explicit NotifyAccess setting from journald's unit file (#5749) (#1444356)
  - systemd-notify: Always pass a valid pid to sd_pid_notify (#1381743)
  - sd_pid_notify_with_fds: fix computing msg_controllen (#1381743)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-42.1
changelog:
  - Revert "udev: net_id: add support for phys_port_name attribute (#4506)" (#1477285)
  - reintroduce naming based on phys_port_name for mlxsw and rocker via udev rule


author: Lukas Nykryn <lnykryn@redhat.com> - 219-42.4
changelog:
  - manager: when reexecuting try to connect to bus only when dbus.service is around (#6773) (#1465737)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-42.5
changelog:
  - unmount: Pass in mount options when remounting read-only (#1312002)
  - shutdown: don't remount,ro network filesystems. (#6588) (#1312002)
  - shutdown: fix incorrect fscanf() result check (#6806) (#1312002)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-42.10
changelog:
  - journal: remove error check that never happens (#1465759)
  - sd-journal: various clean-ups and modernizations (#1465759)
  - journalctl: continue operation, even if we run into an invalid file (#1465759)
  - journalctl: when we fail to open a journal file, print why (#1465759)
  - sd-journal: properly handle inotify queue overflow (#1540538)
  - sd-journal: make sure it's safe to call sd_journal_process() before the first sd_journal_wait() (#1540538)
  - sd-journal: when picking up a new file, compare inode/device info with previous open file by same name (#1540538)
  - journalctl: Periodically call sd_journal_process in journalctl (#1540538)


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.28.1-1.50
changelog:
  - v2v:
    * When debugging, dump OVF to stderr.
    * Ignore missing kernels from grub
      resolves: rhbz#1230412
    * Calculate VMware dcPath correctly (1256823)
    * Map empty VMware network or bridge name to default (1257895)
  - p2v:
    * Wait for network to come online before testing connection
      resolves: rhbz#1256222
  - Fix tests to run correctly with libguestfs-winsupport 7.2.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.28.1-1.51
changelog:
  - v2v: Fix handling of extra slashes in dcPath calculation
    resolves: rhbz#1258342 rhbz#1256823
  - v2v: Fix -oa preallocation option
    resolves: rhbz#1251909


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.28.1-1.52
changelog:
  - v2v: Warn if Group Policy or AV software may result in 7B boot failure
    (1260689)
  - v2v: Fix OVF XML to enable qxl display
    resolves: rhbz#1260590


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.28.1-1.53
changelog:
  - v2v: Error if certain options appear twice on the command line (1261242)
  - v2v: Add --dcpath parameter to allow dcPath to be overridden (1256823)
  - v2v: Partially revert: Fix OVF XML to enable qxl display (1260590)
  - v2v: Detect AVG Technologies as AV software (1261436)
    resolves: rhbz#1261281


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.32.7-3
changelog:
  - Rebase to libguestfs 1.32 in RHEL 7.3
    resolves: rhbz#1218766
  - The full tests are now run after the package has been built.
  - New tool and subpackage: virt-dib (safe diskimage-builder replacement).
  - New subpackage libguestfs-inspect-icons to reduce dependencies of main pkg
    (see https://bugzilla.redhat.com/1194158).
  - New tool: virt-get-kernel.
  - Depend on java-headless instead of full java.
  - New tool: virt-v2v-copy-to-local.
  - Disable virt-v2v subpackage on ppc64 etc
    resolves: rhbz#1287826
  - v2v: Remove VirtualBox Additions correctly
    resolves: rhbz#1296606
  - Add clearer warnings sections to all man pages
    resolves: rhbz#1293527
  - v2v: Disable the --in-place option.
  - v2v: Support conversion of Windows > 7
    resolves: rhbz#1190669
  - Add code to verify tarball signatures.
  - General performance improvements.
  - v2v: Prevent duplicate -b, -n, -oa options
    resolves: rhbz#1326266
    resolves: rhbz#1325825
  - v2v: Unquote UUID and LABEL in fstab (util-linux 1335671)
  - v2v: Fix alignment issues in treeviews in conversion dialog
    resolves: rhbz#1340407
  - p2v: spinner should be hidden when it stops spinning
    resolves: rhbz#1341564
  - p2v: ethtool command is not supported on p2v client
    resolves: rhbz#1341608
  - p2v: Add ifconfig command to ISO
    resolves: rhbz#1342447
  - p2v: Warn if virt-p2v-make-disk used on a partition
    resolves: rhbz#1342337
  - Build using OCaml with fix for CVE-2015-8869.
    resolves: rhbz#1343101
  - customize: Add --uninstall option (upstream 1343375)
  - p2v: Document permissions on id_rsa file
    resolves: rhbz#1343414
  - p2v: Print full curl error message
    resolves: rhbz#1343423
  - get-kernel: Fix --format auto
    resolves: rhbz#1341984
  - v2v: Provide better <Origin/> information to RHEV-M
    resolves: rhbz#1342398
  - customize: Give an error if --truncate-recursive path does not exist
    resolves: rhbz#1345809
  - sysprep: Add --network option so that --install option can be used
    resolves: rhbz#1345813
  - p2v: Print proper error if incorrect password is given
    resolves: rhbz#1227599
  - p2v: Print ssh error if incorrect hostname is given
    resolves: rhbz#1167916
  - p2v: Display progress of operation in non-GUI mode
    resolves: rhbz#1229386
  - p2v: Add a dialog confirming the user really means to cancel
    resolves: rhbz#1340464
  - p2v: log window should process colour escapes and backspaces
    resolves: rhbz#1314244
  - v2v: Fix installation of virtio drivers with *.dll files
    resolves: rhbz#1311373
  - p2v: Improve error message when ssh login to conversion server fails
    resolves: rhbz#1348900
  - v2v: Remove --dcpath parameter from manual
    resolves: rhbz#1315237
  - v2v: Fix conversion of guests with floppy drives
    resolves: rhbz#1309706
  - p2v: Better error when sudo requires a password
    resolves: rhbz#1340809
  - v2v: Refuse to convert if there is < 1GB free in temporary directory
    resolves: rhbz#1316479
  - inspection: Get Windows drive letters for GPT disks
    resolves: rhbz#1349237
  - p2v: Add disk utils and display serial number of disks
    resolves: rhbz#855058
  - p2v: Fix timeout error when connecting to unresponsive ssh server
    resolves: rhbz#1350363
  - Remove external dependency generator.  Use supermin RPM deps instead.
    related: rhbz#1309796
  - p2v: Flush messages to the journal immediately
    resolves: rhbz#1229386
  - customize: Fix --install on ppc64le
    resolves: rhbz#1264835
  - lib: Fix finding icons in Windows 7 64 bit guests
    resolevs: rhbz#1352761
  - v2v: Add virsh --quiet flag when running virt-v2v --quiet
    resolves: rhbz#1358142
  - lib: Fix inspection of ISOs with latest libosinfo
    resolves: rhbz#1359652
  - dib: Fix run_command exit handlers on failure
    resolves: rhbz#1362357
  - dib: Rework run of extra-data.d hooks
    resolves: rhbz#1362354
  - Miscellaneous fixes to man pages and --help output
    resolves: rhbz#1362668
  - lib: Specify backing format for read-only files
    resolves: rhbz#1354335
  - Fix --selinux-relabel option
    resolves: rhbz#1362669
  - sparsify: Fix --in-place option with UEFI guest
    resolves: rhbz#1364347
  - p2v: Use latest linux-firmware in ISO
    resolves: rhbz#1364419
  - v2v: Fix guest name when using -i disk
    resolves: rhbz#1365005
  - p2v: Fix GUI message.
  - v2v: Make fstrim message clearer
    resolves: rhbz#1366456
  - v2v: Fix conversion of UEFI guests when Secure Boot OVMF installed
    resolves: rhbz#1367615
  - lib: Fix assert-fail if port is missing in libvirt XML
    resolves: rhbz#1370424


author: Pino Toscano <ptoscano@redhat.com> - 1:1.36.3-6
changelog:
  - Rebase to libguestfs 1.36 in RHEL 7.4.
    resolves: rhbz#1359086
  - v2v: always use names for libvirt pools
    resolves: rhbz#1141631
  - v2v: correctly find GRUB in RHEL UEFI guests
  - v2v: uninstall VMware tools packages from guests
    resolves: rhbz#1155150
  - v2v: install RHEV-APT only when using -o rhev/-o vdsm
    resolves: rhbz#1161019
  - New API: btrfs-filesystem-show
    resolves: rhbz#1164765
  - p2v: always enable debugging when running virt-v2v
    resolves: rhbz#1167623
  - libguestfs prefers virtio-pci on aarch64
    resolves: rhbz#1237250
  - v2v: make sure to copy all the driver files on Windows
    resolves: rhbz#1255610
  - Better tolerate corrupted Windows hivex; bump the hivex BuildRequires and
    Requires to >= 1.3.10-5.8.el7
    resolves: rhbz#1311890
  - v2v: ignore all the environment variables for proxy when exporting from
    vCenter
    resolves: rhbz#1354507
  - virt-sysprep can deal with full-LUKS encrypted guests
    resolves: rhbz#1362649
  - All the tools have bash completion scripts.
    resolves: rhbz#1367738
  - v2v: do not remove Processor and Intelppm nodes in Windows guests
    resolves: rhbz#1372668
  - Fix SELinux relabelling in old RHEL 6 guests, by adjusting a broken
    regular expression in file_contexts file
    resolves: rhbz#1374232
  - v2v: set all the properties on creation when exporting to Glance
    resolves: rhbz#1374405
  - v2v: set hw_video_model when exporting to Glance
    resolves: rhbz#1374651
  - v2v: fix OVA conversion as root using the libvirt backend
    resolves: rhbz#1375157
  - Various improvements and fixes to the documentation
    resolves: rhbz#1377081
    resolves: rhbz#1390876
    resolves: rhbz#1398070
    resolves: rhbz#1425306
  - v2v: support <listen type='socket'> and <listen type='none'>
    resolves: rhbz#1378022
  - v2v: allow libvirt >= 2.1.0 for vCenter conversions
    resolves: rhbz#1379240
  - p2v: enable mnemonics in the GUI
    resolves: rhbz#1379289
  - Split virt-p2v, and the tools for it, in an own package: virt-p2v-maker
    resolves: rhbz#1382275
  - Correctly parse mount options in btrfs entries in /etc/fstab.
    resolves: rhbz#1383517
  - Read secrets from libvirt domains, when inspecting them
    resolves: rhbz#1392798
  - v2v: add --vdsm-compat=1.1 flag for VDSM
    resolves: rhbz#1400205
  - Fix inspection with UsrMove and /usr in a separate partition
    resolves: rhbz#1401474
  - v2v: improve import compatibility with OVAs produced by AWS
    resolves: rhbz#1402301
  - resize: allow URIs for the output disk
    resolves: rhbz#1404182
  - Disable EDD when launching the appliance
    resolves: rhbz#1404287
  - v2v: increase the memory allocated to the appliance
    resolves: rhbz#1418283
  - p2v: switch from GTK+ 2 to GTK+ 3
  - p2v: add dbus-devel as BuildRequires to disable suspension during the
    conversion
  - libguestfs-java: bump the java-headless Require to >= 1.7.0, matching the
    Build-Require, and the generated bytecode
    resolves: rhbz#1364518
  - Do not try to use/write to /var/cache/yum & /var/log/yum.log
  - Bump ocaml-findlib-devel BuildRequires to >= 1.3.3-7.el7, because of
    RHBZ#1403897
  - v2v: remove --dcpath & --dcPath from --help output too
    resolves: rhbz#1429430
  - v2v: force VNC as display for -i disk, as SDL is not supported
    resolves: rhbz#1372671
  - v2v, p2v: rename rhvm network to ovirtmgmt
    resolves: rhbz#1429491
  - v2v: when exporting to local disk, check that UEFI firmware is installed
    before conversion
    resolves: rhbz#1429506
  - dib: actually generate SHA256 checksums when using --checksum
    resolves: rhbz#1430184
  - v2v: do not mention SUSE Xen hosts as supported
    resolves: rhbz#1430203
  - v2v: depend on OVMF/AAVMF, for converting EFI guests
    resolves: rhbz#1429643
  - v2v: use absolute path when using an OVA as backing file
    resolves: rhbz#1430680
  - v2v: support Debian/Ubuntu guests
    resolves: rhbz#1387213
  - sysprep: remove DHCP_HOSTNAME entries
    resolves: rhbz#1427529
  - v2v: avoid repeated "run virt-v2v -v -x" message on error
    resolves: rhbz#1167623
  - bash-completion: add script for virt-v2v-copy-to-local
    resolves: rhbz#1367738
  - v2v: fix virtio block driver installation for Windows 10 and Windows 2016
    resolves: rhbz#1434737
  - Replace the libosinfo dependency with osinfo-db, since we are only using
    the osinfo database.
  - v2v: fix virtio driver installation for Windows 8 UEFI
    resolves: rhbz#1431579
  - v2v: new 'vmx' import method
    resolves: rhbz#1441197
  - v2v: properly identify Windows 2016 guests when exporting them to RHV-M
    resolves: rhbz#1447202
  - Run pvresize in non-interactive mode
    resolves: rhbz#1460692
  - resize: make sure the input disk is read-only
    resolves: rhbz#1463714
  - Switch qemu-kvm-rhev dependency to qemu-kvm on aarch64
    resolves: rhbz#1463646


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-50.2
changelog:
  - Resolves: rhbz#1478252 - Querying the AD domain for external domain's
                             ID can mark the AD domain offline [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50.3
changelog:
  - Resolves: rhbz#1482927 - sssd_be is utilizing more CPU during sudoi
                             rules refresh [rhel-7.4.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-50.4
changelog:
  - Resolves: rhbz#1489290 - samba shares with sssd authentication broken
                             on 7.4 [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50.6
changelog:
  - Add a patch that was missed in 1.15.2-50.4
  - Related: rhbz#1489290 - samba shares with sssd authentication broken
                            on 7.4 [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50.7
changelog:
  - Resolves: rhbz#1506142 - SSSD can crash due to ABI changes in
                             libldb >= 1.2.0 (1.1.30) [rhel-7.4.z]
  - Resolves: rhbz#1506682 - sssd_client: add mutex protected call to the
                             PAC responder [rhel-7.4.z]
  - Resolves: rhbz#1499658 - CVE-2017-12173 sssd: unsanitized input when
                             searching in local cache database [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50.8
changelog:
  - Resolves: rhbz#1508972 - Accessing IdM kerberos ticket fails while id
                             mapping is applied [rhel-7.4.z]
  - Resolves: rhbz#1509177 - Race condition between refreshing the cr_domain
                             list and a request that is using the list can
                             cause a segfault is sssd_nss [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50.9
changelog:
  - Resolves: rhbz#1525110 - NSS by-id requests are not checked against
                             max_id/min_id ranges before triggering the
                             backend [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50-10
changelog:
  - Resolves: rhbz#1530975 - sssd_be stuck in an infinite loop after
                             completing full refresh of sudo rules
                             [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50-11
changelog:
  - Resolves: rhbz#1516700 - SELINUX: Use getseuserbyname to get IPA
                             seuser [rhel-7.4.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-43
changelog:
  - Resolves: rhbz#1440132 - fiter_users and filter_groups stop working
                             properly in v 1.15


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-44
changelog:
  - Resolves: rhbz#1457927 - getent failed to fetch netgroup information
                             after changing default_domain_suffix to
                             ADdomin in /etc/sssd/sssd.conf


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-47
changelog:
  - Resolves: rhbz#1430415 - ldap_purge_cache_timeout in RHEL7.3 invalidate
                             most of the entries once the cleanup task kicks in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-48
changelog:
  - Resolves: rhbz#1459846 - krb5: properly handle 'password expired'
                             information retured by the KDC during
                             PKINIT/Smartcard authentication


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-49
changelog:
  - Resolves: rhbz#1450107 - SSSD doesn't handle conflicts between users
                             from trusted domains with the same name when
                             shortname user resolution is enabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-50
changelog:
  - Resolves: rhbz#1457926 - Wrong search base used when SSSD is directly
                             connected to AD child domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-50.1
changelog:
  - Resolves: rhbz#1478250 - Idle nss file descriptors should be closed
                             [rhel-7.4.z]


author: Rui Matos <rmatos@redhat.com> - 2.5.2-11
changelog:
  - Resolves: CVE-2017-13738, CVE-2017-13740, CVE-2017-13741,
    CVE-2017-13742, CVE-2017-13743, CVE-2017-13744, CVE-2014-8184


author: Paul Wouters <pwouters@redhat.com> - 3.15-6
changelog:
  - Resolves: rhbz#1283468 keyingtries=0 is broken
  - Resolves: rhbz#1297816 When using SHA2 as PRF algorithm, nonce payload is below the RFC minimum size
  - Resolves: rhbz#1344567 CVE-2016-5361 libreswan: IKEv1 protocol is vulnerable to DoS amplification attack
  - Resolves: rhbz#1313747 ipsec pluto returns zero even if it fails
  - Resolves: rhbz#1302778 fips does not check hash of some files (like _import_crl)
  - Resolves: rhbz#1278063 Unable to authenticate with PAM for IKEv1 XAUTH
  - Resolves: rhbz#1257079 Libreswan doesn't call NetworkManager helper in case of a connection error
  - Resolves: rhbz#1272112 ipsec whack man page discrepancies
  - Resolves: rhbz#1280449 PAM xauth method does not work with pam_sss
  - Resolves: rhbz#1290907 ipsec initnss/checknss custom directory not recognized
  - Resolves: rhbz#1309764 ipsec barf does not show pluto log correctly in the output
  - Resolves: rhbz#1347735 libreswan needs to check additional CRLs after LDAP CRL distributionpoint fails
  - Resolves: rhbz#1219049 Pluto does not handle delete message from responder site in ikev1
  - Resolves: rhbz#1276524 [USGv6] IKEv2.EN.R.1.1.3.2 case failed due to response to bad INFORMATIONAL request
  - Resolves: rhbz#1315412 ipsec.conf manpage does not contain any mention about crl-strict option
  - Resolves: rhbz#1229766 Pluto crashes after stop when I use floating ip address


author: Paul Wouters <pwouters@redhat.com> - 3.15-7
changelog:
  - Resolves: rhbz#1311360  When IKE rekeys, if on a different tunnel, all subsequent attempts to rekey fail
  - Resolves: rhbz#1361721 libreswan pluto segfault


author: Paul Wouters <pwouters@redhat.com> - 3.15-8
changelog:
  - Resolves: rhbz#1361721 libreswan pluto segfault [UPDATED]
  - Resolves: rhbz#1276524 [USGv6] IKEv2.EN.R.1.1.3.2 case failed due to response to bad INFORMATIONAL request [UPDATED]
  - Resolves: rhbz#1309764 ipsec barf [additional man page update and --no-pager]


author: Paul Wouters <pwouters@redhat.com> - 3.20-2
changelog:
  - Resolves: rhbz#1372279 ipsec auto --down CONNECTION returns error for tunnels
  - Resolves: rhbz#1444115 FIPS: libreswan must generate RSA keys with a minimal exponent of F4, nor E=3
  - Resolves: rhbz#1341353 Allow Preshared Key authentication in FIPS mode for libreswan


author: Paul Wouters <pwouters@redhat.com> - 3.20-3
changelog:
  - Resolves: rhbz#1372279 ipsec auto --down CONNECTION returns error for tunnels [updated]
  - Resolves: rhbz#1458227 CAVS test driver does not work in FIPS mode
  - Resolves: rhbz#1452672 (new-ksk-libreswan-el7) DNSSEC trust anchor cannot be updated without recompilation


author: Paul Wouters <pwouters@redhat.com> - 3.20-4
changelog:
  - Resolves: rhbz#1501809 libreswan does not establish IKE with xauth enabled but modecfg disabled
  - Resolves: rhbz#1503949 xauth password length limited to 64 bytes while XAUTH_MAX_PASS_LENGTH (128)


author: Gris Ge <fge@redhat.com> 1.4.0-1
changelog:
  - Add Python3 support.
  - New sub rpm package python3-libstoragemgmt.
  - Add support of lmiwbem.
  - Allow plugin test to be run concurrently.
  - Bug fixes:
      * Fix megaraid plugin for dell PERC.
      * Fix local disk rotation speed query on NVMe disk.
      * Fix lsmcli incorrect try-expect on local disk query.
      * Fix all the gcc compile warnings.
      * Fix the obsolete usage of AC_OUTPUT in configure.ac.
  - Library adds:
      * Query serial of local disk:
          lsm_local_disk_serial_num_get()/lsm.LocalDisk.serial_num_get()
      * Query LED status of local disk:
          lsm_local_disk_led_status_get()/lsm.LocalDisk.led_status_get()
      * Query link speed of local disk:
          lsm_local_disk_link_speed_get()/lsm.LocalDisk.link_speed_get()


author: Marcelo Ricardo Leitner <mleitner@redhat.com> - 1.25-2
changelog:
  - Updated to 1.25 [1286840 1286063]
  - Added patch teamd-LACP-runner-does-not-set-Agg-bit-on-first-slav.patch [1347818]


author: Marcelo Ricardo Leitner <mleitner@redhat.com> - 1.25-4
changelog:
  - Added patches to avoid hung on shutdown [1330550]
  - Added patch to fix an out-of-bound write with zero-length hardware
    address [1286840]


author: Xin Long <lxin@redhat.com> - 1.25-5
changelog:
  - Added patch to escape some sensitive characters [1383997]
  - Added patch to check port link_up when a port is added for lb runner
    [1393430]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.21-2
changelog:
  - Allow building with RHEL-7.0 libtalloc
  - Resolves: rhbz#1133919 - Rebase libtevent to version 0.9.21 or newer


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.21-3
changelog:
  - BuildRequire the minimal applicable libtalloc version
  - Resolves: rhbz#1133919 - Rebase libtevent to version 0.9.21 or newer


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.31-2
changelog:
  - Resolves: #1513984 - tevent can cause a Samba file corruption bug under
                         heavy threaded load [rhel-7.4.z]


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-7
changelog:
  - conf: Resolve corner case on fc_host deletion (rhbz#1420740)
  - pci: fix link maximum speed detection (rhbz#1455017)
  - qemu: Use correct variable in qemuDomainSetBlockIoTune (rhbz#1455510)
  - virsh: Track when create pkttyagent (rhbz#1374126)
  - conf: add eim attribute to <iommu><driver> (rhbz#1451282, rhbz#1289153)
  - qemu: format eim on intel-iommu command line (rhbz#1451282, rhbz#1289153)
  - rpc: Double buffer size instead of quadrupling buffer size. (rhbz#1440683)
  - rpc: Allow up to 256K records to be returned per domain from virConnectGetAllDomainStats. (rhbz#1440683)
  - nodedev: Increase the netlink socket buffer size to the one used by udev (rhbz#1450960, rhbz#1442307)
  - util: hostcpu: Correctly report total number of vcpus in virHostCPUGetMap (rhbz#1456793)
  - qemu: Report shutdown event details (rhbz#1384007)
  - qemu: json: Fix daemon crash on handling domain shutdown event (rhbz#1384007)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-8
changelog:
  - qemu: mkdir memory_backing_dir on startup (rhbz#1214369)
  - qemu: Don't error out if allocation info can't be queried (rhbz#1452045)
  - daemon: Don't initialize SASL context if not necessary (rhbz#1450095)
  - virDomainXMLOption: Introduce virDomainABIStabilityDomain (rhbz#1450349)
  - virQEMUDriverDomainABIStability: Check for memoryBacking (rhbz#1450349)
  - qemu: process: Save vcpu ordering information on reconnect (rhbz#1451251)
  - audit: Fix the output message for shmem (rhbz#1218603)
  - qemu: Set operation on completed migration job (rhbz#1457052)
  - qemu: Conditionally allow block-copy for persistent domains (rhbz#1459113)
  - virsh: Add support for VIR_DOMAIN_BLOCK_COPY_TRANSIENT_JOB (rhbz#1459113)
  - qemu: Fix serial stub console allocation (rhbz#1434278)
  - conf: Make error reporting in virCPUDefIsEqual optional (rhbz#1441662)
  - conf: Refactor virCPUDefParseXML (rhbz#1441662)
  - conf: Make virDomainSnapshotDefFormat easier to read (rhbz#1441662)
  - conf: Pass xmlopt to virDomainSnapshotDefFormat (rhbz#1441662)
  - qemu: Rename xml_len in virQEMUSaveHeader as data_len (rhbz#1441662)
  - qemu: Fix memory leaks in qemuDomainSaveImageOpen (rhbz#1441662)
  - qemu: Introduce virQEMUSaveData{New,Free} (rhbz#1441662)
  - qemu: Introduce virQEMUSaveDataFinish (rhbz#1441662)
  - qemu: Refactor qemuDomainSaveHeader (rhbz#1441662)
  - qemu: Introduce virQEMUSaveData structure (rhbz#1441662)
  - conf: Introduce virSaveCookie (rhbz#1441662)
  - conf: Add save cookie callbacks to xmlopt (rhbz#1441662)
  - qemu: Implement virSaveCookie object and callbacks (rhbz#1441662)
  - qemu: Store save cookie in save images and snapshots (rhbz#1441662)
  - qemu: Remember CPU def from domain start (rhbz#1441662)
  - qemu: Report the original CPU in migratable xml (rhbz#1441662)
  - qemu: Always send persistent XML during migration (rhbz#1441662)
  - qemu: Send updated CPU in migration cookie (rhbz#1441662)
  - qemu: Store updated CPU in save cookie (rhbz#1441662)
  - qemu: Use updated CPU when starting QEMU if possible (rhbz#1441662)
  - docs: correct improper information about domain states in virsh manpage (rhbz#1408778)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-10
changelog:
  - qemu: Set iface MTU on hotplug (rhbz#1408701)
  - Use a separate buffer for <input> subelements (rhbz#1283251)
  - Use a separate buffer for <disk><driver> (rhbz#1283251)
  - Use a separate buffer for <controller><driver> (rhbz#1283251)
  - Use a separate buffer for <filesystem><driver> (rhbz#1283251)
  - conf: introduce virDomainControllerDriverFormat (rhbz#1283251)
  - conf: add iotlb attribute to iommu (rhbz#1283251)
  - qemu: format device-iotlb on intel-iommu command line (rhbz#1283251)
  - qemuxml2xmltest: add virtio-options test (rhbz#1283251)
  - conf: use a leading space in virDomainVirtioNetDriverFormat (rhbz#1283251)
  - Add virtio-related options to interfaces (rhbz#1283251)
  - add virtio-related options to memballoon (rhbz#1283251)
  - Add virtio-related options to disks (rhbz#1283251)
  - Add virtio-related options to controllers (rhbz#1283251)
  - Add virtio-related options to filesystems (rhbz#1283251)
  - Add virtio-related options to rng devices (rhbz#1283251)
  - Add virtio-related options to video (rhbz#1283251)
  - Add virtio-related options to input devices (rhbz#1283251)
  - qemuxml2argvtest: add virtio-options test case (rhbz#1283251)
  - qemu: format virtio-related options on the command line (rhbz#1283251)
  - qemu: Allow memAccess for hugepages again (rhbz#1214369, rhbz#1458638)
  - qemu: Prefer hugepages over mem source='file' (rhbz#1214369)
  - qemu: Don't try to use hugepages if not enabled (rhbz#1214369)
  - qemu: Introduce qemuDomainDefFromXML helper (rhbz#1460952)
  - qemu: Add qemuDomainMigratableDefCheckABIStability (rhbz#1460952)
  - qemu: Add qemuDomainCheckABIStability (rhbz#1460952)
  - qemu: Use qemuDomainCheckABIStability where needed (rhbz#1460952)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-11
changelog:
  - util: storage: Output parsed network backing store string to debug log (rhbz#1461638)
  - util: storage: Add missing return to virStorageSourceParseBackingJSONGluster (rhbz#1461638)
  - util: storage: make virStorageSourceParseBackingJSONGlusterHost universal (rhbz#1461638)
  - util: storage: Add support for type 'inet' in virStorageSourceParseBackingJSONSocketAddress (rhbz#1461638)
  - util: storage: Split out parsing of TCP network host from JSON pseudoprotocol (rhbz#1461638)
  - util: storage: Report errors when source host data is missing (rhbz#1461638)
  - util: storage: Add JSON parser for new options in iSCSI protocol (rhbz#1461638)
  - util: storage: adapt to changes in JSON format for NBD (rhbz#1461638)
  - util: storage: adapt to changes in JSON format for ceph/rbd (rhbz#1461638)
  - util: storage: adapt to changes in JSON format for ssh (rhbz#1461638)
  - util: storage: adapt to changes in JSON format for sheepdog (rhbz#1461638)
  - qemu: Allow live-updates of coalesce settings (rhbz#1414627)
  - qemu: Pass the number of heads even with -vga qxl (rhbz#1283207)
  - util: storage: Export virStorageIsRelative (rhbz#1461303)
  - storage: Add helper to retrieve the backing store string of a storage volume (rhbz#1461303)
  - qemu: snapshot: Load data necessary for relative block commit to work (rhbz#1461303)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-14.el7_4.1
changelog:
  - qemu: Don't update CPU when checking ABI stability (rhbz#1470582)
  - cpu_x86: Properly disable unknown CPU features (rhbz#1470582)
  - qemu: Add qemuProcessFetchGuestCPU (rhbz#1470582)
  - qemu: Add qemuProcessVerifyCPU (rhbz#1470582)
  - qemu: Rename qemuProcessUpdateLiveGuestCPU (rhbz#1470582)
  - qemu: Add qemuProcessUpdateLiveGuestCPU (rhbz#1470582)
  - qemu: Export virQEMUCapsGuestIsNative (rhbz#1470582)
  - qemu: Move qemuProcessReconnect to the end of qemu_process.c (rhbz#1470582)
  - qemu: Update host-model CPUs on reconnect (rhbz#1470582)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-14.el7_4.2
changelog:
  - qemu: Fix qemuDomainGetBlockInfo allocation value setting (rhbz#1470127)
  - qemuDomainBuildNamespace: Handle special file mount points (rhbz#1471660)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-14.el7_4.4
changelog:
  - qemu: Pass virArch * to virQEMUCapsCPUFilterFeatures (rhbz#1508549)
  - qemu: Publish virQEMUCapsCPUFilterFeatures (rhbz#1508549)
  - qemu: Separate CPU updating code from qemuProcessReconnect (rhbz#1508549)
  - conf: Introduce virCPUDefFindFeature (rhbz#1508549)
  - qemu: Filter CPU features when using host CPU (rhbz#1508549)
  - qemu: Fix CPU model broken by older libvirt (rhbz#1508549)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-14.el7_4.5
changelog:
  - qemu: block commit: Don't overwrite error when rolling back disk labels (rhbz#1516717)
  - qemu: block commit: Determine relative path of images before initializing (rhbz#1516717)
  - qemu: domain: Don't call namespace setup for storage already accessed by vm (rhbz#1516717)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-14.el7_4.6
changelog:
  - util: add virFileReadHeaderQuiet wrapper around virFileReadHeaderFD (CVE-2017-5715)
  - util: introduce virHostCPUGetMicrocodeVersion (CVE-2017-5715)
  - cpu_x86: Rename virCPUx86MapInitialize (CVE-2017-5715)
  - conf: include x86 microcode version in virsh capabiltiies (CVE-2017-5715)
  - qemu: capabilities: force update if the microcode version does not match (CVE-2017-5715)
  - cpu: add CPU features and model for indirect branch prediction protection (CVE-2017-5715)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-14.el7_4.8
changelog:
  - qemuDomainAttachDeviceMknodHelper: Remove symlink before creating it (rhbz#1532183)
  - cpu_x86: Copy CPU signature from ancestor (rhbz#1533418)
  - qemu: take current async job into account in qemuBlockNodeNamesDetect (rhbz#1530129)
  - qemu: migration: fix race on cancelling drive mirror (rhbz#1530129)
  - qemu: drop code for VIR_DOMAIN_JOB_BOUNDED and timeRemaining (rhbz#1530130)
  - qemu: introduce qemu domain job status (rhbz#1530130)
  - qemu: introduce QEMU_DOMAIN_JOB_STATUS_POSTCOPY (rhbz#1530130)
  - qemu: start all async job with job status active (rhbz#1530130)
  - qemu: introduce migrating job status (rhbz#1530130)
  - qemu: migration: don't expose incomplete job as complete (rhbz#1530130)
  - qemu: Fix type of a completed job (rhbz#1530130)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-14.el7_4.9
changelog:
  - qemu: Fix crash in offline migration (rhbz#1530130)
  - RHEL: qemu: Report full stats for completed migration (rhbz#1530130)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-7
changelog:
  - conf: Add infrastructure for disk source private data XML (rhbz#1523261)
  - util: storage: Add helpers to parse and format relPath into privateData (rhbz#1523261)
  - qemu: domain: Parse and format relPath into disk source private data (rhbz#1523261)
  - qemu: remove input device after receiving the event (rhbz#1524837)
  - conf: honor maxnames in nodeListDevices API (rhbz#1528572)
  - storage: Fixing missing 'backingStore' tag from volume XML dumps. (rhbz#1529663)
  - util: add virFileReadHeaderQuiet wrapper around virFileReadHeaderFD (CVE-2017-5715)
  - util: introduce virHostCPUGetMicrocodeVersion (CVE-2017-5715)
  - cpu_x86: Rename virCPUx86MapInitialize (CVE-2017-5715)
  - conf: include x86 microcode version in virsh capabiltiies (CVE-2017-5715)
  - qemu: capabilities: force update if the microcode version does not match (CVE-2017-5715)
  - cpu: add CPU features and model for indirect branch prediction protection (CVE-2017-5715)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-8
changelog:
  - qemuDomainAttachDeviceMknodHelper: Remove symlink before creating it (rhbz#1528502)
  - RHEL: cpu: Fix EPYC-IBRS CPU model (CVE-2017-5715)
  - cpu_x86: Copy CPU signature from ancestor (rhbz#1533125)
  - qemu: Ignore fallback CPU attribute on reconnect (rhbz#1532980)
  - qemu: Fix type of a completed job (rhbz#1523036)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-9
changelog:
  - qemu: Fix crash in offline migration (rhbz#1536351)
  - Revert "qemu: monitor: do not report error on shutdown" (rhbz#1536461)
  - qemu: Refresh caps cache after booting a different kernel (rhbz#1525182)
  - qemu: Don't initialize struct utsname (rhbz#1525182)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-10
changelog:
  - storage: util: Properly ignore errors when backing volume is inaccessible (rhbz#1540022)
  - util: json: Add helper to return string or number properties as string (rhbz#1540290)
  - util: storage: Parse 'lun' for iSCSI protocol from JSON as string or number (rhbz#1540290)
  - util: Introduce virFormatIntPretty (rhbz#1289368)
  - util: Make prefix optional in virBitampString (rhbz#1289368)
  - util: Rename virBitmapString to virBitmapToString (rhbz#1289368)
  - util: Rename virBitmapDataToString to virBitmapDataFormat (rhbz#1289368)
  - util: Don't output too many zeros from virBitmapToString (rhbz#1289368)
  - util: Introduce virBitmapNewString (rhbz#1289368)
  - util: Reintroduce virBitmapSubtract (rhbz#1289368)
  - util: Introduce virBitmapShrink (rhbz#1289368)
  - conf: Sort cache banks in capabilities XML (rhbz#1289368)
  - conf: Format cache banks in capabilities with virFormatIntPretty (rhbz#1289368)
  - tests: Remove executable bits on plain data files (rhbz#1289368)
  - tests: Minor adjustments for test data (rhbz#1289368)
  - tests: Add resctrl-skx-twocaches test case to vircaps2xmltest (rhbz#1289368)
  - util: Fix leak in virStringTrimOptionalNewline (rhbz#1289368)
  - Rename virResctrlInfo to virResctrlInfoPerCache (rhbz#1289368)
  - util: Add virResctrlInfo (rhbz#1289368)
  - conf: Use virResctrlInfo in capabilities (rhbz#1289368)
  - util: Remove now-unneeded resctrl functions (rhbz#1289368)
  - fixup_resctrlinfo (rhbz#1289368)
  - resctrl: Add functions to work with resctrl allocations (rhbz#1289368)
  - conf: Add support for cputune/cachetune (rhbz#1289368)
  - tests: Add virresctrltest (rhbz#1289368)
  - qemu: Add support for resctrl (rhbz#1289368)
  - tests: Clean up and modify some vircaps2xmldata (rhbz#1289368)
  - resctl: stub out functions with Linux-only APIs used (rhbz#1289368)
  - util: Check for empty allocation instead of just NULL pointer (rhbz#1289368)
  - util: Use "resctrl" instead of "resctrlfs" spelling (rhbz#1289368)
  - util: Make it possible for virResctrlAllocSetMask to replace existing mask (rhbz#1289368)
  - util: Remove unused variable in virResctrlGetInfo (rhbz#1289368)
  - util: Don't check if entries under /sys/fs/resctrl/(info/) are directories (rhbz#1289368)
  - util: Add helpers for getting resctrl group allocs (rhbz#1289368)
  - util: Use default group's mask for unspecified resctrl allocations (rhbz#1289368)
  - util: Don't overwrite mask in virResctrlAllocFindUnused (rhbz#1289368)
  - qemu: Restore machinename even without cgroups (rhbz#1289368)
  - util: Extract path formatting into virResctrlAllocDeterminePath (rhbz#1289368)
  - qemu: Restore resctrl alloc data after restart (rhbz#1289368)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-11
changelog:
  - qemu: migration: Refresh device information after transferring state (rhbz#1463168)
  - qemuDomainRemoveMemoryDevice: unlink() memory backing file (rhbz#1461214)
  - util: Fix possible leak in virResctrlAllocMasksAssign (rhbz#1540817)
  - util: Clear unused part of the map in virBitmapShrink (rhbz#1540817)
  - tests: Add test for properly removing cachetune entries (rhbz#1540817)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-12
changelog:
  - util: Check if kernel-provided info is consistent with itself (rhbz#1540780)
  - qemu: Refresh capabilities when creating resctrl allocation (rhbz#1540780)
  - qemu: Expose rx/tx_queue_size in qemu.conf too (rhbz#1541960)
  - util: bitmap: Fix value of 'map_alloc' when shrinking bitmap (rhbz#1540817)
  - qemu: driver: Extract vcpu halted state directly (rhbz#1534585)
  - qemu: Remove unused 'cpuhalted' argument from qemuDomainHelperGetVcpus (rhbz#1534585)
  - qemu: domain: Store vcpu halted state as a tristate (rhbz#1534585)
  - qemu: Limit refresh of CPU halted state to s390 (rhbz#1534585)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.1
changelog:
  - virDomainDeviceValidateAliasForHotplug: Use correct domain defintion (rhbz#1554928)
  - conf: Check for user aliases duplicates only (rhbz#1554962)


author: Jiri Denemark <jdenemar@redhat.com> - 2.5.0-1
changelog:
  - Rebased to libvirt-python-2.5.0 (rhbz#1382642)
  - The rebase also fixes the following bugs:
      rhbz#1377071


author: Petr Pisar <ppisar@redhat.com> - 0.9.9-10
changelog:
  - Fix CVE-2014-6051 (integer overflow in screen size handling) (bug #1157671)
  - Fix CVE-2014-6052 (NULL pointer dereference in framebuffer setup)
    (bug #1157671)
  - Fix CVE-2014-6053 (NULL pointer dereference in ClientCutText message
    handling) (bug #1157671)
  - Fix CVE-2014-6054 (server divide-by-zero in scaling factor handling)
    (bug #1157671)
  - Fix CVE-2014-6055 (server stacked-based buffer overflow in file transfer
    handling) (bug #1157671)


author: Petr Pisar <ppisar@redhat.com> - 0.9.9-11
changelog:
  - Fix a crash in the VNC server library on connecting an IPv4 client if the
    server could not start listening on an IPv6 socket (bug #1314814)


author: Jindrich Novy <jnovy@redhat.com> 1.3.2-2
changelog:
  - ship documentation only in -doc subpackage and only license
    in -devel (#540634) - thanks to Edward Sheldrake
  - -devel-doc subpackage requires -devel


author: Ville Skyttä <ville.skytta@iki.fi> - 1:1.3.3-3
changelog:
  - Run test suite during build.
  - Fix doc file permissions and duplicate doc dir ownership.
  - rpmlint warning fixes.


author: Miroslav Lichvar <mlichvar@redhat.com> 1.4-1.20140718gitbdb6a3
changelog:
  - update to 20140718gitbdb6a3 (#1108795, #1059039)
  - fix PIE linking (#1092537)
  - replace hardening build flags with _hardened_build
  - include simulation test suite


author: Miroslav Lichvar <mlichvar@redhat.com> 1.4-2.20140718gitbdb6a3
changelog:
  - add timemaster (#1085580)
  - send peer messages to correct address
  - make NTP SHM segment number configurable
  - update UDS handling to allow running multiple ptp4l/phc2sys instances
  - fix warnings from static analysis


author: Miroslav Lichvar <mlichvar@redhat.com> 1.4-3.20140718gitbdb6a3
changelog:
  - fix resetting of linreg servo (#1165045)
  - fix phc2sys automatic mode with multiple interfaces (#1108795)


author: Java SIG <java-devel@lists.fedoraproject.org> - 0:1.2.17-7
changelog:
  - Update for https://fedoraproject.org/wiki/Fedora_19_Maven_Rebuild
  - Replace maven BuildRequires with maven-local


author: Pavel Šimerda <psimerda@redhat.com> - 3:2.1.15-23
changelog:
  - Resolves: #1232749 - fix bad subject of the welcome email when creating list
    using newlist command


author: Paul Howarth <paul@city-fan.org> 2.3.9-1
changelog:
  - Update to 2.3.9
    - SECURITY: Fix possible heap buffer overwrite (CVE-2013-4365)
    - Add experimental cmake-based build system for Windows
    - Correctly parse quotation and escaped spaces in FcgidWrapper and the AAA
      Authenticator/Authorizor/Access directives' command line argument, as
      currently documented (PR#51194)
    - Honor quoted FcgidCmdOptions arguments (notably for InitialEnv
      assignments) (PR#51657)
    - Conform script response parsing with mod_cgid and ensure no response body
      is sent when ap_meets_conditions() determines that request conditions are
      met
    - Improve logging in access control hook functions
    - Avoid making internal sub-requests and processing Location headers when in
      FCGI_AUTHORIZER mode, as the auth hook functions already treat Location
      headers returned by scripts as an error since redirections are not
      meaningful in this mode
    - Revert fix for PR#53693, added in 2.3.8 but undocumented
    - Fix issues with a minor optimization added in 2.3.8


author: Luboš Uhliarik <luhliari@redhat.com> - 2.3.9-4.1
changelog:
  - Resolves: #1501307 - mod_fcgid cause Segmentation fault error while doing
    large file uploads over HTTPS


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-6
changelog:
  - Check the NSS certificate database directory for read permissions
    by the Apache user. (#1312583)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-8
changelog:
  - Fail start start when there are invalid Protocols defined (#1389114)
  - Handle group membership when testing NSS database filesystem
    permissions (#1395300)
  - Add OCSP cache tuning directives (#1392582) 
  - Don't share mod_nss NSS database with nss_pcache (#1382102)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-9
changelog:
  - Update nss_pcache.8 to drop directory and prefix options (#1382102)

  - Don't share mod_nss NSS database with nss_pcache (#1382102)


author: Thomas Woerner <twoerner@redhat.com> 2.3.4-1
changelog:
  - new version 2.3.4 with LGPL license
  - fixed some rpmlint warnings
  - new sub package for static libraries
  - added /etc/X11/mwm directory
  - removed defattrs


author: Thomas Woerner <twoerner@redhat.com> 2.3.4-2
changelog:
  - fixed requirements according to review (RHBZ#870049)
  - flex-static has been renamed to flex-devel with Fedora-18 and RHEL-7


author: Thomas Woerner <twoerner@redhat.com> - 2.3.4-8
changelog:
  - mwm: do not see outline of window when moving (RHBZ#1080548)
    Clone of RHBZ#997241
  - Fixed rendering issues seen while scrolling window (RHBZ#1134365)
    (MotifZone bug #1654)


author: Thomas Woerner <twoerner@redhat.com> - 2.3.4-9
changelog:
  - Fixed motif issue while navigating drop down menus with arrow keys
    (RHBZ#1396514) (MotifZone bug #1564)


author: Carlos Soriano <csoriano@redhat.com> - 2.3.4-10
changelog:
  - Fix last commit that is actually MotifZone#1565 and removes that patch since
    it was causing more problems. Fixes MotifZone#1576.
    Resolves: rhbz#1448509


author: Florian Müllner <fmuellner@redhat.com> - 3.24.3-11
changelog:
  - Prevent crash when removing workspace with on-all-workspaces windows
    present (like desktop icons)
  - Resolves: #1453065


author: Carlos Soriano <csoriano@redhat.com> 3.14.3-8
changelog:
  - Backport fix for jp2 images crashing nautilus
  - Apply downstream translations
    Resolves: #1271297 #1272881


author: Carlos Soriano <csoriano@redhat.com> 3.14.3-9
changelog:
  - Apply downstream translations
  - Restrict icons on desktop to the primary monitor
    Resolves: #1207646 #1046876 #1272881


author: Miroslav Lichvar <mlichvar@redhat.com> 5.9-8.20130126
changelog:
  - update to 20130126
  - clear scrollback buffer in clear (#815790)
  - make -base and -term subpackages noarch
  - make some dependencies arch-specific


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-21
changelog:
  - Fixed crash on reloading 'exec' configuration options (#1228893)
  - Fixed CVE-2014-3565, snmptrapd died when parsing certain traps (#1209361)
  - Fixed storageUseNFS functionality in hrStorageTable (#1193006)
  - Fixed forwarding of traps with RequestID=0 in snmptrapd (#1192511)
  - Fixed hrStorageTable to contain 31 bits integers (#1192221)
  - Fixed 'clientaddr' option for UDPv6 client messages (#1190679)
  - Fixed log level of SMUX messages (#1189393)
  - Fixed UDP-MIB::udpTable index on big-endian platforms (#1184433)
  - Fixed client utilities reporting 'read_config_store open failure on
    /var/lib/net-snmp/snmpapp.conf' (#1151310)
  - Fixed snmpd crash when failed to parse SMUX message headers (#1140236)
  - Added 'diskio' option to snmpd.conf, it's possible to monitor only
    selected devices in diskIOTable (#1092308)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-23
changelog:
  - Fixed parsing of invalid variables in incoming packets (#1248414)
  - Fixed HOST-RESOURCES-MIB::hrFSAccess flag when read-only filesystem
    becomes writable (#1241897)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-24
changelog:
  - Fixed lmSensorsTable not reporting sensors with duplicate names
    (#1252053)
  - Fixed close() overhead of extend commands (#1252048)
  - Fixed out-of-bounds write in python code (#1252034)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-27
changelog:
  - Allow clients to use UDPv6 addresses without 'udp6:' prefix (#1326850)
  - snmpd: Speed up ipAddressTable loading. (#1327240)
  - Fixed net-snmp segfault in netsnmp_copy_fd_set_to_large_fd_set (#1327200)
  - Fixed issue with net-snmp-perl dependency on net-snmp-devel (#1438875)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.41
changelog:
  - nfsdcltrack: silence some expected errors (bz 1443176)
  - Conditionally restart gssproxy now that config file is installed (bz 1440887)
  - systemd: NFS server services should use network-online (bz 1409012)
  - Cleaned up some fuzzy patches (bz 1409012)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.43
changelog:
  - mount: explicit v4 mounts should not roll back to v3 (bz 1447849)
  - spec: Use reload-or-try-restart to restart gssproxy (bz 1440887)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.48
changelog:
  - exportfs: fix path comparison in unexportfs_parsed() (bz 1389046)
  - Correctly set the minor version when set in nfsmount.conf (1458504)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.40
changelog:
  - gssd: ensure that preferred_realm is non-NULL (bz 1432643)
  - mountstats: handle KeyError in accumulate_iostats() (bz 1400106)
  - mount: RPC_PROGNOTREGISTERED should not be a permanent error (bz 1404121)
  - sm-notify: ending the grace period early should be configurable (bz 1424599)
  - Fixed a couple typos that effected the '--mounts' nfsstat option (bz 1425956)
  - Manual page bug: two inaccuracies in nfsd(7) (bz 1432750)


author: Daiki Ueno <dueno@redhat.com> - 3.28.4-3
changelog:
  - Reorder ChaCha20-Poly1305 cipher suites, as suggested in:
    https://bugzilla.redhat.com/show_bug.cgi?id=1373158#c9


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-2
changelog:
  - Update to NSS 3.28.3
  - Remove upstreamed patches for the previous FIPS validation
  - Package lowkeyi.h and lowkeyti.h in freebl-devel
  - Pick up a patch in the Fedora package to fix build issue


author: Bob Relyea <rrelyea@redhat.com> - 3.28.3-4
changelog:
  - include new PKCS12 NSS specific mechanisms.
  - alias CKM_TLS_KDF to CKM_TLS_MAC to preserve ABI
  - add RSA PSS oid to decrypting PKCS #5 key blobs.
  - move ec public key check from softokn to freebl so apps like Java can benefit.


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-5
changelog:
  - fix login handling for FIPS slots, patch from rhbz#1390154
  - backport upstream fix for CVE-2017-5462 (DRBG leak)


author: Martin Preisler <mpreisle@redhat.com> - 1.2.12-1
changelog:
  - Upgrade to the latest upstream release
  - improved HTML report by referencing links
  - fixed validity errors in ARF files
  - fixed CVE parsing
  - fixed injecting xccdf:check-content-ref references in ARF results
  - fixed oscap-docker incompliance reporting (#1387248)
  - fixed oscap-docker man page (#1387166)


author: Martin Preisler <mpreisle@redhat.com> - 1.2.13-1
changelog:
  - Upgrade to the latest upstream release
  - Added --thin-results CLI override to oscap xccdf eval
  - Added --without-syschar CLI override to oscap xccdf eval
  - Remediations are not filtered by applicability
  - Fixed segmentation faults in XCCDF and OVAL processing
  - Added a warning on generating an ARF from XCCDF 1.1


author: Jan Černý <jcerny@redhat.com> - 1.2.14-1
changelog:
  - Upgrade to the latest upstream release
  - Detailed information about ARF files in 'oscap info'
  - Generating remediation scripts from ARF
  - HTML report UX improvements
  - Fixed CPE dictionary to identify RHEVH as RHEL7 (#1420038)
  - Fixed systemd probes crashes inside containers (#1431186)
  - Fixed output on terminals with white background (#1365911)
  - Error handling in oscap-vm (#1391754)
  - Fixed SCE stderr stalling (#1420811)
  - Fixed absolute filepath parsing in OVAL (#1312831, #1312824)
  - Fixed segmentation faults in RPM probes (#1414303, #1414312)
  - Fixed missing header in result-oriented Ansible remediations


author: Martin Preisler <mpreisle@redhat.com> - 1.2.14-2
changelog:
  - RPM probes to return not applicable on non-rpm systems (#1447629)
  - fixed sysctl tests on s390x architecture (#1447649)
  - Revert warning by default in oscap tool, our message categories are not ready for it (#1447341)


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-2 + 0.10.3-1
changelog:
  - Fix coverity scan results
  - Adjust FIPS algorithms list (#1420910)
  - Revert problematic feature for chroot(#1418062)
  - Fix CBC weakness in released OpenSSH 7.5


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-3 + 0.10.3-1
changelog:
  - Do not completely disable SHA-1 key exchange methods in FIPS (#1324493)
  - Remove wrong coverity patches


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-5 + 0.10.3-1
changelog:
  - Fix the default key exchange proposal in FIPS mode (#1438414)
  - Remove another wrong coverity chunk to unbreak gsskex (#1438414)


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-5
changelog:
  - Keep man pages compressed
  - Bugfixes for container bundles
  - Resolves: rhbz#1410886
  - Resolves: rhbz#1432722


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-7
changelog:
  - Avoid fencing old DC if it is shutting down while another node is joining
  - Improve crmd's handling of repeated fencing failures
  - Correct behavior when guest created by bundle has a node attribute
  - Show Red Hat bugzilla URL rather than upstream when generating cluster report
  - Resolves: rhbz#1430112
  - Resolves: rhbz#1432722


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-9
changelog:
  - Allow cleanup of guest nodes when guest is unmanaged
  - Allow bundles to run on Pacemaker Remote nodes
  - Handle slow IPC clients better
  - Update crmd throttle information when CPUs are hot-plugged in
  - Order pacemaker systemd unit after resource-agents-deps target
  - Resolves: rhbz#1303742
  - Resolves: rhbz#1432722
  - Resolves: rhbz#1435067
  - Resolves: rhbz#1444728
  - Resolves: rhbz#1446669


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-10
changelog:
  - Fix issues when running bundles on Pacemaker Remote nodes
  - Reap orphaned processes when running Pacemaker Remote as pid 1
  - Order remote actions after remote connection recovery
    (fixes regression in RHEL 7.3)
  - Avoid local resource manager daemon (lrmd) crash when an
    in-flight systemd operation is cancelled
  - Resolves: rhbz#1432722
  - Resolves: rhbz#1441603
  - Resolves: rhbz#1448772
  - Resolves: rhbz#1451170


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-12.1
changelog:
  - Add cluster-ipc-limit option to avoid CIB eviction in large clusters
  - Implement ordering constraints involving bundles
  - Always re-check resource placement after quorum loss
  - Avoid stonithd crash when disabling fence device with queued actions
  - Allow re-enabled fence devices to be used
  - Resolves: rhbz#1478298
  - Resolves: rhbz#1481139
  - Resolves: rhbz#1481140
  - Resolves: rhbz#1481141
  - Resolves: rhbz#1481142


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-12.3
changelog:
  - Allow unfencing of remote nodes
  - Support clone notifications for bundle resources
  - Support colocation constraints involving bundles
  - Support container-attribute-target resource meta-attribute
  - Resolves: rhbz#1491544
  - Resolves: rhbz#1497602


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-12.5
changelog:
  - Fix multiple issues with bundle resources
  - Handle clean-ups of primitive within bundle properly
  - Resolves: rhbz#1509871
  - Resolves: rhbz#1509874


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-12.6
changelog:
  - Fix unfencing regression
  - Prevent invalid transition with bundles
  - Resolves: rhbz#1524828
  - Resolves: rhbz#1527810


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-12.8
changelog:
  - Fix pcs resource --wait timeout when bundles are used
  - Observe colocation constraints correctly with bundles in master role
  - Resolves: rhbz#1520798
  - Resolves: rhbz#1537557


author: Ivan Devat <idevat@redhat.com> - 0.9.157-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1362493 rhbz#1315627 rhbz#1378742 rhbz#1334429 rhbz#1402374 rhbz#1389941 rhbz#1303969 rhbz#1415080 rhbz#1328882 rhbz#1434972 rhbz#1413958


author: Ivan Devat <idevat@redhat.com> - 0.9.158-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1447702 rhbz#1176018 rhbz#1433016 rhbz#1303969 rhbz#1386114 rhbz#1386512 rhbz#1390609 rhbz#1165821 rhbz#1315992 rhbz#1373614 rhbz#1422667 rhbz#1254984


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.158-2
changelog:
  - Fixed crash of the `pcs cluster setup` command when the `--force` flag was used
  - Fixed crash of the `pcs cluster destroy --all` command when the cluster was not running
  - Fixed crash of the `pcs config restore` command when restoring pacemaker authkey
  - Fixed "Error: unable to get cib" when adding a node to a stopped cluster
  - Resolves: rhbz#1176018


author: Ivan Devat <idevat@redhat.com> - 0.9.158-3
changelog:
  - Added option to create not hardened cluster with the `pcs cluster setup` command using the `--no-hardened` flag
  - Added option to create not hardened cluster from web UI
  - Fixed a crash in the `pcs cluster node add-remote` command when an id conflict occurs
  - Fixed creating a new cluster from the web UI
  - `pcs cluster node add-guest` now works with the flag `--skipp-offline`
  - `pcs cluster node remove-guest` can be run again when the guest node was unreachable first time
  - Fixed "Error: Unable to read /etc/corosync/corosync.conf" when running `pcs resource create`([rhbz#1386114])
  - Binary data are stored in corosync authkey
  - Resolves: rhbz#1284404 rhbz#1373614 rhbz#1165821 rhbz#1176018 rhbz#1386114


author: Ivan Devat <idevat@redhat.com> - 0.9.158-4
changelog:
  - Added support for enable and disable in bundles
  - New clusters are created with corosync encryption disabled by default
  - Flag `--master` is backward compatible in `pcs resource create`
  - Resolves: rhbz#1165821 rhbz#1433016 rhbz#1458153


author: Ivan Devat <idevat@redhat.com> - 0.9.158-5
changelog:
  - `pcs cluster setup` uses existing pacemaker authkey if it exists
  - `pcs resource create` shows only warning when case of remote node is detected
  - Resolves: rhbz#1459503


author: Ivan Devat <idevat@redhat.com> - 0.9.158-6
changelog:
  - It is now possible to disable, enable, unmanage and manage bundle resources and set their meta attributes
  - Fixed timeout when cluster setup takes long time in web UI
  - It is now mandatory to specify container type in the "resource bundle create" command
  - Resolves: rhbz#1447910 rhbz#1284404


author: Ivan Devat <idevat@redhat.com> - 0.9.158-6.el7_4.1
changelog:
  - `resurce update` no longer exits with an error when the `remote-node` meta attribute is set to the same value that it already has
  - Resolves: rhbz#1507399


author: Ivan Devat <idevat@redhat.com> - 0.9.160-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1499749 rhbz#1443647 rhbz#1432283 rhbz#1421702 rhbz#1443418 rhbz#1464781 rhbz#1435697 rhbz#1441673 rhbz#1420437 rhbz#1388783 rhbz#1463327 rhbz#1418199 rhbz#1341582 rhbz#1489682 rhbz#1491631 rhbz#1213946


author: Ivan Devat <idevat@redhat.com> - 0.9.161-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1499749 rhbz#1415197 rhbz#1501274 rhbz#1502715 rhbz#1230919 rhbz#1503110


author: Ondrej Mular <omular@redhat.com> - 0.9.162-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1389943 rhbz#1389209 rhbz#1506220 rhbz#1508351 rhbz#1415197 rhbz#1506864 rhbz#1367808 rhbz#1499749


author: Ivan Devat <idevat@redhat.com> - 0.9.162-2
changelog:
  - Changed snmp agent logfile path
  - It is now possible to set the `action` option of stonith devices in GUI by using force
  - Do not crash when `--wait` is used in `pcs stonith create`
  - A warning is displayed in `pcs status` and a stonith device detail in web UI  when a stonith device has its `method` option set to `cycle`
  - Resolves: rhbz#1367808 rhbz#1421702 rhbz#1522813 rhbz#1523378


author: Ivan Devat <idevat@redhat.com> - 0.9.162-3
changelog:
  - Pcs now properly exits with code 1 when an error occurs in pcs cluster node add-remote and pcs cluster node add-guest commands
  - Fixed a crash in the pcs booth sync command
  - Resolves: rhbz#1464781 rhbz#1527530


author: Ondrej Mular <omular@redhat.com> - 0.9.162-5
changelog:
  - Fixed `pcs cluster auth` in a cluster when not authenticated and using a non-default port
  - Fixed `pcs cluster auth` in a cluster when previously authenticated using a non-default port and reauthenticating using an implicit default port
  - Resolves: rhbz#1415197


author: Ondrej Mular <omular@redhat.com> - 0.9.162-5.el7_5.1
changelog:
  - Fixed CVE-2018-1086 pcs: Debug parameter removal bypass, allowing information disclosure
  - Fixed CVE-2018-1079 pcs: Privilege escalation via authorized user malicious REST call
  - Fixed CVE-2018-1000119 rack-protection: Timing attack in authenticity_token.rb
  - Resolves: rhbz#1557253


author: Remi Collet <rcollet@redhat.com> - 5.4.16-35
changelog:
  - core: fix multipart/form-data request can use excessive
    amount of CPU usage CVE-2015-4024
  - fix various functions accept paths with NUL character
    CVE-2015-4025, CVE-2015-4026, #1213407
  - fileinfo: fix denial of service when processing a crafted
    file #1213442
  - ftp: fix integer overflow leading to heap overflow when
    reading FTP file listing CVE-2015-4022
  - phar: fix buffer over-read in metadata parsing CVE-2015-2783
  - phar: invalid pointer free() in phar_tar_process_metadata()
    CVE-2015-3307
  - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
  - phar: fix memory corruption in phar_parse_tarfile caused by
    empty entry file name CVE-2015-4021
  - soap: fix type confusion through unserialize #1222538
  - apache2handler: fix pipelined request executed in deinitialized
    interpreter under httpd 2.4 CVE-2015-3330


author: Remi Collet <rcollet@redhat.com> - 5.4.16-38
changelog:
  - curl: add options to enable TLS #1291667
  - mysqli: fix segfault in mysqli_stmt::bind_result() when
    link is closed #1096800
  - fpm: fix incorrectly defined SCRIPT_NAME variable when
    using Apache #1138563
  - core: fix segfault when a zend_extension is loaded twice #1289457
  - openssl: change default_md algo from MD5 to SHA1 #1073388
  - wddx: fix segfault in php_wddx_serialize_var #1131979


author: Remi Collet <rcollet@redhat.com> - 5.4.16-41
changelog:
  - gd: fix integer overflow in _gd2GetHeader() resulting in
    heap overflow CVE-2016-5766
  - gd: fix integer overflow in gdImagePaletteToTrueColor()
    resulting in heap overflow CVE-2016-5767
  - mbstring: fix double free in _php_mb_regex_ereg_replace_exec
    CVE-2016-5768


author: Remi Collet <rcollet@redhat.com> - 5.4.16-43
changelog:
  - gd: fix DoS vulnerability in gdImageCreateFromGd2Ctx() CVE-2016-10167
  - gd: Signed Integer Overflow gd_io.c CVE-2016-10168


author: Remi Collet <rcollet@redhat.com> - 5.4.16-34
changelog:
  - fix memory corruption in fileinfo module on big endian
    machines #1082624
  - fix segfault in pdo_odbc on x86_64 #1159892
  - fix segfault in gmp allocator #1154760


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-1
changelog:
  - Require "nss >= 3.28.3" as a build and runtime requirement
  - Require "jss >= 4.4.0-4" as a build and runtime requirement
  - Require "tomcatjss >= 7.2.1-3" as a build and runtime requirement
  - dogtagpki Pagure Issue #2612 - Unable to clone due to pki pkcs12-cert-find
    failure (edewata)
  - ############################################################################
  - Bugzilla Bug #1394309 - Rebase pki-core to 10.4.x in RHEL-7.4
  - Bugzilla Bug #1394315 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.4.x
  - ############################################################################
  - RHEL 7.4:
  - ############################################################################
  - ############################################################################
  - RHCS 9.2:
  - ############################################################################
  - ############################################################################
  - Common Criteria
  - ############################################################################
  - Bugzilla Bug #1419734 - CC: CMC: id-cmc-identityProofV2 feature
    implementation (cfu)
  - Bugzilla Bug #1419742 - CC: CMC: provide Proof of Possession for encryption
    cert requests (cfu)
  - Bugzilla Bug #1404080 - CC: add audit event: various SSL/TLS failures
    (edewata)
  - Bugzilla Bug #1428020 - CC: CMC feature support: provided issuance
    protection cert mechanism (cfu)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-2
changelog:
  - ############################################################################
  - RHEL 7.4:
  - ############################################################################
  - Bugzilla Bug #1282504 - Installing pki-server in container reports
    scriptlet failed, exit status 1 (jpazdziora)
  - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS
    enabled system (edewata)
  - Bugzilla Bug #1410650 - [RFE] Add SCP03 support
    for sc 7 g & d cards (RHEL) (jmagne)
  - Bugzilla Bug #1437591 - cli authentication using expired cert throws an
    exception (edewata)
  - Bugzilla Bug #1437602 - non-CA cli looks for CA in the instance during a
    request (edewata)
  - ############################################################################
  - RHCS 9.2:
  - ############################################################################
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support
    for sc 7 g & d cards (RHCS) (jmagne)
  - ############################################################################
  - Common Criteria
  - ############################################################################
  - Bugzilla Bug #1404080 - CC: add audit event: various SSL/TLS failures
    (edewata)
  - Bugzilla Bug #1417307 - CC: Audit Review /Searches (edewata)
  - Bugzilla Bug #1419737 - CC: CMC: id-cmc-popLinkWitnessV2 feature
    implementation (cfu)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-3
changelog:
  - ############################################################################
  - RHEL 7.4:
  - ############################################################################
  - Bugzilla Bug #1303683 - dogtag should support GSSAPI based auth in
    conjuction with FreeIPA (ftweedal)
  - Bugzilla Bug #1385208 - RHCS 9.1 RC5 CA in the certificate profiles the
    startTime parameter is not working as expected. (jmagne)
  - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC non-signing
    certificate requests (cfu)
  - Bugzilla Bug #1426754 - PKCS12: upgrade to at least AES and SHA2 (ftweedal)
  - Bugzilla Bug #1445088 - profile modification cannot remove existing config
    parameters (ftweedal)
  - Bugzilla Bug #1445535 - CC: Crypto Operation (AES Encryption/Decryption)
    (RHEL) (alee)
  - Bugzilla Bug #1446874 - Missing ClientIP and ServerIP in audit log when
    pki CLI terminates SSL connection (edewata)
  - Bugzilla Bug #1446875 - Session timeout for PKI console (RHEL) (edewata)
  - ############################################################################
  - RHCS 9.2:
  - ############################################################################
  - Bugzilla Bug #1404480 - CC: Crypto Operation (AES Encryption/Decryption)
    (RHCS) (alee)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-4
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1386303 - cannot extract generated private key from KRA when
    HSM is used. (alee)
  - Bugzilla Bug #1446364 - pkispawn returns before tomcat is ready (cheimes)
  - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false would cause
    error (cfu)
  - Bugzilla Bug #1448203 - CAInfoService: retrieve KRA-related values from
    the KRA (ftweedal)
  - Bugzilla Bug #1448204 - pkispawn of clone install fails with
    InvalidBERException (ftweedal)
  - Bugzilla Bug #1448521 - kra unable to extract symmetric keys generated on
    thales hsm (alee)
  - Updated "jss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - RHCS 9.2:
  - ##########################################################################
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-5
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1419761 - CC: allow CA to process pre-signed CMC renewal
    non-signing cert requests (cfu)
  - Bugzilla Bug #1447080 - CC: CMC: allow enrollment key signed (self-signed)
    CMC with identity proof (cfu)
  - Bugzilla Bug #1447144 - CA brought down during separate KRA instance
    creation (mharmsen)
  - Bugzilla Bug #1448903 - exception Invalid module "--ignore-banner" when
    defined in ~/.dogtag/pki.conf and run pki pkcs12-import --help (edewata)
  - Bugzilla Bug #1450143 - CA installation with HSM in FIPS mode fails (jmagne)
  - Bugzilla Bug #1452123 - CA CS.cfg shows default port (mharmsen)
  - Bugzilla Bug #1452250 - Inconsistent CERT_REQUEST_PROCESSED event in
    ConnectorServlet. (edewata)
  - Bugzilla Bug #1452340 - Ensuring common audit log correctness (edewata)
  - Bugzilla Bug #1452344 - Adding serial number into CERT_REQUEST_PROCESSED
    audit event. (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-7
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret)
    using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne)
  - Bugzilla Bug #1445519 - CA Server installation with HSM fails
    (jmagne)
  - Bugzilla Bug #1452617 - Unable to create IPA Sub CA
    (ftweedal)
  - Bugzilla Bug #1454471 - Enabling all subsystems on startup
    (edewata)
  - Bugzilla Bug #1455617 - Key recovery on token fails because
    key record is not marked encrypted (alee)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-8
changelog:
  - Require "selinux-policy-targeted >= 3.13.1-159" as a runtime requirement
  - Require "tomcatjss >= 7.2.1-4" as a build and runtime requirement
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS
    enabled system (edewata)
  - Bugzilla Bug #1447144 - CA brought down during separate KRA instance
    creation (edewata)
  - Bugzilla Bug #1447762 - pkispawn fails occasionally with this failure
    ACCESS_SESSION_ESTABLISH_FAILURE (edewata)
  - Bugzilla Bug #1454450 - SubCA installation failure with 2 step
    installation in fips enabled mode (edewata)
  - Bugzilla Bug #1456597 - Certificate import using pki client-cert-import
    is asking for password when already provided (edewata)
  - Bugzilla Bug #1456940 - Build failure due to Pylint issues (cheimes)
  - Bugzilla Bug #1458043 - Key recovery using externalReg fails
    with java null pointer exception on KRA (alee)
  - Bugzilla Bug #1458379 - Upgrade script for keepAliveTimeout parameter
    (edewata)
  - Bugzilla Bug #1458429 - client-cert-import --ca-cert should
    import CA cert with trust bits "CT,C,C" (edewata)
  - ##########################################################################
  - RHCS 9.2:
  - ##########################################################################
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-9
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret)
    using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne)
  - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC
    non-signing certificate requests (cfu)
  - Bugzilla Bug #1419777 - CC: allow CA to process pre-signed CMC
     revocation non-signing cert requests (cfu)
  - Bugzilla Bug #1458047 - change the way aes clients refer to
    aes keysets (alee)
  - Bugzilla Bug #1458055 - dont reuse IVs in the CMC code
    (alee)
  - Bugzilla Bug #1460028 - In keywrap mode, key recovery on
    KRA with HSM causes KRA to crash (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-10
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1458043 - Key recovery on token fails with
    invalid public key error on KRA (alee)
  - Bugzilla Bug #1460764 - CC: CMC: check HTTPS client
    authentication cert against CMC signer (cfu)
  - Bugzilla Bug #1461533 - Unable to find keys in the p12 file after
    deleting the any of the subsystem certs from it (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-11
changelog:
  - Resolves: rhbz #1469432
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1469432 - CMC plugin default change
  - Resolves CVE-2017-7537
  - Fixes BZ #1470948


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-12
changelog:
  - Resolves: rhbz #1472615,1472617,1469447,1463350,1469449,1472619,1464970,1469437,1469439,1469446
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1472615 - CC: allow CA to process pre-signed CMC non-signing
    certificate requests (cfu)
    [PREVIOUS PATCH:  pki-core-beta.patch]
    [PREVIOUS PATCH:  pki-core-snapshot-4.patch]
  - Bugzilla Bug #1472617 - CMC: cmc.popLinkWitnessRequired=false would cause
    error (cfu)
    [PREVIOUS PATCH:  pki-core-post-beta.patch]
  - Bugzilla Bug #1469447 - CC: CMC: check HTTPS client authentication cert
    against CMC signer (cfu)
    [PREVIOUS PATCH:  pki-core-CMC-check-HTTPS-client-authentication-cert.patch]
  - Bugzilla Bug #1463350 - Access banner validation (edewata)
    [pki-core-server-access-banner-validation.patch]
  - Bugzilla Bug #1469449 - CC: allow CA to process pre-signed CMC renewal
    non-signing cert requests (cfu)
    [PREVIOUS PATCH:  pki-core-snapshot-1.patch]
    [pki-core-pre-signed-CMC-renewal-UniqueKeyConstraint.patch]
  - Bugzilla Bug #1472619 - Platform Dependent Python Import (mharmsen)
    [pki-core-platform-dependent-python-import.patch]
  - Bugzilla Bug #1464970 - CC: CMC: replace id-cmc-statusInfo with
    id-cmc-statusInfoV2 (cfu)
    [pki-core-CMC-id-cmc-statusInfoV2.patch]
  - Bugzilla Bug #1469437 - subsystem-cert-update command lacks --cert option
    (dmoluguw)
    [pki-core-subsystem-cert-update-CLI-cert-option.patch]
  - Bugzilla Bug #1469439 - Fix Key Changeover with HSM to support SCP03
    (jmagne)
    [pki-core-HSM-key-changeover-SCP03-support.patch]
  - Bugzilla Bug #1469446 - CC: need CMC enrollment profiles for system
    certificates (cfu)
    [pki-core-system-cert-CMC-enroll-profile.patch]


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-13
changelog:
  - Resolves: rhbz #1463350
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1463350 - Access banner validation (edewata)
    [pki-core-server-access-banner-retrieval-validation.patch]


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-14
changelog:
  - Require "jss >= 4.4.0-8" as a build and runtime requirement
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Resolves: rhbz #1486870,1485833,1487509,1490241,1491332
  - Bugzilla Bug #1486870 - Lightweight CA key replication fails (regressions)
    [RHEL 7.4.z] (ftweedal)
  - Bugzilla Bug #1485833 - Missing CN in user signing cert would cause error
    in cmc user-signed [rhel-7.4.z] (cfu)
  - Bugzilla Bug #1487509 - pki-server-upgrade fails when upgrading from
    RHEL 7.1 [rhel-7.4.z] (ftweedal)
  - Bugzilla Bug #1490241 - PKCS12: upgrade to at least AES and SHA2 (FIPS)
    [rhel-7.4.z] (ftweedal)
  - Bugzilla Bug #1491332 - TPS UI: need to display tokenType and tokenOrigin
    for token certificates on TPS UI Server [rhel-7.4.z] (edewata)
  - dogtagpki Pagure Issue #2764 - py3: pki.key.archive_encrypted_data:
    TypeError: ... is not JSON serializable (ftweedal)
  - ##########################################################################
  - RHCS 9.2:
  - ##########################################################################
  - Resolves: rhbz #1486870,1485833,1487509,1490241,1491332,1482729,1462271
  - Bugzilla Bug #1462271 - TPS incorrectly assigns "tokenOrigin" and
    "tokenType" certificate attribute for recovered certificates. (cfu)
  - Bugzilla Bug #1482729 - TPS UI: need to display tokenType and tokenOrigin
    for token certificates on TPS UI (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-16
changelog:
  - ###########################################################################
  - ## RHCS 9.2
  - ###########################################################################
  - #Bugzilla Bug #1439228 - externalRegRecover does not support multiple
    - #Bugzilla Bug #1507160 - TPS new configuration to allow the protocol of
    - #Bugzilla Bug #1471996 - Certificate Revocation Reasons not being updated
    - ###########################################################################
  - ## RHEL 7.4
  - ###########################################################################
  - Bugzilla Bug #1500499 - Certificate Revocation Reasons not being updated
    in some cases [rhel-7.4.z] (cfu)
  - Bugzilla Bug #1502527 - CA cert without Subject Key Identifier causes
    issuance failure [rhel-7.4.z] (ftweedal)
  - Bugzilla Bug #1492560 - ipa-replica-install --setup-kra broken on DL0
    [rhel-7.4.z] (ftweedal)
    NOTE: Check-ins for #1492560 all reference the dogtagpki Pagure Issue
          associated with Bugzilla Bug #1402280 - CA Cloning: Failed to
          update number range in few cases (which is not yet fully resolved)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-17
changelog:
  - ###########################################################################
  - ## RHCS 9.2
  - ###########################################################################
  - #Bugzilla Bug #1507160 - TPS new configuration to allow the protocol of


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.12-1
changelog:
  - update to 9.2.12 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-12.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.13-1
changelog:
  - update to 9.2.13 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-13.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.14-1
changelog:
  - update to 9.2.14 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-14.html


author: Pavel Kajaba <pkajaba@redhat.com> - 9.2.15-1
changelog:
  - update to 9.2.15 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-15.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.18-1
changelog:
  - update to 9.2.18 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-18.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-17.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-16.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.21-1
changelog:
  - update to 9.2.21 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-21.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-20.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-19.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.22-1
changelog:
  - update to 9.2.22 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-22.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.23-1
changelog:
  - update to 9.2.23 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-23.html


author: Christian Heimes <cheimes@redhat.com> - 1.7.2-1
changelog:
  - Update to 1.7.2
  - Disable pytest.deprecated_call() tests
  - Remove versioned pytest
  - Add build requirements pytz


author: Christian Heimes <cheimes@redhat.com> - 1.7.2-1.1
changelog:
  - Ignore errors on OpenSSL's error stack when initializing, fixes RHBZ#1485896
  - Fix parsing of long OIDs, fixes RHBZ#1485898


author: Alex Wood <awood@redhat.com> 1.19.1-1
changelog:
  - Adjust our C bindings for OpenSSL v1.1 API. (awood@redhat.com)
  - Make python-rhsm Python-3 compatible (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.2-1
changelog:
  - 1423443: Handle IndexError during m2crypto request (khowell@redhat.com)
  - Move python-rhsm into subdirectory (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.3-1
changelog:
  - 1435475: Support older versions of M2Crypto (awood@redhat.com)
  - 1427069: Prioritize content from Basic entitlements (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.4-1
changelog:
  - 1438552: Allows releases to be listed through a proxy (csnyder@redhat.com)
  - 1420533: Add no_proxy option to API, config, UI (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.6-1
changelog:
  - 1426343: fixed rct to display cert without subjectAltName.
    (jhnidek@redhat.com)
  - Add Update subscriptions pools (tcoufal@redhat.com)
  - Add support to list future subscription pools (tcoufal@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.7-1
changelog:
  - 1443159: Added default value for splay configuration (jhnidek@redhat.com)
  - 1451166: Fix Host header when using proxy (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.9-1
changelog:
  - 1444453: Have gettext return unicode instead of bytes. (awood@redhat.com)
  - 1457197: Env. variable no_proxy=* is not ignored (jhnidek@redhat.com)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-133.el7
changelog:
  - kvm-target-i386-add-Ivy-Bridge-CPU-model.patch [bz#1368375]
  - kvm-x86-add-AVX512_4VNNIW-and-AVX512_4FMAPS-features.patch [bz#1382122]
  - kvm-target-i386-kvm_cpu_fill_host-Kill-unused-code.patch [bz#1382122]
  - kvm-target-i386-kvm_cpu_fill_host-No-need-to-check-level.patch [bz#1382122]
  - kvm-target-i386-kvm_cpu_fill_host-No-need-to-check-CPU-v.patch [bz#1382122]
  - kvm-target-i386-kvm_cpu_fill_host-No-need-to-check-xleve.patch [bz#1382122]
  - kvm-target-i386-kvm_cpu_fill_host-Set-all-feature-words-.patch [bz#1382122]
  - kvm-target-i386-kvm_cpu_fill_host-Fill-feature-words-in-.patch [bz#1382122]
  - kvm-target-i386-kvm_check_features_against_host-Kill-fea.patch [bz#1382122]
  - kvm-target-i386-Make-TCG-feature-filtering-more-readable.patch [bz#1382122]
  - kvm-target-i386-Filter-FEAT_7_0_EBX-TCG-features-too.patch [bz#1382122]
  - kvm-target-i386-Filter-KVM-and-0xC0000001-features-on-TC.patch [bz#1382122]
  - kvm-target-i386-Define-TCG_-_FEATURES-earlier-in-cpu.c.patch [bz#1382122]
  - kvm-target-i386-Loop-based-copying-and-setting-unsetting.patch [bz#1382122]
  - kvm-target-i386-Loop-based-feature-word-filtering-in-TCG.patch [bz#1382122]
  - kvm-spice-remove-spice-experimental.h-include.patch [bz#1430606]
  - kvm-spice-replace-use-of-deprecated-API.patch [bz#1430606]
  - Resolves: bz#1368375
    ([Intel 7.4 Bug] qemu-kvm does not support “-cpu IvyBridge”)
  - Resolves: bz#1382122
    ([Intel 7.4 FEAT] KVM Enable the avx512_4vnniw, avx512_4fmaps instructions in qemu)
  - Resolves: bz#1430606
    (Can't build qemu-kvm with newer spice packages)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-134.el7
changelog:
  - kvm-ui-vnc-introduce-VNC_DIRTY_PIXELS_PER_BIT-macro.patch [bz#1377977]
  - kvm-ui-vnc-derive-cmp_bytes-from-VNC_DIRTY_PIXELS_PER_BI.patch [bz#1377977]
  - kvm-ui-vnc-optimize-dirty-bitmap-tracking.patch [bz#1377977]
  - kvm-ui-vnc-optimize-setting-in-vnc_dpy_update.patch [bz#1377977]
  - kvm-ui-vnc-fix-vmware-VGA-incompatiblities.patch [bz#1377977]
  - kvm-ui-vnc-fix-potential-memory-corruption-issues.patch [bz#1377977]
  - kvm-vnc-fix-memory-corruption-CVE-2015-5225.patch [bz#1377977]
  - kvm-vnc-fix-overflow-in-vnc_update_stats.patch [bz#1377977]
  - kvm-i386-kvmvapic-initialise-imm32-variable.patch [bz#1335751]
  - kvm-qemu-iotests-Filter-out-actual-image-size-in-067.patch [bz#1427176]
  - vm-qcow2-Don-t-rely-on-free_cluster_index-in-alloc_ref2.patch [bz#1427176]
  - kvm-qemu-iotests-Fix-core-dump-suppression-in-test-039.patch [bz#1427176]
  - kvm-qemu-io-Add-sigraise-command.patch [bz#1427176]
  - kvm-iotests-Filter-for-Killed-in-qemu-io-output.patch [bz#1427176]
  - kvm-iotests-Fix-test-039.patch [bz#1427176]
  - kvm-blkdebug-Add-bdrv_truncate.patch [bz#1427176]
  - kvm-vhdx-Fix-zero-fill-iov-length.patch [bz#1427176]
  - kvm-qemu-iotests-Disable-030-040-041.patch [bz#1427176]
  - kvm-x86-add-AVX512_VPOPCNTDQ-features.patch [bz#1415830]
  - kvm-usb-ccid-check-ccid-apdu-length.patch [bz#1419818]
  - kvm-usb-ccid-better-bulk_out-error-handling.patch [bz#1419818]
  - kvm-usb-ccid-move-header-size-check.patch [bz#1419818]
  - kvm-usb-ccid-add-check-message-size-checks.patch [bz#1419818]
  - kvm-spec-Update-rdma-build-dependency.patch [bz#1433920]
  - Resolves: bz#1335751
    (CVE-2016-4020 qemu-kvm: Qemu: i386: leakage of stack memory to guest in kvmvapic.c [rhel-7.4])
  - Resolves: bz#1377977
    (qemu-kvm coredump in vnc_raw_send_framebuffer_update [rhel-7.4])
  - Resolves: bz#1415830
    ([Intel 7.4 FEAT] Enable vpopcntdq for KNM - qemu/kvm)
  - Resolves: bz#1419818
    (CVE-2017-5898 qemu-kvm: Qemu: usb: integer overflow in emulated_apdu_from_guest [rhel-7.4])
  - Resolves: bz#1427176
    (test cases of qemu-iotests failed)
  - Resolves: bz#1433920
    (Switch from librdmacm-devel to rdma-core-devel)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-135.el7
changelog:
  - kvm-fix-cirrus_vga-fix-OOB-read-case-qemu-Segmentation-f.patch [bz#1430060]
  - kvm-cirrus-vnc-zap-bitblit-support-from-console-code.patch [bz#1430060]
  - kvm-cirrus-add-option-to-disable-blitter.patch [bz#1430060]
  - kvm-cirrus-fix-cirrus_invalidate_region.patch [bz#1430060]
  - kvm-cirrus-stop-passing-around-dst-pointers-in-the-blitt.patch [bz#1430060]
  - kvm-cirrus-stop-passing-around-src-pointers-in-the-blitt.patch [bz#1430060]
  - kvm-cirrus-fix-off-by-one-in-cirrus_bitblt_rop_bkwd_tran.patch [bz#1430060]
  - Resolves: bz#1430060
    (CVE-2016-9603 qemu-kvm: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-7.4])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-136.el7
changelog:
  - kvm-target-i386-get-set-migrate-XSAVES-state.patch [bz#1327593]
  - kvm-Removing-texi2html-from-build-requirements.patch [bz#1440987]
  - kvm-Disable-build-of-32bit-packages.patch [bz#1441778]
  - kvm-Add-sample-images-to-srpm.patch [bz#1436280]
  - Resolves: bz#1327593
    ([Intel 7.4 FEAT] KVM Enable the XSAVEC, XSAVES and XRSTORS instructions)
  - Resolves: bz#1436280
    (sample images  for qemu-iotests are missing in the SRPM)
  - Resolves: bz#1440987
    (Remove texi2html build dependancy from RPM)
  - Resolves: bz#1441778
    (Stop building qemu-img for 32bit architectures.)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-137.el7
changelog:
  - kvm-ide-fix-halted-IO-segfault-at-reset.patch [bz#1299875]
  - Resolves: bz#1299875
    (system_reset should clear pending request for error (IDE))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-138.el7
changelog:
  - kvm-char-serial-cosmetic-fixes.patch [bz#1451470]
  - kvm-char-serial-Use-generic-Fifo8.patch [bz#1451470]
  - kvm-char-serial-serial_ioport_write-Factor-out-common-co.patch [bz#1451470]
  - kvm-char-serial-fix-copy-paste-error-fifo8_is_full-vs-em.patch [bz#1451470]
  - kvm-char-serial-Fix-emptyness-check.patch [bz#1451470]
  - kvm-char-serial-Fix-emptyness-handling.patch [bz#1451470]
  - kvm-serial-poll-the-serial-console-with-G_IO_HUP.patch [bz#1451470]
  - kvm-serial-change-retry-logic-to-avoid-concurrency.patch [bz#1451470]
  - kvm-qemu-char-ignore-flow-control-if-a-PTY-s-slave-is-no.patch [bz#1451470]
  - kvm-serial-check-if-backed-by-a-physical-serial-port-at-.patch [bz#1451470]
  - kvm-serial-reset-thri_pending-on-IER-writes-with-THRI-0.patch [bz#1451470]
  - kvm-serial-clean-up-THRE-TEMT-handling.patch [bz#1451470]
  - kvm-serial-update-LSR-on-enabling-disabling-FIFOs.patch [bz#1451470]
  - kvm-serial-only-resample-THR-interrupt-on-rising-edge-of.patch [bz#1451470]
  - kvm-serial-make-tsr_retry-unsigned.patch [bz#1451470]
  - kvm-serial-simplify-tsr_retry-reset.patch [bz#1451470]
  - kvm-serial-separate-serial_xmit-and-serial_watch_cb.patch [bz#1451470]
  - kvm-serial-remove-watch-on-reset.patch [bz#1451470]
  - Resolves: bz#1451470
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-139.el7
changelog:
  - kvm-char-change-qemu_chr_fe_add_watch-to-return-unsigned.patch [bz#1451470]
  - Resolves: bz#1451470
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-140.el7
changelog:
  - kvm-spice-fix-spice_chr_add_watch-pre-condition.patch [bz#1456983]
  - Resolves: bz#1456983
    (Character device regression due to missing patch)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7
changelog:
  - kvm-Fix-memory-slot-page-alignment-logic-bug-1455745.patch [bz#1455745]
  - kvm-Do-not-hang-on-full-PTY.patch [bz#1452067]
  - kvm-serial-fixing-vmstate-for-save-restore.patch [bz#1452067]
  - kvm-serial-reinstate-watch-after-migration.patch [bz#1452067]
  - kvm-nbd-Fully-initialize-client-in-case-of-failed-negoti.patch [bz#1451614]
  - kvm-nbd-Fix-regression-on-resiliency-to-port-scan.patch [bz#1451614]
  - Resolves: bz#1451614
    (CVE-2017-9524 qemu-kvm: segment fault when private user nmap qemu-nbd server [rhel-7.4])
  - Resolves: bz#1452067
    (migration can confuse serial port user)
  - Resolves: bz#1455745
    (Backport fix for broken logic that's supposed to ensure memory slots are page aligned)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.1
changelog:
  - kvm-qemu-nbd-Ignore-SIGPIPE.patch [bz#1468107]
  - Resolves: bz#1468107
    (CVE-2017-10664 qemu-kvm: Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.2
changelog:
  - kvm-virtio-net-dynamic-network-offloads-configuration.patch [bz#1482468]
  - kvm-Workaround-rhel6-ctrl_guest_offloads-machine-type-mi.patch [bz#1482468]
  - Resolves: bz#1482468
    (KVM: windows guest migration from EL6 to EL7 fails. [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.3
changelog:
  - kvm-bswap.h-Remove-cpu_to_32wu.patch [bz#1501294]
  - kvm-hw-use-ld_p-st_p-instead-of-ld_raw-st_raw.patch [bz#1501294]
  - kvm-vga-Start-cutting-out-non-32bpp-conversion-support.patch [bz#1501294]
  - kvm-vga-Remove-remainder-of-old-conversion-cruft.patch [bz#1501294]
  - kvm-vga-Separate-LE-and-BE-conversion-functions.patch [bz#1501294]
  - kvm-vga-Rename-vga_template.h-to-vga-helpers.h.patch [bz#1501294]
  - kvm-vga-stop-passing-pointers-to-vga_draw_line-functions.patch [bz#1501294]
  - kvm-vga-drop-line_offset-variable.patch [bz#1501294]
  - kvm-vga-Add-mechanism-to-force-the-use-of-a-shadow-surfa.patch [bz#1501294]
  - kvm-vga-handle-cirrus-vbe-mode-wraparounds.patch [bz#1501294]
  - kvm-cirrus-fix-oob-access-in-mode4and5-write-functions.patch [bz#1501294]
  - Resolves: bz#1501294
    (CVE-2017-15289 qemu-kvm: Qemu: cirrus: OOB access issue in  mode4and5 write functions [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.4
changelog:
  - kvm-multiboot-validate-multiboot-header-address-values.patch [bz#1501120]
  - Resolves: bz#1501120
    (CVE-2017-14167 qemu-kvm: Qemu: i386: multiboot OOB access while loading kernel image [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.5
changelog:
  - kvm-vfio-pci-Only-mmap-TARGET_PAGE_SIZE-regions.patch [bz#1515110]
  - Resolves: bz#1515110
    (Regression in QEMU handling for sub-page MMIO BARs for vfio-pci devices [rhel-7.4.z])


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.1-7
changelog:
  - quagga is service which might implement networking, thus it should not have
    WantedBy=network.target in its systemd configuration
  - resolves: #976883


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.3-1
changelog:
  - update to 0.99.22.3
  - disable ospfapi and ospfclient
  - fix bogus dates in changelog
  - resolves : #984532


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.4-4
changelog:
  - fix link to upstream tarball (#1059219)
  - reference pidfiles of quagga daemons in service files (#842309)


author: Ondřej Lysoněk <olysonek@redhat.com> - 0.99.22.4-5
changelog:
  - Fixed CVE-2018-5379 - Double free vulnerability in bgpd when processing
    certain forms of UPDATE message allowing to crash or potentially execute
    arbitrary code
  - Resolves: rhbz#1546015


author: Petr Hracek <phracek@redhat.com> - 1.17.2-2
changelog:
  - rear does not require syslinux
  - changing to arch package so that syslinux is installed
  - Resolves: #1283927


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-4
changelog:
  - cd to the correct directory before md5sum to fix BACKUP_INTEGRITY_CHECK.
    Upstream PR#1685, bz1532676


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-5
changelog:
  - Ensure that NetBackup is started automatically upon recovery (PR#1544)
    Also do not kill daemons spawned by sysinit.service at the service's end
    (PR#1610, applies to NetBackup and also to dhclient)
    Resolves #1506231


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-105.6
changelog:
  - ocf_attribute_target: add fallback for Pacemaker versions without
    bundle support

    Resolves: rhbz#1524454


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-102
changelog:
  - LVM: update metadata on start/relocate
  - LVM: warn when cache mode is not writethrough

    Resolves: rhbz#1451933


author: Milan Zazrivec <mzazrivec@redhat.com> 5.0.9-1
changelog:
  - Update .po and .pot files for rhnsd.
  - New translations from Transifex for rhnsd.
  - Download translations from Transifex for rhnsd.


author: Michael Mraka <michael.mraka@redhat.com> 5.0.10-1
changelog:
  - let rhnsd.service be enabled after installation
  - Purging %changelog entries preceding Spacewalk 1.0, in active packages.


author: Grant Gainey 5.0.13-5
changelog:
  - Bump release to get past weirdness in brew-tags (ggainey@redhat.com)
  - Related: #1138939 - up2date and systemid files are managed by rhnsd itself,
    no need to break init script if they do not exist (jdobes@redhat.com)
  - Related: #1092518 - PIE+RELRO for rhnsd (mkollar@redhat.com)
  - Revert changes in order to clean up tagging issues with brew
    (ggainey@redhat.com)
  - Automatic commit of package [rhnsd] minor release [5.0.13-4-el7].
    (ggainey@redhat.com)
  - Bump release to get past weirdness in brew-tags (ggainey@redhat.com)
  - Automatic commit of package [rhnsd] minor release [5.0.13-2-el7].
    (ggainey@redhat.com)
  - Resolves: #1138939 - up2date and systemid files are managed by rhnsd itself,
    no need to break init script if they do not exist (jdobes@redhat.com)
  - Resolves: #1092518 - PIE+RELRO for rhnsd (mkollar@redhat.com)


author: Gennadii Altukhov <galt@redhat.com> 5.0.13-6
changelog:
  - 1409562 - RHEL7 rhnsd reload doesn't work (jdostal@redhat.com)
  - 1409562 - Reboot loop - rhn_check, rhnsd (jdostal@redhat.com)


author: Tomas Kasparek <tkasparek@redhat.com> 5.0.13-7.2
changelog:
  - Resolves: #1506911 - close and reopen syslog when redirecting child output
    (martin.matuska@axelspringer.de)


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.598-24
changelog:
  - Rebased to Ruby 2.0.0-p598.
    * Remove Patch19: ruby-2.0.0-p247-Make-stable-Gem-Specification.files-in-
        default-.gems.patch; subsumed
    * Remove Patch20: ruby-2.1.1-fix-test-failures-due-to-expired-certs.patch;
        subsumed
    * Remove Patch21: ruby-2.1.0-test_aes_gcm_wrong_tag-Dont-use-String
        -succ.patch; subsumed
    * Remove Patch22: ruby-2.2.0-fix-error-with-tzdata.patch; subsumed
    Resolves: rhbz#1071187
  - Incorporates fixes for CVE-2014-8080 and CVE-2015-8090.
    Resolves: rhbz#1164000
  - Fix for Proxy Realm feature.
    Resolves: rhbz#1122140
  - Fix off-by-one stack-based buffer overflow in the encodes() function
    (CVE-2014-4975).
    Related: rhbz#1164000


author: Pavel Valena <pvalena@redhat.com> - 2.0.0.648-26
changelog:
  - Rebase to Ruby 2.0.0-p648
    Resolves: rhbz#1197720, rhbz#1298282, rhbz#1258863
    * Remove Patch18: ruby-2.0.0-p247-Revert-mkmf.rb-prefix-install_dirs-only-
        with-DESTDIR.patch; subsumed
    * Remove Patch23: ruby-openssl-wrap-cipher-fix.patch; subsumed
    * Remove Patch25: ruby-2.0.0-p607-DNS-Resolv-fall-back-if-canonicalization-
        fails.patch; subsumed
  - Remove tests depending on europe/moscow to avoid failures due to tzdata change
    https://github.com/eggert/tz/commit/8ee11a301cf173afb0c76e0315b9f9ec8ebb9d95
  - Add checks for systemtap, abrt hook and rubygems version
  - Fix significant hash table performance slowdown on ppc64le
    Resolves: rhbz#1163032
  - Support in no_proxy for domain names with whitespaces and leading dots
    Resolves: rhbz#1300433


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-30
changelog:
  - Fix test_npn_protocol_selection_ary and test_npn_protocol_selection_enum
    failures with newest openssl.
    Resolves: rhbz#1416123
  - Add gemspec_add_dep and gemspec_remove_dep macros.
  - Extend 'gem_' macros for pre-release version support.
    Resolves: rhbz#1397390
  - Make symlinks for json gem.
    Resolves: rhbz#1308992


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-31
changelog:
  - Fix unsafe object deserialization in RubyGems (CVE-2017-0903).
    * ruby-2.4.3-CVE-2017-0903-Fix-unsafe-object-deserialization
        -vulnerability.patch
    Resolves: CVE-2017-0903
  - Fix an ANSI escape sequence vulnerability (CVE-2017-0899).
    Resolves: CVE-2017-0899
  - Fix a DOS vulernerability in the query command (CVE-2017-0900).
    Resolves: CVE-2017-0900
  - Fix a vulnerability in the gem installer that allowed a malicious gem
      to overwrite arbitrary files (CVE-2017-0901).
    Resolves: CVE-2017-0901
  - Fix a DNS request hijacking vulnerability (CVE-2017-0902).
    * ruby-2.2.8-lib-rubygems-fix-several-vulnerabilities-in-RubyGems.patch
    Resolves: CVE-2017-0902
  - Fix buffer underrun vulnerability in Kernel.sprintf (CVE-2017-0898).
    * ruby-2.2.8-Buffer-underrun-vulnerability-in-Kernel.sprintf.patch
    Resolves: CVE-2017-0898
  - Escape sequence injection vulnerability in the Basic
      authentication of WEBrick (CVE-2017-10784).
    * ruby-2.2.8-sanitize-any-type-of-logs.patch
    Resolves: CVE-2017-10784
  - Arbitrary heap exposure during a JSON.generate call (CVE-2017-14064).
    * ruby-2.2.8-Fix-arbitrary-heap-exposure-during-a-JSON.generate-call.patch
    Resolves: CVE-2017-14064
  - Command injection vulnerability in Net::FTP (CVE-2017-17405).
    * ruby-2.2.9-Fix-a-command-injection-vulnerability-in-Net-FTP.patch
    Resolves: CVE-2017-17405
  - Buffer underrun in OpenSSL ASN1 decode (CVE-2017-14033).
    * ruby-2.2.8-asn1-fix-out-of-bounds-read-in-decoding-constructed-objects.patch
    Resolves: CVE-2017-14033
  - Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code
      execution(CVE-2017-17790).
    * ruby-2.5.0-Fixed-command-Injection.patch
    Resolves: CVE-2017-17790


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-32
changelog:
  - Add Psych.safe_load
    * ruby-2.1.0-there-should-be-only-one-exception.patch
    * ruby-2.1.0-Adding-Psych.safe_load.patch
    Related: CVE-2017-0903
  - Disable Tokyo TZ tests broken by recen tzdata update.
    * ruby-2.5.0-Disable-Tokyo-TZ-tests.patch
    Related: CVE-2017-0903


author: Roman Rakus <rrakus@redhat.com> - 2.2.7-3
changelog:
  - Fixed a typo
  - Added missing providers
  - improved providers registration
  - Fixed owning of filesystem's directories (man)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.8-7
changelog:
  - Fix sblim-gather is installing files under /etc/tmpfiles.d/
    Resolves: #1180992
  - Build with PIE and full RELRO
    Resolves: #1092566


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.8-8
changelog:
  - Fix reposd crashes with SIGFPE during calcluation of interval metric when there
    are duplicate data values in the repository
    Resolves: #1467038


author: Watson Sato <wsato@redhat.com> 0.1.30-5
changelog:
  - Fix template remediation function used by SSHD remediation
  - Reduce scope of patch that fixes SSHD remediation (RH BZ#1415152)


author: Watson Sato <wsato@redhat.com> 0.1.32-1
changelog:
  - Update to upstream version 0.1.32
  - New CMake build system
  - Improved NIST 800-171 profile
  - Initial RHVH profile
  - New CPE to identify systems like machines (bare-metal and VM) and containers (image and container)
  - Template clean up in lots of remediations


author: Watson Sato <wsato@redhat.com> 0.1.33-1
changelog:
  - Update to upstream version 0.1.33
  - DISA RHEL7 STIG profile alignment improved
  - Introduction of remediation roles
  - RPM and DEB test packages are built by CMake with CPack
  - Lots of remediation fixes


author: Lubos Kardos <lkardos@redhat.com> - 20130529-10
changelog:
  - Allow to use vendor prefix in packages names
  - Include %nfsmountable macro into scl's rpm macros file


author: Jan Zeleny <jzeleny@redhat.com> - 20130529-13
changelog:
  - bump the version to get in sync with 7.1 branch
  - Reflect the state of %nfsmountable macro in collections' rpm macro files
  - escape all the % chars in changelog


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-3.el7
changelog:
  - seabios-redhat-reserve-more-memory-on-fseg.patch [bz#1327060]
  - seabios-redhat-turn-off-some-config-options.patch [bz#1327060]
  - Resolves: bz#1327060
    ([Seabios]Limited boot number supported for SCSI/SATA)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-4.el7
changelog:
  - seabios-Build-vgabios-virtio.bin.patch [bz#1327001]
  - Resolves: bz#1327001
    (vgabios-virtio.bin should be included  in seavgabios-bin package)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-5.el7
changelog:
  - seabios-pci-don-t-map-virtio-1.0-storage-devices-above-4G.patch [bz#1373154]
  - Resolves: bz#1373154
    (Guest fails boot up with ivshmem-plain and virtio-pci device)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-5.el7_3.1
changelog:
  - seabios-vgabios-Reorder-video-modes-to-work-around-a-Windows.patch [bz#1392028]
  - Resolves: bz#1392028
    ([virtio-win][svvp][ws2016] cannot generate dump file when using nmi on ws2016 and win10-32/64)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.10.1-2.el7
changelog:
  - seabios-smm-disable-by-default.patch [bz#1378006]
  - seabios-ahci-Set-upper-32-bit-registers-to-zero.patch [bz#1418320]
  - Resolves: bz#1378006
    (guest paused on target host sometimes when do migration during guest boot)
  - Resolves: bz#1418320
    (Seabios does not fully reset AHCI adapters)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.10.2-2.el7
changelog:
  - seabios-resume-Don-t-attempt-to-use-generic-reboot-mechanism.patch [bz#1428347]
  - Resolves: bz#1428347
    (reboot hangs on rhel6 machine types (~1/20 times))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.10.2-3.el7
changelog:
  - seabios-blockcmd-accept-only-disks-and-CD-ROMs.patch [bz#1020622]
  - seabios-blockcmd-generic-SCSI-luns-enumeration.patch [bz#1020622]
  - seabios-virtio-scsi-enumerate-luns-with-REPORT-LUNS.patch [bz#1020622]
  - seabios-usb-uas-enumerate-luns-with-REPORT-LUNS.patch [bz#1020622]
  - Resolves: bz#1020622
    (seabios fail to recognize virtio-scsi device if specify LUN not 0)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 1.10.2-3.el7_4.1
changelog:
  - seabios-virtio-IOMMU-support.patch [bz#1472131]
  - Resolves: bz#1472131
    (Guest OS will down when disk enable the IOMMU for Virtio)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-163
changelog:
  - Allow sssd_t to read realmd lib files.
  Resolves: rhbz#1436689
  - Add permission open to files_read_inherited_tmp_files() interface
  Resolves: rhbz#1290633
  Resolves: rhbz#1457106


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-164
changelog:
  - Allow couple rules needed to start targetd daemon with SELinux in enforcing mode
  Resolves: rhbz#1424621
  - Add interface lvm_manage_metadata
  Resolves: rhbz#1424621


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-166
changelog:
  - Add new boolean gluster_use_execmem
  Resolves: rhbz#1469027
  - Allow cluster_t and glusterd_t domains to dbus chat with ganesha service
  Resolves: rhbz#1468581


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-166.6
changelog:
  - Allow tomcat domain to connect to mssql port
  Resolves: rhbz#1500697
  - Add keepalived domain setpgid capability
  Resolves: rhbz#1500813


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-166.7
changelog:
  - Allow cluster_t domain creating bundles directory with label var_log_t instead of cluster_var_log_t
  Resolves: rhbz:#1513075


author: Pavel Moravec <pmoravec@redhat.com> = 3.4-7
changelog:
  - [openstack plugins] Tripleo specific containerized services
    Resolves: bz1463635
  - [jars] Scan only /usr/{share,lib}/java by default
    Resolves: bz1482574
  - [gluster_block] Added new plugin gluster_block
    Resolves: bz1491964


author: Pavel Moravec <pmoravec@redhat.com> = 3.4-12
changelog:
  - [openstack_cinder] check for api service running
    Resolves: bz1511087
  - [plugins] allow add_cmd_output to collect binary output
    Resolves: bz1515113


author: Christophe Fergeau <cfergeau@redhat.com> - 0.12.4-16
changelog:
  - Use autosetup
    Related: CVE-2016-0749
  - Fix heap-based memory corruption within smartcard handling
    Resolves: CVE-2016-0749
  - Fix host memory access from guest with invalid primary surface parameters
    Resolves: CVE-2016-2150


author: Christophe Fergeau <cfergeau@redhat.com> - 0.12.4-17
changelog:
  - Fix crash when the client sends a wrong header (for example when using spice-html5)
    Resolves: rhbz#1281442
  - Fix crash when guest provides wrong address
    Resolves: rhbz#1264356
  - Fix thread-safety issue causing a crash when playing a Youtube video spanning
    multiple monitors
    Resolves: rhbz#1253375
  - Add patches reducing QEMU wake-ups
    Related: rhbz#912763, rhbz#1186146
  - Fix use-after-free after resetting a VM
    Resolves: rhbz#1281455
  - Send KeepAlive probes every 10 minutes
    Resolves: rhbz#1298590
  - Add client to guest volume synchronization
    Resolves: rhbz#1264107


author: Christophe Fergeau <cfergeau@redhat.com> - 0.12.4-18
changelog:
  - Fix crash when connecting to VM using smartcard passthrough
    Resolves: rhbz#1340899
  - Fix hang after unredirecting a USB device
    Resolves: rhbz#1338752
  - Backport spice_qxl_set_max_monitors()
    Resolves: rhbz#1283202


author: Frediano Ziglio <fziglio@redhat.com> - 0.12.4-20
changelog:
  - Fix buffer overflow in main_channel_alloc_msg_rcv_buf when reading large
    messages.
    Resolves: CVE-2016-9577
  - Fix remote DoS via crafted message.
    Resolves: CVE-2016-9578


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.8-1
changelog:
  - Rebase to spice-server 0.12.8
    Resolves: rhbz#1388947
    Resolves: rhbz#1377551
    Resolves: rhbz#1283202


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.8-3
changelog:
  - Prevent potential buffer/integer overflows with invalid MonitorsConfig messages
    sent from an authenticated client
    Resolves: CVE-2017-7506


author: Pavel Grunt <pgrunt@redhat.com> - 0.33-1
changelog:
  - Rebase to 0.33
    Resolves: rhbz#1402474
  - Rebuilt with correct hardening flags due to bug 1387475
    Resolves: rhbz#1420778
  - Fix copy paste issues
    Resolve: rhbz#1409854


author: Pavel Grunt <pgrunt@redhat.com> - 0.33-2
changelog:
  - Add missing patch for rebase
    Resolves: rhbz#1402474
  - Add obsoletes to the spec file to ease updates
    Resolves: rhbz#1432776
  - Fix black screen in virt-manager
    Resolves: rhbz#1433242
  - Make connection error message more clear
    Resolves: rhbz#1365736


author: Victor Toso <victortoso@redhat.com> - 0.33-3
changelog:
  - Avoid CRITICALs on copy-paste
    Resolves: rhbz#1440096
  - Avoid assertions on file-xfer while agent disconnects
    Related: rhbz#1440096


author: Pavel Grunt <pgrunt@redhat.com> - 0.33-4
changelog:
  - Make connection error message more clear
    Resolves: rhbz#1365736
  - Improve audio debug
    Resolves: rhbz#1436249
  - Fix wrong encoding of transferred files
    Resolves: rhbz#1440206


author: Kevin Howell <khowell@redhat.com> 1.19.15-1
changelog:
  - Sync zanata translations (khowell@redhat.com)
  - 1452737: Enable saving no_proxy settings from GUI (jhnidek@redhat.com)
  - 1451003: identity reports right info in name field (jhnidek@redhat.com)
  - 1432231: Support /etc/init.d daemon even on EL7 (khowell@redhat.com)
  - 1450818: Bug fix of com.redhat.Subscriptionmanager D-Bus policy
    (jhnidek@redhat.com)
  - 1450862: remove obsolete certificates of golden ticket (jhnidek@redhat.com)
  - 1450049: Replace `-` with `_` in completion functions (khowell@redhat.com)
  - 1450210: Make lscpu ignore locale again (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.17-1
changelog:
  - Bump python-rhsm requirement to 1.19.8 (khowell@redhat.com)
  - 1441397: Sync zanata translations (khowell@redhat.com)
  - 1441397: Added --noproxy to bash completion script (jhnidek@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.18-1
changelog:
  - Bump python-rhsm requirement to 1.19.9 (khowell@redhat.com)
  - 1452075: print only readable part of SSL error to console
    (jhnidek@redhat.com)
  - 1444453: Have gettext return unicode instead of bytes. (awood@redhat.com)
  - 1457197: Env. variable no_proxy=* is not ignored (jhnidek@redhat.com)
  - 1441397: added --noproxy for rhsm-debug auto-completion (jhnidek@redhat.com)
  - 1365472: Add mnemonic for subscription-manager spoke (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.21-1
changelog:
  - 1463765: Sync zanata translations (khowell@redhat.com)
  - 1463765: Fix wrong Indic-language translations (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.22-1
changelog:
  - 1486549: Do not update redhat.repo at RateLimitExceededException
    (jhnidek@redhat.com)
  - 1486326: Add subscription-manager plugin to yum-config-manager
    (khowell@redhat.com)
  - 1486338: Properly initialize clean repo copy (khowell@redhat.com)
  - 1484265: Force UTF-8 encoding in daemons (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.23-1
changelog:
  - Bump python-rhsm requirement to 1.19.10 (khowell@redhat.com)
  - 1481384: Improve error message for RateLimitExceededException
    (jhnidek@redhat.com)


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-2
changelog:
  - RHEL 7.4 erratum
  - Fixes coverity scan issues created by our patches: 
    - fixed resource leaks and a compiler warning in digest backport patch
    - removed needless code from cmnd_no_wait patch causing clang warning
    - format of the last changelog message causes problems to rhpkg push,
      so don't use that as a commit message 
    Resolves: rhbz#1360687


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-3
changelog:
  - RHEL 7.4 eratum
  - Fixes semicolon typo in digest backport patch from the previous build
    Resolves: rhbz#1360687


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-4
changelog:
  - RHEL 7.4 erratum
  - fixed cmnd_no_wait patch
  - backported iolog_flush sudoers default
    Resolves: rhbz#1369856
    Resolves: rhbz#1425853


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-5
changelog:
  - RHEL 7.4 erratum
  - added doc patch about sudo lookup issue
    Resolves: rhbz#1293306
  - added test suite patch
    Resolves: rhbz#1360687
  - fixed use after free fqdn problem
    Resolves: rhbz#1360687


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.19p2-7
changelog:
  - RHEL 7.4 erratum
  - added patch to fix output truncation (in some cases) when log_output
    option is enabled
    Resolves: rhbz#1454571


author: Jakub Jelen <jjelen@redhat.com> - 1.8.19p2-8
changelog:
  - RHEL 7.4 erratum
  - Fixes CVE-2017-1000367: Privilege escalation in via improper get_process_ttyname() parsing
    Resolves: rhbz#1455402


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-9
changelog:
  - RHEL 7.4 erratum
  - removed patch for output truncation (1454571) which introduced regression
    Resolves: rhbz#1360687


author: Frank Ch. Eigler <fche@redhat.com> - 3.0-3
changelog:
  - rhbz1346112 delay tls cert creation
  - rhbz1269062 null elevator
  - rhbz1337416 'count' tapset variable - autocast/@defined


author: David Smith <dsmith@redhat.com> - 3.1-3
changelog:
  - Added patches for:
  - rhbz1425568 task_dentry_path() fix
  - rhbz1431263 arm64 hardware breakpoint crash fix
  - rhbz1430828 replace task_exe_file() with current_exe_file()
  - rhbz1436845 adapt stapdyn to the dyninst 9.3.1 library search model
  - rhbz1433391 workaround parser issue in nfs_proc.stp
  - rhbz1428120 update lookup_bad_addr()


author: Jan Grulich <jgrulich@redhat.com> - 1.7.1-1
changelog:
  - Update to 1.7.1
    Resolves: bz#1388620
    Resolves: bz#1343899
    Resolves: bz#1410164
    Resolves: bz#1415547
    Resolves: bz#1418945
    Resolves: bz#1416290
    Resolves: bz#1342956
  - Fix shared memory leakage
    Resolves: bz#1358090
  - Added systemd unit file for xvnc
    Resolves: bz#1393971


author: Jan Grulich <jgrulich@redhat.com> - 1.7.1-2
changelog:
  - Be more restrictive with shared memory mode bits
    Resolves: bz#1152552
    Limit max username/password size in SSecurityPlain [CVE-2017-7394]
    Resolves: bz#1438737
    Fix crash from integer overflow in SMsgReader::readClientCutText [CVE-2017-7395]
    Resolves: bz#1438742


author: Jan Grulich <jgrulich@redhat.com> - 1.7.1-3
changelog:
  - Delete underlying ssecurity in SSecurityVeNCrypt [CCVE-2017-7392]
    Resolves: bz#1439127
    Prevent double free by crafted fences [CVE-2017-7393]
    Resolves: bz#1439134


author: Petr Pisar <ppisar@redhat.com> - 1.7-39
changelog:
  - Fix maximal RSS report (bug #702826)
  - Clean spec file
  - Recompute CPU usage at finer level (bug #527276)


author: Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-4
changelog:
  - Resolves: rhbz#1350438 CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service


author: Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-9
changelog:
  - Resolves: rhbz#1362213 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
  - Resolves: rhbz#1368122


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-2
changelog:
  - Resolves: rhbz#1459747 CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism
  - Resolves: rhbz#1441481 CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-3
changelog:
  - Resolves: rhbz#1498344 CVE-2017-12615 CVE-2017-12617 tomcat: various flaws
  - Resolves: rhbz#1495654 CVE-2017-7674 tomcat: Vary header not added by CORS filter leading to cache poisoning
  - Resolves: rhbz#1470596 CVE-2017-5647 Add follow up revision


author: Bastien Nocera <bnocera@redhat.com> 3.14.3-1
changelog:
  - Update to 3.14.3
  - Re-add opensubtitles plugin, as it doesn't depend on PyXDG anymore
  Resolves: #1174589


author: Bastien Nocera <bnocera@redhat.com> 3.14.3-4
changelog:
  - Remove Python3 plugins, they're mostly accessory plugins,
    and RHEL 7.2 only support Python2 for now
  Resolves: #1259643


author: Ray Strode <rstrode@redhat.com> 3.14.3-5
changelog:
  - Add more goo to the compat desktop file to prevent them
    from exposing in control-center
  Related: #1259292


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.8.0-1
changelog:
  - new release
    - rebase tuned to latest upstream
      resolves: rhbz#1388454
    - cpu-partitioning: enabled timer migration
      resolves: rhbz#1408308
    - cpu-partitioning: disabled kvmclock sync and ple
      resolves: rhbz#1395855
    - spec: muted error if there is no selinux support
      resolves: rhbz#1404214
    - units: implemented instance priority
      resolves: rhbz#1246172
    - bootloader: added support for initrd overlays
      resolves: rhbz#1414098
    - cpu-partitioning: set CPUAffinity early in initrd image
      resolves: rhbz#1394965
    - cpu-partitioning: set workqueue affinity early
      resolves: rhbz#1395899
    - scsi_host: fixed probing of ALPM, missing ALPM logged as info
      resolves: rhbz#1416712
    - added new profile cpu-partitioning
      resolves: rhbz#1359956
    - bootloader: improved inheritance
      resolves: rhbz#1274464
    - units: mplemented udev-based regexp device matching
      resolves: rhbz#1251240
    - units: introduced pre_script, post_script
      resolves: rhbz#1246176
    - realtime-virtual-host: accommodate new ktimersoftd thread
      resolves: rhbz#1332563
    - defirqaffinity: fixed traceback due to syntax error
      resolves: rhbz#1369791
    - variables: support inheritance of variables
      resolves: rhbz#1433496
    - scheduler: added support for cores isolation
      resolves: rhbz#1403309
    - tuned-profiles-nfv splitted to host/guest and dropped unneeded dependency
      resolves: rhbz#1413111
    - desktop: fixed typo in profile summary
      resolves: rhbz#1421238
    - with systemd don't do full rollback on shutdown / reboot
      resolves: rhbz#1421286
    - builtin functions: added virt_check function and support to include
      resolves: rhbz#1426654
    - cpulist_present: explicitly sorted present CPUs
      resolves: rhbz#1432240
    - plugin_scheduler: fixed initialization
      resolves: rhbz#1433496
    - log errors when applying a profile fails
      resolves: rhbz#1434360


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.8.0-2
changelog:
  - respin
    related: rhbz#1388454
  - systemd: added support for older systemd CPUAffinity syntax
    resolves: rhbz#1441791
  - scheduler: added workarounds for low level exceptions from
    python-linux-procfs
    resolves: rhbz#1441792
  - bootloader: workaround for adding tuned_initrd to new kernels on restart
    resolves: rhbz#1441797
  - cpu-partitioning: use tuna for cores isolation
    related: rhbz#1403309


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-1.prerelease
changelog:
  - Rebase to prerelease version of tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07. 
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-2
changelog:
  - Rebase to tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07.
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Patsy Franklin <pfrankli@redhat.com> - 2016i-1
changelog:
  - Rebase to tzdata-2016i:
    - Cyprus is now split into two time zones as of 2016-10-30
    - Tonga will reintroduce DST on 2016-11-06


author: Patsy Franklin <pfrankli@redhat.com> - 2016j-1
changelog:
  - Rebase to tzdata-2016ij
    - Saratov region of Russia is moving from +03 offset to +04 offset
      on 2016-12-04.


author: Patsy Franklin <pfrankli@redhat.com> - 2017a-1
changelog:
  - Rebase to tzdata-2017a.
    - Mongolia no longer observes DST. (BZ #1425214)
    - Add upstream patch to fix over-runing of POSIX limit on zone abbreviations.
  - Add zone1970.tab file to the install list. (BZ #1414829)


author: Patsy Franklin <pfrankli@redhat.com> - 2017c-1
changelog:
  - Rebase to tzdata-2017c.
    - Northern Cyprus will revert to using EQ rules on October 29, 2017.
    - Sudan will switch from +03 to +02 on November 1, 2017.
    - Tonga will not change it's clocks on Novemeber 5, 2017 ending it's
      experiment with DST.
    - Fiji DST will end on January 14, 2018 rather than January 21, 2018.
    - Namibia - starting September 3, 2017 switches from +)1 with DST to
      +02 all year.  This change takes effect April 1, 2018.
    - Turks & Caicos changes from -04 all year to -05 with US DST starting
      on March 11, 2018.  Effective change date is November 4, 2018. 
    - tzdata now includes two text versions of the time zone data - tzdata.zi
      and leapseconds. 
    - Includes two patches to deal with build issues.


author: Patsy Franklin <pfrankli@redhat.com> - 2018b-1
changelog:
  - Rebase to tzdata-2018b
    - São Tomé and Príncipe changed from +00 to +01 on January 1, 2018
    - Brazil's DST will start on the first Sunday in November
    - Irish standard time is in the summer now, not the winter.
    - Support for the new zic -t option.
    - Add back pacificnew file omitted in tzdata-2018a


author: Patsy Franklin <pfrankli@redhat.com> - 2018d-1
changelog:
  - Rebase to tzdata-2018d
    - DST for Asia/Gaza and Asia/Hebron has changed from March 31 to March 24.
    - Antarctica/Casey station changed to UTC+8 on March 11.


author: Patsy Franklin <pfrankli@redhat.com> - 2018e-2
changelog:
  - Rebase to tzdata-2018e
    - North Korea changed from UTC+8:30 to UTC+9 on May 5, 2018.
    - In this update, the upstream project now defaults to using
      the "vanguard" data implementation which includes negative DST offsets.
      However, we are continuing to provide the "rearguard" format
      for data which does not use negative DST offsets to provide
      better compatibility with existing tools.  We intend to transition
      to the "vanguard" data implementation in the future.


author: Mark Wielaard <mjw@redhat.com> - 3.11.0-20
changelog:
  - Rebase to fedora 3.11.0
    (#1316512 #1306844 #1305962 #1298888 #1296318 #1271754 #1265566 #1265557)


author: Mark Wielaard <mjw@redhat.com> - 3.11.0-21
changelog:
  - Add valgrind-3.11.0-deduppoolalloc.patch (#1328347)
  - Add valgrind-3.11.0-ppc-bcd-addsub.patch (#1331738)
  - Add valgrind-3.11.0-ppc64-vgdb-vr-regs.patch (#1331774)


author: Mark Wielaard <mjw@redhat.com> - 3.12.0-8
changelog:
  - Add valgrind-3.12.0-powerpc-register-pair.patch (#1437030)
  - Add valgrind-3.12.0-ppc64-isa-3_00.patch (#1437032)


author: Devan Goodwin <dgoodwin@rm-rf.ca> 0.15-1
changelog:
  - Update spec for renamed README.md. (dgoodwin@redhat.com)
  - Moves fakevirt._decode() to util.decode() (csnyder@redhat.com)
  - Adds the report.config.name to log message when refusing to send a report due
    to lack of change (csnyder@redhat.com)
  - VirtWho: Clears list of reports on reload (csnyder@redhat.com)
  - Revises change detection tests to account for changes in master
    (csnyder@redhat.com)
  - Libvirtd: Sends a report on start up, and on events (csnyder@redhat.com)
  - Removes trailing line at the end of the file (csnyder@redhat.com)
  - Test_Esx: Test Oneshot to ensure it queues a report (csnyder@redhat.com)
  - Esx: only queue data if the version has changed (csnyder@redhat.com)
  - Test_VirtWho:Patches manager.Manager.fromOptions, removes unnecessary mocks
    (csnyder@redhat.com)
  - Removes unhelpful debug log message (csnyder@redhat.com)
  - Fix spacing, remove unused imports (csnyder@redhat.com)
  - Test_VirtWho: Adds test to show same report will not be sent twice
    (csnyder@redhat.com)
  - VirtWho: Adds basic change detection using report hashs (csnyder@redhat.com)
  - Adds hash property to config (csnyder@redhat.com)
  - Adds hash property to DomainListReport and HypervisorGuestAssociationReport
    (csnyder@redhat.com)
  - Hypervisor: Adds getHash class method (csnyder@redhat.com)
  - Limits interval settings (wpoteat@redhat.com)
  - Retry sending data to subscription manager multiple times before dropping
    (rnovacek@redhat.com)
  - SubscriptionManager: nicely order keys in debug report (rnovacek@redhat.com)
  - Fix serialization of guest list in print mode (rnovacek@redhat.com)
  - Do not exit oneshot mode if any job exists (rnovacek@redhat.com)
  - SubscriptionManager: check if report result has failedUpdate item
    (rnovacek@redhat.com)
  - SubscriptionManager: minor logging fixes (rnovacek@redhat.com)
  - SubscriptionManager: add env var to disable asynchronous reporting
    (rnovacek@redhat.com)
  - Check jobs status in increasing interval (rnovacek@redhat.com)
  - Esx: report host even if it doesn't have any guests (rnovacek@redhat.com)
  - Hypervisors reported by hyperv now include hostname. (csnyder@redhat.com)
  - Removes completed jobs. (csnyder@redhat.com)
  - Fix output format in print mode (rnovacek@redhat.com)
  - Fix using empty list as default parameter value (rnovacek@redhat.com)
  - satellite: support new hypervisor format (rnovacek@redhat.com)
  - Fix tests failures (rnovacek@redhat.com)
  - Removes timeouts for jobs. All jobs in the list are now executed just before
    a new report is sent. (csnyder@redhat.com)
  - The virtwho loop now blocks on the report queue with a one second timeout
    (csnyder@redhat.com)
  - Removes unnecessary imports and queue (csnyder@redhat.com)
  - Rewrite readme to markdown syntax (rnovacek@redhat.com)
  - CI: install unittest2 from pypi (rnovacek@redhat.com)
  - CI: add -y option to add-apt-repository (rnovacek@redhat.com)
  - CI: another attempt on cloud archive for libvirt (rnovacek@redhat.com)
  - CI: try to install newer version of libvirt from cloud archive
    (rnovacek@redhat.com)
  - CI: add libvirt-dev dependency (rnovacek@redhat.com)
  - CI: install libvirt-python via pip (rnovacek@redhat.com)
  - CI: another attempt without site-packages (rnovacek@redhat.com)
  - CI: install python-rhsm dependencies (rnovacek@redhat.com)
  - Adds support for facts in Hypervisor profile. (csnyder@redhat.com)
  - Adds count of unchanged mappings to the info logged for the result of an
    async job (csnyder@redhat.com)
  - Adds tests for jobs in virtwho, removes unnecessary tests for managerprocess.
    (csnyder@redhat.com)
  - Changes to ensure backwards compatibility with python-rhsm
    (csnyder@redhat.com)
  - Fixes RhevM.getHostGuestMapping() as suggested by rnovacek
    (csnyder@redhat.com)
  - Adds layer to hypervisorId. Removes completed TODO (csnyder@redhat.com)
  - Moves all functionality of managerprocess into virtwho. (csnyder@redhat.com)
  - CI: use python with system side packages enabled (rnovacek@redhat.com)
  - CI: install m2crypto using apt instead of pip (rnovacek@redhat.com)
  - CI: install python-libvirt using apt instead of pip (rnovacek@redhat.com)
  - Add requirements.txt and .travis.yml for the CI (rnovacek@redhat.com)
  - Adds tests to verify the hostGuestAssociation is generated correctly.
    (csnyder@redhat.com)
  - Updates libvirtd and tests to add host name to hypervisor profile
    (csnyder@redhat.com)
  - Updates managerprocess with better logging and changes for the new tests.~~
    (csnyder@redhat.com)
  - Updates to use the new hypervisor class (csnyder@redhat.com)
  - print mode: format debug message about found hypervisors
    (rnovacek@redhat.com)
  - Removing uncesasary comments (csnyder@redhat.com)
  - Removes unused dictionary of jobs and associated methods.
    (csnyder@redhat.com)
  - Fixes tests data to include "status" key. (csnyder@redhat.com)
  - Updates tests to make use of new Hypervisor class. (csnyder@redhat.com)
  - Host name is now included in the hypervisor profile using the new Hypervisor
    class (csnyder@redhat.com)
  - Adds new Hypervisor class. (csnyder@redhat.com)
  - Adds new test for the updates to subscriptionmanager.py (csnyder@redhat.com)
  - Updates fakevirt to make use of virt.Guest classes (csnyder@redhat.com)
  - Changes to ensure proper execution post-merge (csnyder@redhat.com)
  - Removing more unnecessary prints (csnyder@redhat.com)
  - Fixes oneshot mode for work with new managerprocess (csnyder@redhat.com)
  - Cleaning up unneeded prints and adding more useful debug log messages
    (csnyder@redhat.com)
  - Adds async job status polling for use with the new report API
    (csnyder@redhat.com)
  - This (along with python-rhsm/csnyder/new_report_api ee38f15, allows
    communication with new report api (csnyder@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 0.19-1
changelog:
  - 1415497: Support rhev4 auto detection and usage (pcreech@redhat.com)
  - 1388577: Adding UTF-8 support (pcreech@redhat.com)
  - 1410000: Include org_id in hv base channel (pcreech@redhat.com)
  - 1400431: Fix AttributeError where val is missing (pcreech@redhat.com)
  - 1405967: Filter host via glob or regex (pcreech@redhat.com)
  - Adds --password option to virt-who-pasword (tstrachota@redhat.com)
  - 1392390 Fix default interval handling (pcreech@redhat.com)
  - BZ1405967  Add filter_hosts_regex, and exclude_hosts_regex to allow filtering
    large numbers of hosts easily (chris@chrisprocter.co.uk)
  - 1369107: Only load files with .conf extension (pcreech@redhat.com)
  - 1383436: Obey the interval setting (csnyder@redhat.com)
  - 1299643: Update virt-who-config man page to include NO_PROXY
    (csnyder@redhat.com)


author: Kevin Howell <khowell@redhat.com> 0.19-2
changelog:
  - 1437229: Fix syntax error in exception handling (pcreech@redhat.com)
  - Update the spec file for builds on more downstream platforms
    (csnyder@redhat.com)
  - 1437228: Handle utf-8 within Xmlrpc transport (pcreech@redhat.com)


author: Kevin Howell <khowell@redhat.com> 0.19-3
changelog:
  - Do not join threads not started, fix up fake backend (csnyder@redhat.com)
  - 1439317: Ensure reports are still sent despite duplicate configurations
    (csnyder@redhat.com)
  - 1436811: Send reports on the interval per destination (csnyder@redhat.com)
  - 1436517: Set Version header for version detect (pcreech@redhat.com)


author: Kevin Howell <khowell@redhat.com> 0.19-4
changelog:
  - 1436517: Fix api base detection for rhevm version 3 and 4
    (csnyder@redhat.com)
  - 1442337: Send updates immediately the first run (csnyder@redhat.com)


author: Kevin Howell <khowell@redhat.com> 0.19-5
changelog:
  - 1448267: Fix polling behavior for oneshot, CTRL-C, 429 responses
    (csnyder@redhat.com)
  - 1450747: Continue running destination threads on internal failure
    (csnyder@redhat.com)
  - 1444718: Log name of config when duplicate reports are retrieved
    (csnyder@redhat.com)
  - 1447264: Keep running on InvalidPasswordFormat given other valid configs
    (csnyder@redhat.com)
  - 1369107: Update docs and log messages to show the *.conf requirement
    (csnyder@redhat.com)


author: Tomas Popela <tpopela@redhat.com> - 2.14.6-1
changelog:
  - Update to 2.14.6
  - Resolves: rhbz#1440681
  - Don't crash is no render is available in AX render object
  - Resolves: rhbz#1437672


author: Tomas Popela <tpopela@redhat.com> - 2.14.6-3
changelog:
  - Bundle only needed icu libraries
  - Don't list bundled icu libraries in provides
  - Resolves: rhbz#1383614


author: Tomas Popela <tpopela@redhat.com> - 2.14.7-1
changelog:
  - Update to 2.14.7
  - Backport more of a11y fixes from upstream
  - Fix JSC crashes on big endian arches
  - Resolves: rhbz#1442160


author: Tomas Popela <tpopela@redhat.com> - 2.14.7-2
changelog:
  - Fix a CLoop patch that was not correctly backported from upstream, causing
    crashes on big endian machines
  - Resolves: rhbz#1442160


author: Tomas Popela <tpopela@redhat.com> - 2.14.7-3
changelog:
  - Update the bundled brotli and woff2 to the latest releases due to
    woff2's license incompatibility with WebKitGTK+ project
  - Resolves: rhbz#1500368


author: Tomas Hozza <thozza@redhat.com> - 1.14-8
changelog:
  - Fix deadcode and possible use of NULL in vprintf (#913153)
  - Add documentation for --regex-type and --preserve-permissions
  - Fix --preserve-permissions to work as documented (and expected)
  - Fix bug when authenticating using user:password@url syntax (#912358)
  - Document and fix --backups option


author: Tomas Hozza <thozza@redhat.com> - 1.14-12
changelog:
  - Fix wget to include Host header on CONNECT as required by HTTP 1.1 (#1203384)
  - Run internal test suite during build (#1295846)
  - Fix -nv being documented as synonym for two options (#1147572)


author: Tomas Hozza <thozza@redhat.com> - 1.14-15
changelog:
  - Added TLSv1_1 and TLSv1_2 as secure-protocol values to help (#1439811)
  - Fixed synchronization in randomly failing unit test Test-proxied-https-auth (#1448440)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-5
changelog:
  - macsec: Fix segmentation fault in case macsec.ko is not loaded (rh #1440646)
  - nl80211: Fix race condition in detecting MAC change (rh #1447073)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-5.1
changelog:
  - avoid key reinstallation (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079,
    CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086,
    CVE-2017-13087, CVE-2017-13088)


author: Simo Sorce <simo@redhat.com> - 1.2.20-1
changelog:
  - New upstrema version with memleaks, crl checks and other fixes
  - enable make check during build
  - drop ecdsa patch as it has been included upstream


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.4.3-151
changelog:
  - Add repo-id to repomd timestamp error message.
  - Resolves: bug#1389816
  - Don't recommend makecache if just running.
  - Resolves: bug#1369389
  - Add logging of bad update notice duplicates.
  - Resolves: bug#1194915


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.4.3-153
changelog:
  - Filter duplicates when counting security updates.
  - Resolves: bug#1399628
  - sqlitesack: fix filelist queries for duplicate pkgs.
  - Resolves: bug#1391507


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.4.3-154
changelog:
  - Add payload_gpgcheck option.
  - Resolves: bug#1343690
  - Add hint about rm -rf for yum clean all.
  - Resolves: bug#1357083
  - Have "yum check" ignore self conflicts.
  - Resolves: bug#1370134
  - Detect installed virtual provide in install().
  - Resolves: bug#1352585
  - Fix reget problems with simple md filenames.
  - Resolves: bug#1397829


author: CentOS Sources <bugs@centos.org> - 3.4.3-154.el7.centos
changelog:
  - CentOS yum config
  -  use the CentOS bug tracker url
  -  retain installonly limit of 5
  -  ensure distrover is always from centos-release
  - Make yum require yum-plugin-fastestmirror


