# changelog

author: Nalin Dahyabhai <nalin@redhat.com> 1.11-0.alpha1.1
changelog:
  - handle releases where texlive packaging wasn't yet as complicated as it
    is in Fedora 18
  - fix an uninitialized-variable error building one of the test programs


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - when building with our bundled copy of libverto, package it in with -libs
    rather than with -server (#886049)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.1-1
changelog:
  - update to 1.11.1
    - drop patch for noticing negative timeouts being passed to the poll()
      wrapper in the client transmit functions


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.1-2
changelog:
  - prebuild PDF docs to reduce multilib differences (internal tooling, #884065)
  - drop the kerberos-iv portreserve file, and drop the rest on systemd systems
  - escape uses of macros in comments (more of #884065)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix a version comparison to expect newer texlive build requirements when
    %{_rhel} > 6 rather than when it's > 7


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.1-5
changelog:
  - pull up Simo's patch to mark the correct mechanism on imported GSSAPI
    contexts (RT#7592)
  - go back to using reconf to run autoconf and autoheader (part of #925640)
  - add temporary patch to use newer config.guess/config.sub (more of #925640)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.1-6
changelog:
  - create and own /var/kerberos/krb5/user instead of /var/kerberos/kdc/user,
    since that's what the libraries actually look for
  - add buildrequires on nss-myhostname, in an attempt to get more of the tests
    to run properly during builds
  - pull in Simo's patch to recognize "client_keytab" as a key type which can
    be passed in to gss_acquire_cred_from() (RT#7598)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.1-7
changelog:
  - when testing the RPC library, treat denials from the local portmapper the
    same as a portmapper-not-running situation, to allow other library tests
    to be run while building the package


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.1-9
changelog:
  - move the compiled-in default ccache location from the previous default of
    FILE:/tmp/krb5cc_%{uid} to DIR:/run/user/%{uid}/krb5cc (part of #949588)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.2-1
changelog:
  - update to 1.11.2
    - drop pulled in patch for RT#7586, included in this release
    - drop pulled in patch for RT#7592, included in this release
  - pull in fix for keeping track of the message type when parsing FAST requests
    in the KDC (RT#7605, #951843) (also #951965)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.2-3
changelog:
  - pull the changing of the compiled-in default ccache location to
    DIR:/run/user/%{uid}/krb5cc back into F19, in line with SSSD and
    the most recent pam_krb5 build


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.2-6
changelog:
  - pull in upstream fix to start treating a KRB5CCNAME value that begins
    with DIR:: the same as it would a DIR: value with just one ccache file
    in it (RT#7172, #965574)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.2-7
changelog:
  - backport fix for not being able to verify the list of transited realms
    in GSS acceptors (RT#7639, #959685)
  - backport fix for not being able to pass an empty password to the
    get-init-creds APIs and have them actually use it (RT#7642, #960001)
  - add backported proposed fix to use the unauthenticated server time
    as the basis for computing the requested credential expiration times,
    rather than the client's idea of the current time, which could be
    significantly incorrect (#961221)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.2-8
changelog:
  - pull in patches from master to not test GSSRPC-over-UDP and to not
    depend on the portmapper, which are areas where our build systems
    often give us trouble, too


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.2-9
changelog:
  - don't forget to set the SELinux label when creating the directory for
    a DIR: ccache
  - pull in proposed fix for attempts to get initial creds, which end up
    following referrals, incorrectly trying to always use master KDCs if
    they talked to a master at any point (should fix RT#7650)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.3-1
changelog:
  - update to 1.11.3
    - drop patch for RT#7605, fixed in this release
    - drop patch for CVE-2002-2443, fixed in this release
    - drop patch for RT#7369, fixed in this release
  - pull upstream fix for breaking t_skew.py by adding the patch for #961221


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.3-2
changelog:
  - special-case /run/user/0, attempting to create it when resolving a
    directory cache below it fails due to ENOENT and we find that it doesn't
    already exist, either, before attempting to create the directory cache
    (maybe helping, maybe just making things more confusing for #961235)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.3-3
changelog:
  - specify dependencies on the same arch of krb5-libs by using the %{?_isa}
    suffix, to avoid dragging 32-bit libraries onto 64-bit systems (#980155)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.3-4
changelog:
  - use (a bundled, for now, copy of) nss_wrapper to let us run some of the
    self-tests at build-time in more places than we could previously (#978756)
  - cover inconsistencies in whether or not there's a local caching nameserver
    that's willing to answer when the build environment doesn't have a
    resolver configuration, so that nss_wrapper's faking of the local
    hostname can be complete


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.3-6
changelog:
  - tweak configuration files used during tests to try to reduce the number
    of conflicts encountered when builds for multiple arches land on the same
    builder


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.3-8
changelog:
  - drop a patch we weren't not applying (build tooling)
  - wrap kadmind and kpropd in scripts which check for the presence/absence
    of files which dictate particular exit codes before exec'ing the actual
    binaries, instead of trying to use ConditionPathExists in the unit files
    to accomplish that, so that we exit with failure properly when what we
    expect isn't actually in effect on the system (#800343)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.3-9
changelog:
  - take another stab at accounting for UnversionedDocdirs for the -libs
    subpackage (spotted by ssorce)
  - switch to just the snapshot of nss_wrapper we were using, since we
    no longer need to carry anything that isn't in the cwrap.org repository
    (ssorce)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.3-10
changelog:
  - incorporate Simo's backport of his persistent-keyring changes (#991148)
  - restore build-time default DEFCCNAME on Fedora 21 and later and EL, and
    instead set default_ccache_name in the default krb5.conf's [libdefaults]
    section (#991148)
  - on releases where we expect krb5.conf to be configured with a
    default_ccache_name, add it whenever we upgrade from an older version of
    the package that wouldn't have included it in its default configuration
    file (#991148)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.3-11
changelog:
  - don't let comments intended for one scriptlet become part of the "script"
    that gets passed to ldconfig as part of another one (Mattias Ellert, #1005675)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - only apply the patch to autocreate /run/user/0 when we're hard-wiring the
    default ccache location to be under it; otherwise it's unnecessary


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-15
changelog:
  - add explicit build-time dependency on a version of keyutils that's new
    enough to include keyctl_get_persistent() (more of #991148)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-16
changelog:
  - back out setting default_ccache_name to the new default for now, resetting
    it to the old default while the kernel/keyutils bits get sorted (sgallagh)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-19
changelog:
  - configure --without-krb5-config so that we don't pull in the old default
    ccache name when we want to stop setting a default ccache name at configure-
    time


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-20
changelog:
  - pull up fix for not calling a kdb plugin's check-transited-path
    method before calling the library's default version, which only knows
    how to read what's in the configuration file (RT#7709, #1013664)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-21
changelog:
  - switch to the version of persistent-keyring that was just merged to
    master (RT#7711), along with related changes to kinit (RT#7689)
  - go back to setting default_ccache_name to a KEYRING type


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-24
changelog:
  - backport the callback to use the libkrb5 prompter when we can't load PEM
    files for PKINIT (RT#7590, includes part of #965721/#1016690)
  - extract the rest of the fix #965721/#1016690 from the changes for RT#7680


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-25
changelog:
  - pull up fix for importing previously-exported credential caches in the
    gssapi library (RT# 7706, #1019420)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12-alpha1.0
changelog:
  - initial update to alpha1
    - drop backport of persistent keyring support
    - drop backport for RT#7689
    - drop obsolete patch for fixing a use-before-init in a test program
    - drop obsolete patch teaching config.guess/config.sub about aarch64-linux
    - drop backport for RT#7598
    - drop backport for RT#7172
    - drop backport for RT#7642
    - drop backport for RT#7643
    - drop patches from master to not test GSSRPC-over-UDP and to not
      depend on the portmapper, which are areas where our build systems
      often give us trouble, too; obsolete
    - drop backports for RT#7682
    - drop backport for RT#7709
    - drop backport for RT#7590 and partial backport for RT#7680
    - drop OTP backport
    - drop backports for RT#7656 and RT#7657
  - BuildRequires: libedit-devel to prefer it
  - BuildRequires: pkgconfig, since configure uses it


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-27
changelog:
  - add some minimal description to the top of the wrapper scripts we use
    when starting krb5kdc and kadmind to describe why they exist (tooling)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-28
changelog:
  - drop patch to add additional access() checks to ksu - they add to breakage
    when non-FILE: caches are in use (#1026099), shouldn't be resulting in any
    benefit, and clash with proposed changes to fix its cache handling


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-29
changelog:
  - incorporate upstream patch for remote crash of KDCs which serve multiple
    realms simultaneously (RT#7756, CVE-2013-1418/CVE-2013-6800,


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-30
changelog:
  - check more thoroughly for errors when resolving KEYRING ccache names of type
    "persistent", which should only have a numeric UID as the next part of the
    name (#1029110)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.4-1
changelog:
  - update to 1.11.4
    - drop patch for RT#7650, obsoleted
    - drop patch for RT#7706, obsoleted as RT#7723
    - drop patch for CVE-2013-1418/CVE-2013-6800, included in 1.11.4


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.4-2
changelog:
  - pull in fix to store KDC time offsets in keyring credential caches (RT#7768,
    - pull in fix to set expiration times on credentials stored in keyring
    credential caches (RT#7769, #1031724)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12-beta2.0
changelog:
  - update to beta2
    - drop obsolete backports for storing KDC time offsets and expiration times
      in keyring credential caches


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12-2
changelog:
  - pull in fix from master to return a NULL pointer rather than allocating
    zero bytes of memory if we read a zero-length input token (RT#7794, part of
    - pull in fix from master to ignore an empty token from an acceptor if
    we've already finished authenticating (RT#7797, part of #1043962)
  - pull in fix from master to avoid a memory leak when a mechanism's
    init_sec_context function fails (RT#7803, part of #1043962)
  - pull in fix from master to avoid a memory leak in a couple of error
    cases which could occur while obtaining acceptor credentials (RT#7805, part
    of #1043962)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update a test wrapper to properly handle things that the new libkrad does,
    and add python-pyrad as a build requirement so that we can run its tests


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12-5
changelog:
  - pull in fix from master to make reporting of errors encountered by
    the SPNEGO mechanism work better (RT#7045, part of #1043962)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12-8
changelog:
  - add patch from Dhiru Kholia for the AES-NI implementations to allow
    libk5crypto to be properly marked as not needing an executable stack
    on arches where they're used (#1045699, and so many others)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12-9
changelog:
  - grab a more-commented version of the most recent patch from upstream
    master
  - make a guess at making the 32-bit AES-NI implementation sufficiently
    position-independent to not require execmod permissions for libk5crypto
    (more of #1045699)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12-10
changelog:
  - amend the PIC patch for iaesx86.s to also save/restore ebx in the
    functions where we modify it, because the ELF spec says we need to


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12-11
changelog:
  - update the PIC patch for iaesx86.s to not use ELF relocations to the version
    that landed upstream (RT#7815, #1045699)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-1
changelog:
  - update to 1.12.1
    - drop patch for RT#7794, included now
    - drop patch for RT#7797, included now
    - drop patch for RT#7803, included now
    - drop patch for RT#7805, included now
    - drop patch for RT#7807, included now
    - drop patch for RT#7045, included now
    - drop patches for RT#7813 and RT#7815, included now
    - add patch to always retrieve the KDC time offsets from keyring caches,
      so that we don't mistakenly interpret creds as expired before their
      time when our clock is ahead of the KDC's (RT#7820, #1030607)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-2
changelog:
  - pull in multiple changes to allow replay caches to be added to a GSS
    credential store as "rcache"-type credentials (RT#7818/#7819/#7836,


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add currently-proposed changes to teach ksu about credential cache
    collections and the default_ccache_name setting (#1015559,#1026099)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-4
changelog:
  - pull in patch from master to move the default directory which the KDC uses
    when computing the socket path for a local OTP daemon from the database
    directory (/var/kerberos/krb5kdc) to the newly-added run directory
    (/run/krb5kdc), in line with what we're expecting in 1.13 (RT#7859, more
    of #1040056 as #1063905)
  - add a tmpfiles.d configuration file to have /run/krb5kdc created at
    boot-time
  - own /var/run/krb5kdc


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-5
changelog:
  - spnego: pull in patch from master to restore preserving the OID of the
    mechanism the initiator requested when we have multiple OIDs for the same
    mechanism, so that we reply using the same mechanism OID and the initiator
    doesn't get confused (#1066000, RT#7858)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-9
changelog:
  - pull in changes from upstream which add processing of the contents of
    /etc/gss/mech.d/*.conf when loading GSS modules (#1102839)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-10
changelog:
  - pull in fix for denial of service by injection of malformed GSSAPI tokens
    (CVE-2014-4341, CVE-2014-4342, #1116181)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-12
changelog:
  - gssapi: pull in proposed fix for a double free in initiators (David
    Woodhouse, CVE-2014-4343, #1117963)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12.2-1
changelog:
  - update to 1.12.2
    - drop patch for RT#7820, fixed in 1.12.2
    - drop patch for #231147, fixed as RT#3277 in 1.12.2
    - drop patch for RT#7818, fixed in 1.12.2
    - drop patch for RT#7836, fixed in 1.12.2
    - drop patch for RT#7858, fixed in 1.12.2
    - drop patch for RT#7924, fixed in 1.12.2
    - drop patch for RT#7926, fixed in 1.12.2
    - drop patches for CVE-2014-4341/CVE-2014-4342, included in 1.12.2
    - drop patch for CVE-2014-4343, included in 1.12.2
    - drop patch for CVE-2014-4344, included in 1.12.2
    - drop patch for CVE-2014-4345, included in 1.12.2
  - replace older proposed changes for ksu with backports of the changes
    after review and merging upstream (#1015559, #1026099, #1118347)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12.2-4
changelog:
  - kpropd hasn't bothered with -S since 1.11; stop trying to use that flag
    in the systemd unit file


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12.2-5
changelog:
  - backport fix for trying all compatible keys when not being strict about
    acceptor names while reading AP-REQs (RT#7883, #1078888)
  - define _GNU_SOURCE in files where we use EAI_NODATA, to make sure that
    it's declared (#1059730,#1084068,#1109102)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12.2-6
changelog:
  - backport patch to make the client skip checking the server's reply
    address when processing responses to password-change requests, which
    between NAT and upcoming HTTPS support, can cause us to erroneously
    report an error to the user when the server actually reported success
    (RT#7886)
  - backport support for accessing KDCs and kpasswd services via HTTPS
    proxies (marked by being specified as https URIs instead as hostnames
    or hostname-and-port), such as the one implemented in python-kdcproxy
    (RT#7929, #109919), and pick up a subsequent patch to build HTTPS
    as a plugin


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12.2-8
changelog:
  - fix the problem where the %license file has been a dangling symlink
  - ksu: pull in fix from pull #206 to avoid breakage when the
    default_ccache_name doesn't include a cache type as a prefix
  - ksu: pull in a proposed fix for pull #207 to avoid breakage when the
    invoking user doesn't already have a ccache


author: Roland Mainz <rmainz@redhat.com> - 1.12.2-9
changelog:
  - Undo libkadmclnt SONAME change (from 8 to 9) which originally
    happened in the krb5 1.12 rebase (#1166012) but broke
    rubygem-rkerberos (sort of ruby language bindings for
    libkadmclnt&co.) dependicies, as side effect of
    rubygem-rkerberos using private interfaces in libkadmclnt.


author: Roland Mainz <rmainz@redhat.com> - 1.12.2-10
changelog:
  - In ksu, without the -e flag, also check .k5users (#1105489)
    When ksu was explicitly told to spawn a shell, a line in .k5users which
    listed "*" as the allowed command would cause the principal named on the
    line to be considered as a candidate for authentication.
    When ksu was not passed a command to run, which implicitly meant that
    the invoking user wanted to run the target user's login shell, knowledge
    that the principal was a valid candidate was ignored, which could cause
    a less optimal choice of the default target principal.
    This doesn't impact the authorization checks which we perform later.
    Patch by Nalin Dahyabhai <nalin@redhat.com>


author: Roland Mainz <rmainz@redhat.com> - 1.12.2-13
changelog:
  - fix for CVE-2014-5352 (#1179856) "gss_process_context_token()
    incorrectly frees context (MITKRB5-SA-2015-001)"
  - fix for CVE-2014-9421 (#1179857) "kadmind doubly frees partial
    deserialization results (MITKRB5-SA-2015-001)"
  - fix for CVE-2014-9422 (#1179861) "kadmind incorrectly
    validates server principal name (MITKRB5-SA-2015-001)"
  - fix for CVE-2014-9423 (#1179863) "libgssrpc server applications
    leak uninitialized bytes (MITKRB5-SA-2015-001)"


author: Roland Mainz <rmainz@redhat.com> - 1.12.2-14
changelog:
  - fix for kinit -C loops (#1184629, MIT/krb5 issue 243, "Do not
    loop on principal unknown errors").


author: Roland Mainz <rmainz@redhat.com> - 1.13.1-0
changelog:
  - Update to krb5-1.13.1
    - patch krb5-1.12-selinux-label was updated and renamed to krb5-1.13-selinux-label
    - patch krb5-1.11-dirsrv-accountlock was updated and renamed to krb5-1.13-dirsrv-accountlock
    - drop patch for krb5-1.12-pwdch-fast, fixed in krb5-1.13
    - drop patch for krb5-1.12ish-kpasswd_tcp, fixed in krb5-1.13
    - drop patch for krb5-master-rcache-internal-const, no longer needed
    - drop patch for krb5-master-rcache-acquirecred-cleanup, no longer needed
    - drop patch for krb5-master-rcache-acquirecred-source, no longer needed
    - drop patch for krb5-master-rcache-acquirecred-test, no longer needed
    - drop patch for krb5-master-move-otp-sockets, no longer needed
    - drop patch for krb5-master-mechd, no longer needed
    - drop patch for krb5-master-strdupcheck, no longer needed
    - drop patch for krb5-master-compatible-keys, no longer needed
    - drop patch for krb5-1.12-system-exts, fixed in krb5-1.13
    - drop patch for 0001-In-ksu-merge-krb5_ccache_copy-and-_restricted, no longer needed
    - drop patch for 0002-In-ksu-don-t-stat-not-on-disk-ccache-residuals, no longer needed
    - drop patch for 0003-Use-an-intermediate-memory-cache-in-ksu, no longer needed
    - drop patch for 0004-Make-ksu-respect-the-default_ccache_name-setting, no longer needed
    - drop patch for 0005-Copy-config-entries-to-the-ksu-target-ccache, no longer needed
    - drop patch for 0006-Use-more-randomness-for-ksu-secondary-cache-names, no longer needed
    - drop patch for 0007-Make-krb5_cc_new_unique-create-DIR-directories, no longer needed
    - drop patch for krb5-1.12-kpasswd-skip-address-check, fixed in krb5-1.13
    - drop patch for 0000-Refactor-cm-functions-in-sendto_kdc.c, no longer needed
    - drop patch for 0001-Simplify-sendto_kdc.c, no longer needed
    - drop patch for 0002-Add-helper-to-determine-if-a-KDC-is-the-master, no longer needed
    - drop patch for 0003-Use-k5_transport-_strategy-enums-for-k5_sendto, no longer needed
    - drop patch for 0004-Build-support-for-TLS-used-by-HTTPS-proxy-support, no longer needed
    - drop patch for 0005-Add-ASN.1-codec-for-KKDCP-s-KDC-PROXY-MESSAGE, no longer needed
    - drop patch for 0006-Dispatch-style-protocol-switching-for-transport, no longer needed
    - drop patch for 0007-HTTPS-transport-Microsoft-KKDCPP-implementation, no longer needed
    - drop patch for 0008-Load-custom-anchors-when-using-KKDCP, no longer needed
    - drop patch for 0009-Check-names-in-the-server-s-cert-when-using-KKDCP, no longer needed
    - drop patch for 0010-Add-some-longer-form-docs-for-HTTPS, no longer needed
    - drop patch for 0011-Have-k5test.py-provide-runenv-to-python-tests, no longer needed
    - drop patch for 0012-Add-a-simple-KDC-proxy-test-server, no longer needed
    - drop patch for 0013-Add-tests-for-MS-KKDCP-client-support, no longer needed
    - drop patch for krb5-1.12ish-tls-plugins, fixed in krb5-1.13.1
    - drop patch for krb5-1.12-nodelete-plugins, fixed in krb5-1.13.1
    - drop patch for krb5-1.12-ksu-untyped-default-ccache-name, fixed in krb5-1.13.1
    - drop patch for krb5-1.12-ksu-no-ccache, fixed in krb5-1.13.1
    - drop patch for krb5-ksu_not_working_with_default_principal, fixed in krb5-1.13.1
    - drop patch for CVE_2014_5353_fix_LDAP_misused_policy_name_crash, fixed in krb5-1.13.1
    - drop patch for CVE_2014_5354_support_keyless_principals_in_ldap, fixed in krb5-1.13.1
    - drop patch for kinit -C loops (MIT/krb5 bug #243), fixed in krb5-1.13.1
    - drop patch for CVEs { 2014-9421, 2014-9422, 2014-9423, 2014-5352 }, fixed in krb5-1.13.1
    - added patch krb5-1.14-Support-KDC_ERR_MORE_PREAUTH_DATA_REQUIRED
    - added patch krb5-1.12.1-CVE_2014_5355_fix_krb5_read_message_handling
  - Minor spec cleanup


author: Roland Mainz <rmainz@redhat.com> - 1.13.1-1
changelog:
  - fix for CVE-2015-2694 (#1218020) "requires_preauth bypass
    in PKINIT-enabled KDC".
    In MIT krb5 1.12 and later, when the KDC is configured with
    PKINIT support, an unauthenticated remote attacker can
    bypass the requires_preauth flag on a client principal and
    obtain a ciphertext encrypted in the principal's long-term
    key.  This ciphertext could be used to conduct an off-line
    dictionary attack against the user's password.


author: Roland Mainz <rmainz@redhat.com> - 1.13.1-2
changelog:
  - the rebase to krb5 1.13.1 in vers 1.13.1-0 also fixed RH
    bug #1156144 ("krb5 upstream test t_kdb.py failure")


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-0
changelog:
  - Update to krb5-1.13.2
    - drop patch for krb5-1.13.2-CVE_2015_2694_requires_preauth_bypass_in_PKINIT_enabled_KDC, fixed in krb5-1.13.2
    - drop patch for krb5-1.12.1-CVE_2014_5355_fix_krb5_read_message_handling, fixed in krb5-1.13.2


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-1
changelog:
  - the rebase to krb5 1.13.1 in vers 1.13.1-0 also fixed:
    - Bug 1144498 ("Fix the race condition in the libkrb5 replay cache")
    - Bug 1163402 ("kdb5_ldap_util view_policy does not shows ticket flags on s390x and ppc64")
    - Bug 1185770 ("Missing upstream test in krb5-1.12.2: src/tests/gssapi/t_invalid.c")
    - Bug 1204211 ("CVE-2014-5355 krb5: unauthenticated denial of service in recvauth_common() and other")


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-2
changelog:
  - Add fix for RedHat Bug #1164304 ("Upstream unit tests loads
    the installed shared libraries instead the ones from the build")


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-3
changelog:
  - Add patch to fix Redhat Bug #1222903 ("[SELinux] AVC denials may appear
    when kadmind starts"). The issue was caused by an unneeded |htons()|
    which triggered SELinux AVC denials due to the "random" port usage.


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-4
changelog:
  - the rebase to krb5 1.13.2 in vers 1.13.2-0 also fixed:
    - Redhat Bug #1247761 ("RFE: Minor krb5 spec file cleanup and sync
      with recent Fedora 22/23 changes")
    - Redhat Bug #1247751 ("krb5-config returns wrong -specs path")
    - Redhat Bug #1247608 ('Add support for multi-hop preauth mechs
      via |KDC_ERR_MORE_PREAUTH_DATA_REQUIRED| for RFC 6113 ("A
      Generalized Framework for Kerberos Pre-Authentication")')
  - Removed "krb5-1.10-kprop-mktemp.patch" and
    "krb5-1.3.4-send-pr-tempfile.patch", both are no longer used since
    the rebase to krb5 1.13.1


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-5
changelog:
  - Add a patch to fix RedHat bug #1251586 ("KDC sends multiple
    requests to ipa-otpd for the same authentication") which causes
    the KDC to send multiple retries to ipa-otpd for TCP transports
    while it should only be done for UDP.


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-6
changelog:
  - Add a patch to fix RedHat bug #1252454 ('testsuite complains
    "Lifetime has increased by 32436 sec while 0 sec passed!",
    while rhel5-libkrb5 passes') so that krb5 resolves GSS creds
    if |time_rec| is requested.


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-7
changelog:
  - Obsolete multilib versions of server packages to fix RH
    bug #1251913 ("krb5 should obsolete the multilib versions
    of krb5-server and krb5-server-ldap").
    The following packages are declared obsolete:
    - krb5-server-1.11.3-49.el7.i686
    - krb5-server-1.11.3-49.el7.ppc
    - krb5-server-1.11.3-49.el7.s390
    - krb5-server-ldap-1.11.3-49.el7.i686
    - krb5-server-ldap-1.11.3-49.el7.ppc
    - krb5-server-ldap-1.11.3-49.el7.s390


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-8
changelog:
  - Add a patch to fix RH Bug #1250154 ("[s390x, ppc64, ppc64le]:
    kadmind does not accept ACL if kadm5.acl does not end with EOL")
    The code "accidently" works on x86/AMD64 because declaring a
    variable |char| results in an |unsigned char| by default while
    most other platforms (e.g. { s390x, ppc64, ppc64le, ...})
    default to |signed char| (still have to use lint(1) to clean
    up 38 more instances of this kind of bug).


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-9
changelog:
  - Ammend patch for RedHat bug #1252454 ('testsuite complains
    "Lifetime has increased by 32436 sec while 0 sec passed!",
    while rhel5-libkrb5 passes') to handle the newly introduced
    valgrind hits.


author: Robbie Harwood <rharwood@redhat.com> 1.13.2-9
changelog:
  - Add patch and test case for "KDC does not return proper
    client principal for client referrals"
  - Resolves: #1259846


author: Robbie Harwood <rharwood@redhat.com> - 1.14.1-1
changelog:
  - Rebase to new upstream version 1.14.1
  - Remove pax logic
  - Resolves: #1292153
  - Resolves: #1135427
  - Resolves: #1265509
  - Resolves: #1265510
  - Resolves: #1296241


author: Robbie Harwood <rharwood@redhat.com> - 1.14.1-16
changelog:
  - Fix kprop/iprop handling of default realm
  - Fix t_kprop.py
  - Resolves: #1290561
  - Resolves: #1302967
  - Resolves: #1292795


author: David Walluck <david@anti-microsoft.org> 0:4.1-5jpp
changelog:
  - add Distribution and Vendor tags
  - fix jpackage-utils requirement
  - change gmake to %__make
  - break %description lines


author: Dennis Gilmore <dennis@ausil.us> - 4.18-1
changelog:
  - update to 4.18
  - spec contents pulled from RHEL5 srpm 
  - fedora spec changelog
  - update buildroot
  - use jss from fedora for building


author: Rich Megginson <rmeggins@redhat.com> 0:4.18-8
changelog:
  - Resolves: bug 684012 - LDAPSchemaElement.getOptionalValues() mangles values
  - upstream bug https://bugzilla.mozilla.org/show_bug.cgi?id=640750


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - update to 1.1.7
  - change license to LGPL.
  - include splint annotations patch.
  - install info pages.


author: Nalin Dahyabhai <nalin@redhat.com> 1.2.2-2
changelog:
  - remove file conflicts in libgcrypt-config by making the 64-bit version
    think the libraries are in /usr/lib (which is wrong, but which it also
    prunes from the suggest --libs output, so no harm done, hopefully)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.2.4-4
changelog:
  - clarify license
  - force use of the linux /dev/random RNG, to avoid accidentally falling back
    to others which would affect the license of the resulting library


author: Nalin Dahyabhai <nalin@redhat.com> - 1.2.4-5
changelog:
  - add missing gawk buildrequirement
  - switch from explicitly specifying the /dev/random RNG to just verifying
    that the non-LGPL ones were disabled by the configure script


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.1-1
changelog:
  - update to 1.4.1
  - bump libgpgerror-devel requirement to 1.4, matching the requirement enforced
    by the configure script


author: Tomas Mraz <tmraz@redhat.com> 1.4.4-1
changelog:
  - update to 1.4.4
  - do not abort when the fips mode kernel flag is inaccessible
    due to permissions (#470219)
  - hobble the library to drop the ECC support


author: Tomas Mraz <tmraz@redhat.com> 1.4.5-1
changelog:
  - workaround for build on S390 (#548825)
  - spec file cleanups
  - upgrade to new minor upstream release


author: Tomas Mraz <tmraz@redhat.com> 1.4.5-3
changelog:
  - drop the S390 build workaround as it is no longer needed
  - additional spec file cleanups for merge review (#226008)


author: Tomas Mraz <tmraz@redhat.com> 1.4.5-5
changelog:
  - use /dev/urandom for seeding in the FIPS mode
  - make the tests to pass in the FIPS mode also fixing
    the FIPS-186-3 DSA keygen


author: Tomas Mraz <tmraz@redhat.com> 1.4.6-3
changelog:
  - Make the FIPS-186-3 DSA implementation CAVS testable
  - add configurable source of RNG seed /etc/gcrypt/rngseed
    in the FIPS mode (#700388)


author: Tomas Mraz <tmraz@redhat.com> 1.5.0-8
changelog:
  - fix multilib conflict in libgcrypt-config
  - fix minor memory leaks and other bugs found by Coverity scan


author: Tomáš Mráz <tmraz@redhat.com> 1.5.3-5
changelog:
  - add FIPS DRBG implementation
  - run the FIPS POST tests in shared library constructor
  - make it possible to run the test suite in the FIPS mode


author: Tomáš Mráz <tmraz@redhat.com> 1.5.3-13
changelog:
  - touch only urandom in the selftest and when /dev/random is
    unavailable for example by SELinux confinement
  - fix the RSA selftest key (p q swap)


author: Lennart Poettering <lpoetter@redhat.com> - 0-0.7.20100629git4176e5
changelog:
  - New snapshot
  - Split off -units package where other packages can depend on without pulling in the whole of systemd


author: Lennart Poettering <lpoetter@redhat.com> - 8-3
changelog:
  - Reexecute after installation, take ownership of /var/run/user
  - https://bugzilla.redhat.com/show_bug.cgi?id=627457
  - https://bugzilla.redhat.com/show_bug.cgi?id=627634


author: Lennart Poettering <lpoetter@redhat.com> - 10-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=630401
  - https://bugzilla.redhat.com/show_bug.cgi?id=630225
  - https://bugzilla.redhat.com/show_bug.cgi?id=626966
  - https://bugzilla.redhat.com/show_bug.cgi?id=623456


author: Lennart Poettering <lpoetter@redhat.com> - 14-1
changelog:
  - Upstream update
  - Enable hwclock-load by default
  - Obsolete readahead
  - Enable /var/run and /var/lock on tmpfs


author: Lennart Poettering <lpoetter@redhat.com> - 24-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=694079
  - https://bugzilla.redhat.com/show_bug.cgi?id=693289
  - https://bugzilla.redhat.com/show_bug.cgi?id=693274
  - https://bugzilla.redhat.com/show_bug.cgi?id=693161


author: Lennart Poettering <lpoetter@redhat.com> - 25-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=694788
  - https://bugzilla.redhat.com/show_bug.cgi?id=694321
  - https://bugzilla.redhat.com/show_bug.cgi?id=690253
  - https://bugzilla.redhat.com/show_bug.cgi?id=688661
  - https://bugzilla.redhat.com/show_bug.cgi?id=682662
  - https://bugzilla.redhat.com/show_bug.cgi?id=678555
  - https://bugzilla.redhat.com/show_bug.cgi?id=628004


author: Lennart Poettering <lpoetter@redhat.com> - 26-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=699394
  - https://bugzilla.redhat.com/show_bug.cgi?id=698198
  - https://bugzilla.redhat.com/show_bug.cgi?id=698674
  - https://bugzilla.redhat.com/show_bug.cgi?id=699114
  - https://bugzilla.redhat.com/show_bug.cgi?id=699128


author: Lennart Poettering <lpoetter@redhat.com> - 26-2
changelog:
  - Bugfix release
  - https://bugzilla.redhat.com/show_bug.cgi?id=707507
  - https://bugzilla.redhat.com/show_bug.cgi?id=707483
  - https://bugzilla.redhat.com/show_bug.cgi?id=705427
  - https://bugzilla.redhat.com/show_bug.cgi?id=707577


author: Michal Schmidt <mschmidt@redhat.com> - 28-3
changelog:
  - Apply patches from current upstream
  - https://bugzilla.redhat.com/show_bug.cgi?id=709909
  - https://bugzilla.redhat.com/show_bug.cgi?id=710839
  - https://bugzilla.redhat.com/show_bug.cgi?id=711015


author: Michal Schmidt <mschmidt@redhat.com> - 28-4
changelog:
  - Apply patches from current upstream.
  - Fixes memory size detection on 32-bit with >4GB RAM (BZ712341)


author: Lennart Poettering <lpoetter@redhat.com> - 35-1
changelog:
  - New upstream release
  - Update post scripts
  - Resolves: #726683, #713384, #698198, #722803, #727315, #729997, #733706, #734611


author: Michal Schmidt <mschmidt@redhat.com> - 37-2
changelog:
  - A couple of fixes from upstream:
  - Fix a regression in bash-completion reported in Bodhi.
  - Fix a crash in isolating.
  - Resolves: #717325


author: Michal Schmidt <mschmidt@redhat.com> - 38-5
changelog:
  - Build against libgee06. Reenable gtk tools.
  - Delete unused patches.
  - Add easy building of git snapshots.
  - Remove legacy spec file elements.
  - Don't mention implicit BuildRequires.
  - Configure with --disable-static.
  - Merge -units into the main package.
  - Move section 3 manpages to -devel.
  - Fix unowned directory.
  - Run ldconfig in scriptlets.
  - Split systemd-analyze to a subpackage.


author: Lennart Poettering <lpoetter@redhat.com> - 42-1
changelog:
  - New upstream release
  - Save a bit of entropy during system installation (#789407)
  - Don't own /etc/os-release anymore, leave that to fedora-release


author: Dennis Gilmore <dennis@ausil.us> - 43-2
changelog:
  - don't conflict with fedora-release systemd never actually provided
  - /etc/os-release so there is no actual conflict


author: Dennis Gilmore <dennis@ausil.us> - 44-3
changelog:
  - apply patch from upstream so we can build systemd on arm and ppc
  - and likely the rest of the secondary arches


author: Michal Schmidt <mschmidt@redhat.com> - 44-4
changelog:
  - Add triggers from Bill Nottingham to correct the damage done by
  the obsoleted systemd-units's preun scriptlet (#807457).


author: Michal Schmidt <mschmidt@redhat.com> - 185-4.gita2368a3
changelog:
  - Update to current git snapshot
  - Add systemd-readahead-analyze
  - Drop upstream patch
  - Split systemd-libs
  - Drop duplicate doc files
  - Fixed License headers of subpackages


author: Lennart Poettering <lpoetter@redhat.com> - 188-1
changelog:
  - New upstream release
  - Enable gdm and avahi by default via the preset file
  - Convert /etc/sysconfig/desktop to display-manager.service symlink
  - Enable hardened build


author: Lennart Poettering <lpoetter@redhat.com> - 188-3
changelog:
  - Remount file systems MS_PRIVATE before switching roots
  - https://bugzilla.redhat.com/show_bug.cgi?id=847418


author: Ray Strode <rstrode@redhat.com> 188-4
changelog:
  - more scriptlet fixes
  (move dm migration logic to %posttrans so the service
  files it's looking for are available at the time
  the logic is run)


author: Lennart Poettering <lpoetter@redhat.com> - 189-3
changelog:
  - Update preset policy
  - Rename preset policy file from 99-default.preset to 90-default.preset so that people can order their own stuff after the Fedora default policy if they wish


author: Lennart Poettering <lpoetter@redhat.com> - 190-1
changelog:
  - New upstream release
  - Take possession of /etc/localtime, and remove /etc/sysconfig/clock
  - https://bugzilla.redhat.com/show_bug.cgi?id=858780
  - https://bugzilla.redhat.com/show_bug.cgi?id=858787
  - https://bugzilla.redhat.com/show_bug.cgi?id=858771
  - https://bugzilla.redhat.com/show_bug.cgi?id=858754
  - https://bugzilla.redhat.com/show_bug.cgi?id=858746
  - https://bugzilla.redhat.com/show_bug.cgi?id=858266
  - https://bugzilla.redhat.com/show_bug.cgi?id=858224
  - https://bugzilla.redhat.com/show_bug.cgi?id=857670
  - https://bugzilla.redhat.com/show_bug.cgi?id=856975
  - https://bugzilla.redhat.com/show_bug.cgi?id=855863
  - https://bugzilla.redhat.com/show_bug.cgi?id=851970
  - https://bugzilla.redhat.com/show_bug.cgi?id=851275
  - https://bugzilla.redhat.com/show_bug.cgi?id=851131
  - https://bugzilla.redhat.com/show_bug.cgi?id=847472
  - https://bugzilla.redhat.com/show_bug.cgi?id=847207
  - https://bugzilla.redhat.com/show_bug.cgi?id=846483
  - https://bugzilla.redhat.com/show_bug.cgi?id=846085
  - https://bugzilla.redhat.com/show_bug.cgi?id=845973
  - https://bugzilla.redhat.com/show_bug.cgi?id=845194
  - https://bugzilla.redhat.com/show_bug.cgi?id=845028
  - https://bugzilla.redhat.com/show_bug.cgi?id=844630
  - https://bugzilla.redhat.com/show_bug.cgi?id=839736
  - https://bugzilla.redhat.com/show_bug.cgi?id=835848
  - https://bugzilla.redhat.com/show_bug.cgi?id=831740
  - https://bugzilla.redhat.com/show_bug.cgi?id=823485
  - https://bugzilla.redhat.com/show_bug.cgi?id=821813
  - https://bugzilla.redhat.com/show_bug.cgi?id=807886
  - https://bugzilla.redhat.com/show_bug.cgi?id=802198
  - https://bugzilla.redhat.com/show_bug.cgi?id=767795
  - https://bugzilla.redhat.com/show_bug.cgi?id=767561
  - https://bugzilla.redhat.com/show_bug.cgi?id=752774
  - https://bugzilla.redhat.com/show_bug.cgi?id=732874
  - https://bugzilla.redhat.com/show_bug.cgi?id=858735


author: Lennart Poettering <lpoetter@redhat.com> - 194-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=859614
  - https://bugzilla.redhat.com/show_bug.cgi?id=859655


author: Lennart Poettering <lpoetter@redhat.com> - 195-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=831665
  - https://bugzilla.redhat.com/show_bug.cgi?id=847720
  - https://bugzilla.redhat.com/show_bug.cgi?id=858693
  - https://bugzilla.redhat.com/show_bug.cgi?id=863481
  - https://bugzilla.redhat.com/show_bug.cgi?id=864629
  - https://bugzilla.redhat.com/show_bug.cgi?id=864672
  - https://bugzilla.redhat.com/show_bug.cgi?id=864674
  - https://bugzilla.redhat.com/show_bug.cgi?id=865128
  - https://bugzilla.redhat.com/show_bug.cgi?id=866346
  - https://bugzilla.redhat.com/show_bug.cgi?id=867407
  - https://bugzilla.redhat.com/show_bug.cgi?id=868603


author: Michal Schmidt <mschmidt@redhat.com> - 195-4
changelog:
  - add dmraid-activation.service to the default preset
  - add yum protected.d fragment
  - https://bugzilla.redhat.com/show_bug.cgi?id=869619
  - https://bugzilla.redhat.com/show_bug.cgi?id=869717


author: Michal Schmidt <mschmidt@redhat.com> - 195-6
changelog:
  - Fix cyclical dep between systemd and systemd-libs.
  - Avoid broken build of test-journal-syslog.
  - https://bugzilla.redhat.com/show_bug.cgi?id=873387
  - https://bugzilla.redhat.com/show_bug.cgi?id=872638


author: Michal Schmidt <mschmidt@redhat.com> - 195-7
changelog:
  - Revert udev killing cgroup patch for F18 Beta.
  - https://bugzilla.redhat.com/show_bug.cgi?id=873576


author: Lennart Poettering <lpoetter@redhat.com> - 195-8
changelog:
  - https://bugzilla.redhat.com/show_bug.cgi?id=873459
  - https://bugzilla.redhat.com/show_bug.cgi?id=878093


author: Michal Schmidt <mschmidt@redhat.com> - 196-2
changelog:
  - added spice-vdagentd.service to presets (Lennart, #876237)
  - BR cryptsetup-devel instead of the legacy cryptsetup-luks-devel provide name
  (requested by Milan Brož).
  - verbose make to see the actual build flags


author: Michal Schmidt <mschmidt@redhat.com> - 196-3
changelog:
  - Disable hardening on s390(x) because PIE is broken there and produces
  text relocations with __thread (#868839).


author: Michal Schmidt <mschmidt@redhat.com> - 197-2
changelog:
  - Added qemu-guest-agent.service to presets (Lennart, #885406).
  - Add missing pygobject3-base to systemd-analyze deps (Lennart).
  - Do not require hwdata, it is all in the hwdb now (Kay).
  - Drop dependency on dbus-python.


author: Michal Schmidt <mschmidt@redhat.com> - 201-2
changelog:
  - Automatically discover whether to run autoreconf and add autotools and git
  BuildRequires based on the presence of patches to be applied.
  - Use find -delete.


author: Harald Hoyer <harald@redhat.com> 202-2
changelog:
  - nspawn create empty /etc/resolv.conf if necessary
  - python wrapper: add sd_journal_add_conjunction()
  - fix s390 booting
  - Resolves: rhbz#953217


author: Harald Hoyer <harald@redhat.com> 202-3
changelog:
  - fix ENOENT for getaddrinfo
  - Resolves: rhbz#954012 rhbz#956035
  - crypt-setup-generator: correctly check return of strdup
  - logind-dbus: initialize result variable
  - prevent library underlinking


author: Lennart Poettering <lpoetter@redhat.com> - 204-5
changelog:
  - Rename 90-display-manager.preset to 85-display-manager.preset so that it actually takes precedence over 90-default.preset's "disable *" line (#903690)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 206-3
changelog:
  - add dependency on kmod >= 14
  - remove /var/log/journal to make journal non-persistant (#989750)
  - add hypervkvpd.service to presets (#924321)


author: Harald Hoyer <harald@redhat.com> 206-4
changelog:
  - journal: handle multiline syslog messages
  - man: Fix copy&paste error
  - core: synchronously block when logging
  - journal: immediately sync to disk as soon as we receieve an EMERG/ALERT/CRIT message
  - initctl: use irreversible jobs when switching runlevels
  - udev: log error if chmod/chown of static dev nodes fails
  - udev: static_node - don't touch permissions uneccessarily
  - tmpfiles: support passing --prefix multiple times
  - tmpfiles: introduce --exclude-prefix
  - tmpfiles-setup: exclude /dev prefixes files
  - logind: update state file after generating the session fifo, not before
  - journalctl: use _COMM= match for scripts
  - man: systemd.unit: fix volatile path
  - man: link up scope+slice units from systemd.unit(5)
  - man: there is no session mode, only user mode
  - journal: fix hashmap leak in mmap-cache
  - systemd-delta: Only print colors when on a tty
  - systemd: fix segv in snapshot creation
  - udev: hwdb - try reading modalias for usb before falling back to the composed one
  - udevd: respect the log-level set in /etc/udev/udev.conf
  - fstab-generator: respect noauto/nofail when adding sysroot mount


author: Harald Hoyer <harald@redhat.com> 206-5
changelog:
  - obsolete upstart
  Resolves: rhbz#978014
  - obsolete hal
  Resolves: rhbz#975589
  - service: always unwatch PIDs before forgetting old ones
  Resolves: rhbz#995197
  - units: disable kmod-static-nodes.service in containers
  - use CAP_MKNOD ConditionCapability
  - fstab-generator: read rd.fstab=on/off switch correctly
  - backlight: add minimal tool to save/restore screen brightness
  - backlight: instead of syspath use sysname for identifying
  - sysctl: allow overwriting of values specified in "later"
  - systemd-python: fix initialization of _Reader objects
  - udevd: simplify sigterm check
  - libudev: fix hwdb validation to look for the *new* file
  - units: make fsck units remain after exit
  - udev: replace CAP_MKNOD by writable /sys condition
  - libudev-enumerate.c:udev_enumerate_get_list_entry() fixed
  - journal: fix parsing of facility in syslog messages


author: Harald Hoyer <harald@redhat.com> 206-8
changelog:
  - support "debug" kernel command line parameter
  - journald: fix fd leak in journal_file_empty
  - journald: fix vacuuming of archived journals
  - libudev: enumerate - do not try to match against an empty subsystem
  - cgtop: fixup the online help
  - libudev: fix memleak when enumerating childs


author: Lukas Nykryn <lnykryn@redhat.com> - 207-2
changelog:
  - Advertise hibernation only if there's enough free swap
  - swap: create .wants symlink to 'auto' swap devices
  - Verify validity of session name when received from outside
  - polkit: Avoid race condition in scraping /proc
  Resolves: rhbz#1005142


author: Lukas Nykryn <lnykryn@redhat.com> - 207-5
changelog:
  - create /etc/rc.d/rc.local (#968401)
  - cgroup: always enable memory.use_hierarchy= for all cgroups (#1011575)
  - remove user@.service (#1019738)
  - drop some out-of-date references to cgroup settings (#1000004)
  - explain NAME in systemctl man page (#978954)


author: Harald Hoyer <harald@redhat.com> 207-6
changelog:
  - changed systemd-journal-gateway login shell to /sbin/nologin
  - backported a lot of bugfixes
  - udev: path_id - fix by-path link generation for scm devices
  Resolves: rhbz#888707


author: Lukas Nykryn <lnykryn@redhat.com> - 207-9
changelog:
  - treat reload failure as failure (#1036848)
  - improve journal performance (#1029604)
  - backport bugfixes (#1043525)
  - fix handling of trailing whitespace in split_quoted (#984832)
  - localed: match converted keymaps before legacy (#903776)
  - improve the description of parameter X in tmpfiles.d page (#1029604)
  - obsolete ConsoleKit (#1039761)
  - make rc.local more backward comaptible (#1039465)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 207-12
changelog:
  - shell-completion: remove load and dump from systemctl (#1048066)
  - delta: ensure that d_type will be set on every fs (#1050795)
  - tmpfiles: don't allow label_fix to print ENOENT when we want to ignore it (#1044871)
  - udev/net_id: Introduce predictable network names for Linux on System z (#870859)
  - coredumpctl: in case of error free pattern after print (#1052786)


author: Michal Sekletar <msekleta@redhat.com> - 208-1
changelog:
  - rebase to systemd-208 (#1063332)
  - do not create symlink /etc/systemd/system/syslog.service (#1055421)


author: Michal Sekletar <msekleta@redhat.com> - 208-2
changelog:
  - require redhat-release package
  - call systemd-tmpfiles after package installation (#1059345)
  - move preset policy out of systemd package (#903690)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-7
changelog:
  - setup tty permissions and group for /dev/sclp_line0 (#1070310)
  - cdrom_id: use the old MMC fallback (#1038015)
  - mount: don't send out PropertiesChanged message if actually nothing got changed (#1069718)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-8
changelog:
  - rules: mark loop device as SYSTEMD_READY=0 if no file is attached (#1067422)
  - utmp: make sure we don't write the utmp reboot record twice on each boot (#1053600)
  - rework session shutdown logic (#1047614)
  - introduce new stop protocol for unit scopes (#1064976)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-9
changelog:
  - fixes crashes in logind and systemd (#1073994)
  - run fsck before mouting root in initramfs (#1056661)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-11
changelog:
  - logind-session: save stopping flag (#1082692)
  - unit: add waiting jobs to run queue in unit_coldplug (#1083159)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-12
changelog:
  - units/serial-getty@.service: add [Install] section (#1083936)
  - units: order network-online.target after network.target (#1072431)
  - util: consider both fuse.glusterfs and glusterfs network file systems (#1080229)
  - core: make StopWhenUnneeded work in conjunction with units that fail during their start job (#986949)
  - cgroups-agent: down-grade log level (#1044386)
  - random-seed: raise POOL_SIZE_MIN constant to 1024 (#1066517)
  - delta: do not use unicode chars in C locale (#1088419)
  - core: print debug instead of error message (#1105608)
  - journald: always add syslog facility for messages coming from kmsg (#1113215)
  - fsck,fstab-generator: be lenient about missing fsck.<type> (#1098310)
  - rules/60-persistent-storage: add nvme pcie ssd scsi_id ENV (#1042990)
  - cgls: fix running with -M option (#1085455)
  - getty: Start getty on 3270 terminals available on Linux on System z (#1075729)
  - core: Added support for ERRNO NOTIFY_SOCKET  message parsing (#1106457)
  - socket: add SocketUser= and SocketGroup= for chown()ing sockets in the file system (#1111761)
  - tmpfiles: add --root option to operate on an alternate fs tree (#1111199)
  - units: make ExecStopPost action part of ExecStart (#1036276)
  - machine-id: only look into KVM uuid when we are not running in a container (#1123452)
  - util: reset signals when we fork off agents (#1134818)
  - udev: do not skip the execution of RUN when renaming a network device fails (#1102135)
  - man: mention System Administrator's Guide in systemctl manpage (#978948)
  - vconsole: also copy character maps (not just fonts) from vt1 to vt2, vt3, ... (#1002450)
  - localed: consider an unset model as a wildcard (#903776)
  - systemd-detect-virt: detect s390 virtualization (#1139149)
  - socket: introduce SELinuxContextFromNet option (#1113790)
  - sysctl: make --prefix allow all kinds of sysctl paths (#1138591)
  - man: mention localectl in locale.conf (#1049286)
  - rules: automatically online hot-added CPUs (#968811)
  - rules: add rule for naming Dell iDRAC USB Virtual NIC as 'idrac' (#1054477)
  - bash-completion: add verb set-property (#1064487)
  - man: update journald rate limit defaults (#1145352)
  - core: don't try to connect to d-bus after switchroot (#1083300)
  - localed: check for partially matching converted keymaps (#1109145)
  - fileio: make parse_env_file() return number of parsed items (#1069420)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-13
changelog:
  - tmpfiles: minor modernizations (#1147524)
  - install: when looking for a unit file for enabling, search for templates only after traversing all search directories (#1147524)
  - install: remove unused variable (#1147524)
  - bootctl: typo fix in help message (#1147524)
  - logind: ignore failing close() on session-devices (#1147524)
  - sysfs-show.c: return negative error (#1147524)
  - core: only send SIGHUP when doing first kill, not when doing final sigkill (#1147524)
  - cgroup: make sure to properly send SIGCONT to all processes of a cgroup if that's requested (#1147524)
  - core: don't send duplicate SIGCONT when killing units (#1147524)
  - efi: fix Undefined reference efi_loader_get_boot_usec when EFI support is disabled (#1147524)
  - macro: better make IN_SET() macro use const arrays (#1147524)
  - macro: make sure we can use IN_SET() also with complex function calls as first argument (#1147524)
  - core: fix property changes in transient units (#1147524)
  - load-modules: properly return a failing error code if some module fails to load (#1147524)
  - core/unit: fix unit_add_target_dependencies() for units with no dependencies (#1147524)
  - man: there is no ExecStopPre= for service units (#1147524)
  - man: document that per-interface sysctl variables are applied as network interfaces show up (#1147524)
  - journal: downgrade vaccuum message to debug level (#1147524)
  - logs-show: fix corrupt output with empty messages (#1147524)
  - journalctl: refuse extra arguments with --verify and similar (#1147524)
  - journal: assume that next entry is after previous entry (#1147524)
  - journal: forget file after encountering an error (#1147524)
  - man: update link to LSB (#1147524)
  - man: systemd-bootchart - fix spacing in command (#1147524)
  - man: add missing comma (#1147524)
  - units: Do not unescape instance name in systemd-backlight@.service (#1147524)
  - manager: flush memory stream before using the buffer (#1147524)
  - man: multiple sleep modes are to be separated by whitespace, not commas (#1147524)
  - man: fix description of systemctl --after/--before (#1147524)
  - udev: properly detect reference to unexisting part of PROGRAM's result (#1147524)
  - gpt-auto-generator: don't return OOM on parentless devices (#1147524)
  - man: improve wording of systemctl's --after/--before (#1147524)
  - cgroup: it's not OK to invoke alloca() in loops (#1147524)
  - core: don't try to relabel mounts before we loaded the policy (#1147524)
  - systemctl: --kill-mode is long long gone, don't mention it in the man page (#1147524)
  - ask-password: when the user types a overly long password, beep and refuse (#1147524)
  - logind: don't print error if devices vanish during ACL-init (#1147524)
  - tty-ask-password-agent: return negative errno (#1147524)
  - journal: cleanup up error handling in update_catalog() (#1147524)
  - bash completion: fix __get_startable_units (#1147524)
  - core: check the right variable for failed open() (#1147524)
  - man: sd_journal_send does nothing when journald is not available (#1147524)
  - man: clarify that the ExecReload= command should be synchronous (#1147524)
  - conf-parser: never consider it an error if we cannot load a drop-in file because it is missing (#1147524)
  - socket: properly handle if our service vanished during runtime (#1147524)
  - Do not unescape unit names in [Install] section (#1147524)
  - util: ignore_file should not allow files ending with '~' (#1147524)
  - core: fix invalid free() in killall() (#1147524)
  - install: fix invalid free() in unit_file_mask() (#1147524)
  - unit-name: fix detection of unit templates/instances (#1147524)
  - journald: make MaxFileSec really default to 1month (#1147524)
  - bootchart: it's not OK to return -1 from a main program (#1147524)
  - journald: Fix off-by-one error in "Missed X kernel messages" warning (#1147524)
  - man: drop references to removed and obsolete 'systemctl load' command (#1147524)
  - units: fix BindsTo= logic when applied relative to services with Type=oneshot (#1147524)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-15
changelog:
  - core: do not segfault if /proc/swaps cannot be opened (#1151239)
  - man: we don't have 'Wanted' dependency (#1152487)
  - environment: append unit_id to error messages regarding EnvironmentFile (#1147691)
  - udevd: add --event-timeout commandline option (#1154778)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-16
changelog:
  - logind: use correct "who" enum values with KillUnit. (#1155502)
  - logind: always kill session when termination is requested (#1155502)
  - udev: net_id - correctly name netdevs based on dev_port when set (#1155996)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-17
changelog:
  - udev: net_id dev_port is base 10 (#1155996)
  - udev: Fix parsing of udev.event-timeout kernel parameter (#1154778)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 217-0.2
changelog:
  - spec fixes
  - core: introduce new Delegate=yes/no property controlling creation of cgroup subhierarchies


author: Lukáš Nykrýn <lnykryn@redhat.com> - 218-0.3
changelog:
  - rebase to 218
  - remove networkd tmpfiles snipets due to packaging issues
  - add resolved subpackage
  - backport some nspawn features from upstream


author: Lukas Nykryn <lnykryn@redhat.com> - 219-2
changelog:
  - udev: restore udevadm settle timeout (#1210981)
  - udev: settle should return immediately when timeout is 0 (#1210981)
  - udev: Fix ping timeout when settle timeout is 0 (#1210981)
  - detect-virt: use /proc/device-tree (#1207773)
  - ARM: detect-virt: detect Xen (#1207773)
  - ARM: detect-virt: detect QEMU/KVM (#1207773)
  - Persistent by_path links for ata devices (#1045498)
  - man: document forwarding to syslog better (#1177336)
  - man: fix typos in previous comimt (#1177336)
  - LSB: always add network-online.target to services with priority over 10 (#1189253)
  - rules: enable memory hotplug (#1105020)
  - rules: reload sysctl settings when the bridge module is loaded (#1182105)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-3
changelog:
  - console-getty.service: don't start when /dev/console is missing (#1222517)
  - resolved: Do not add .busname dependencies, when compiling without kdbus. (#1222517)
  - man: add journal-remote.conf(5) (#1222517)
  - mount: don't run quotaon only for network filesystems (#1222517)
  - mount: fix up wording in the comment (#1222517)
  - udev: net_id - fix copy-paste error (#1222517)
  - man: don't mention "journalctl /dev/sda" (#1222517)
  - units: move After=systemd-hwdb-update.service dependency from udev to udev-trigger (#1222517)
  - units: explicitly order systemd-user-sessions.service after nss-user-lookup.target (#1222517)
  - zsh-completion: update loginctl (#1222517)
  - zsh-completion: add missing -M completion for journalctl (#1222517)
  - zsh-completion: update hostnamectl (#1222517)
  - shell-completion: systemctl switch-root verb (#1222517)
  - core/automount: beef up error message (#1222517)
  - man: remove 'fs' from 'rootfsflags' (#1222517)
  - shared: fix memleak (#1222517)
  - udevd: fix synchronization with settle when handling inotify events (#1222517)
  - python-systemd: fix is_socket_inet to cope with ports (#1222517)
  - man: fix examples indentation in tmpfiles.d(5) (#1222517)
  - systemctl: avoid bumping NOFILE rlimit unless needed (#1222517)
  - exit-status: Fix "NOTINSSTALLED" typo (#1222517)
  - tmpfiles: there's no systemd-forbid-user-logins.service service (#1222517)
  - kmod-setup: load ip_tables kmod at boot (#1222517)
  - util: Fix assertion in split() on missing ' (#1222517)
  - units: set KillMode=mixed for our daemons that fork worker processes (#1222517)
  - unit: don't add automatic dependencies on device units if they aren't supported (#1222517)
  - update-done: ignore nanosecond file timestamp components, they are not reliable (#1222517)
  - sd-daemon: simplify sd_pid_notify_with_fds (#1222517)
  - fstab-generator: add x-systemd.requires and x-systemd.requires-mounts-for (#1164334)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-4
changelog:
  - core: Fix assertion with empty Exec*= paths (#1222517)
  - rules: load sg module (#1186462)
  - util: add shell_maybe_quote() call for preparing a string for shell cmdline inclusion (#1016680)
  - bus-util: be more verbose if dbus job fails (#1016680)
  - notify: fix badly backported help message (#1199644)
  - cryptsetup: craft a unique ID with the source device (#1226333)
  - systemctl: introduce --now for enable, disable and mask (#1233081)
  - udev: also create old sas paths (#957112)
  - journald: do not strip leading whitespace from messages (#1227396)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-5
changelog:
  - Revert "core: one step back again, for nspawn we actually can't wait for cgroups running empty since systemd will get exactly zero notifications about it" (#1199644)
  - bus-creds: always set SD_BUS_CREDS_PID when we set pid in the mask (#1230190)
  - sd-bus: do not use per-datagram auxiliary information (#1230190)
  - sd-bus: store selinux context at connection time (#1230190)
  - journald: simplify context handling (#1230190)
  - bash-completion: add verb set-property (#1235635)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-6
changelog:
  - sd-bus: don't inherit connection creds into message creds when we have a direct connection (#1230190)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-8
changelog:
  - sysv-generator test: Fix assertion (#1222517)
  - man: avoid line break in url (#1222517)
  - Add VARIANT as a standard value for /etc/os-release (#1222517)
  - Fix permissions on /run/systemd/nspawn/locks (#1222517)
  - generators: rename add_{root,usr}_mount to add_{sysroot,sysroot_usr}_mount (#1222517)
  - Generate systemd-fsck-root.service in the initramfs (#1222517)
  - units: fix typo in systemd-resolved.service (#1222517)
  - core: don't consider umask for SocketMode= (#1222517)
  - timedate: fix memory leak in timedated (#1222517)
  - coredump: make sure we vacuum by default (#1222517)
  - tmpfiles: don't fail if we cannot create a subvolume because a file system is read-only but a dir already exists anyway (#1222517)
  - resolved: fix crash when shutting down (#1222517)
  - resolved: allow DnsAnswer objects with no space for RRs (#1222517)
  - id128: add new sd_id128_is_null() call (#1222517)
  - journalctl: Improve boot ID lookup (#1222517)
  - test-hashmap: fix an assert (#1222517)
  - units: make sure systemd-nspawn@.slice instances are actually located in machine.slice (#1222517)
  - Revert "journald-audit: exit gracefully in the case we can't join audit multicast group" (#1222517)
  - journald: handle more gracefully when bind() fails on audit sockets (#1222517)
  - udev: link-config - fix corruption (#1222517)
  - udev/net_id: Only read the first 64 bytes of PCI config space (#1222517)
  - shared: generator - correct path to systemd-fsck (#1222517)
  - logind: Save the user’s state when a session enters SESSION_ACTIVE (#1222517)
  - small fix ru translation (#1222517)
  - kmod-setup: don't warn when ipv6 can't be loaded (#1222517)
  - Partially revert "ma-setup: simplify" (#1222517)
  - ima-setup: write policy one line at a time (#1222517)
  - ata_id: unbotch format specifier (#1222517)
  - install: explicitly return 0 on success (#1222517)
  - systemd.service.xml: document that systemd removes the PIDFile (#1222517)
  - core: handle --log-target=null when calling systemd-shutdown (#1222517)
  - man: ProtectHome= protects /root as well (#1222517)
  - timedatectl: trim non-local RTC warning to 80 chars wide (#1222517)
  - escape: fix exit code (#1222517)
  - man: information about available properties (#1222517)
  - journal: in persistent mode create /var/log/journal, with all parents. (#1222517)
  - sysv-generator: fix wrong "Overwriting existing symlink" warnings (#1222517)
  - mount: don't claim a device is gone from /proc/self/mountinfo before it is gone from *all* lines (#1222517)
  - mount: properly check for mounts currently in /proc/self/mountinfo (#1222517)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-9
changelog:
  - units: add [Install] section to tmp.mount
  - bus-util: add articles to explanation messages (#1016680)
  - bus-util: print correct warnings for units that fail but for which we have a NULL result only (#1016680)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-11
changelog:
  - journald-server: don't read audit events (#1252409)
  - everything: remove traces of --user (#1071363)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-12
changelog:
  - selinux: fix check for transient units (#1255129)
  - socket: fix setsockopt call. SOL_SOCKET changed to SOL_TCP. (#1135599)
  - selinux: fix missing SELinux unit access check (#1185120)
  - selinux: always use *_raw API from libselinux (#1256888)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-14
changelog:
  - Revert "sysctl.d: default to fq_codel, fight bufferbloat" (#1263158)
  - loginctl: print nontrivial properties in logictl show-* (#1260465)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-15
changelog:
  - login: fix label on /run/nologin (#1264073)
  - udev-rules: prandom character device node permissions (#1264112)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-16
changelog:
  - login: fix gcc warning, include missing header file (#1264073)
  - shutdown: make sure /run/nologin has correct label (#1264073)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-17
changelog:
  - sd-event: fix prepare priority queue comparison function (#1266479)
  - units: run ldconfig also when cache is unpopulated (#1265539)
  - selinux: fix regression of systemctl subcommands when absolute unit file paths are specified (#1185120)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-19
changelog:
  - udev: make naming for virtio devices opt-in (#1269216)
  - tmpfiles.d: don't clean SAP sockets either (#1186044)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-20
changelog:
  - run: synchronously wait until the scope unit we create is started (#1272368)
  - device: rework how we enter tentative state (#1283579)
  - core: Do not bind a mount unit to a device, if it was from mountinfo (#1283579)
  - logind: set RemoveIPC=no by default (#1284588)
  - sysv-generator: follow symlinks in /etc/rc.d/init.d (#1285492)
  - sysv-generator test: always log to console (#1279034)
  - man: RemoveIPC is set to no on rhel (#1284588)
  - Avoid /tmp being mounted as tmpfs without the user's will (#1298109)
  - test sysv-generator: Check for network-online.target. (#1279034)
  - arm/aarch64: detect-virt: check dmi (#1278165)
  - detect-virt: dmi: look for KVM (#1278165)
  - Revert "journald: turn ForwardToSyslog= off by default" (#1285642)
  - terminal-util: when resetting terminals, don't wait for carrier (#1266745)
  - basic/terminal-util: introduce SYSTEMD_COLORS environment variable (#1247963)
  - ask-password: don't abort when message is missing (#1261136)
  - sysv-generator: do not join dependencies on one line, split them (#1288600)
  - udev: fibre channel: fix NPIV support (#1266934)
  - ata_id: unreverse WWN identifier (#1273306)
  - Fixup WWN bytes for big-endian systems (#1273306)
  - sd-journal: introduce has_runtime_files and has_persistent_files (#1082179)
  - journalctl: improve error messages when the specified boot is not found (#1082179)
  - journalctl: show friendly info when using -b on runtime journal only (#1082179)
  - journalctl: make "journalctl /dev/sda" work (#947636)
  - journalctl: add match for the current boot when called with devpath (#947636)
  - man: clarify what happens when journalctl is called with devpath (#947636)
  - core: downgrade warning about duplicate device names (#1296249)
  - udev: downgrade a few warnings to debug messages (#1289461)
  - man: LEVEL in systemd-analyze set-log level is not optional (#1268336)
  - Revert "udev: fibre channel: fix NPIV support" (#1266934)
  - udev: path-id: fibre channel NPIV - use fc_vport's port_name (#1266934)
  - systemctl: is-active/failed should return 0 if at least one unit is in given state (#1254650)
  - rules: set SYSTEMD_READY=0 on DM_UDEV_DISABLE_OTHER_RULES_FLAG=1 only with ADD event (#1312011)
  - s390: add personality support (#1300344)
  - socket_address_listen - do not rely on errno (#1316452)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-21
changelog:
  - path_id: reintroduce by-path links for virtio block devices (#952567)
  - journal: fix error handling when compressing journal objects (#1292447)
  - journal: irrelevant coding style fixes (#1292447)
  - install: follow unit file symlinks in /usr, but not /etc when looking for [Install] data (#1159308)
  - core: look for instance when processing template name (#1159308)
  - core: improve error message when starting template without instance (#1142369)
  - man/tmpfiles.d: add note about permissions and ownership of symlinks (#1296288)
  - tmpfiles: don't follow symlinks when adjusting ACLs, fille attributes, access modes or ownership (#1296288)
  - udev: filter out non-sensically high onboard indexes reported by the kernel (#1230210)
  - test-execute: add tests for RuntimeDirectory (#1324826)
  - core: fix group ownership when Group is set (#1324826)
  - fstab-generator: cescape device name in root-fsck service (#1306126)
  - core: add new RandomSec= setting for time units (#1305279)
  - core: rename Random* to RandomizedDelay* (#1305279)
  - journal-remote: change owner of /var/log/journal/remote and create /var/lib/systemd/journal-upload (#1327303)
  - Add Seal option in the configuration file for journald-remote (#1329233)
  - tests: fix make check failure (#1159308)
  - device: make sure to not ignore re-plugged device (#1332606)
  - device: Ensure we have sysfs path before comparing. (#1332606)
  - core: fix memory leak on set-default, enable, disable etc (#1331667)
  - nspawn: fix minor memory leak (#1331667)
  - basic: fix error/memleak in socket-util (#1331667)
  - core: fix memory leak in manager_run_generators() (#1331667)
  - modules-load: fix memory leak (#1331667)
  - core: fix memory leak on failed preset-all (#1331667)
  - sd-bus: fix memory leak in test-bus-chat (#1331667)
  - core: fix memory leak in transient units (#1331667)
  - bus: fix leak in error path (#1331667)
  - shared/logs-show: fix memleak in add_matches_for_unit (#1331667)
  - logind: introduce LockedHint and SetLockedHint (#3238) (#1335499)
  - import: use the old curl api (#1284974)
  - importd: drop dkr support (#1284974)
  - import: add support for gpg2 for verifying imported images (#1284974)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-22
changelog:
  - nspawn: when connected to pipes for stdin/stdout, pass them as-is to PID 1 (#1307080)
  - mount: remove obsolete -n (#1339721)
  - core: don't log job status message in case job was effectively NOP (#3199) (#1280014)
  - core: use an AF_UNIX/SOCK_DGRAM socket for cgroup agent notification (#1305608)
  - logind: process session/inhibitor fds at higher priority (#1305608)
  - Teach bus_append_unit_property_assignment() about 'Delegate' property (#1337922)
  - sd-netlink: fix deep recursion in message destruction (#1330593)
  - add REMOTE_ADDR and REMOTE_PORT for Accept=yes (#1341154)
  - core: don't dispatch load queue when setting Slice= for transient units (#1343904)
  - run: make --slice= work in conjunction with --scope (#1343904)
  - myhostname: fix timeout if ipv6 is disabled (#1330973)
  - readahead: do not increase nr_requests for root fs block device (#1314559)
  - manager: reduce complexity of unit_gc_sweep (#3507) (#1344556)
  - hwdb: selinuxify a bit (#3460) (#1343648)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-23
changelog:
  - udevadm: explicitly relabel /etc/udev/hwdb.bin after rename (#1350756)
  - systemctl: return diffrent error code if service exist or not (#3385) (#1047466)
  - systemctl: Replace init script error codes with enum (#3400) (#1047466)
  - systemctl: rework "systemctl status" a bit (#1047466)
  - journal-verify: don't hit SIGFPE when determining progress (#1350232)
  - journal: avoid mapping empty data and field hash tables (#1350232)
  - journal: when verifying journal files, handle empty ones nicely (#1350232)
  - journal: explain the error when we find a non-DATA object that is compressed (#1350232)
  - journalctl: properly detect empty journal files (#1350232)
  - journal: uppercase first character in verify error messages (#1350232)
  - journalctl: make sure 'journalctl -f -t unmatched' blocks (#1350232)
  - journalctl: don't print -- No entries -- in quiet mode (#1350232)
  - sd-event: expose the event loop iteration counter via sd_event_get_iteration() (#1342173)
  - manager: Only invoke a single sigchld per unit within a cleanup cycle (#1342173)
  - manager: Fixing a debug printf formatting mistake (#1342173)
  - core: support IEC suffixes for RLIMIT stuff (#1351415)
  - core: accept time units for time-based resource limits (#1351415)
  - time-util: add parse_time(), which is like parse_sec() but allows specification of default time unit if none is specified (#1351415)
  - core: support <soft:hard> ranges for RLIMIT options (#1351415)
  - core: fix rlimit parsing (#1351415)
  - core: dump rlim_cur too (#1351415)
  - install: fix disable via unit file path (#1348208)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-25
changelog:
  - units: increase watchdog timeout to 3min for all our services (#1267707)
  - core: bump net.unix.max_dgram_qlen really early during boot (#1267707)
  - core: fix priority ordering in notify-handling (#1267707)
  - tests: fix personality tests on ppc64 and aarch64 (#1361049)
  - systemctl: consider service running only when it is in active or reloading state (#3874) (#1362461)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-26
changelog:
  - install: do not crash when processing empty (masked) unit file (#1159308)
  - Revert "install: fix disable via unit file path" (#1348208)
  - systemctl: allow disable on the unit file path, but warn about it (#3806) (#1348208)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-27
changelog:
  - tmpfiles: enforce ordering when executing lines (#1365870)
  - Introduce bus_unit_check_load_state() helper (#1256858)
  - core: use bus_unit_check_load_state() in transaction_add_job_and_dependencies() (#1256858)
  - udev/path_id: correct segmentation fault due to missing NULL check (#1365556)
  - rules: load sg driver also when scsi_target appears (#45) (#1322773)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-29
changelog:
  - fix gcc warnings about uninitialized variables (#1318994)
  - journalctl: rework code that checks whether we have access to /var/log/journal (#1318994)
  - journalctl: Improve boot ID lookup (#1318994)
  - journalctl: only have a single exit path from main() (#1318994)
  - journalctl: free all command line argument objects (#1318994)
  - journalctl: rename boot_id_t to BootId (#1318994)
  - util: introduce CMSG_FOREACH() macro and make use of it everywhere (#1318994)
  - journald: don't employ inner loop for reading from incoming sockets (#1318994)
  - journald: fix count of object meta fields (#1318994)
  - journal-cat: return a correct error, not -1 (#1318994)
  - journalctl: introduce short options for --since and --until (#1318994)
  - journal: s/Envalid/Invalid/ (#1318994)
  - journald: dispatch SIGTERM/SIGINT with a low priority (#1318994)
  - lz4: fix size check which had no chance of working on big-endian (#1318994)
  - journal: normalize priority of logging sources (#1318994)
  - Fix miscalculated buffer size and uses of size-unlimited sprintf() function. (#1318994)
  - journal: Drop monotonicity check when appending to journal file (#1318994)
  - journalctl: unify how we free boot id lists a bit (#1318994)
  - journalctl: don't trust the per-field entry tables when looking for boot IDs (#1318994)
  - units: remove udev control socket when systemd stops the socket unit (#49) (#1370133)
  - logind: don't assert if the slice is missing (#1371437)
  - core: enable transient unit support for slice units (#1370299)
  - sd-bus: bump message queue size (#1371205)
  - install: fix disable when /etc/systemd/system is a symlink (#1285996)
  - rules: add NVMe rules (#3136) (#1274651)
  - rules: introduce disk/by-id (model_serial) symlinks for NVMe drives (#3974) (#1274651)
  - rules: fix for possible whitespace in the "model" attribute (#1274651)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30
changelog:
  - systemctl,pid1: do not warn about missing install info with "preset" (#1373950)
  - systemctl/core: ignore masked units in preset-all (#1375097)
  - shared/install: handle dangling aliases as an explicit case, report nicely (#1375097)
  - shared/install: ignore unit symlinks when doing preset-all (#1375097)
  - 40-redhat.rules: don't hoplug memory on s390x (#1370161)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30.1
changelog:
  - If the notification message length is 0, ignore the message (#4237) (#1381573)
  - systemctl: suppress errors with "show" for nonexistent units and properties (#1380686)
  - 40-redhat.rules: disable auto-online of hot-plugged memory on IBM z Systems (#1381123)
  - pid1: don't return any error in manager_dispatch_notify_fd() (#4240) (#1381573)
  - pid1: process zero-length notification messages again (#1381573)
  - pid1: more informative error message for ignored notifications (#1381573)


author: Michal Sekletar <msekleta@redhat.com> - 219-30.5
changelog:
  - on update from systemd version 219-21 and older generate udev rules that preserve old network interface names on VMware VMs (#1391944)


author: Simo Sorce <ssorce@redhat.com> - 0.3.0-2
changelog:
  - Try to fix build adding automake as an explicit BuildRequire
  - Add also a couple of last minute patches from upstream


author: Jakub Hrozek <jhrozek@redhat.com> - 0.3.2-1
changelog:
  - bugfix release 0.3.2
  - includes previous release patches
  - change permissions of the /etc/sssd/sssd.conf to 0600


author: Simo Sorce <ssorce@redhat.com> - 0.4.1-1
changelog:
  - add missing configure check that broke stopping the daemon
  - also fix default config to add a missing required option


author: Jakub Hrozek <jhrozek@redhat.com> - 0.4.1-4
changelog:
  - Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
    without a password. (Patch by Stephen Gallagher)


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.0-1
changelog:
  - Ensure that the configuration upgrade script always writes the config
    file with 0600 permissions
  - Eliminate an infinite loop in group enumerations


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.1-1
changelog:
  - Add SSSDConfig API
  - Update polish translation for 0.6.0
  - Fix long timeout on ldap operation
  - Make dp requests more robust


author: Stephen Gallagher <sgallagh@redhat.com> - 0.7.1-1
changelog:
  - Fix segfault in sssd_pam when cache_credentials was enabled
  - Update the sample configuration
  - Fix upgrade issues caused by data provider service removal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.2-1
changelog:
  - Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
  - Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
  - Several segfault bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.3-1
changelog:
  - Fixes link error on platforms that do not do implicit linking
  - Fixes double-free segfault in PAM
  - Fixes double-free error in async resolver
  - Fixes support for TCP-based DNS lookups in async resolver
  - Fixes memory alignment issues on ARM processors
  - Manpage fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-1.pre20100317git0ea7f19
changelog:
  - Release candidate for SSSD 1.1
  - Add simple access provider
  - Create subpackages for libcollection, libini_config, libdhash and librefarray
  - Support IPv6
  - Support LDAP referrals
  - Fix cache issues
  - Better feedback from PAM when offline


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-2
changelog:
  - Release SSSD 1.1.0 final
  - Fix two potential segfaults
  - Fix memory leak in monitor
  - Better error message for unusable confdb


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.1-1
changelog:
  - New upstream release 1.1.1
  - Fixed the IPA provider (which was segfaulting at start)
  - Fixed a bug in the SSSDConfig API causing some options to revert to
  - their defaults
  - This impacted the Authconfig UI
  - Ensure that SASL binds to LDAP auto-retry when interrupted by a signal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.91-10
changelog:
  - Release new upstream version 1.1.91
  - Enhancements when using SSSD with FreeIPA v2
  - Support for deferred kinit
  - Support for DNS SRV records for failover


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.92-11
changelog:
  - New LDAP access provider allows for filtering user access by LDAP attribute
  - Reduced default timeout for detecting offline status with LDAP
  - GSSAPI ticket lifetime made configurable
  - Better offline->online transition support in Kerberos


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-12
changelog:
  - New stable upstream version 1.2.0
  - Support ServiceGroups for FreeIPA v2 HBAC rules
  - Fix long-standing issue with auth_provider = proxy
  - Better logging for TLS issues in LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-15
changelog:
  - New stable upstream version 1.2.1
  - Resolves: rhbz#595529 - spec file should eschew %define in favor of
  -                         %global
  - Resolves: rhbz#593644 - Empty list of simple_allow_users causes sssd service
  -                         to fail while restart.
  - Resolves: rhbz#599026 - Makefile typo causes SSSD not to use the kernel
  -                         keyring
  - Resolves: rhbz#599724 - sssd is broken on Rawhide


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.91-20
changelog:
  - New upstream version 1.2.91 (1.3.0rc1)
  - Improved LDAP failover
  - Synchronous sysdb API (provides performance enhancements)
  - Better online reconnection detection


author: Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-30
changelog:
  - Resolves: CVE-2010-2940 - sssd allows null password entry to authenticate
  -                           against LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-32
changelog:
  - Resolves: rhbz#637955 - libini_config-devel needs libcollection-devel but
  -                         doesn't require it


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.0-1
changelog:
  - New upstream release 1.4.0
  - Added support for netgroups to the LDAP provider
  - Performance improvements made to group processing of RFC2307 LDAP servers
  - Fixed nested group issues with RFC2307bis LDAP servers without a memberOf plugin
  - Build-system improvements to support Gentoo
  - Split out several libraries into the ding-libs tarball
  - Manpage reviewed and updated


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-1
changelog:
  - New upstream release 1.4.1
  - Add support for netgroups to the proxy provider
  - Fixes a minor bug with UIDs/GIDs >= 2^31
  - Fixes a segfault in the kerberos provider
  - Fixes a segfault in the NSS responder if a data provider crashes
  - Correctly use sdap_netgroup_search_base


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-3
changelog:
  - Solve a shutdown race-condition that sometimes left processes running
  - Resolves: rhbz#606887 - SSSD stops on upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.0-1
changelog:
  - New upstream release 1.5.0
  - Fixed issues with LDAP search filters that needed to be escaped
  - Add Kerberos FAST support on platforms that support it
  - Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
  - Added a Kerberos access provider to honor .k5login
  - Addressed several thread-safety issues in the sss_client code
  - Improved support for delayed online Kerberos auth
  - Significantly reduced time between connecting to the network/VPN and
  - acquiring a TGT
  - Added feature for automatic Kerberos ticket renewal
  - Provides the kerberos ticket for long-lived processes or cron jobs
  - even when the user logs out
  - Added several new features to the LDAP access provider
  - Support for 'shadow' access control
  - Support for authorizedService access control
  - Ability to mix-and-match LDAP access control features
  - Added an option for a separate password-change LDAP server for those
  - platforms where LDAP referrals are not supported
  - Added support for manpage translations


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-1
changelog:
  - New upstream release 1.5.1
  - Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
  - Vast performance improvements when enumerate = true
  - All PAM actions will now perform a forced initgroups lookup instead of just
  - a user information lookup
  -   This guarantees that all group information is available to other
  -   providers, such as the simple provider.
  - For backwards-compatibility, DNS lookups will also fall back to trying the
  - SSSD domain name as a DNS discovery domain.
  - Support for more password expiration policies in LDAP
  -    389 Directory Server
  -    FreeIPA
  -    ActiveDirectory
  - Support for ldap_tls_{cert,key,cipher_suite} config options
  -Assorted bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-3
changelog:
  - Fix nested group member filter sanitization for RFC2307bis
  - Put translated tool manpages into the sssd-tools subpackage


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-8
changelog:
  - Resolves: rhbz#677768 - name service caches names, so id command shows
  -                         recently deleted users


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.2-1
changelog:
  - New upstream release 1.5.2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.2
  - Fixes for support of FreeIPA v2
  - Fixes for failover if DNS entries change
  - Improved sss_obfuscate tool with better interactive mode
  - Fix several crash bugs
  - Don't attempt to use START_TLS over SSL. Some LDAP servers can't handle this
  - Delete users from the local cache if initgroups calls return 'no such user'
  - (previously only worked for getpwnam/getpwuid)
  - Use new Transifex.net translations
  - Better support for automatic TGT renewal (now survives restart)
  - Netgroup fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.4-1
changelog:
  - New upstream release 1.5.4
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.4
  - Fixes for Active Directory when not all users and groups have POSIX attributes
  - Fixes for handling users and groups that have name aliases (aliases are ignored)
  - Fix group memberships after initgroups in the IPA provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-1
changelog:
  - New upstream release 1.5.5
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.5
  - Fixes for several crash bugs
  - LDAP group lookups will no longer abort if there is a zero-length member
  - attribute
  - Add automatic fallback to 'cn' if the 'gecos' attribute does not exist


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-3
changelog:
  - Fix systemd conversion. Upgrades from SysV to systemd weren't properly
  - enabling the systemd service.
  - Fix a serious memory leak in the memberOf plugin
  - Fix an issue where the user's full name would sometimes be removed
  - from the cache


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-5
changelog:
  - Resolves: rhbz#697057 - kpasswd fails when using sssd and
  -                         kadmin server != kdc server
  - Upgrades from SysV should now maintain enabled/disabled status


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.6-1
changelog:
  - New upstream release 1.5.6
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.6
  - Fixed a serious memory leak in the memberOf plugin
  - Fixed a regression with the negative cache that caused it to be essentially
  - nonfunctional
  - Fixed an issue where the user's full name would sometimes be removed from
  - the cache
  - Fixed an issue with password changes in the kerberos provider not working
  - with kpasswd


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-1
changelog:
  - Resolves: rhbz#700891 - CVE-2011-1758 sssd: automatic TGT renewal overwrites
  -                         cached password with predicatable filename


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-3
changelog:
  - Resolves: rhbz#706740 - Orphaned links on rc0.d-rc6.d
  - Make sure to properly convert to systemd if upgrading from newer
  - updates for Fedora 14


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.8-1
changelog:
  - New upstream release 1.5.8
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.8
  - Support for the LDAP paging control
  - Support for multiple DNS servers for name resolution
  - Fixes for several group membership bugs
  - Fixes for rare crash bugs


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.9-1
changelog:
  - New upstream release 1.5.9
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.9
  - Support for overriding home directory, shell and primary GID locally
  - Properly honor TTL values from SRV record lookups
  - Support non-POSIX groups in nested group chains (for RFC2307bis LDAP
  - servers)
  - Properly escape IPv6 addresses in the failover code
  - Do not crash if inotify fails (e.g. resource exhaustion)
  - Don't add multiple TGT renewal callbacks (too many log messages)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.10-1
changelog:
  - New upstream release 1.5.10
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.10
  - Fixed a regression introduced in 1.5.9 that could result in blocking calls
  - to LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.11-2
changelog:
  - New upstream release 1.5.11
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.11
  - Fix a serious regression that prevented SSSD from working with ldaps:// URIs
  - IPA Provider: Fix a bug with dynamic DNS that resulted in the wrong IPv6
  - address being saved to the AAAA record


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.0-1
changelog:
  - New upstream release 1.6.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.0
  - Add host access control support for LDAP (similar to pam_host_attr)
  - Finer-grained control on principals used with Kerberos (such as for FAST or
  - validation)
  - Added a new tool sss_cache to allow selective expiring of cached entries
  - Added support for LDAP DEREF and ASQ controls
  - Added access control features for Novell Directory Server
  - FreeIPA dynamic DNS update now checks first to see if an update is needed
  - Complete rewrite of the HBAC library
  - New libraries: libipa_hbac and libipa_hbac-python


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.1-1
changelog:
  - New upstream release 1.6.1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.1
  - Fixes a serious issue with LDAP connections when the communication is
    dropped (e.g. VPN disconnection, waking from sleep)
  - SSSD is now less strict when dealing with users/groups with multiple names
    when a definitive primary name cannot be determined
  - The LDAP provider will no longer attempt to canonicalize by default when
    using SASL. An option to re-enable this has been provided.
  - Fixes for non-standard LDAP attribute names (e.g. those used by Active
    Directory)
  - Three HBAC regressions have been fixed.
  - Fix for an infinite loop in the deref code


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.2-1
changelog:
  - Improved handling of users and groups with multi-valued name attributes
    (aliases)
  - Performance enhancements
      Initgroups on RFC2307bis/FreeIPA
      HBAC rule processing
  - Improved process-hang detection and restarting
  - Enabled the midpoint cache refresh by default (fewer cache misses on
    commonly-used entries)
  - Cleaned up the example configuration
  - New tool to change debug level on the fly


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.2-4
changelog:
  - Change selinux policy requirement to Conflicts: with the old version,
    rather than Requires: the supported version.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.3-1
changelog:
  - New upstream release 1.6.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.3
  - Fixes a major cache performance issue introduced in 1.6.2
  - Fixes a potential infinite-loop with certain LDAP layouts


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.3-4
changelog:
  - Resolves: rhbz#753639 - sssd_nss crashes when passed invalid UTF-8 for the
                            username in getpwnam()
  - Resolves: rhbz#758425 - LDAP failover not working if server refuses
                            connections


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.4-1
changelog:
  - New upstream release 1.6.4
  - Rolls up previous patches applied to the 1.6.3 tarball
  - Fixes a rare issue causing crashes in the failover logic
  - Fixes an issue where SSSD would return the wrong PAM error code for users
    that it does not recognize.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-1
changelog:
  - New upstream release 1.7.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.7.0
  - Support for case-insensitive domains
  - Support for multiple search bases in the LDAP provider
  - Support for the native FreeIPA netgroup implementation
  - Reliability improvements to the process monitor
  - New DEBUG facility with more consistent log levels
  - New tool to change debug log levels without restarting SSSD
  - SSSD will now disconnect from LDAP server when idle
  - FreeIPA HBAC rules can choose to ignore srchost options for significant
    performance gains
  - Assorted performance improvements in the LDAP provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-3
changelog:
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-5
changelog:
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features - fix netgroups and sudo as well


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-1.beta1
changelog:
  - New upstream release
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta1
  - Support for the service map in NSS
  - Support for setting default SELinux user context from FreeIPA
  - Support for retrieving SSH user and host keys from LDAP (Experimental)
  - Support for caching autofs LDAP requests (Experimental)
  - Support for caching SUDO rules (Experimental)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-1.beta2
changelog:
  - New upstream release
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta2
  - Fix two minor manpage bugs
  - Include the IPA AutoFS provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-4.beta3
changelog:
  - New upstream release 1.8.0 beta 3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta3
  - Fixed a regression in group enumeration since 1.7.0
  - Fixed several memory-corruption bugs
  - Finalized the ABI for the autofs support
  - Fixed a regression in the proxy provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-6
changelog:
  - New upstream release 1.8.0
  - Support for the service map in NSS
  - Support for setting default SELinux user context from FreeIPA
  - Support for retrieving SSH user and host keys from LDAP (Experimental)
  - Support for caching autofs LDAP requests (Experimental)
  - Support for caching SUDO rules (Experimental)
  - Include the IPA AutoFS provider
  - Fixed several memory-corruption bugs
  - Fixed a regression in group enumeration since 1.7.0
  - Fixed a regression in the proxy provider
  - Resolves: rhbz#741981 - Separate Cache Timeouts for SSSD
  - Resolves: rhbz#797968 - sssd_be: The requested tar get is not configured is
                            logged at each login
  - Resolves: rhbz#754114 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process
                            /usr/sbin/sssd was killed by signal 11 (SIGSEGV)
  - Resolves: rhbz#743133 - Performance regression with Kerberos authentication
                            against AD
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features
  - Resolves: rhbz#786957 - sssd and kerberos should change the default location for create the Credential Cashes to /run/usr/USERNAME/krb5cc


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-7
changelog:
  - New upstream release 1.8.1
  - Resolve issue where we could enter an infinite loop trying to connect to an
    auth server
  - Fix serious issue with complex (3+ levels) nested groups
  - Fix netgroup support for case-insensitivity and aliases
  - Fix serious issue with lookup bundling resulting in requests never
    completing
  - IPA provider will now check the value of nsAccountLock during pam_acct_mgmt
    in addition to pam_authenticate
  - Fix several regressions in the proxy provider
  - Resolves: rhbz#743133 - Performance regression with Kerberos authentication
                            against AD
  - Resolves: rhbz#799031 - --debug option for sss_debuglevel doesn't work


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-8
changelog:
  - Fix uninitialized value bug causing crashes throughout the code
  - Resolves: rhbz#804783 - [abrt] Segfault during LDAP 'services' lookup


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-9
changelog:
  - Don't duplicate libsss_autofs.so in two packages
  - Set explicit package contents instead of globbing


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.2-10
changelog:
  - New upstream release 1.8.2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.2
  - Several fixes to case-insensitive domain functions
  - Fix for GSSAPI binds when the keytab contains unrelated principals
  - Fixed several segfaults
  - Workarounds added for LDAP servers with unreadable RootDSE
  - SSH knownhostproxy will no longer enter an infinite loop preventing login
  - The provided SYSV init script now starts SSSD earlier at startup and stops
    it later during shutdown
  - Assorted minor fixes for issues discovered by static analysis tools


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.3-11
changelog:
  - New upstream release 1.8.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.3
  - Numerous manpage and translation updates
  - LDAP: Handle situations where the RootDSE isn't available anonymously
  - LDAP: Fix regression for users using non-standard LDAP attributes for user
    information


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-1.beta1
changelog:
  - New upstream release 1.9.0 beta 1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta1
  - Add native support for autofs to the IPA provider
  - Support for ID-mapping when connecting to Active Directory
  - Support for handling very large (> 1500 users) groups in Active Directory
  - Support for sub-domains (will be used for dealing with trust relationships)
  - Add a new fast in-memory cache to speed up lookups of cached data on
    repeated requests


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-2.beta1
changelog:
  - Fix several regressions since 1.5.x
  - Ensure that the RPM creates the /var/lib/sss/mc directory
  - Add support for Netscape password warning expiration control
  - Rebuild against libldb 1.1.6


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-5.beta2
changelog:
  - New upstream release 1.9.0 beta 2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta2
  - Add support for the Kerberos DIR cache for storing multiple TGTs
    automatically
  - Major performance enhancement when storing large groups in the cache
  - Major performance enhancement when performing initgroups() against Active
    Directory
  - SSSDConfig data file default locations can now be set during configure for
    easier packaging


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-7.beta2
changelog:
  - Switch unicode library from libunistring to Glib
  - Drop unnecessary explicit Requires on keyutils
  - Guarantee that versioned Requires include the correct architecture


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-8.beta3
changelog:
  - New upstream release 1.9.0 beta 3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta3
  - Add a new PAC responder for dealing with cross-realm Kerberos trusts
  - Terminate idle connections to the NSS and PAM responders


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-9.beta4
changelog:
  - New upstream release 1.9.0 beta 4
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta4
  - Add a new AD provider to improve integration with Active Directory 2008 R2
    or later servers
  - SUDO integration was completely rewritten. The new implementation works
    with multiple domains and uses an improved refresh mechanism to download
    only the necessary rules
  - The IPA authentication provider now supports subdomains
  - Fixed regression for setups that were setting default_tkt_enctypes
    manually by reverting a previous workaround.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-12.beta5
changelog:
  - New upstream release 1.9.0 beta 5
  - Obsoletes the patch for missing DP_OPTION_TERMINATOR in AD provider options
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta5
  - Many fixes for the support for setting default SELinux user context from
    FreeIPA, most notably fixed the specificity evaluation
  - Fixed an incorrect default in the krb5_canonicalize option of the AD
    provider which was preventing password change operation
  - The shadowLastChange attribute value is now correctly updated with the
    number of days since the Epoch, not seconds


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-13.beta6
changelog:
  - New upstream release 1.9.0 beta 6
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta6
  - A new option, override_shell was added. If this option is set, all users
    managed by SSSD will have their shell set to its value.
  - Fixes for the support for setting default SELinux user context from FreeIPA.
  - Fixed a regression introduced in beta 5 that broke LDAP SASL binds
  - The SSSD supports the concept of a Primary Server and a Back Up Server in
    failover
  - A new command-line tool sss_seed is available to help prime the cache with
    a user record when deploying a new machine
  - SSSD is now able to discover and save the domain-realm mappings
    between an IPA server and a trusted Active Directory server.
  - Packaging changes to fix ldconfig usage in subpackages (#843995)
  - Rebuild against libldb 1.1.9


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-14.beta6
changelog:
  - Don't discard HBAC rule processing result if SELinux is on
    Resolves: rhbz#846792 (CVE-2012-3462)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-18.beta6
changelog:
  - Change the default ccache location to DIR:/run/user/${UID}/krb5cc
    and patch man page accordingly
  - Resolves: rhbz#851304


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.4-3
changelog:
  - Recreate Kerberos ccache directory if it's missing
  - Resolves: rhbz#853558 - [sssd[krb5_child[PID]]]: Credential cache
                            directory /run/user/UID/ccdir does not exist


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-4.beta1
changelog:
  - Explicitly Require libini_config >= 1.0.0.1 to work around a SONAME bug
    in ding-libs
  - Fix SSH integration with fully-qualified domains
  - Add the ability to dynamically discover the NetBIOS name


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-5.beta1
changelog:
  - Resolves: rhbz#961357 - Missing dyndns_update entry in sssd.conf during
                            realm join
  - Resolves: rhbz#961278 - Login failure: Enterprise Principal enabled by
                            default for AD Provider
  - Resolves: rhbz#961251 - sssd does not create user's krb5 ccache dir/file
                            parent directory when logging in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-6.beta1
changelog:
  - Apply a couple of patches from upstream git that resolve crashes when
    ID mapping object was not initialized properly but needed later


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-8.beta2
changelog:
  - New upstream release 1.10 beta2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta2
  - BuildRequire libcmocka-devel in order to run all upstream tests during build
  - BuildRequire libnl3 instead of libnl1
  - No longer BuildRequire initscripts, we no longer use /sbin/service
  - Remove explicit krb5-libs >= 1.10 requires; this platform doensn't carry any
    older krb5-libs version


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-9.beta2
changelog:
  - Fix typo in Requires that prevented an upgrade (#973916)
  - Use a hardcoded version in Conflicts, not less-than-current


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-11.beta2
changelog:
  - Apply a number of patches from upstream to fix issues found post-beta,
    in particular:
    -- segfault with a high DEBUG level
    -- Fix IPA password migration (upstream #1873)
    -- Fix fail over when retrying SRV resolution (upstream #1886)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.10.0-14
changelog:
  - Fix Obsoletes: to account for dist tag
  - Convert post and pre scripts to run on the sssd-common subpackage
  - Remove old conversion from SYSV


author: Stephen Gallagher <sgallagh@redhat.com> - 1.10.0-16
changelog:
  - Move sssd_pac to the sssd-ipa and sssd-ad subpackages
  - Trim out RHEL5-specific macros since we don't build on RHEL 5
  - Trim out macros for Fedora older than F18
  - Update libldb requirement to 1.1.16
  - Trim RPM changelog down to the last year


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-2
changelog:
  - Apply several important fixes from upstream 1.10 branch
  - Related: #966757 - SSSD failover doesn't work if the first DNS server
                       in resolv.conf is unavailable


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-3
changelog:
  - Resolves: #983580 - Netgroups should ignore the 'use_fully_qualified_names'
                        setting


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-4
changelog:
  - Resolves: #983587 - sss_debuglevel did not increase verbosity in
                        sssd_pac.log


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-5
changelog:
  - Resolves: #906427 - Do not use lib in specfile for the nss and
                        pam libraries


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0.1beta2
changelog:
  - New upstream release 1.11 beta 2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.0beta2
  - Related: rhbz#991065


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-1
changelog:
  - New upstream release 1.11.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.0
  - Resolves: rhbz#991065


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.1-1
changelog:
  - New upstream release 1.11.1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.1
  - Resolves: rhbz#991065 - Rebase SSSD to 1.11.0


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.1-2
changelog:
  - Resolves: rhbz#1019882 - RHEL7 ipa ad trusted user lookups failed with
                             sssd_be crash
  - Resolves: rhbz#1002597 - ad: unable to resolve membership when user is
                             from different domain than group


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-1
changelog:
  - New upstream release 1.11.2
  - Remove upstreamed patches
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.2
  - Resolves: rhbz#991065


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-2
changelog:
  - Skip netgroups that don't provide well-formed triplets
  - Related: rhbz#991549 -  sssd fails to retrieve netgroups with multiple
                            CN attributes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-3
changelog:
  - Resolves: rhbz#991549 - sssd fails to retrieve netgroups with multiple
                            CN attributes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-4
changelog:
  - Resolves: rhbz#1031562 - Incorrect mention of access_filter in sssd-ad
                             manpage


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-5
changelog:
  - Resolves: rhbz#1033084 - sssd_be segfaults if empty grop is resolved
                             using ad_matching_rule


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-6
changelog:
  - Resolves: rhbz#1028057 - Improve detection of the right domain when
                             processing group with members from several domains


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-7
changelog:
  - Resolves: rhbz#1036157 - sssd can't retrieve auto.master when using the
                             "default_domain_suffix" option in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-9
changelog:
  - Resolves: rhbz#1036758 - SSSD: Allow for custom attributes in RDN when
                             using id_provider = proxy


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-10
changelog:
  - Resolves: rhbz#1029631 - sssd_be crashes on manually adding a cleartext
                             password to ldap_default_authtok


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-11
changelog:
  - Resolves: rhbz#1038637 - If SSSD starts offline, subdomains list is
                             never read


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-13
changelog:
  - Resolves: rhbz#1023409 - Valgrind sssd "Syscall param
                             socketcall.sendto(msg) points to uninitialised
                             byte(s)"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-14
changelog:
  - Resolves: rhbz#1040969 - sssd_nss grows memory footprint when netgroups
                             are requested


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-15
changelog:
  - Resolves: rhbz#1033096 - tokenGroups do not work reliable with Global
                             Catalog
  - Resolves: rhbz#1030483 - Individual group search returned multiple
                             results in GC lookups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-16
changelog:
  - The AD provider is able to resolve group memberships for groups with
    Global and Universal scope
  - Related: rhbz#1033096 - tokenGroups do not work reliable with Global
                            Catalog


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-17
changelog:
  - Re-initialize subdomains after provider startup
  - Related: rhbz#1038637 - If SSSD starts offline, subdomains list is
                            never read


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-21
changelog:
  - Resolves: rhbz#1048184 - Group lookup does not return member with multiple
                             names after user lookup


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-22
changelog:
  - Resolves: rhbz#1032983 - sssd_be crashes when ad_access_filter uses
                             FOREST keyword.
  - Fix two memory leaks in the PAC responder (Related: rhbz#991065)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-23
changelog:
  - Resolves: rhbz#1033133 - "System Error" when invalid ad_access_filter
                              is used


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-25
changelog:
  - Resolves: rhbz#1053106 - sssd ad trusted sub domain do not inherit
                             fallbacks and overrides settings


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-26
changelog:
  - Resolves: rhbz#1048102 - Access denied for users from gc domain when
                             using format DOMAIN\user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-28
changelog:
  - Resolves: rhbz#1054639 - sssd_be aborts a request if it doesn't match
                             any configured idmap domain
  - Fix return value when searching for AD domain flat names
  - Resolves: rhbz#1048102 - Access denied for users from gc domain when
                             using format DOMAIN\user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-29
changelog:
  - Resolves: rhbz#1051360 - [FJ7.0 Bug]: [REG] sssd_be crashes when
                             ldap_search_base cannot be parsed.
  - Fix a typo in the man page
  - Related: rhbz#1034920 - RHEL7 sssd not setting IPA AD trusted user homedir


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-30
changelog:
  - Resolves: rhbz#1037653 - Enabling ldap_id_mapping doesn't exclude
                             uidNumber in filter


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-31
changelog:
  - Resolves: rhbz#1054899 - explicitly suggest krb5_auth_timeout in a loud
                             DEBUG message in case Kerberos authentication
                             times out


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-32
changelog:
  - Resolves: rhbz#1054639 - sssd_be aborts a request if it doesn't match
                             any configured idmap domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-34
changelog:
  - Resolves: rhbz#877438 - sudoNotBefore/sudoNotAfter not supported by sssd
                            sudoers plugin


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-35
changelog:
  - Resolves: rhbz#1028039 - AD Enumeration reads data from LDAP while
                             regular lookups connect to GC


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-36
changelog:
  - Resolves: rhbz#1059253 - Man page states default_shell option supersedes
                             other shell options but in fact override_shell does.
  - Use the right domain for AD site resolution
  - Related: rhbz#743503 -  [RFE] sssd should support DNS sites


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-38
changelog:
  - Resolves: rhbz#1059753 - Warn with a user-friendly error message when
                             permissions on sssd.conf are incorrect


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-39
changelog:
  - Resolves: rhbz#872177 - [RFE] subdomain homedir template should be
                            configurable/use flatname by default


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-40
changelog:
  - Resolves: rhbz#1033081 - Implement heuristics to detect if POSIX attributes
                             have been replicated to the Global Catalog or not


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-41
changelog:
  - Resolves: rhbz#1064582 - sss_cache does not reset the SYSDB_INITGR_EXPIRE
                             attribute when expiring users


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-43
changelog:
  - Resolves: rhbz#1068640 - 'IPA: Don't call tevent_req_post outside _send'
                             should be added to RHEL7


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-44
changelog:
  - Resolves: rhbz#1033069 - Configuring two different provider types might
                             start two parallel enumeration tasks


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-45
changelog:
  - Resolves: rhbz#1067476 - SSSD pam module accepts usernames with leading
                             spaces


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-48
changelog:
  - Resolves: rhbz#1064908 - MAN: Remove misleading memberof example from
                             ldap_access_filter example


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-49
changelog:
  - Resolves: rhbz#1060389 - Document that `sssd` cache needs to be cleared
                             manually, if ID mapping configuration changes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-50
changelog:
  - Pull some follow up man page fixes from upstream
  - Related: rhbz#1060389 - Document that `sssd` cache needs to be cleared
                            manually, if ID mapping configuration changes
  - Related: rhbz#1064908 - MAN: Remove misleading memberof example from
                            ldap_access_filter example


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-51
changelog:
  - Fix idmap documentation
  - Bump idmap version info
  - Related: rhbz#1067361 - Check IPA idranges before saving them to the cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-52
changelog:
  - Resolves: rhbz#1068725 - Evaluate usage of sudo LDAP provider together
                             with the AD provider


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-53
changelog:
  - Resolves: rhbz#1071903 - ipa-server-mode: Use lower-case user name
                             component in home dir path


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-54
changelog:
  - Resolves: rhbz#1072067 - SSSD Does not cache SELinux map from FreeIPA
                             correctly


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-55
changelog:
  - Resolves: rhbz#1073631 - sssd fails to handle expired passwords
                             when OTP is used


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-56
changelog:
  - Related: rhbz#1072995 -  AD group inconsistency when using AD provider
                             in sssd-1.11-40


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-57
changelog:
  - Related: rhbz#1066096 - not retrieving homedirs of AD users with
                            posix attributes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-58
changelog:
  - Related: rhbz#1073635 - IPA SELinux code looks for the host in the wrong
                            sysdb subdir when a trusted user logs in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-59
changelog:
  - Related: rhbz#1075621 - Add another Kerberos error code to trigger IPA
                            password migration


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-60
changelog:
  - Resolves: rhbz#1075663 - SSSD should create the SELinux mapping file
                             with format expected by pam_selinux


author: Sumit Bose <sbose@redhat.com> - 1.11.2-63
changelog:
  - Resolves: rhbz#1078877 - Valgrind: Invalid read of int while processing
                             netgroup


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-64
changelog:
  - Resolves: rhbz#1077328 - other subdomains are unavailable when joined
                             to a subdomain in the ad forest


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-65
changelog:
  - Resolves: rhbz#1082191 - RHEL7 IPA selinuxusermap hbac rule not always
                             matching


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-66
changelog:
  - Resolves: rhbz#1090653 - segfault in sssd_be when second domain tree
                             users are queried while joined to child domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-67
changelog:
  - Fix a DEBUG message, backport two related fixes
  - Related: rhbz#1090653 - segfault in sssd_be when second domain tree
                             users are queried while joined to child domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-68
changelog:
  - Resolves: rhbz#1097286 - Expanding home directory fails when the request
                             comes from the PAC responder


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-69
changelog:
  - Backport a patch to allow krb5-utils-test to run as root
  - Related: rhbz#1097286 - Expanding home directory fails when the request
                            comes from the PAC responder


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-70
changelog:
  - Squash in upstream review comments about the PAC patch
  - Related: rhbz#1097286 - Expanding home directory fails when the request
                            comes from the PAC responder


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-2
changelog:
  - Use libsemanage for SELinux label changes
  - Resolves: rhbz#1113784 - sssd should audit selinux user map changes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-3
changelog:
  - Add the low-level server changes for running as unprivileged user
  - Package the libsss_semange library needed for SELinux label changes
  - Related: rhbz#1113783 - sssd should run under unprivileged user 
  - Resolves: rhbz#1113784 - sssd should audit selinux user map changes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-4
changelog:
  - Fix regressions caused by views patches when SSSD is connected to a
    pre-4.0 IPA server
  - Related: rhbz#1109756 - Rebase SSSD to 1.12


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-5
changelog:
  - Amend the sssd-ldap man page with info about lockout setup
  - Related: rhbz#1109756 - Rebase SSSD to 1.12
  - Resolves: rhbz#1137014 - Shell fallback mechanism in SSSD 
  - Resolves: rhbz#790854 - 4 functions with reference leaks within sssd (src/python/pyhbac.c)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-6
changelog:
  - Include the responder and packaging patches for rootless sssd
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-7
changelog:
  - Resolves: rhbz#1153518 - service lookups returned in lowercase with
                             case_sensitive=preserving
  - Resolves: rhbz#1158809 - Enumeration shows only a single group multiple
                             times


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-8
changelog:
  - Support overriding SSH public keys with views
  - Support extended attributes via the extop plugin
  - Related: rhbz#1109756 - Rebase SSSD to 1.12
  - Resolves: rhbz#1137010 - disable midpoint refresh for netgroups if ptask
                             refresh is enabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-9
changelog:
  - Include the ldap_child and selinux_child patches for rootless sssd
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-10
changelog:
  - Fix two regressions in the new selinux_child process
  - Related: rhbz#1113783 - sssd should run under unprivileged user
  - Resolves: rhbz#1132365 - Remove password from the PAM stack if OTP is used


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-12
changelog:
  - Move adding the user from pretrans to pre, copy adding the user to
    sssd-krb5-common and sssd-ipa as well in order to work around yum
    ordering issue
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-15
changelog:
  - Resolves: rhbz#1153603 - Proxy Provider: Fails to lookup case sensitive
                             users and groups with case_sensitive=preserving


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-16
changelog:
  - Use upstreamed patches for the rootless sssd
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-17
changelog:
  - Update man page to clarify TGs should be disabled with a custom search base
  - Related: rhbz#1161741 - TokenGroups for LDAP provider breaks in corner cases


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-18
changelog:
  - Support views for IPA users
  - Related: rhbz#891984 - [RFE] ID Views: Support migration from the sync
                           solution to the trust solution


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-19
changelog:
  - Resolves: rhbz#1153593 - Manpage description of case_sensitive=preserving
                            is incomplete


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-20
changelog:
  - Resolves: rhbz#1163742 - "debug_timestamps = false" and "debug_microseconds
                             = true" do not work after enabling journald
                             with sssd.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-22
changelog:
  - Handle IPA group names returned from the extop plugin
  - Related: rhbz#891984 - [RFE] ID Views: Support migration from the sync
                           solution to the trust solution


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-23
changelog:
  - Add an option that describes where to put generated krb5 files to
  - Related: rhbz#1135043 - [RFE] Implement localauth plugin for MIT krb5 1.12


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-24
changelog:
  - Resolves: rhbz#1165794 - sssd does not work with custom value of option
                             re_expression


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-25
changelog:
  - Use alternatives for libwbclient
  - Related: rhbz#1109331 - [RFE] Allow SSSD to be used with smbd shares


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-26
changelog:
  - Handle migrating clients between views
  - Related: rhbz#891984 - [RFE] ID Views: Support migration from the sync
                           solution to the trust solution


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-27
changelog:
  - Resolves: rhbz#1166727 - pam_sss domains option: Untrusted users from
                             the same domain are allowed to auth.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-28
changelog:
  - Fix typo in libwbclient-devel alternatives invocation
  - Related: rhbz#1109331 - [RFE] Allow SSSD to be used with smbd shares


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-30
changelog:
  - krb5_child and ldap_child do not call Kerberos calls as root
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-31
changelog:
  - Resolves: rhbz#1169739 - selinuxusermap rule does not apply to trusted
                             AD users
  - Enable running unit tests without cmocka
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-32
changelog:
  - Resolves: rhbz#1124320 - [FJ7.0 Bug]: getgrent returns error because sss
                             is written in nsswitch.conf as default.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-34
changelog:
  - Resolves: rhbz#1173482 - MAN: Document that only user names are checked
                             for pam_trusted_users
  - Resolves: rhbz#1167324 - pam_sss domains option: User auth should fail
                             when domains=<emtpy value>


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-35
changelog:
  - Remove Coverity warnings in krb5_child code
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-35
changelog:
  - Rebuild to add several forgotten Patch entries
  - Resolves: rhbz#1173482 - MAN: Document that only user names are checked
                             for pam_trusted_users
  - Resolves: rhbz#1167324 - pam_sss domains option: User auth should fail
                             when domains=<emtpy value>


author: Sumit Bose <sbose@redhat.com> - 1.12.2-37
changelog:
  - Resolves: rhbz#1169459 - sssd-ad: The man page description to enable GPO HBAC
                             Policies are unclear
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Sumit Bose <sbose@redhat.com> - 1.12.2-38
changelog:
  - Resolves: rhbz#1171215 - Crash in function get_object_from_cache
  - Resolves: rhbz#1171383 - getent fails for posix group with AD users after
                             login
  - Resolves: rhbz#1171382 - getent of AD universal group fails after group users
                             login
  - Resolves: rhbz#1170300 - Access is not rejected for disabled domain
  - Resolves: rhbz#1162486 - Error processing external groups with
                             getgrnam/getgrgid in the server mode
  - Resolves: rhbz#1168904 - gid is overridden by uid in default trust view


author: Sumit Bose <sbose@redhat.com> - 1.12.2-39
changelog:
  - Resolves: rhbz#1175408 - SSSD should not fail authentication when only allow
                             rules are used
  - Resolves: rhbz#1175705 - sssd-libwbclient conflicts with Samba's and causes
                             crash in wbinfo
                             - in addition to the patch libwbclient.so is
                               filtered out of the Provides list of the package


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-40
changelog:
  - Resolves: rhbz#1177140 - gpo_child fails if "log level" is enabled in smb.conf
  - Related: rhbz#1168904 - gid is overridden by uid in default trust view


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-43
changelog:
  - Resolves: rhbz#1182183 - pam_sss(sshd:auth): authentication failure with
                             user from AD


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-44
changelog:
  - Resolves: rhbz#1184140 - Users saved throug extop don't have the
                             originalMemberOf attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-45
changelog:
  - Open socket to the PAC responder in krb5_child before dropping root
  - Related: rhbz#1184140 - Users saved throug extop don't have the
                            originalMemberOf attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-46
changelog:
  - Handle GID override in MPG domains
  - Handle views with mixed-case domains
  - Related: rhbz#1168904 - gid is overridden by uid in default trust view


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-48
changelog:
  - Related: rhbz#1184140 - Users saved throug extop don't have the
                            originalMemberOf attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-49
changelog:
  - Process ghost members only once
  - Fix processing of universal groups with members from different domains
  - Related: rhbz#1168904 - gid is overridden by uid in default trust view


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-50
changelog:
  - Add a patch dependency
  - Related: rhbz#1184140 - Users saved throug extop don't have the
                            originalMemberOf attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-51
changelog:
  - Bump the release number
  - Related: rhbz#1184140 - Users saved throug extop don't have the
                            originalMemberOf attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-53
changelog:
  - Resolves: rhbz#1187192 - IPA initgroups don't work correctly in
                             non-default view


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-55
changelog:
  - Fix endianess bug in fill_id()
  - Related: rhbz#1109331 - [RFE] Allow SSSD to be used with smbd shares


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-57
changelog:
  - Run the restart in sssd-common posttrans
  - Explicitly require libwbclient
  - Resolves: rhbz#1187113 - sssd deamon was not running after RHEL 7.1 upgrade


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-58.2
changelog:
  - Resolves: rhbz#1199143 - With empty ipaselinuxusermapdefault security
                             context on client is staff_u


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-58.3
changelog:
  - Set a pointer in ldap_child to NULL to avoid warnings
  - Related: rhbz#1198759 - ccname_file_dummy is not unlinked on error


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-58.4
changelog:
  - Handle case where there is no default and no rules
  - Resolves: rhbz#1192314 - With empty ipaselinuxusermapdefault security
                             context on client is staff_u


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-58.5
changelog:
  - Resolves: rhbz#1202170 - sssd_be segfault on IPA(when auth with AD
                             trusted domain) client at
                             src/providers/ipa/ipa_s2n_exop.c:1605


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-58.6
changelog:
  - Initialize variable in the views code in one success and one failure path
  - Resolves: rhbz#1202170 - sssd_be segfault on IPA(when auth with AD
                             trusted domain) client at
                             src/providers/ipa/ipa_s2n_exop.c:1605


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-59
changelog:
  - Resolves: rhbz#1201840 - SSSD downloads too much information when fetching
                             information about groups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-60
changelog:
  - Filter out domain-local groups during AD initgroups operation
  - Related: rhbz#1201840 - SSSD downloads too much information when fetching
                            information about groups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0.1alpha
changelog:
  - Resolves: rhbz#1205554 - Rebase SSSD to 1.13.x
  - Relax the libldb requirement
  - Resolves: rhbz#1221992 - sssd_be segfault at 0 ip sp error 6 in
                             libtevent.so.0.9.21
  - Resolves: rhbz#1221839 - SSSD group enumeration inconsistent due to
                             binary SIDs
  - Resolves: rhbz#1219285 - Unable to resolve group memberships for AD
                             users when using sssd-1.12.2-58.el7_1.6.x86_64
                             client in combination with
                             ipa-server-3.0.0-42.el6.x86_64 with AD Trust
  - Resolves: rhbz#1217559 - [RFE] Support GPOs from different domain controllers
  - Resolves: rhbz#1217350 - ignore_group_members doesn't work for subdomains
  - Resolves: rhbz#1217127 - Override for IPA users with login does not list
                             user all groups
  - Resolves: rhbz#1216285 - autofs provider fails when default_domain_suffix
                             and use_fully_qualified_names set
  - Resolves: rhbz#1214719 - Group resolution is inconsistent with group
                             overrides
  - Resolves: rhbz#1214718 - Overridde with --login fails trusted adusers
                             group membership resolution
  - Resolves: rhbz#1214716 - idoverridegroup for ipa group with --group-name
                             does not work
  - Resolves: rhbz#1214337 - Overrides with --login work in second attempt
  - Resolves: rhbz#1212489 - Disable the cleanup task by default
  - Resolves: rhbz#1211830 - external users do not resolve with
                             "default_domain_suffix" set in IPA server sssd.conf
  - Resolves: rhbz#1210854 - Only set the selinux context if the context
                             differs from the local one
  - Resolves: rhbz#1209483 - When using id_provider=proxy with
                             auth_provider=ldap, it does not work as expected
  - Resolves: rhbz#1209374 - Man sssd-ad(5) lists Group Policy Management
                             Editor naming for some policies but not for all
  - Resolves: rhbz#1208507 - sysdb sudo search doesn't escape special characters
  - Resolves: rhbz#1206571 - [RFE] Expose D-BUS interface
  - Resolves: rhbz#1206566 - SSSD does not update Dynamic DNS records if
                             the IPA domain differs from machine hostname's
                             domain
  - Resolves: rhbz#1206189 - [bug] sssd always appends default_domain_suffix
                             when checking for host keys
  - Resolves: rhbz#1204203 - sssd crashes intermittently
  - Resolves: rhbz#1203945 - [FJ7.0 Bug]: getgrent returns error because
                             sss is written in nsswitch.conf as default
  - Resolves: rhbz#1203642 - GPO access control looks for computer object
                             in user's domain only
  - Resolves: rhbz#1202245 - SSSD's HBAC processing is not permissive enough
                             with broken replication entries
  - Resolves: rhbz#1201271 - sssd_nss segfaults if initgroups request is by
                             UPN and doesn't find anything
  - Resolves: rhbz#1200873 - [RFE] Allow smart multi step prompting when
                             user logs in with password and token code from IPA
  - Resolves: rhbz#1199541 - Read and use the TTL value when resolving a
                             SRV query
  - Resolves: rhbz#1199533 - [RFE] Implement background refresh for users,
                             groups or other cache objects
  - Resolves: rhbz#1199445 - Does sssd-ad use the most suitable attribute
                             for group name?
  - Resolves: rhbz#1198477 - ccname_file_dummy is not unlinked on error
  - Resolves: rhbz#1187103 - [RFE] User's home directories are not taken
                             from AD when there is an IPA trust with AD
  - Resolves: rhbz#1185536 - In ipa-ad trust, with 'default_domain_suffix' set
                             to AD domain, IPA user are not able to log unless
                             use_fully_qualified_names is set
  - Resolves: rhbz#1175760 - [RFE] Have OpenLDAP lock out ssh keys when
                             account naturally expires
  - Resolves: rhbz#1163806 - [RFE]ad provider dns_discovery_domain option:
                             kerberos discovery is not using this option
  - Resolves: rhbz#1205160 - Complain loudly if backend doesn't start due
                             to missing or invalid keytab


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-1
changelog:
  - Rebase to 1.13.0 upstream
  - Related: rhbz#1205554 - Rebase SSSD to 1.13.x
  - Resolves: rhbz#910187 - [RFE] authenticate against cache in SSSD
  - Resolves: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-3
changelog:
  - Add support for InfoPipe wildcard requests
  - Resolves: rhbz#1206571 - [RFE] Expose D-BUS interface


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-6
changelog:
  - Resolves: rhbz#1206565 - [RFE] Add dualstack and multihomed support
  - Resolves: rhbz#1187146 - If v4 address exists, will not create nonexistant
                             v6 in ipa domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-8
changelog:
  - Remove OTP from PAM stack correctly
  - Related: rhbz#1200873 - [RFE] Allow smart multi step prompting when
                            user logs in with password and token code from IPA
  - Handle sssd-owned keytabs when sssd runs as root
  - Related: rhbz#1205144 - RFE: Support one-way trusts for IPA


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-9
changelog:
  - Fix memory cache integration tests
  - Resolves: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups
  - Resolves: rhbz#854396 - [RFE] Support for smart cards


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-10
changelog:
  - Resolves: rhbz#1244949 - getgrgid for user's UID on a trust client
                             prevents getpw*


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-11
changelog:
  - Remove binary blob from SC patches as patch(1) can't handle those
  - Related: rhbz#854396 - [RFE] Support for smart cards


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-12
changelog:
  - More memory cache related fixes
  - Related: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.0-13
changelog:
  - Fix missing dependency of sssd-tools
  - Resolves: rhbz#1246489 - sss_obfuscate fails with "ImportError: No module
                             named pysss"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-14
changelog:
  - Bump release number
  - Related: rhbz#1246489 - sss_obfuscate fails with "ImportError: No module
                            named pysss"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-15
changelog:
  - Resolves: rhbz#1249015 - KDC proxy not working with SSSD krb5_use_kdcinfo
                             enabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-16
changelog:
  - Fix race condition in invalidating the memory cache
  - Related: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-19
changelog:
  - Resolves: rhbz#1202724 - [RFE] Add a way to lookup users based on CAC
                             identity certificates


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-20
changelog:
  - Related: rhbz#1250135 - Detect re-established trusts in the IPA
                            subdomain code


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-22
changelog:
  - Resolves: rhbz#1244950 - Add index for 'objectSIDString' and maybe to
                             other cache attributes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-23
changelog:
  - Support import/export for local overrides
  - Support FQDNs for local overrides
  - Resolves: rhbz#1254184 - sss_override does not work correctly when
                             'use_fully_qualified_names = True'


author: Martin Kosek <mkosek@redhat.com> - 1.13.0-25
changelog:
  - Resolves: rhbz#1254189 - sss_override contains an extra parameter --debug
                             but is not listed in the man page or in
                             the arguments help


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-26
changelog:
  - Resolves: rhbz#1256398 - sssd cannot resolve user names containing
                             backslash with ldap provider


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-29
changelog:
  - Resolves: rhbz#1263587 - sss_override --name doesn't work with RFC2307
                             and ghost users


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-30
changelog:
  - Patches required for better handling of failover with one-way trusts
  - Related: rhbz#1250135 - Detect re-established trusts in the IPA subdomain
                            code


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-31
changelog:
  - Remove -d from sss_override manpage
  - Related: rhbz#1259512 - sss_override : The local override user is not found


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-33
changelog:
  - Resolves: rhbz#1261155 - nsupdate exits on first GSSAPI error instead
                             of processing other commands


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-34
changelog:
  - Fix a Coverity warning in dyndns code
  - Resolves: rhbz#1261155 - nsupdate exits on first GSSAPI error instead
                             of processing other commands


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-35
changelog:
  - Resolves: rhbz#1250135 - Detect re-established trusts in the IPA
                             subdomain code


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-36
changelog:
  - Resolves: rhbz#1266107 - AD: Conditional jump or move depends on
                             uninitialised value


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-40
changelog:
  - Resolves: rhbz#1270827 - local overrides: don't contact server with
                             overridden name/id


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-42
changelog:
  - Resolves: rhbz#1300740 - [RFE] IPA: resolve external group memberships
                             of IPA groups during getgrnam and getgrgid


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-44
changelog:
  - Resolves: rhbz#1308913 - sssd be memory leak in sssd's memberof plugin
  - More patches from upstream related to the memory leak


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-45
changelog:
  - Resolves: rhbz#1334159 - IPA provider crashes if a netgroup from a
                             trusted domain is requested


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-46
changelog:
  - Resolves: rhbz#1296902 - In IPA-AD trust environment access is granted
                             to AD user even if the user is disabled on AD.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-47
changelog:
  - Resolves: rhbz#1336706 - sssd_nss memory usage keeps growing when trying
                             to retrieve non-existing netgroups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-48
changelog:
  - Resolves: rhbz#1290853 - [sssd] Trusted (AD) user's info stays in sssd
                             cache for much more than expected.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-49
changelog:
  - Resolves: rhbz#1336688 - sssd tries to resolve global catalog servers
                             from AD forest sub-domains in AD-IPA trust setup


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-50
changelog:
  - Build the PAC plugin with krb5-1.14
  - Related: rhbz#1336688 - sssd tries to resolve global catalog servers
                            from AD forest sub-domains in AD-IPA trust setup


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0alpha-1
changelog:
  - Resolves: rhbz#1290381 - Rebase SSSD to 1.14.x in RHEL-7.3
  - The rebase includes fixes for the following bugzillas:
  - Resolves: rhbz#789477 - [RFE] SUDO: Support the IPA schema
  - Resolves: rhbz#1059972 - RFE: SSSD: Automatically assign new slices for
                             any AD domain
  - Resolves: rhbz#1233200 - man sssd.conf should clarify details about
                             subdomain_inherit option.
  - Resolves: rhbz#1238144 - Need better libhbac debuging added to sssd
  - Resolves: rhbz#1265366 - sss_override segfaults when accidentally adding
                             --help flag to some commands
  - Resolves: rhbz#1269512 - sss_override: memory violation
  - Resolves: rhbz#1278566 - crash in sssd when non-Englsh locale is used
                             and pam_strerror prints non-ASCII characters
  - Resolves: rhbz#1283686 - groups get deleted from the cache
  - Resolves: rhbz#1290378 - Smart Cards: Certificate in the ID View
  - Resolves: rhbz#1292238 - extreme memory usage in libnfsidmap sss.so
                             plug-in when resolving groups with many members
  - Resolves: rhbz#1292456 - sssd_be AD segfaults on missing A record
  - Resolves: rhbz#1294670 - Local users with local sudo rules causes
                             LDAP queries
  - Resolves: rhbz#1296618 - Properly remove OriginalMemberOf attribute in
                             SSSD cache if user has no secondary groups anymore
  - Resolves: rhbz#1299553 - Cannot retrieve users after upgrade from 1.12
                             to 1.13
  - Resolves: rhbz#1302821 - Cannot start sssd after switching to non-root
  - Resolves: rhbz#1310877 - [RFE] Support Automatic Renewing of Kerberos
                             Host Keytabs
  - Resolves: rhbz#1313014 - sssd is not closing sockets properly
  - Resolves: rhbz#1318996 - SSSD does not fail over to next GC
  - Resolves: rhbz#1327270 - local overrides: issues with sub-domain users
                             and mixed case names
  - Resolves: rhbz#1342547 - sssd-libwbclient: wbcSidsToUnixIds should not
                             fail on lookup errors


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0beta1-2
changelog:
  - Resolves: rhbz#1290381 - Rebase SSSD to 1.14.x in RHEL-7.3
  - Resolves: rhbz#790113 - [RFE] "include" directive in sssd.conf
  - Resolves: rhbz#874985 - [RFE] AD provider support for automount lookups
  - Resolves: rhbz#879333 - [RFE] SSSD admin tool request - status overview
  - Resolves: rhbz#1140022 - [RFE]Allow sssd to add a new option that would
                             specify which server to update DNS with
  - Resolves: rhbz#1290380 - RFE: Improve SSSD performance in large
                             environments
  - Resolves: rhbz#883886 - sssd: incorrect checks on length values during
                            packet decoding
  - Resolves: rhbz#988207 - sssd does not detail which line in configuration
                            is invalid
  - Resolves: rhbz#1007969 - sssd_cache does not remove have an option to
                             remove the sssd database
  - Resolves: rhbz#1103249 - PAC responder needs much time to process large
                             group lists
  - Resolves: rhbz#1118257 - Users in ipa groups, added to netgroups are
                             not resovable
  - Resolves: rhbz#1269018 - Too much logging from sssd_be
  - Resolves: rhbz#1293695 - sssd mixup nested group from AD trusted domains
  - Resolves: rhbz#1308935 - After removing certificate from user in IPA
                             and even after sss_cache, FindByCertificate
                             still finds the user
  - Resolves: rhbz#1315766 - SSSD PAM module does not support multiple
                             password prompts (e.g. Password + Token) with sudo
  - Resolves: rhbz#1316164 - SSSD fails to process GPO from Active Directory
  - Resolves: rhbz#1322458 - sssd_be[11010]: segfault at 0 ip 00007ff889ff61bb
                             sp 00007ffc7d66a3b0 error 4 in
                             libsss_ipa.so[7ff889fcf000+5d000]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-1
changelog:
  - New upstream release 1.14.0
  - Resolves: rhbz#1290381 - Rebase SSSD to 1.14.x in RHEL-7.3
  - Resolves: rhbz#835492 - [RFE] SSSD admin tool request - force reload
  - Resolves: rhbz#1072458 - [RFE] SSSD configuration file test tool (sssd_check)
  - Resolves: rhbz#1278691 - Please fix rfc2307 autofs schema defaults
  - Resolves: rhbz#1287209 - default_domain_suffix Appended to User Name
  - Resolves: rhbz#1300663 - Improve sudo protocol to support configurations
                             with default_domain_suffix
  - Resolves: rhbz#1312275 - Support authentication indicators from IPA


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-2
changelog:
  - Explicitly BuildRequire newer ding-libs
  - Resolves: rhbz#1072458 - [RFE] SSSD configuration file test tool (sssd_check)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-3
changelog:
  - Sync a few minor patches from upstream
  - Fix a failover issue
  - Resolves: rhbz#1334749 - sssd fails to mark a connection as bad on
                             searches that time out


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-5
changelog:
  - Sync a few minor patches from upstream
  - Fix sssctl manpage
  - Fix nss-tests unit test on big-endian machines
  - Fix several issues in the config schema
  - Related: rhbz#1072458 - [RFE] SSSD configuration file test tool (sssd_check)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-6
changelog:
  - Resolves: rhbz#1349882 - sssd does not work under non-root user
  - Also cherry-pick a few patches from upstream to fix config schema
  - Related: rhbz#1072458 - [RFE] SSSD configuration file test tool (sssd_check)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-7
changelog:
  - Resolves: rhbz#1350520 - [abrt] sssd-common: ipa_dyndns_update_send():
                             sssd_be killed by SIGSEGV


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-9
changelog:
  - Resolves: rhbz#1354414 - New or modified ID-View User overrides are not
                             visible unless rm -f /var/lib/sss/db/*cache*


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-11
changelog:
  - fix capaths output
  - Resolves: rhbz#1344940 - GSSAPI error causes failures for child domain
                             user logins across IPA - AD trust
  - also fix Coverity issues in the secrets responder and suppress noisy
    debug messages when setting the timestamp cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-12
changelog:
  - handle unresolvable sites more gracefully
  - Resolves: rhbz#1346011 - sssd is looking at a server in the GC of a
                             subdomain, not the root domain.
  - fix compilation warnings in unit tests


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-13
changelog:
  - Resolves: rhbz#1304992 - Handle overriden name of members in the
                             memberUid attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-15
changelog:
  - Resolves: rhbz#1364118 - [abrt] [faf] sssd: unknown function():
                             /usr/libexec/sssd/sssd_nss killed by 11
  - Resolves: rhbz#1361563 - Wrong pam error code returned for password
                             change in offline mode


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-16
changelog:
  - Cherry-pick patches from upstream that fix several regressions
  - Avoid checking local users in all cases
  - Resolves: rhbz#1353951 - sssd_pam leaks file descriptors


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-17
changelog:
  - Fix regressions in the simple access provider
  - Resolves: rhbz#1360806 - sssd does not start if sub-domain user is used
                             with simple access provider
  - Apply a number of specfile patches to better match the upstream spefile
  - Related: rhbz#1290381 - Rebase SSSD to 1.14.x in RHEL-7.3


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-18
changelog:
  - Resolves: rhbz#1349900 - gpo search errors out and gpo_cache file is
                             never created


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-19
changelog:
  - Add several small fixes related to the config API
  - Related: rhbz#1072458 - [RFE] SSSD configuration file test tool (sssd_check)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-20
changelog:
  - Resolves: rhbz#1290500 - [feat] command to manually list
                             fo_add_server_to_list information


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-21
changelog:
  - Resolves: rhbz#1271280 - sssd stores and returns incorrect information
                             about empty netgroup (ldap-server: 389-ds)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-22
changelog:
  - Resolves: rhbz#1268874 - Add an option to disable checking for trusted
                             domains in the subdomains provider


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-24
changelog:
  - Add socket-activation plumbing for the sssd-secrets responder
  - Related: rhbz#1311056 - Add a Secrets as a Service component


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-25
changelog:
  - Fix RPM scriptlet plumbing for the sssd-secrets responder
  - Related: rhbz#1311056 - Add a Secrets as a Service component


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-26
changelog:
  - Resolves: rhbz#1368324 - libsss_autofs.so is packaged in two packages
                             sssd-common and libsss_autofs


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-27
changelog:
  - Resolves: rhbz#1362023 - SSSD fails to start when ldap_user_extra_attrs
                             contains mail


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-28
changelog:
  - Resolves: rhbz#1364033 - sssd exits if clock is adjusted backwards
                             after boot


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-31
changelog:
  - Apply forgotten patch
  - Resolves: rhbz#1368496 - sssd is not able to authenticate with alias
  - Resolves: rhbz#1366470 - sssd: throw away the timestamp cache if
                             re-initializing the persistent cache
  - Fix deleting non-existent secret
  - Related: rhbz#1311056 - Add a Secrets as a Service component


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-32
changelog:
  - Resolves: rhbz#1371152 - SSSD qualifies principal twice in IPA-AD trust
                             if the principal attribute doesn't exist on the
                             AD side


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-35
changelog:
  - Fix permissions for the private pipe directory
  - Resolves: rhbz#1362716 - selinux avc denial for vsftp login as ipa user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-37
changelog:
  - Resolves: rhbz#1373444 - unable to create group in sssd cache
  - Resolves: rhbz#1373577 - unable to add local user in sssd to a group in sssd


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-38
changelog:
  - Resolves: rhbz#1372753 - Access denied for user when access_provider =
                             krb5 is set in sssd.conf


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-39
changelog:
  - Resolves: rhbz#1375182 - SSSD goes offline when the LDAP server returns
                             sizelimit exceeded


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-40
changelog:
  - Resolves: rhbz#1375299 - sss_groupshow <user> fails with error "No such
                             group in local domain. Printing groups only
                             allowed in local domain"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-42
changelog:
  - Resolves: rhbz#1371631 - login using gdm calls for gdm-smartcard when
                             smartcard authentication is not enabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-43.1
changelog:
  - Resolves: rhbz#1392896 - AD provider: SSSD does not retrieve a domain-local
                             group with the AD provider when following AGGUDLP
                             group structure across domains


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-43.4
changelog:
  - Revert the fix for ignoring sudoUser case as it breaks processing
    of rules that completely lack a sudoUser attribute
  - Related: rhbz#1392946 - sudo: ignore case on case insensitive domains


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-5
changelog:
  - Resolves: #906427 - Do not use lib64 in specfile for the nss and
                        pam libraries


author: Daniel Veillard <veillard@redhat.com> 0.0.6-1
changelog:
  - added error handling APIs
  - small bug fixes
  - improve python bindings
  - augment documentation and regression tests


author: Daniel Veillard <veillard@redhat.com> 0.1.0-1
changelog:
  - various fixes
  - new APIs: for Node information and Reboot
  - virsh improvements and extensions
  - documentation updates and man page
  - enhancement and fixes of the XML description format


author: Daniel Veillard <veillard@redhat.com> 0.1.1-1
changelog:
  - extend and cleanup the driver infrastructure and code
  - python examples
  - extend uuid support
  - bug fixes, buffer handling cleanups
  - support for new Xen hypervisor API
  - test driver for unit testing
  - virsh --conect argument


author: Daniel Veillard <veillard@redhat.com> 0.1.4-1
changelog:
  - vCPUs and affinity support
  - more complete XML, console and boot options
  - specific features support
  - enforced read-only connections
  - various improvements, bug fixes


author: Daniel Veillard <veillard@redhat.com> 0.1.5-1
changelog:
  - new release
  - bug fixes
  - support for new hypervisor calls
  - early code for config files and defined domains


author: Daniel Veillard <veillard@redhat.com> 0.1.6-1
changelog:
  - Support for localization
  - Support for new Xen-3.0.3 cdrom and disk configuration
  - Support for setting VNC port
  - Fix bug when running against xen-3.0.2 hypercalls
  - Fix reconnection problem when talking directly to http xend


author: Daniel Veillard <veillard@redhat.com> 0.1.7-1
changelog:
  - Fix bug when running against xen-3.0.3 hypercalls
  - Fix memory bug when getting vcpus info from xend


author: Daniel Veillard <veillard@redhat.com> 0.1.8-1
changelog:
  - fix missing page size detection code for ia64
  - fix mlock size when getting domain info list from hypervisor
  - vcpu number initialization
  - don't label crashed domains as shut off
  - fix virsh man page
  - blktapdd support for alternate drivers like blktap
  - memory leak fixes (xend interface and XML parsing)
  - compile fix
  - mlock/munlock size fixes


author: Daniel Veillard <veillard@redhat.com> 0.1.9-1
changelog:
  - better error reporting
  - python bindings fixes and extensions
  - add support for shareable drives
  - add support for non-bridge style networking
  - hot plug device support
  - added support for inactive domains
  - API to dump core of domains
  - various bug fixes, cleanups and improvements
  - updated the localization


author: Daniel Veillard <veillard@redhat.com> 0.1.10-1.fc7
changelog:
  - support for inactive Xen domains
  - improved support for Xen display and vnc
  - a few bug fixes
  - localization updates


author: Daniel P. Berrange <berrange@redhat.com> - 0.2.0-2.fc7
changelog:
  - Fixed path to qemu daemon for autostart
  - Fixed generation of <features> block in XML
  - Pre-create config directory at startup


author: Daniel P. Berrange <berrange@redhat.com> - 0.2.0-3.fc7
changelog:
  - Disable kqemu support since its not in Fedora qemu binary
  - Fix for -vnc arg syntax change in 0.9.0  QEMU


author: Daniel Veillard <veillard@redhat.com> - 0.2.1-1
changelog:
  - Release of 0.2.1
  - lot of bug and portability fixes
  - Add support for network autostart and init scripts
  - New API to detect the virtualization capabilities of a host
  - Documentation updates


author: Jeremy Katz <katzj@redhat.com> - 0.2.1-2.fc7
changelog:
  - don't require xen; we don't need the daemon and can control non-xen now
  - fix scriptlet error (need to own more directories)
  - update description text


author: Daniel Veillard <veillard@redhat.com> - 0.2.3-1
changelog:
  - Release of 0.2.3
  - lot of assorted bugfixes and cleanups
  - support for Xen-3.1
  - new scheduler API


author: Daniel Veillard <veillard@redhat.com> - 0.3.0-1
changelog:
  - Release of 0.3.0
  - Secure remote access support
  - unification of daemons
  - lots of assorted bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.3.1-1
changelog:
  - Release of 0.3.1
  - localtime clock support
  - PS/2 and USB input devices
  - lots of assorted bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.3.2-1
changelog:
  - Release of 0.3.2
  - API for domains migration
  - APIs for collecting statistics on disks and interfaces
  - lots of assorted bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.3.3-1
changelog:
  - Release of 0.3.3
  - Avahi support
  - NUMA support
  - lots of assorted improvements, bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.4.0-1
changelog:
  - Release of 0.4.0
  - SASL based authentication
  - PolicyKit authentication
  - improved NUMA and statistics support
  - lots of assorted improvements, bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.4.1-1
changelog:
  - Release of 0.4.1
  - Storage APIs
  - xenner support
  - lots of assorted improvements, bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.7.0-1
changelog:
  - ESX, VBox3, Power Hypervisor drivers
  - new net filesystem glusterfs
  - Storage cloning for LVM and Disk backends
  - interface implementation based on netcf
  - Support cgroups in QEMU driver
  - QEmu hotplug NIC support
  - a lot of fixes


author: Mark McLoughlin <markmc@redhat.com> - 0.7.0-2
changelog:
  - Make sure qemu can access kernel/initrd (bug #516034)
  - Set perms on /var/lib/libvirt/boot to 0711 (bug #516034)


author: Mark McLoughlin <markmc@redhat.com> - 0.7.0-5
changelog:
  - Add PCI host device hotplug support
  - Allow PCI bus reset to reset other devices (#499678)
  - Fix stupid PCI reset error message (bug #499678)
  - Allow PM reset on multi-function PCI devices (bug #515689)
  - Re-attach PCI host devices after guest shuts down (bug #499561)
  - Fix list corruption after disk hot-unplug
  - Fix minor 'virsh nodedev-list --tree' annoyance


author: Mark McLoughlin <markmc@redhat.com> - 0.7.1-0.2.gitfac3f4c
changelog:
  - Update to newer snapshot of 0.7.1
  - Stop libvirt using untrusted 'info vcpus' PID data (#520864)
  - Support relabelling of USB and PCI devices
  - Enable multipath storage support
  - Restart libvirtd upon RPM upgrade


author: Daniel Veillard <veillard@redhat.com> - 0.7.1-1
changelog:
  - Upstream release of 0.7.1
  - ESX, VBox driver updates
  - mutipath support
  - support for encrypted (qcow) volume
  - compressed save image format for Qemu/KVM
  - QEmu host PCI device hotplug support
  - configuration of huge pages in guests
  - a lot of fixes


author: Mark McLoughlin <markmc@redhat.com> - 0.7.1-8
changelog:
  - Disable sound backend, even when selinux is disabled (#524499)
  - Re-label qcow2 backing files (#497131)


author: Mark McLoughlin <markmc@redhat.com> - 0.7.1-10
changelog:
  - Create /var/log/libvirt/{lxc,uml} dirs for logrotate
  - Make libvirt-python dependon on libvirt-client
  - Sync misc minor changes from upstream spec


author: Mark McLoughlin <markmc@redhat.com> - 0.7.1-11
changelog:
  - Fix libvirtd memory leak during error reply sending (#528162)
  - Add several PCI hot-unplug typo fixes from upstream


author: Daniel Veillard <veillard@redhat.com> - 0.7.2-1
changelog:
  - Upstream release of 0.7.2
  - Allow to define ESX domains
  - Allows suspend and resulme of LXC domains
  - API for data streams
  - many bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.7.4-1
changelog:
  - upstream release of 0.7.4
  - udev node device backend
  - API to check object properties
  - better QEmu monitor processing
  - MAC address based port filtering for qemu
  - support IPv6 and multiple addresses per interfaces
  - a lot of fixes


author: Daniel Veillard <veillard@redhat.com> - 0.7.5-1
changelog:
  - Add new API virDomainMemoryStats
  - Public API and domain extension for CPU flags
  - vbox: Add support for version 3.1
  - Support QEMU's virtual FAT block device driver
  - a lot of fixes


author: Daniel Veillard <veillard@redhat.com> - 0.7.6-1
changelog:
  - upstream release of 0.7.6
  - Use QEmu new device adressing when possible
  - Implement CPU topology support for QEMU driver
  - Implement SCSI controller hotplug/unplug for QEMU
  - Implement support for multi IQN
  - a lot of fixes and improvements


author: Adam Jackson <ajax@redhat.com> 0.7.6-2
changelog:
  - libvirt-0.7.6-add-needed.patch: Fix FTBFS from --no-add-needed
  - Add BuildRequires: xmlrpc-c-client for libxmlrpc_client.so


author: Daniel Veillard <veillard@redhat.com> - 0.7.7-1
changelog:
  - macvtap support
  - async job handling
  - virtio channel
  - computing baseline CPU
  - virDomain{Attach,Detach}DeviceFlags
  - assorted bug fixes and lots of cleanups


author: Cole Robinson <crobinso@redhat.com> - 0.7.7-2.fc14
changelog:
  - Fix USB devices by product with security enabled (bz 574136)
  - Set kernel/initrd in security driver, fixes some URL installs (bz 566425)


author: Daniel Veillard <veillard@redhat.com> - 0.8.0-1
changelog:
  - Upstream release 0.8.0
  - Snapshotting support (QEmu/VBox/ESX)
  - Network filtering API
  - XenAPI driver
  - new APIs for domain events
  - Libvirt managed save API
  - timer subselection for domain clock
  - synchronous hooks
  - API to update guest CPU to host CPU
  - virDomainUpdateDeviceFlags new API
  - migrate max downtime API
  - volume wiping API
  - and many bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.8.1-1
changelog:
  - Upstream release 0.8.1
  - Starts dnsmasq from libvirtd with --dhcp-hostsfile
  - Add virDomainGetBlockInfo API to query disk sizing
  - a lot of bug fixes and cleanups


author: Daniel Veillard <veillard@redhat.com> - 0.8.2-1
changelog:
  - Upstream release 0.8.2
  - phyp: adding support for IVM
  - libvirt: introduce domainCreateWithFlags API
  - add 802.1Qbh and 802.1Qbg switches handling
  - Support for VirtualBox version 3.2
  - Init script for handling guests on shutdown/boot
  - qemu: live migration with non-shared storage for kvm


author: Daniel P. Berrange <berrange@redhat.com> - 0.8.2-2
changelog:
  - CVE-2010-2237 ignoring defined main disk format when looking up disk backing stores
  - CVE-2010-2238 ignoring defined disk backing store format when recursing into disk
    image backing stores
  - CVE-2010-2239 not setting user defined backing store format when creating new image
  - CVE-2010-2242 libvirt: improperly mapped source privileged ports may allow for
    obtaining privileged resources on the host


author: Daniel Veillard <veillard@redhat.com> - 0.8.5-1
changelog:
  - Enable JSON and netdev features in QEMU >= 0.13
  - framework for auditing integration
  - framework DTrace/SystemTap integration
  - Setting the number of vcpu at boot
  - Enable support for nested SVM
  - Virtio plan9fs filesystem QEMU
  - Memory parameter controls
  - various improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.8.7-1
changelog:
  - Preliminary support for VirtualBox 4.0
  - IPv6 support
  - Add VMware Workstation and Player driver driver
  - Add network disk support
  - Various improvements and bug fixes
  - from 0.8.6:
  - Add support for iSCSI target auto-discovery
  - QED: Basic support for QED images
  - remote console support
  - support for SPICE graphics
  - sysinfo and VMBIOS support
  - virsh qemu-monitor-command
  - various improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.8.8-1
changelog:
  - expose new API for sysinfo extraction
  - cgroup blkio weight support
  - smartcard device support
  - qemu: Support per-device boot ordering
  - Various improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.9.0-1
changelog:
  - Support cputune cpu usage tuning
  - Add public APIs for storage volume upload/download
  - Add public API for setting migration speed on the fly
  - Add libxenlight driver
  - qemu: support migration to fd
  - libvirt: add virDomain{Get,Set}BlkioParameters
  - setmem: introduce a new libvirt API (virDomainSetMemoryFlags)
  - Expose event loop implementation as a public API
  - Dump the debug buffer to libvirtd.log on fatal signal
  - Audit support
  - Various improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.9.1-1
changelog:
  - support various persistent domain updates
  - improvements on memory APIs
  - Add virDomainEventRebootNew
  - various improvements to libxl driver
  - Spice: support audio, images and stream compression
  - Various improvements and bug fixes


author: Richard W.M. Jones <rjones@redhat.com> - 0.9.1-3
changelog:
  - Add upstream patches:
      0001-json-Avoid-passing-large-positive-64-bit-integers-to.patch
      0001-qemudDomainMemoryPeek-change-ownership-selinux-label.patch
      0002-remote-remove-bogus-virDomainFree.patch
    so that users can try out virt-dmesg.
  - Change /var/cache mode to 0711.


author: Daniel Veillard <veillard@redhat.com> - 0.9.2-1
changelog:
  - Framework for lock manager plugins
  - API for network config change transactions
  - flags for setting memory parameters
  - virDomainGetState public API
  - qemu: allow blkstat/blkinfo calls during migration
  - Introduce migration v3 API
  - Defining the Screenshot public API
  - public API for NMI injection
  - Various improvements and bug fixes


author: Laine Stump <laine@redhat.com> - 0.9.2-2
changelog:
  - add rule to require netcf-0.1.8 during build so that new transactional
    network change APIs are included.
  - document that CVE-2011-2178 has been fixed (by virtue of rebase
    to 0.9.2 - see https://bugzilla.redhat.com/show_bug.cgi?id=709777)


author: Daniel Veillard <veillard@redhat.com> - 0.9.3-1
changelog:
  - new API virDomainGetVcpupinInfo
  - Add TXT record support for virtual DNS service
  - Support reboots with the QEMU driver
  - New API virDomainGetControlInfo API
  - New API virNodeGetMemoryStats
  - New API virNodeGetCPUTime
  - New API for send-key
  - New API virDomainPinVcpuFlags
  - support multifunction PCI device
  - lxc: various improvements
  - many improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.9.4-1
changelog:
  - network bandwidth QoS control
  - Add new API virDomainBlockPull*
  - save: new API to manipulate save file images
  - CPU bandwidth limits support
  - allow to send NMI and key event to guests
  - new API virDomainUndefineFlags
  - Implement code to attach to external QEMU instances
  - bios: Add support for SGA
  - various missing python binding
  - many improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.9.5-1
changelog:
  - many snapshot improvements (Eric Blake)
  - latency: Define new public API and structure (Osier Yang)
  - USB2 and various USB improvements (Marc-André Lureau)
  - storage: Add fs pool formatting (Osier Yang)
  - Add public API for getting migration speed (Jim Fehlig)
  - Add basic driver for Microsoft Hyper-V (Matthias Bolte)
  - many improvements and bug fixes


author: Laine Stump <laine@redhat.com> - 0.9.6-2
changelog:
  - Make PCI multifunction support more manual - Bug 742836
  - F15 build still uses cgconfig - Bug 738725


author: Daniel Veillard <veillard@redhat.com> - 0.9.8-1
changelog:
  - Add support for QEMU 1.0
  - Add preliminary PPC cpu driver
  - Add new API virDomain{Set, Get}BlockIoTune
  - block_resize: Define the new API
  - Add a public API to invoke suspend/resume on the host
  - various improvements for LXC containers
  - Define keepalive protocol and add virConnectIsAlive API
  - Add support for STP and VLAN filtering
  - many improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.9.9-1
changelog:
  - Add API virDomain{S,G}etInterfaceParameters
  - Add API virDomain{G, S}etNumaParameters
  - Add support for ppc64 qemu
  - Support Xen domctl v8
  - many improvements and bug fixes


author: Cole Robinson <crobinso@redhat.com> - 0.9.11.3-1
changelog:
  - Rebased to version 0.9.11.3
  - Abide URI username when connecting to hypervisor (bz 811397)
  - Fix managed USB mode (bz 814866)
  - Fix crash connecting to ESX host (bz 811891)


author: Daniel Veillard <veillard@redhat.com> - 0.9.12-1
changelog:
  - qemu: allow snapshotting of sheepdog and rbd disks
  - blockjob: add new APIs
  - a lot of bug fixes, improvements and portability work


author: Daniel Veillard <veillard@redhat.com> - 0.9.13-1
changelog:
  - S390: support for s390(x)
  - snapshot: implement new APIs for esx and vbox
  - snapshot: new query APIs and many improvements
  - virsh: Allow users to reedit rejected XML
  - nwfilter: add DHCP snooping
  - Enable driver modules in libvirt RPM
  - Default to enable driver modules for libvirtd
  - storage backend: Add RBD (RADOS Block Device) support
  - sVirt support for LXC domains inprovement
  - a lot of bug fixes, improvements and portability work


author: Daniel Veillard <veillard@redhat.com> - 0.10.0-1
changelog:
  - upstream release of 0.10.0
  - agent: add qemuAgentArbitraryCommand() for general qemu agent command
  - Introduce virDomainPinEmulator and virDomainGetEmulatorPinInfo functions
  - network: use firewalld instead of iptables, when available
  - network: make network driver vlan-aware
  - esx: Implement network driver
  - driver for parallels hypervisor
  - Various LXC improvements
  - Add virDomainGetHostname
  - a lot of bug fixes, improvements and portability work


author: Cole Robinson <crobinso@redhat.com> - 0.10.1-3
changelog:
  - Fix libvirtd segfault with old netcf-libs (bz 853381)
  - Drop unneeded dnsmasq --filterwin2k
  - Fix unwanted connection closing, needed for boxes


author: Daniel Veillard <veillard@redhat.com> - 0.10.2-1
changelog:
  - Upstream release 0.10.2
  - network: define new API virNetworkUpdate
  - add support for QEmu sandbox support
  - blockjob: add virDomainBlockCommit
  - New APIs to get/set Node memory parameters
  - new API virConnectListAllSecrets
  - new API virConnectListAllNWFilters
  - new API virConnectListAllNodeDevices
  - parallels: add support of containers to the driver
  - new API virConnectListAllInterfaces
  - new API virConnectListAllNetworks
  - new API virStoragePoolListAllVolumes
  - Add PMSUSPENDED life cycle event
  - new API virStorageListAllStoragePools
  - Add per-guest S3/S4 state configuration
  - qemu: Support for Block Device IO Limits
  - a lot of bug fixes, improvements and portability work


author: Richard W.M. Jones <rjones@redhat.com> - 0.10.2-3
changelog:
  - Re-add Use-qemu-system-i386-as-binary-instead-of-qemu.patch
    NB: This patch is Fedora-specific and not upstream.
  - Add upstream patches: don't duplicate environment variables (RHBZ#859596).


author: Cole Robinson <crobinso@redhat.com> - 0.10.2.1-1
changelog:
  - Rebased to version 0.10.2.1
  - Fix lvm volume creation when alloc=0 (bz #866481)
  - Clarify virsh send-keys man page example (bz #860004)
  - Fix occasional deadlock via virDomainDestroy (bz #859009)
  - Fix LXC deadlock from ctrl-c (bz #848119)
  - Fix occasional selinux denials with macvtap (bz #798605)
  - Fix multilib conflict with systemtap files (bz #831425)
  - Don't trigger keytab warning in system logs (bz #745203)
  - Fix qemu domxml-2-native NIC model out (bz #636832)
  - Fix error message if not enough space for lvm vol (bz #609104)


author: Jiri Denemark <jdenemar@redhat.com> - 1.0.5-2
changelog:
  - virInitctlRequest: Don't hardcode 384 bytes size
  - network: Fix network driver startup for qemu:///session
  - virInitctlRequest: Unbreak make syntax check
  - virInitctlRequest: Unbreak make syntax check
  - build: Always include sanitytest in tarball
  - qemu: Fix stupid typos in VFIO cgroup setup/teardown
  - build: Always include libvirt_lxc.syms in tarball
  - build: Clean up stray files found by 'make distcheck'
  - spec: Proper soft static allocation of qemu uid
  - Fix F_DUPFD_CLOEXEC operation args
  - build: Fix mingw build of virprocess.c
  - Fix potential use of undefined variable in remote dispatch code
  - build: Avoid non-portable cast of pthread_t
  - Fix release of resources with lockd plugin
  - Fixup rpcgen code on kFreeBSD too
  - Make detect_scsi_host_caps a function on all architectures
  - qemu: Allocate network connections sooner during domain startup
  - tests: Files named '.*-invalid.xml' should fail validation
  - conf: Don't crash on a tpm device with no backends
  - Don't mention disk controllers in generic controller errors
  - iscsi: Don't leak portal string when starting a pool
  - util: Fix virFileOpenAs return value and resulting error logs


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.0-2
changelog:
  - qemu: Fix double free in qemuMigrationPrepareDirect (rhbz#977961)
  - Fix crash when multiple event callbacks were registered (CVE-2013-2230)
  - Paused domain should remain paused after migration (rhbz#981139)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-2
changelog:
  - spec: Change --enable-werror handling to match upstream
  - Delete obsolete / unused python test files (rhbz#884103)
  - Remove reference to python/tests from RPM %doc (rhbz#884103)
  - spec: Explicitly claim ownership of channel subdir (rhbz#884103)
  - Add APIs for formatting systemd slice/scope names (rhbz#980929)
  - Add support for systemd cgroup mount (rhbz#980929)
  - Cope with races while killing processes (rhbz#980929)
  - Enable support for systemd-machined in cgroups creation (rhbz#980929)
  - Ensure LXC/QEMU APIs set the filename for errors (rhbz#991348)
  - Avoid crash if NULL is passed for filename/funcname in logging (rhbz#991348)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-3
changelog:
  - RPC: Don't accept client if it would overcommit max_clients (rhbz#981729)
  - Introduce max_queued_clients (rhbz#981729)
  - conf: Add default USB controller in qemu post-parse callback (rhbz#819968)
  - qemu: Rename some functions in qemu_command.c (rhbz#819968)
  - qemu: Eliminate almost-duplicate code in qemu_command.c (rhbz#819968)
  - qemu: Enable auto-allocate of all PCI addresses (rhbz#819968)
  - qemu: Add pcie-root controller (rhbz#819968)
  - qemu: Add dmi-to-pci-bridge controller (rhbz#819968)
  - qemu: Fix handling of default/implicit devices for q35 (rhbz#819968)
  - qemu: Properly set/use device alias for pci controllers (rhbz#819968)
  - qemu: Enable using implicit sata controller in q35 machines (rhbz#819968)
  - qemu: Improve error reporting during PCI address validation (rhbz#819968)
  - qemu: Refactor qemuDomainCheckDiskPresence for only disk presence check (rhbz#910171)
  - qemu: Add helper functions for diskchain checking (rhbz#910171)
  - qemu: Check presence of each disk and its backing file as well (rhbz#910171)
  - conf: Add startupPolicy attribute for harddisk (rhbz#910171)
  - qemu: Support to drop disk with 'optional' startupPolicy (rhbz#910171)
  - Split TLS test into two separate tests (rhbz#994158)
  - Avoid re-generating certs every time (rhbz#994158)
  - Change data passed into TLS test cases (rhbz#994158)
  - Fix validation of CA certificate chains (rhbz#994158)
  - Fix parallel runs of TLS test suites (rhbz#994158)
  - tests: Fix parallel runs of TLS test suites (rhbz#994158)
  - Add a man page for virtlockd daemon (rhbz#991494)
  - Add an example config file for virtlockd (rhbz#991494)
  - Properly handle -h / -V for --help/--version aliases in virtlockd/libvirtd (rhbz#991494)
  - Make check for /dev/loop device names stricter to avoid /dev/loop-control (rhbz#924815)
  - Ensure securityfs is mounted readonly in container (rhbz#872642)
  - Add info about access control checks into API reference (rhbz#700443)
  - Record the where the auto-generated data comes from (rhbz#700443)
  - Add documentation for access control system (rhbz#700443)
  - virsh-domain: Flip logic in cmdSetvcpus (rhbz#996552)
  - Honour root prefix in lxcContainerMountFSBlockAuto (rhbz#924815)
  - util: Add virGetUserDirectoryByUID (rhbz#988491)
  - Introduce a virt-login-shell binary (rhbz#988491)
  - build: Fix compilation of virt-login-shell.c (rhbz#988491)
  - Fix double-free and broken logic in virt-login-shell (rhbz#988491)
  - Address missed feedback from review of virt-login-shell (rhbz#988491)
  - Ensure that /dev exists in the container root filesystem (rhbz#924815)
  - remote: Fix a segfault in remoteDomainCreateWithFlags (rhbz#994855)
  - build: Avoid -lgcrypt with newer gnutls (rhbz#951637)
  - virnettlscontext: Resolve Coverity warnings (UNINIT) (rhbz#994158)
  - build: Fix missing max_queued_clients in augeas test file for libvirtd.conf (rhbz#981729)
  - virsh-domain: Fix memleak in cmdCPUBaseline (rhbz#997798)
  - Fix typo in domain name in polkit acl example (rhbz#700443)
  - Update polkit examples to use 'lookup' method (rhbz#700443)
  - Add bounds checking on virDomainMigrate*Params RPC calls (CVE-2013-4292) (rhbz#1002667)
  - Add bounds checking on virDomainGetJobStats RPC call (rhbz#1002667)
  - Add bounds checking on virDomain{SnapshotListAllChildren, ListAllSnapshots} RPC calls (rhbz#1002667)
  - Add bounds checking on virConnectListAllDomains RPC call (rhbz#1002667)
  - Add bounds checking on virConnectListAllStoragePools RPC call (rhbz#1002667)
  - Add bounds checking on virStoragePoolListAllVolumes RPC call (rhbz#1002667)
  - Add bounds checking on virConnectListAllNetworks RPC call (rhbz#1002667)
  - Add bounds checking on virConnectListAllInterfaces RPC call (rhbz#1002667)
  - Add bounds checking on virConnectListAllNodeDevices RPC call (rhbz#1002667)
  - Add bounds checking on virConnectListAllNWFilters RPC call (rhbz#1002667)
  - Add bounds checking on virConnectListAllSecrets RPC call (rhbz#1002667)
  - Prohibit unbounded arrays in XDR protocols (rhbz#1002667)
  - virbitmap: Refactor virBitmapParse to avoid access beyond bounds of array (rhbz#997906)
  - virbitmaptest: Fix function header formatting (rhbz#997906)
  - virbitmaptest: Add test for out of bounds condition (rhbz#997906)
  - virsh-domain: Fix memleak in cmdUndefine with storage (rhbz#999057)
  - virsh: Modify vshStringToArray to duplicate the elements too (rhbz#999057)
  - virsh: Don't leak list of volumes when undefining domain with storage (rhbz#999057)
  - Fix URI connect precedence (rhbz#999323)
  - tests: Add URI precedence checking (rhbz#999323)
  - Don't free NULL network in cmdNetworkUpdate (rhbz#1001094)
  - virsh: Fix debugging (rhbz#1001628)
  - qemu: Remove hostdev entry when freeing the depending network entry (rhbz#1002669)
  - Set security label on FD for virDomainOpenGraphics (rhbz#999925)
  - virsh: Free the caps list properly if one of them is invalid (rhbz#1001957)
  - virsh: Free the formatting string when listing pool details (rhbz#1001957)
  - virsh-pool.c: Don't jump over variable declaration (rhbz#1001957)
  - virsh: Free the list from ListAll APIs even for 0 items (rhbz#1001957)
  - virsh: Free messages after logging them to a file (rhbz#1001957)
  - Reverse logic allowing partial DHCP host XML (rhbz#1001078)
  - virsh: Print cephx and iscsi usage (rhbz#1000155)
  - qemu_conf: Fix broken logic for adding passthrough iscsi lun (rhbz#1000159)
  - Report secret usage error message similarly (rhbz#1000168)
  - docs: Update the formatdomain disk examples (rhbz#1000169)
  - docs: Update formatsecrets to include more examples of each type (rhbz#1000169)
  - docs: Update iSCSI storage pool example (rhbz#1000169)
  - docs: Reformat <disk> attribute description in formatdomain (rhbz#1000169)
  - qemuBuildNicDevStr: Add mq=on for multiqueue networking (rhbz#651941)
  - migration: Do not restore labels on failed migration (rhbz#822052)
  - qemu: Drop qemuDomainMemoryLimit (rhbz#1001143)
  - docs: Discourage users to set hard_limit (rhbz#1001143)
  - docs: Clean 09adfdc62de2b up (rhbz#1001143)
  - qemuSetupMemoryCgroup: Handle hard_limit properly (rhbz#1001143)
  - qemuBuildCommandLine: Fall back to mem balloon if there's no hard_limit (rhbz#1001143)
  - qemuDomainAttachHostPciDevice: Fall back to mem balloon if there's no hard_limit (rhbz#1001143)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-4
changelog:
  - Don't crash in qemuBuildDeviceAddressStr (rhbz#1003526)
  - Fix leaks in python bindings (rhbz#1003828)
  - Process virtlockd.conf instead of libvirtd.conf (rhbz#1003685)
  - test_virtlockd.aug.in: Use the correct file (rhbz#1003685)
  - qemu: Make domain renaming work during migration (rhbz#999352)
  - qemu: Handle huge number of queues correctly (rhbz#651941)
  - conf: Remove the actual hostdev when removing a network (rhbz#1003537)
  - conf: Don't deref NULL actual network in virDomainNetGetActualHostdev() (rhbz#1003537)
  - python: Fix a PyList usage mistake (rhbz#1002558)
  - Add '<nat>' element to '<forward>' network schemas (rhbz#1004364)
  - Always specify qcow2 compat level on qemu-img command line (rhbz#997977)
  - selinux: Distinguish failure to label from request to avoid label (rhbz#924153)
  - selinux: Enhance test to cover nfs label failure (rhbz#924153)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-5
changelog:
  - Pass AM_LDFLAGS to driver modules too (rhbz#1006299)
  - virsh domjobinfo: Do not return 1 if job is NONE (rhbz#1006864)
  - Fix polkit permission names for storage pools, vols & node devices (rhbz#700443)
  - Fix naming of permission for detecting storage pools (rhbz#700443)
  - security: Provide supplemental groups even when parsing label (CVE-2013-4291) (rhbz#1006513)
  - virFileNBDDeviceAssociate: Avoid use of uninitialized variable (CVE-2013-4297)
  - Rename "struct interface_driver" to virNetcfDriverState (rhbz#983026)
  - netcf driver: Use a single netcf handle for all connections (rhbz#983026)
  - virDomainDefParseXML: Set the argument of virBitmapFree to NULL after calling virBitmapFree (rhbz#1006722)
  - Add test for the nodemask double free crash (rhbz#1006722)
  - qemu: Fix checking of guest ABI compatibility when reverting snapshots (rhbz#1006886)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-6
changelog:
  - Also store user & group ID values in virIdentity (rhbz#1006272)
  - Ensure system identity includes process start time (rhbz#1006272)
  - Add support for using 3-arg pkcheck syntax for process (CVE-2013-4311)
  - Free slicename in virSystemdCreateMachine (rhbz#1008619)
  - qemu: Fix checking of ABI stability when restoring external checkpoints (rhbz#1008340)
  - qemu: Use "migratable" XML definition when doing external checkpoints (rhbz#1008340)
  - qemu: Fix memleak after commit 59898a88ce8431bd3ea249b8789edc2ef9985827 (rhbz#1008340)
  - qemu: Avoid dangling job in qemuDomainSetBlockIoTune (rhbz#700443)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-7
changelog:
  - Fix crash in remoteDispatchDomainMemoryStats (CVE-2013-4296)
  - LXC: Don't mount securityfs when user namespace enabled (rhbz#872648)
  - Move array of mounts out of lxcContainerMountBasicFS (rhbz#872648)
  - Ensure root filesystem is recursively mounted readonly (rhbz#872648)
  - qemu: Fix seamless SPICE migration (rhbz#1010861)
  - qemu: Use "ide" as device name for implicit SATA controller on Q35 (rhbz#1008903)
  - qemu: Only parse basename when determining emulator properties (rhbz#1010617)
  - qemu: Recognize -machine accel=kvm when parsing native (rhbz#1010617)
  - qemu: Don't leave shutdown inhibited on attach failure (rhbz#1010617)
  - qemu: Don't leak vm on failure (rhbz#1010617)
  - Fix typo in identity code which is pre-requisite for CVE-2013-4311 (rhbz#1006272)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-8
changelog:
  - conf: Don't crash on invalid chardev source definition of RNGs and other (rhbz#1012196)
  - rpc: Increase bound limit for virDomainGetJobStats (rhbz#1012818)
  - qemu: Free all driver data in qemuStateCleanup (rhbz#1011330)
  - qemu: Don't leak reference to virQEMUDriverConfigPtr (rhbz#1011330)
  - qemu: Eliminate redundant if clauses in qemuCollectPCIAddress (rhbz#1003983)
  - qemu: Allow some PCI devices to be attached to PCIe slots (rhbz#1003983)
  - qemu: Replace multiple strcmps with a switch on an enum (rhbz#1003983)
  - qemu: Support ich9-intel-hda audio device (rhbz#1003983)
  - qemu: Turn if into switch in qemuDomainValidateDevicePCISlotsQ35 (rhbz#1003983)
  - qemu: Prefer to put a Q35 machine's dmi-to-pci-bridge at 00:1E.0 (rhbz#1003983)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-9
changelog:
  - virNetDevBandwidthEqual: Make it more robust (rhbz#1014503)
  - qemu_hotplug: Allow QoS update in qemuDomainChangeNet (rhbz#1014503)
  - qemu: Check actual netdev type rather than config netdev type during init (rhbz#1012824)
  - Fix crash in libvirtd when events are registered & ACLs active (CVE-2013-4399) (rhbz#1011429)
  - Remove virConnectPtr arg from virNWFilterDefParse* (rhbz#1015108)
  - Don't pass virConnectPtr in nwfilter 'struct domUpdateCBStruct' (rhbz#1015108)
  - Remove use of virConnectPtr from all remaining nwfilter code (rhbz#1015108)
  - Don't set netdev offline in container cleanup (rhbz#1014604)
  - Avoid reporting an error if veth device is already deleted (rhbz#1014604)
  - Avoid deleting NULL veth device name (rhbz#1014604)
  - Retry veth device creation on failure (rhbz#1014604)
  - Use 'vnet' as prefix for veth devices (rhbz#1014604)
  - Free cmd in virNetDevVethDelete (rhbz#1014604)
  - Free cmd in virNetDevVethCreate (rhbz#1014604)
  - LXC: Fix handling of RAM filesystem size units (rhbz#1015689)
  - build: Add lxc testcase to dist list (rhbz#1015689)
  - tests: Work with older dbus (rhbz#1018730)
  - virdbus: Add virDBusHasSystemBus() (rhbz#1018730)
  - virsystemd: Don't fail to start VM if DBus isn't available or compiled in (rhbz#1018730)
  - DBus: Introduce virDBusIsServiceEnabled (rhbz#1018730)
  - Change way we fake dbus method calls (rhbz#1018730)
  - Fix virsystemdtest for previous commit (rhbz#1018730)
  - LXC: Workaround machined uncleaned data with containers running systemd. (rhbz#1018730)
  - Allow use of a private dbus bus connection (rhbz#998365)
  - Add a method for closing the dbus system bus connection (rhbz#998365)
  - Make LXC controller use a private dbus connection & close it (rhbz#998365)
  - Fix flaw in detecting log format (rhbz#927072)
  - Fix exit status of lxc controller (rhbz#927072)
  - Improve error reporting with LXC controller (rhbz#927072)
  - nwfilter: Don't fail to start if DBus isn't available (rhbz#927072)
  - Don't ignore all dbus connection errors (rhbz#927072)
  - LXC: Check the existence of dir before resolving symlinks (rhbz#927072)
  - Ensure lxcContainerMain reports errors on stderr (rhbz#927072)
  - Ensure lxcContainerResolveSymlinks reports errors (rhbz#927072)
  - Improve log filtering in virLXCProcessReadLogOutputData (rhbz#927072)
  - Initialize threading & error layer in LXC controller (rhbz#1018725)
  - qemu_migration: Avoid crashing if domain dies too quickly (rhbz#1018267)
  - Convert uuid to a string before printing it (rhbz#1019023)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-10
changelog:
  - qemu_process: Make qemuProcessReadLog() more versatile and reusable (rhbz#1001738)
  - qemu: monitor: Add infrastructure to access VM logs for better err msgs (rhbz#1001738)
  - qemu: monitor: Produce better errors on monitor hangup (rhbz#1001738)
  - qemu: Wire up better early error reporting (rhbz#1001738)
  - qemu: process: Silence coverity warning when rewinding log file (rhbz#1001738)
  - qemu: hostdev: Refactor PCI passhrough handling (rhbz#1001738)
  - qemu: hostdev: Fix function spacing and header formatting (rhbz#1001738)
  - qemu: hostdev: Add checks if PCI passthrough is available in the host (rhbz#1001738)
  - qemu: Prefer VFIO for PCI device passthrough (rhbz#1001738)
  - qemu: Init @pcidevs in qemuPrepareHostdevPCIDevices (rhbz#1001738)
  - Fix max stream packet size for old clients (rhbz#950416)
  - Adjust legacy max payload size to account for header information (rhbz#950416)
  - rpc: Correct the wrong payload size checking (rhbz#950416)
  - qemu: Simplify calling qemuDomainHostdevNetConfigRestore (rhbz#1005682)
  - qemu: Move qemuDomainRemoveNetDevice to avoid forward reference (rhbz#1005682)
  - qemu: Fix removal of <interface type='hostdev'> (rhbz#1005682)
  - remote: Fix regression in event deregistration (rhbz#1020376)
  - qemu: managedsave: Add support for compressing managed save images (rhbz#1017227)
  - qemu: snapshot: Add support for compressing external snapshot memory (rhbz#1017227)
  - Migration: Introduce VIR_MIGRATE_PARAM_LISTEN_ADDRESS (rhbz#1015215)
  - virsocket: Introduce virSocketAddrIsWildcard (rhbz#1015215)
  - qemu: Implement support for VIR_MIGRATE_PARAM_LISTEN_ADDRESS (rhbz#1015215)
  - qemu_conf: Introduce "migration_address" (rhbz#1015215)
  - qemu: Include listenAddress in debug prints (rhbz#1015215)
  - docs: Expand description of host-model CPU mode (rhbz#1014682)
  - qemu: Avoid assigning unavailable migration ports (rhbz#1019237)
  - qemu: Make migration port range configurable (rhbz#1019237)
  - qemu: Fix augeas support for migration ports (rhbz#1019237)
  - Fix perms for virConnectDomainXML{To, From}Native (CVE-2013-4401)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-11
changelog:
  - Add helpers for getting env vars in a setuid environment (rhbz#1015247)
  - Only allow 'stderr' log output when running setuid (CVE-2013-4400)
  - Close all non-stdio FDs in virt-login-shell (CVE-2013-4400)
  - Don't link virt-login-shell against libvirt.so (CVE-2013-4400)
  - build: Fix linking virt-login-shell (rhbz#1015247)
  - build: Fix build of virt-login-shell on systems with older gnutls (rhbz#1015247)
  - Set a sane $PATH for virt-login-shell (rhbz#1015247)
  - spec: Fix rpm build when lxc disabled (rhbz#1015247)
  - Move virt-login-shell into libvirt-login-shell sub-RPM (rhbz#1015247)
  - Make virCommand env handling robust in setuid env (rhbz#1015247)
  - Remove all direct use of getenv (rhbz#1015247)
  - Block all use of getenv with syntax-check (rhbz#1015247)
  - Only allow the UNIX transport in remote driver when setuid (rhbz#1015247)
  - Don't allow remote driver daemon autostart when running setuid (rhbz#1015247)
  - Add stub getegid impl for platforms lacking it (rhbz#1015247)
  - Remove (nearly) all use of getuid()/getgid() (rhbz#1015247)
  - Block all use of libvirt.so in setuid programs (rhbz#1015247)
  - spec: Clean up distribution of ChangeLog (and others) (rhbz#1024393)
  - Push RPM deps down into libvirt-daemon-driver-XXXX sub-RPMs (rhbz#1024393)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-12
changelog:
  - virpci: Don't error on unbinded devices (rhbz#1019387)
  - network: Fix connections count in case of allocate failure (rhbz#1020135)
  - qemu: Clean up migration ports when migration cancelled (rhbz#1019237)
  - qemuMigrationBeginPhase: Check for 'drive-mirror' for NBD (rhbz#1022393)
  - Allow root directory in filesystem source dir schema (rhbz#1028107)
  - Use a port from the migration range for NBD as well (rhbz#1025699)
  - qemu: Avoid double free of VM (rhbz#1018267)
  - util: Use size_t instead of unsigned int for num_virtual_functions (rhbz#1025397)
  - pci: Properly handle out-of-order SRIOV virtual functions (rhbz#1025397)
  - conf: Do better job when comparing features ABI compatibility (rhbz#1008989)
  - schema: Rename option 'hypervtristate' to 'featurestate' (rhbz#1008989)
  - conf: Mark user provided strings in error messages when parsing XML (rhbz#1008989)
  - cpu: Add support for loading and storing CPU data (rhbz#1008989)
  - cpu: x86: Rename struct cpuX86cpuid as virCPUx86CPUID (rhbz#1008989)
  - cpu: x86: Rename struct cpuX86Data as virCPUx86Data (rhbz#1008989)
  - cpu: x86: Rename x86DataFree() as virCPUx86DataFree() (rhbz#1008989)
  - Ensure 'arch' is always set in cpuArchNodeData (rhbz#1008989)
  - cpu: x86: Rename x86MakeCPUData as virCPUx86MakeData (rhbz#1008989)
  - cpu: x86: Rename x86DataAddCpuid as virCPUx86DataAddCPUID (rhbz#1008989)
  - cpu: x86: Rename data_iterator and DATA_ITERATOR_INIT (rhbz#1008989)
  - cpu: x86: Fix return types of x86cpuidMatch and x86cpuidMatchMasked (rhbz#1008989)
  - cpu: x86: Use whitespace to clarify context and use consistent labels (rhbz#1008989)
  - cpu: x86: Clean up error messages in x86VendorLoad() (rhbz#1008989)
  - cpu: Export few x86-specific APIs (rhbz#1008989)
  - cpu: x86: Parse the CPU feature map only once (rhbz#1008989)
  - cpu_x86: Refactor storage of CPUID data to add support for KVM features (rhbz#1008989)
  - qemu: Add monitor APIs to fetch CPUID data from QEMU (rhbz#1008989)
  - cpu: x86: Add internal CPUID features support and KVM feature bits (rhbz#1008989)
  - conf: Refactor storing and usage of feature flags (rhbz#1008989)
  - qemu: Add support for paravirtual spinlocks in the guest (rhbz#1008989)
  - qemu: process: Validate specific CPUID flags of a guest (rhbz#1008989)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-13
changelog:
  - virsh-domain: Mark --live and --config mutually exclusive in vcpucount (rhbz#1024245)
  - virSecurityLabelDefParseXML: Don't parse label on model='none' (rhbz#1028962)
  - qemuMonitorIO: Don't use @mon after it's unrefed (rhbz#1018267)
  - qemu: Allow hotplug of multiple SCSI devices (rhbz#1031062)
  - qemu: Call qemuSetupHostdevCGroup later during hotplug (rhbz#1025108)
  - virscsi: Hostdev SCSI AdapterId retrieval fix (rhbz#1031079)
  - storage: Returns earlier if source adapter of the scsi pool is a HBA (rhbz#1027680)
  - spec: Restrict virt-login-shell usage (rhbz#1033614)
  - spec: Don't save/restore running VMs on libvirt-client update (rhbz#1033626)
  - Don't start a nested job in qemuMigrationPrepareAny (rhbz#1018267)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-14
changelog:
  - nodedev: Resolve Relax-NG validity error (rhbz#1035792)
  - test-lib: Make case skipping possible (rhbz#1034380)
  - tests: Don't test user config file if ran as root (rhbz#1034380)
  - Improve cgroups docs to cover systemd integration (rhbz#1004340)
  - Fix busy wait loop in LXC container I/O handling (rhbz#1032705)
  - tests: Guarantee abs_srcdir in all C tests (rhbz#1035403)
  - Introduce standard methods for sorting strings with qsort (rhbz#1035403)
  - Add virFileIsMountPoint function (rhbz#1035403)
  - Pull lxcContainerGetSubtree out into shared virfile module (rhbz#1035403)
  - Fix bug in identifying sub-mounts (rhbz#1035403)
  - LXC: Ensure security context is set when mounting images (rhbz#923903)
  - Ensure to zero out the virDomainBlockJobInfo arg (rhbz#1028846)
  - qemu: Default to vfio for nodedev-detach (rhbz#1035188)
  - daemon: Run virStateCleanup conditionally (rhbz#1033061)
  - qemu: Add "-boot strict" to commandline whenever possible (rhbz#1037593)
  - tests: Add forgotten boot-strict test files (rhbz#1037593)
  - conf: Fix XML formatting of RNG device info (rhbz#1035118)
  - qemu: Improve error when setting invalid count of vcpus via agent (rhbz#1035108)
  - Add qxl ram size to ABI stability check (rhbz#1035123)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-15
changelog:
  - spec: Don't save/restore running VMs on libvirt-client update (rhbz#1033626)
  - qemu: hotplug: Only label hostdev after checking device conflicts (rhbz#1025108)
  - qemu: hotplug: Fix double free on USB collision (rhbz#1025108)
  - qemu: hotplug: Fix adding USB devices to the driver list (rhbz#1025108)
  - docs: Enhance memoryBacking/locked documentation (rhbz#1035954)
  - util: Fix two virCompareLimitUlong bugs (rhbz#1024272)
  - cgroups: Redefine what "unlimited" means wrt memory limits (rhbz#1024272)
  - qemu: Report VIR_DOMAIN_MEMORY_PARAM_UNLIMITED properly (rhbz#1024272)
  - qemu: Fix minor inconsistency in error message (rhbz#1024272)
  - conf: Don't format memtune with unlimited values (rhbz#1024272)
  - qemu_process: Read errors from child (rhbz#1035955)
  - network: Properly update iptables rules during net-update (rhbz#1035336)
  - Tie SASL callbacks lifecycle to virNetSessionSASLContext (rhbz#1039991)
  - screenshot: Implement multiple screen support (rhbz#1026966)
  - Switch to private redhat namespace for QMP I/O error reason (rhbz#1026966)
  - Support virtio disk hotplug in JSON mode (rhbz#1026966)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-16
changelog:
  - qemu: Check for reboot-timeout on monitor (rhbz#1042690)
  - virsh: Fix return value error of cpu-stats (rhbz#1043388)
  - tools: Fix virsh connect man page (rhbz#1043260)
  - conf: Introduce generic ISA address (rhbz#996520)
  - conf: Add support for panic device (rhbz#996520)
  - qemu: Add support for -device pvpanic (rhbz#996520)
  - Fix invalid read in virNetSASLSessionClientStep debug log (rhbz#1043864)
  - virsh: man: Mention that volumes need to be in storage pool for undefine (rhbz#1044445)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-18
changelog:
  - qemu: Ask for -enable-fips when FIPS is required (rhbz#1035474)
  - qemu: Properly set MaxMemLock when hotplugging with VFIO (rhbz#1035490)
  - qemu: Avoid duplicate security label restore on hostdev attach failure (rhbz#1035490)
  - qemu: Re-add hostdev interfaces to hostdev array on libvirtd restart (rhbz#1045002)
  - domain: Don't try to interpret <driver> as virtio config for hostdev interfaces (rhbz#1046337)
  - virBitmapParse: Fix behavior in case of error and fix up callers (rhbz#1047234)
  - qemu: Fix live pinning to memory node on NUMA system (rhbz#1047234)
  - qemu: Clean up qemuDomainSetNumaParameters (rhbz#1047234)
  - qemu: Range check numa memory placement mode (rhbz#1047234)
  - virkeycode: Allow ANSI_A (rhbz#1044806)
  - Fix argument order of qemuMigrationPerformJob(). (rhbz#1049338)
  - qemu: Do not access stale data in virDomainBlockStats (CVE-2013-6458)
  - qemu: Avoid using stale data in virDomainGetBlockInfo (CVE-2013-6458)
  - qemu: Fix job usage in qemuDomainBlockJobImpl (CVE-2013-6458)
  - qemu: Fix job usage in qemuDomainBlockCopy (rhbz#1048643)
  - qemu: Fix job usage in virDomainGetBlockIoTune (CVE-2013-6458)
  - PanicCheckABIStability: Need to check for existence (rhbz#996520)
  - virsh: Improve usability of '--print-xml' flag for attach-disk command (rhbz#1049529)
  - virsh: Don't use legacy API if --current is used on device hot(un)plug (rhbz#1049529)
  - virsh: Use inactive definition when removing disk from config (rhbz#1049529)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-19
changelog:
  - CVE-2013-6436: Fix crash in lxcDomainGetMemoryParameters (rhbz#1049137)
  - Fix crash in lxcDomainSetMemoryParameters (rhbz#1052062)
  - Don't crash if a connection closes early (CVE-2014-1447)
  - Really don't crash if a connection closes early (CVE-2014-1447)
  - qemu: Change the default unix monitor timeout (rhbz#892273)
  - virSecuritySELinuxSetFileconHelper: Don't fail on read-only NFS (rhbz#996543)
  - qemu: Avoid operations on NULL monitor if VM fails early (rhbz#1054785)
  - virt-login-shell: Fix regressions in behavior (rhbz#1015247)
  - pci: Make reattach work for unbound devices (rhbz#1046919)
  - pci: Fix failure paths in detach (rhbz#1046919)
  - qemu: Don't detach devices if passthrough doesn't work (rhbz#1046919)
  - Fix migration with QEMU 1.6 (rhbz#1053405)
  - build: More workarounds for if_bridge.h (rhbz#1042937)
  - build: Fix build with latest rawhide kernel headers (rhbz#1042937)
  - aarch64: Disable -fstack-protector. (rhbz#1042937)
  - AArch64: Parse cputopology from /proc/cpuinfo. (rhbz#1042937)
  - virDomainEventCallbackListFree: Don't leak @list->callbacks (rhbz#1047964)
  - Fix memory leak in virObjectEventCallbackListRemoveID() (rhbz#1047964)
  - event: Filter global events by domain:getattr ACL (CVE-2014-0028)
  - Doc: Improve the document for nodesuspend (rhbz#1045089)
  - Doc: Add "note" for node-memory-tune (rhbz#1045089)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-21
changelog:
  - util: Correct the NUMA node range checking (rhbz#1045958)
  - storage: Add document for possible problem on volume detection (rhbz#726797)
  - storage: Fix autostart of pool with "fc_host" type adapter (rhbz#726797)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-22
changelog:
  - Add a read/write lock implementation (rhbz#1034807)
  - Push nwfilter update locking up to top level (rhbz#1034807)
  - utils: Introduce functions for kernel module manipulation (rhbz#1045124)
  - virCommand: Introduce virCommandSetDryRun (rhbz#1045124)
  - tests: Add test for new virkmod functions (rhbz#1045124)
  - Honor blacklist for modprobe command (rhbz#1045124)
  - qemu: Be sure we're using the updated value of backend during hotplug (rhbz#1056360)
  - network: Permit upstream forwarding of unqualified DNS names (rhbz#1061099)
  - network: Only prevent forwarding of DNS requests for unqualified names (rhbz#1061099)
  - network: Change default of forwardPlainNames to 'yes' (rhbz#1061099)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-23
changelog:
  - Generate a valid imagelabel even for type 'none' (rhbz#1061657)
  - qemu: keep pre-migration domain state after failed migration (rhbz#1057407)
  - schema: Fix guest timer specification schema according to the docs (rhbz#1056205)
  - conf: Enforce supported options for certain timers (rhbz#1056205)
  - qemu: hyperv: Add support for timer enlightenments (rhbz#1056205)
  - build: correctly check for SOICGIFVLAN GET_VLAN_VID_CMD command (rhbz#1062665)
  - util: Add "shareable" field for virSCSIDevice struct (rhbz#957292)
  - util: Fix the indention (rhbz#957292)
  - qemu: Don't fail if the SCSI host device is shareable between domains (rhbz#957292)
  - util: Add one argument for several scsi utils (rhbz#957292)
  - tests: Add tests for scsi utils (rhbz#957292)
  - qemu: Fix the error message for scsi host device's shareable checking (rhbz#957292)
  - util: Accept test data path for scsi device's sg_path (rhbz#957292)
  - tests: Modify the scsi util tests (rhbz#957292)
  - event: move event filtering to daemon (regression fix) (rhbz#1047964)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-24
changelog:
  - Block info query: Add check for transient domain (rhbz#1065531)
  - Fix minor typos in messages and docs (rhbz#1045643)
  - LXC: Free variable vroot in lxcDomainDetachDeviceHostdevUSBLive() (rhbz#1045643)
  - LXC: free dst before lxcDomainAttachDeviceDiskLive returns (rhbz#1045643)
  - maint: fix comment typos (rhbz#1045643)
  - storage: avoid short reads while chasing backing chain (rhbz#1045643)
  - Don't block use of USB with containers (rhbz#1045643)
  - Fix path used for USB device attach with LXC (rhbz#1045643)
  - Record hotplugged USB device in LXC live guest config (rhbz#1045643)
  - Fix reset of cgroup when detaching USB device from LXC guests (rhbz#1045643)
  - Disks are always block devices, never character devices (rhbz#1045643)
  - Move check for cgroup devices ACL upfront in LXC hotplug (rhbz#1045643)
  - Add virFileMakeParentPath helper function (rhbz#1045643)
  - Add helper for running code in separate namespaces (rhbz#1045643)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC shutdown/reboot code (CVE-2013-6456)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC disk hotplug (CVE-2013-6456)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC USB hotplug (CVE-2013-6456)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC block hostdev hotplug (CVE-2013-6456)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC chardev hostdev hotplug (CVE-2013-6456)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC hotunplug code (CVE-2013-6456)
  - Ignore additional fields in iscsiadm output (rhbz#1067173)
  - qemuBuildNicDevStr: Set vectors= on Multiqueue (rhbz#1066209)
  - Don't depend on syslog.service (rhbz#1032695)
  - libvirt-guests: Run only after libvirtd (rhbz#1032695)
  - virSystemdCreateMachine: Set dependencies for slices (rhbz#1032695)
  - libvirt-guests: Wait for libvirtd to initialize (rhbz#1032695)
  - virNetServerRun: Notify systemd that we're accepting clients (rhbz#1032695)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-25
changelog:
  - maint: fix comma style issues: conf (rhbz#1032370)
  - Allow <source> for type=block to have no dev (rhbz#1032370)
  - Allow LUN type disks to have no source (rhbz#1032370)
  - virsh-volume: Unify strigification of volume type (rhbz#1032370)
  - conf: Refactor virDomainDiskSourcePoolDefParse (rhbz#1032370)
  - conf: Split out code to parse the source of a disk definition (rhbz#1032370)
  - conf: Rename virDomainDiskHostDefFree to virDomainDiskHostDefClear (rhbz#1032370)
  - conf: Refactor virDomainDiskSourceDefParse (rhbz#1032370)
  - storage: fix RNG validation of gluster via netfs (rhbz#1032370)
  - maint: fix comment typos. (rhbz#1032370)
  - storage: use valid XML for awkward volume names (rhbz#1032370)
  - build: Don't fail on '&lt; ' or '&gt; ' with old xmllint (rhbz#1032370)
  - storage: allow interleave in volume XML (rhbz#1032370)
  - storage: expose volume meta-type in XML (rhbz#1032370)
  - storage: initial support for linking with libgfapi (rhbz#1032370)
  - storage: document existing pools (rhbz#1032370)
  - storage: document gluster pool (rhbz#1032370)
  - storage: implement rudimentary glusterfs pool refresh (rhbz#1032370)
  - storage: add network-dir as new storage volume type (rhbz#1032370)
  - storage: improve directory support in gluster pool (rhbz#1032370)
  - storage: improve allocation stats reported on gluster files (rhbz#1032370)
  - storage: improve handling of symlinks in gluster (rhbz#1032370)
  - storage: probe qcow2 volumes in gluster pool (rhbz#1032370)
  - storage: fix typo in previous patch (rhbz#1032370)
  - conf: Export virStorageVolType enum helper functions (rhbz#1032370)
  - test: Implement fake storage pool driver in qemuxml2argv test (rhbz#1032370)
  - storage: reduce number of stat calls (rhbz#1032370)
  - storage: use simpler 'char *' (rhbz#1032370)
  - storage: refactor backing chain division of labor (rhbz#1032370)
  - storage: always probe type with buffer (rhbz#1032370)
  - storage: don't read storage volumes in nonblock mode (rhbz#1032370)
  - storage: skip selinux cleanup when fd not available (rhbz#1032370)
  - storage: use correct type for array count (rhbz#1032370)
  - storage: allow interleave in pool XML (rhbz#1032370)
  - qemuxml2argv: Add test to verify correct usage of disk type="volume" (rhbz#1032370)
  - qemuxml2argv: Add test for disk type='volume' with iSCSI pools (rhbz#1032370)
  - tests: Fix comment for fake storage pool driver (rhbz#1032370)
  - conf: Support disk source formatting without needing a virDomainDiskDefPtr (rhbz#1032370)
  - conf: Clean up virDomainDiskSourceDefFormatInternal (rhbz#1032370)
  - conf: Split out seclabel formating code for disk source (rhbz#1032370)
  - conf: Export disk source formatter and parser (rhbz#1032370)
  - snapshot: conf: Use common parsing and formatting functions for source (rhbz#1032370)
  - snapshot: conf: Fix NULL dereference when <driver> element is empty (rhbz#1032370)
  - conf: Add functions to copy and free network disk source definitions (rhbz#1032370)
  - qemu: snapshot: Detect internal snapshots also for sheepdog and RBD (rhbz#1032370)
  - conf: Add helper do clear disk source authentication struct (rhbz#1032370)
  - qemu: snapshot: Touch up error message (rhbz#1032370)
  - qemu: snapshot: Add functions similar to disk source pool translation (rhbz#1032370)
  - qemu: Refactor qemuTranslateDiskSourcePool (rhbz#1032370)
  - qemu: Split out formatting of network disk source URI (rhbz#1032370)
  - qemu: Simplify call pattern of qemuBuildDriveURIString (rhbz#1032370)
  - qemu: Use qemuBuildNetworkDriveURI to handle http/ftp and friends (rhbz#1032370)
  - qemu: Migrate sheepdog source generation into common function (rhbz#1032370)
  - qemu: Split out NBD command generation (rhbz#1032370)
  - qemu: Unify formatting of RBD sources (rhbz#1032370)
  - qemu: Refactor disk source string formatting (rhbz#1032370)
  - qemu: Clear old translated pool source (rhbz#1032370)
  - qemu: snapshots: Declare supported and unsupported snapshot configs (rhbz#1032370)
  - domainsnapshotxml2xmltest: Clean up labels and use bool instead of int (rhbz#1032370)
  - domainsnapshotxml2xmltest: Allow for better testing of snapshots (rhbz#1032370)
  - domainsnapshotxml2xml: Move files with conflicting names (rhbz#1032370)
  - domainsnapshotxml2xmltest: Add existing files as new tests (rhbz#1032370)
  - domainsnapshotxml2xmltest: Add test case for empty driver element (rhbz#1032370)
  - qemu: Fix indentation in qemuTranslateDiskSourcePool (rhbz#1032370)
  - qemu: snapshot: Fix incorrect disk type for auto-generated disks (rhbz#1032370)
  - storage: fix omitted slash in gluster volume URI (rhbz#1032370)
  - virsh: domain: Fix undefine with storage of 'volume' disks (rhbz#1032370)
  - snapshot: schema: Split out snapshot disk driver definition (rhbz#1032370)
  - storage: Add gluster pool filter and fix virsh pool listing (rhbz#1032370)
  - storage: fix bogus target in gluster volume xml (rhbz#1032370)
  - storage: Improve error message when a storage backend is missing (rhbz#1032370)
  - storage: Break long lines and clean up spaces in storage backend header (rhbz#1032370)
  - storage: Support deletion of volumes on gluster pools (rhbz#1032370)
  - qemu: snapshot: Avoid libvirtd crash when qemu crashes while snapshotting (rhbz#1032370)
  - qemu: snapshot: Forbid snapshots when backing is a scsi passthrough disk (rhbz#1034993)
  - qemu: Avoid crash in qemuDiskGetActualType (rhbz#1032370)
  - snapshot: Add support for specifying snapshot disk backing type (rhbz#1032370)
  - conf: Move qemuDiskGetActualType to virDomainDiskGetActualType (rhbz#1032370)
  - conf: Move qemuSnapshotDiskGetActualType to virDomainSnapshotDiskGetActualType (rhbz#1032370)
  - storage: Add file storage APIs in the default storage driver (rhbz#1032370)
  - storage: add file functions for local and block files (rhbz#1032370)
  - storage: Add storage file backends for gluster (rhbz#1032370)
  - qemu: Switch snapshot deletion to the new API functions (rhbz#1032370)
  - qemu: snapshot: Use new APIs to detect presence of existing storage files (rhbz#1032370)
  - qemu: snapshot: Add support for external active snapshots on gluster (rhbz#1032370)
  - storage: Fix build with older compilers afeter gluster snapshot series (rhbz#1032370)
  - storage: gluster: Don't leak private data when storage file init fails (rhbz#1032370)
  - spec: Use correct versions of libgfapi in RHEL builds (rhbz#1032370)
  - spec: Fix braces around macros (rhbz#1032370)
  - build: use --with-systemd-daemon as configure option (rhbz#1032695)
  - spec: require device-mapper-devel for storage-disk (rhbz#1032695)
  - spec: make systemd_daemon usage configurable (rhbz#1032695)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-26
changelog:
  - virNetDevVethCreate: Serialize callers (rhbz#1014604)
  - qemuBuildNicDevStr: Adapt to new advisory on multiqueue (rhbz#1071888)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-27
changelog:
  - spec: Let translations be properly updated (rhbz#1030368)
  - Update translation to supported languages (rhbz#1030368)
  - Add a mutex to serialize updates to firewall (rhbz#1074003)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-28
changelog:
  - qemu: Forbid "sgio" support for SCSI generic host device (rhbz#957292)
  - qemu: monitor: Fix invalid parentheses (rhbz#1075973)
  - qemu: Introduce qemuDomainDefCheckABIStability (rhbz#1076503)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-29
changelog:
  - nwfilter: Increase buffer size for libpcap (rhbz#1078347)
  - nwfilter: Display pcap's error message when pcap setup fails (rhbz#1078347)
  - nwfilter: Fix double free of pointer (rhbz#1071181)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.7-1
changelog:
  - Rebased to libvirt-1.2.7 (rhbz#1035158)
  - The rebase also fixes the following bugs:
      rhbz#823535, rhbz#872628, rhbz#874418, rhbz#878394, rhbz#880483
      rhbz#921094, rhbz#963817, rhbz#964177, rhbz#967493, rhbz#967494
      rhbz#972964, rhbz#983350, rhbz#985782, rhbz#985980, rhbz#990319
      rhbz#990418, rhbz#991290, rhbz#992980, rhbz#994731, rhbz#995377
      rhbz#997627, rhbz#997802, rhbz#1006700, rhbz#1007698, rhbz#1007759
      rhbz#1010885, rhbz#1022874, rhbz#1023366, rhbz#1025407, rhbz#1027076
      rhbz#1029266, rhbz#1029732, rhbz#1032363, rhbz#1033020, rhbz#1033398
      rhbz#1033704, rhbz#1035128, rhbz#1046192, rhbz#1049038, rhbz#1052114
      rhbz#1056902, rhbz#1062142, rhbz#1063837, rhbz#1066280, rhbz#1066894
      rhbz#1067338, rhbz#1069552, rhbz#1069784, rhbz#1070680, rhbz#1072141
      rhbz#1072677, rhbz#1073368, rhbz#1073506, rhbz#1074086, rhbz#1075290
      rhbz#1075299, rhbz#1076957, rhbz#1076959, rhbz#1076960, rhbz#1076962
      rhbz#1077009, rhbz#1077572, rhbz#1078590, rhbz#1079162, rhbz#1079173
      rhbz#1080859, rhbz#1081881, rhbz#1081932, rhbz#1082124, rhbz#1083345
      rhbz#1084360, rhbz#1085706, rhbz#1085769, rhbz#1086121, rhbz#1086331
      rhbz#1086704, rhbz#1087104, rhbz#1087671, rhbz#1088293, rhbz#1088667
      rhbz#1088787, rhbz#1088864, rhbz#1089179, rhbz#1089378, rhbz#1091132
      rhbz#1091866, rhbz#1092038, rhbz#1092253, rhbz#1093127, rhbz#1095035
      rhbz#1097028, rhbz#1097503, rhbz#1097677, rhbz#1097968, rhbz#1098659
      rhbz#1099978, rhbz#1100086, rhbz#1100769, rhbz#1101059, rhbz#1101510
      rhbz#1101987, rhbz#1101999, rhbz#1102426, rhbz#1102457, rhbz#1102611
      rhbz#1104992, rhbz#1104993, rhbz#1105939, rhbz#1108593, rhbz#1110198
      rhbz#1110212, rhbz#1110673, rhbz#1111044, rhbz#1112939, rhbz#1113332
      rhbz#1113668, rhbz#1113751, rhbz#1113868, rhbz#1118710, rhbz#1119206
      rhbz#1119387, rhbz#1119592, rhbz#1120474, rhbz#1122255, rhbz#1122973
  - spec: Enable qemu driver for RHEL-7 on ppc64 (rhbz#1120474)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-1
changelog:
  - Rebased to libvirt-1.2.8 (rhbz#1035158)
  - The rebase also fixes the following bugs:
      rhbz#927369, rhbz#957293, rhbz#999926, rhbz#1021703, rhbz#1043735
      rhbz#1047818, rhbz#1062142, rhbz#1064770, rhbz#1072653, rhbz#1078126
      rhbz#1095636, rhbz#1103245, rhbz#1119215, rhbz#1121837, rhbz#1121955
      rhbz#1122455, rhbz#1126329, rhbz#1126721, rhbz#1126909, rhbz#1128097
      rhbz#1128751, rhbz#1129207, rhbz#1129372, rhbz#1129998, rhbz#1130089
      rhbz#1130379, rhbz#1131306, rhbz#1131445, rhbz#1131788, rhbz#1131811
      rhbz#1131819, rhbz#1131876, rhbz#1132301, rhbz#1132305, rhbz#1132347


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-2
changelog:
  - remote: Fix memory leak on error path when deserializing bulk stats (rhbz#1136350)
  - spec: Fix preun script for daemon (rhbz#1136736)
  - security: fix DH key generation when FIPS mode is on (rhbz#1128497)
  - tests: force FIPS testing mode with new enough GNU TLS versions (rhbz#1128497)
  - Don't include non-migratable features in host-model (rhbz#1138221)
  - qemu: Rename DEFAULT_JOB_MASK to QEMU_DEFAULT_JOB_MASK (rhbz#1134154)
  - qemu: snapshot: Fix job handling when creating snapshots (rhbz#1134154)
  - qemu: snapshot: Acquire job earlier on snapshot revert/delete (rhbz#1134154)
  - qemu: snapshot: Fix snapshot function header formatting and spacing (rhbz#1134154)
  - qemu: snapshot: Simplify error paths (rhbz#1134154)
  - qemu: Propagate QEMU errors during incoming migrations (rhbz#1090093)
  - Refactor job statistics (rhbz#1063724)
  - qemu: Avoid incrementing jobs_queued if virTimeMillisNow fails (rhbz#1063724)
  - Add support for fetching statistics of completed jobs (rhbz#1063724)
  - qemu: Silence coverity on optional migration stats (rhbz#1063724)
  - virsh: Add support for completed job stats (rhbz#1063724)
  - qemu: Transfer migration statistics to destination (rhbz#1063724)
  - qemu: Recompute downtime and total time when migration completes (rhbz#1063724)
  - qemu: Transfer recomputed stats back to source (rhbz#1063724)
  - conf: Extend <loader/> and introduce <nvram/> (rhbz#1112257)
  - qemu: Implement extended loader and nvram (rhbz#1112257)
  - qemu: Automatically create NVRAM store (rhbz#1112257)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-3
changelog:
  - virsh: Move --completed from resume to domjobinfo (rhbz#1063724)
  - qemu_driver: Resolve Coverity COPY_PASTE_ERROR (rhbz#1141209)
  - virfile: Resolve Coverity DEADCODE (rhbz#1141209)
  - lxc: Resolve Coverity FORWARD_NULL (rhbz#1141209)
  - qemu: Resolve Coverity FORWARD_NULL (rhbz#1141209)
  - qemu: Resolve Coverity FORWARD_NULL (rhbz#1141209)
  - xen: Resolve Coverity NEGATIVE_RETURNS (rhbz#1141209)
  - qemu: Resolve Coverity NEGATIVE_RETURNS (rhbz#1141209)
  - qemu: Resolve Coverity NEGATIVE_RETURNS (rhbz#1141209)
  - virsh: Resolve Coverity NEGATIVE_RETURNS (rhbz#1141209)
  - daemon: Resolve Coverity RESOURCE_LEAK (rhbz#1141209)
  - domain_conf: Resolve Coverity COPY_PASTE_ERROR (rhbz#1141209)
  - storage_conf: Fix libvirtd crash when defining scsi storage pool (rhbz#1141943)
  - qemu: time: Report errors if agent command fails (rhbz#1142294)
  - util: storage: Copy driver type when initializing chain element (rhbz#1140984)
  - docs, conf, schema: add support for shared memory mapping (rhbz#1133144)
  - qemu: add support for shared memory mapping (rhbz#1133144)
  - rpc: reformat the flow to make a bit more sense (rhbz#927369)
  - remove redundant pidfile path constructions (rhbz#927369)
  - util: fix potential leak in error codepath (rhbz#927369)
  - util: get rid of unnecessary umask() call (rhbz#927369)
  - rpc: make daemon spawning a bit more intelligent (rhbz#927369)
  - conf: add backend element to interfaces (rhbz#1139362)
  - Wire up the interface backend options (rhbz#1139362)
  - CVE-2014-3633: qemu: blkiotune: Use correct definition when looking up disk (CVE-2014-3633)
  - qemu: fix crash with shared disks (rhbz#1142722)
  - nvram: Fix permissions (rhbz#1026772)
  - libvirt.spec: Fix permission even for libvirt-driver-qemu (rhbz#1026772)
  - virDomainUndefineFlags: Allow NVRAM unlinking (rhbz#1026772)
  - formatdomain: Update <loader/> example to match the rest (rhbz#1026772)
  - domaincaps: Expose UEFI capability (rhbz#1026772)
  - qemu_capabilities: Change virQEMUCapsFillDomainCaps signature (rhbz#1026772)
  - domaincaps: Expose UEFI binary path, if it exists (rhbz#1026772)
  - domaincapstest: Run cleanly on systems missing OVMF firmware (rhbz#1026772)
  - conf: Disallow nonexistent NUMA nodes for hugepages (rhbz#1135396)
  - qemu: Honor hugepages for UMA domains (rhbz#1135396)
  - RHEL: Fix maxvcpus output (rhbz#1092363)
  - virsh: Add iothread to 'attach-disk' (rhbz#1101574)
  - qemu: Issue query-iothreads and to get list of active IOThreads (rhbz#1101574)
  - vircgroup: Introduce virCgroupNewIOThread (rhbz#1101574)
  - qemu_domain: Add niothreadpids and iothreadpids (rhbz#1101574)
  - qemu_cgroup: Introduce cgroup functions for IOThreads (rhbz#1101574)
  - qemu: Allow pinning specific IOThreads to a CPU (rhbz#1101574)
  - domain_conf: Add iothreadpin to cputune (rhbz#1101574)
  - vircgroup: Fix broken builds without cgroups (rhbz#1101574)
  - cputune: allow interleaved xml (rhbz#1101574)
  - qemu: Fix iothreads issue (rhbz#1101574)
  - qemu_cgroup: Adjust spacing around incrementor (rhbz#1101574)
  - qemu: Fix call in qemuDomainSetNumaParamsLive for virCgroupNewIOThread (rhbz#1101574)
  - qemu: Need to check for capability before query (rhbz#1101574)
  - qemu: Don't fail startup/attach for IOThreads if no JSON (rhbz#1101574)
  - Fixes for domains with no iothreads (rhbz#1101574)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-4
changelog:
  - Fix libvirtd crash when removing metadata (rhbz#1143955)
  - Fix leak in x86UpdateHostModel (rhbz#1144303)
  - Move the FIPS detection from capabilities (rhbz#1135431)
  - qemu: raise an error when trying to use readonly sata disks (rhbz#1112939)
  - virsh-host: fix pagesize unit of freepages (rhbz#1145048)
  - nodeinfo: report error when given node is out of range (rhbz#1145050)
  - Fix typo of virNodeGetFreePages comment (rhbz#1145050)
  - nodeinfo: Prefer MIN in nodeGetFreePages (rhbz#1145050)
  - Fix bug with loading bridge name for active domain during libvirtd start (rhbz#1140085)
  - qemu: save image: Split out user provided XML checker (rhbz#1142693)
  - qemu: save image: Add possibility to return XML stored in the image (rhbz#1142693)
  - qemu: save image: Split out new definition check/update (rhbz#1142693)
  - qemu: save image: Split out checks done only when editing the save img (rhbz#1142693)
  - qemu: hook: Provide hook when restoring a domain save image (rhbz#1142693)
  - qemu: Expose additional migration statistics (rhbz#1013055)
  - qemu: Fix old tcp:host URIs more cleanly (rhbz#1013055)
  - qemu: Prepare support for arbitrary migration protocol (rhbz#1013055)
  - qemu: Add RDMA migration capabilities (rhbz#1013055)
  - qemu: RDMA migration support (rhbz#1013055)
  - qemu: Memory pre-pinning support for RDMA migration (rhbz#1013055)
  - qemu: Fix memory leak in RDMA migration code (rhbz#1013055)
  - schemas: finish virTristate{Bool, Switch} transition (rhbz#1139364)
  - conf: split out virtio net driver formatting (rhbz#1139364)
  - conf: remove redundant local variable (rhbz#1139364)
  - conf: add options for disabling segment offloading (rhbz#1139364)
  - qemu: wire up virtio-net segment offloading options (rhbz#1139364)
  - spec: Enable qemu driver for RHEL-7 on aarch64 (rhbz#1142448)
  - blkdeviotune: fix bug with saving values into live XML (rhbz#1146511)
  - security: Fix labelling host devices (rhbz#1146550)
  - qemu: Add missing goto on rawio (rhbz#1103739)
  - hostdev: Add "rawio" attribute to _virDomainHostdevSubsysSCSI (rhbz#1103739)
  - qemu: Process the hostdev "rawio" setting (rhbz#1103739)
  - util: Add function to check if a virStorageSource is "empty" (rhbz#1138231)
  - util: storage: Allow metadata crawler to report useful errors (rhbz#1138231)
  - qemu: Sanitize argument names and empty disk check in qemuDomainDetermineDiskChain (rhbz#1138231)
  - qemu: Report better errors from broken backing chains (rhbz#1138231)
  - storage: Improve error message when traversing backing chains (rhbz#1138231)
  - qemu: Always re-detect backing chain (rhbz#1144922)
  - event: introduce new event for tunable values (rhbz#1115898)
  - tunable_event: extend debug message and tweak limit for remote message (rhbz#1115898)
  - add an example how to use tunable event (rhbz#1115898)
  - Fix MinGW build (rhbz#1115898)
  - event_example: cleanup example code for tunable event (rhbz#1115898)
  - cputune_event: queue the event for cputune updates (rhbz#1115898)
  - blkdeviotune: trigger tunable event for blkdeviotune updates (rhbz#1115898)
  - Rename tunable event constants (rhbz#1115898)
  - Fix typo s/EMULATORIN/EMULATORPIN/ (rhbz#1115898)
  - Check for NULL in qemu monitor event filter (rhbz#1144920)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-5
changelog:
  - qemuPrepareNVRAM: Save domain after NVRAM path generation (rhbz#1026772)
  - Fix crash cpu_shares change event crash on domain startup (rhbz#1147494)
  - Don't verify CPU features with host-passthrough (rhbz#1147584)
  - Also filter out non-migratable features out of host-passthrough (rhbz#1147584)
  - selinux: Avoid label reservations for type = none (rhbz#1138487)
  - qemu: bulk stats: extend internal collection API (rhbz#1113116)
  - qemu: bulk stats: implement CPU stats group (rhbz#1113116)
  - qemu: bulk stats: implement balloon group (rhbz#1113116)
  - qemu: bulk stats: implement VCPU group (rhbz#1113116)
  - qemu: bulk stats: implement interface group (rhbz#1113116)
  - qemu: bulk stats: implement block group (rhbz#1113116)
  - virsh: add options to query bulk stats group (rhbz#1113116)
  - lib: De-duplicate stats group documentation for all stats functions (rhbz#1113116)
  - lib: Document that virConnectGetAllDomainStats may omit some stats fields (rhbz#1113116)
  - man: virsh: Add docs for supported stats groups (rhbz#1113116)
  - qemu: monitor: return block stats data as a hash to avoid disk mixup (rhbz#1113116)
  - qemu: monitor: Avoid shadowing variable "devname" on FreeBSD (rhbz#1113116)
  - qemu: monitor: Add helper function to fill physical/virtual image size (rhbz#1113116)
  - qemu: bulk stats: add block allocation information (rhbz#1113116)
  - qemu: json: Fix missing break in error reporting function (rhbz#1113116)
  - qemu: monitor: Avoid shadowing variable "devname" on FreeBSD. Again. (rhbz#1113116)
  - docs, conf, schema: add support for shmem device (rhbz#1126991)
  - qemu: add capability probing for ivshmem device (rhbz#1126991)
  - qemu: Build command line for ivshmem device (rhbz#1126991)
  - minor shmem clean-ups (rhbz#1126991)
  - virSecuritySELinuxSetTapFDLabel: Temporarily revert to old behavior (rhbz#1095636)
  - domain_conf: fix domain deadlock (CVE-2014-3657)
  - qemu: support relative backing for RHEL 7.0.z qemu (rhbz#1150322)
  - qemu: Fix hot unplug of SCSI_HOST device (rhbz#1141732)
  - qemu: Remove need for virConnectPtr in hotunplug detach host, net (rhbz#1141732)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-6
changelog:
  - qemu: support nospace reason in io error event (rhbz#1119784)
  - RHEL: Add support for QMP I/O error reason (rhbz#1119784)
  - nodeinfo: fix nodeGetFreePages when max node is zero (rhbz#1145048)
  - nodeGetFreePages: Push forgotten change (rhbz#1145048)
  - conf: tests: fix virDomainNetDefFormat for vhost-user in client mode (rhbz#1155458)
  - util: string: Add helper to check whether string is empty (rhbz#1142693)
  - qemu: restore: Fix restoring of VM when the restore hook returns empty XML (rhbz#1142693)
  - security_selinux: Don't relabel /dev/net/tun (rhbz#1095636)
  - qemu: Fix updating bandwidth limits in live XML (rhbz#1146511)
  - qemu: save domain status after set the blkio parameters (rhbz#1146511)
  - qemu: call qemuDomainObjBeginJob/qemuDomainObjEndJob in qemuDomainSetInterfaceParameters (rhbz#1146511)
  - qemu: save domain status after set domain's numa parameters (rhbz#1146511)
  - qemu: forbid snapshot-delete --children-only on external snapshot (rhbz#956506)
  - qemu: better error message when block job can't succeed (rhbz#1140981)
  - Reject live update of offloading options (rhbz#1155441)
  - virutil: Introduce virGetSCSIHostNumber (rhbz#1146837)
  - virutil: Introduce virGetSCSIHostNameByParentaddr (rhbz#1146837)
  - storage_conf: Resolve libvirtd crash matching scsi_host (rhbz#1146837)
  - Match scsi_host pools by parent address first (rhbz#1146837)
  - Relax duplicate SCSI host pool checking (rhbz#1146837)
  - qemu: Remove possible NULL deref in debug output (rhbz#1141621)
  - virsh: Adjust the text in man page regarding qemu-attach (rhbz#1141621)
  - hotplug: Check for alias in controller detach (rhbz#1141621)
  - hotplug: Check for alias in disk detach (rhbz#1141621)
  - hotplug: Check for alias in hostdev detach (rhbz#1141621)
  - hotplug: Check for alias in chrdev detach (rhbz#1141621)
  - hotplug: Check for alias in net detach (rhbz#1141621)
  - qemu-attach: Assign device aliases (rhbz#1141621)
  - hotplug: fix char device detach (rhbz#1141621)
  - storage: Fix crash when parsing backing store URI with schema (rhbz#1156288)
  - remote: fix jump depends on uninitialised value (rhbz#1158715)
  - qemu: Release nbd port from migrationPorts instead of remotePorts (rhbz#1159245)
  - conf: add trustGuestRxFilters attribute to network and domain interface (rhbz#848199)
  - network: set interface actual trustGuestRxFilters from network/portgroup (rhbz#848199)
  - util: define virNetDevRxFilter and basic utility functions (rhbz#848199)
  - qemu: qemuMonitorQueryRxFilter - retrieve guest netdev rx-filter (rhbz#848199)
  - qemu: add short document on qemu event handlers (rhbz#848199)
  - qemu: setup infrastructure to handle NIC_RX_FILTER_CHANGED event (rhbz#848199)
  - qemu: change macvtap device MAC address in response to NIC_RX_FILTER_CHANGED (rhbz#848199)
  - util: Functions to update host network device's multicast filter (rhbz#848199)
  - qemu: change macvtap multicast list in response to NIC_RX_FILTER_CHANGED (rhbz#848199)
  - virnetdev: Resolve Coverity DEADCODE (rhbz#848199)
  - virnetdev: Resolve Coverity FORWARD_NULL (rhbz#848199)
  - virnetdev: Resolve Coverity RESOURCE_LEAK (rhbz#848199)
  - lxc: improve error message for invalid blkiotune settings (rhbz#1131306)
  - qemu: improve error message for invalid blkiotune settings (rhbz#1131306)
  - Do not probe for power mgmt capabilities in lxc emulator (rhbz#1159227)
  - qemu: make advice from numad available when building commandline (rhbz#1138545)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-7
changelog:
  - qemu: avoid rare race when undefining domain (rhbz#1150505)
  - qemu: stop NBD server after successful migration (rhbz#1160212)
  - Require at least one console for LXC domain (rhbz#1155410)
  - remote: Fix memory leak in remoteConnectGetAllDomainStats (rhbz#1158715)
  - CVE-2014-7823: dumpxml: security hole with migratable flag (CVE-2014-7823)
  - Free job statistics from the migration cookie (rhbz#1161124)
  - Fix virDomainChrEquals for spicevmc (rhbz#1162097)
  - network: fix call virNetworkEventLifecycleNew when networkStartNetwork fail (rhbz#1162915)
  - Do not crash on gluster snapshots with no host name (rhbz#1162974)
  - nwfilter: fix deadlock caused updating network device and nwfilter (rhbz#1143780)
  - util: eliminate "use after free" in callers of virNetDevLinkDump (rhbz#1163463)
  - storage: Check for valid fc_host parent at startup (rhbz#1160565)
  - storage: Ensure fc_host parent matches wwnn/wwpn (rhbz#1160565)
  - storage: Don't use a stack copy of the adapter (rhbz#1160926)
  - storage: Introduce virStoragePoolSaveConfig (rhbz#1160926)
  - storage: Introduce 'managed' for the fchost parent (rhbz#1160926)
  - qemu: Always set migration capabilities (rhbz#1163953)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-8
changelog:
  - qemu: Fix crash in tunnelled migration (rhbz#1147331)
  - qemu: Really fix crash in tunnelled migration (rhbz#1147331)
  - qemu: Update fsfreeze status on domain state transitions (rhbz#1160084)
  - qemuPrepareNVRAM: Save domain conf only if domain's persistent (rhbz#1026772)
  - docs: Document NVRAM behavior on transient domains (rhbz#1026772)
  - Fix build in qemu_capabilities (rhbz#1165782)
  - qemu: Support OVMF on armv7l aarch64 guests (rhbz#1165782)
  - qemu: Drop OVMF whitelist (rhbz#1165782)
  - storage: Fix issue finding LU's when block doesn't exist (rhbz#1152382)
  - storage: Add thread to refresh for createVport (rhbz#1152382)
  - storage: qemu: Fix security labelling of new image chain elements (rhbz#1151718)
  - virsh: sync domdisplay help and manual (rhbz#997802)
  - docs: domain: Move docs for storage hosts under the <source> element (rhbz#1164528)
  - test: virstoragetest: Add testing of network disk details (rhbz#1164528)
  - util: storage: Copy hosts of a storage file only if they exist (rhbz#1164528)
  - qemu: Refactor qemuBuildNetworkDriveURI to take a virStorageSourcePtr (rhbz#1164528)
  - tests: Reflow the expected output from RBD disk test (rhbz#1164528)
  - util: split out qemuParseRBDString into a common helper (rhbz#1164528)
  - util: storagefile: Split out parsing of NBD string into a separate func (rhbz#1164528)
  - storage: Allow parsing of RBD backing strings when building backing chain (rhbz#1164528)
  - storage: rbd: qemu: Add support for specifying internal RBD snapshots (rhbz#1164528)
  - storage: rbd: Implement support for passing config file option (rhbz#1164528)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-9
changelog:
  - doc: fix mismatched ACL attribute name (rhbz#1161358)
  - qemu: monitor: Rename and improve qemuMonitorGetPtyPaths (rhbz#1146944)
  - conf: Add channel state for virtio channels to the XML (rhbz#1146944)
  - qemu: Add handling for VSERPORT_CHANGE event (rhbz#1146944)
  - qemu: chardev: Extract more information about character devices (rhbz#1146944)
  - qemu: process: Refresh virtio channel guest state when connecting to mon (rhbz#1146944)
  - event: Add guest agent lifecycle event (rhbz#1146944)
  - examples: Add support for the guest agent lifecycle event (rhbz#1146944)
  - qemu: Emit the guest agent lifecycle event (rhbz#1146944)
  - internal: add macro to round value to the next closest power of 2 (rhbz#1076098)
  - video: cleanup usage of vram attribute and update documentation (rhbz#1076098)
  - QXL: fix setting ram and vram values for QEMU QXL device (rhbz#1076098)
  - caps: introduce new QEMU capability for vgamem_mb device property (rhbz#1076098)
  - qemu-command: use vram attribute for all video devices (rhbz#1076098)
  - qemu-command: introduce new vgamem attribute for QXL video device (rhbz#1076098)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-10
changelog:
  - qemu: add the missing jobinfo type in qemuDomainGetJobInfo (rhbz#1167883)
  - network: Fix upgrade from libvirt older than 1.2.4 (rhbz#1167145)
  - qemu: fix domain startup failing with 'strict' mode in numatune (rhbz#1168866)
  - qemu: Don't track quiesced state of FSs (rhbz#1160084)
  - qemu: fix block{commit,copy} abort handling (rhbz#1135169)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-11
changelog:
  - virsh: vol-upload disallow negative offset (rhbz#1087104)
  - storage: fix crash caused by no check return before set close (rhbz#1087104)
  - qemu: Fix virsh freeze when blockcopy storage file is removed (rhbz#1139567)
  - security: Manage SELinux labels on shared/readonly hostdev's (rhbz#1082521)
  - nwfilter: fix crash when adding non-existing nwfilter (rhbz#1169409)
  - conf: Fix libvirtd crash matching hostdev XML (rhbz#1174053)
  - qemu: Resolve Coverity REVERSE_INULL (rhbz#1172570)
  - CVE-2014-8131: Fix possible deadlock and segfault in qemuConnectGetAllDomainStats() (CVE-2014-8131)
  - qemu: bulk stats: Fix logic in monitor handling (rhbz#1172570)
  - qemu: avoid rare race when undefining domain (rhbz#1150505)
  - Do not format CPU features without a model (rhbz#1151885)
  - Ignore CPU features without a model for host-passthrough (rhbz#1151885)
  - Silently ignore MAC in NetworkLoadConfig (rhbz#1156367)
  - Generate a MAC when loading a config instead of package update (rhbz#1156367)
  - qemu: move setting emulatorpin ahead of monitor showing up (rhbz#1170484)
  - util: Introduce flags field for macvtap creation (rhbz#1081461)
  - network: Bring netdevs online later (rhbz#1081461)
  - qemu: always call qemuInterfaceStartDevices() when starting CPUs (rhbz#1081461)
  - qemu: add a qemuInterfaceStopDevices(), called when guest CPUs stop (rhbz#1081461)
  - conf: replace call to virNetworkFree() with virObjectUnref() (rhbz#1099210)
  - util: new functions for setting bridge and bridge port attributes (rhbz#1099210)
  - util: functions to manage bridge fdb (forwarding database) (rhbz#1099210)
  - conf: new network bridge device attribute macTableManager (rhbz#1099210)
  - network: save bridge name in ActualNetDef when actualType==network too (rhbz#1099210)
  - network: store network macTableManager setting in NetDef actual object (rhbz#1099210)
  - network: setup bridge devices for macTableManager='libvirt' (rhbz#1099210)
  - qemu: setup tap devices for macTableManager='libvirt' (rhbz#1099210)
  - qemu: add/remove bridge fdb entries as guest CPUs are started/stopped (rhbz#1099210)
  - virsh: document block.n.allocation stat (rhbz#1041569)
  - getstats: avoid memory leak on OOM (rhbz#1041569)
  - getstats: improve documentation (rhbz#1041569)
  - getstats: start giving offline block stats (rhbz#1041569)
  - getstats: add block.n.path stat (rhbz#1041569)
  - qemuMonitorJSONBlockStatsUpdateCapacity: Don't skip disks (rhbz#1041569)
  - getstats: prepare monitor collection for recursion (rhbz#1041569)
  - getstats: perform recursion in monitor collection (rhbz#1041569)
  - getstats: prepare for dynamic block.count stat (rhbz#1041569)
  - getstats: add new flag for block backing chain (rhbz#1041569)
  - getstats: split block stats reporting for easier recursion (rhbz#1041569)
  - getstats: crawl backing chain for qemu (rhbz#1041569)
  - logical: Add "--type snapshot" to lvcreate command (rhbz#1166592)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-12
changelog:
  - Fix hotplugging of block device-backed usb disks (rhbz#1175668)
  - qemu: Create memory-backend-{ram, file} iff needed (rhbz#1175397)
  - conf: Don't format actual network definition in migratable XML (rhbz#1177194)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-13
changelog:
  - conf: Fix memory leak when parsing invalid network XML (rhbz#1180136)
  - qxl: change the default value for vgamem_mb to 16 MiB (rhbz#1181052)
  - qemuxml2argvtest: Fix test after change of qxl vgamem_mb default (rhbz#1181052)
  - conf: fix crash when hotplug a channel chr device with no target (rhbz#1181408)
  - qemu: forbid second blockcommit during active commit (rhbz#1135339)
  - qemu_monitor: introduce new function to get QOM path (rhbz#1180574)
  - qemu_process: detect updated video ram size values from QEMU (rhbz#1180574)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-14
changelog:
  - virNetworkDefUpdateIPDHCPHost: Don't crash when updating network (rhbz#1182486)
  - Format CPU features even for host-model (rhbz#1182448)
  - util: Add function virCgroupHasEmptyTasks (rhbz#1161540)
  - util: Add virNumaGetHostNodeset (rhbz#1161540)
  - qemu: Remove unnecessary qemuSetupCgroupPostInit function (rhbz#1161540)
  - qemu: Save numad advice into qemuDomainObjPrivate (rhbz#1161540)
  - qemu: Leave cpuset.mems in parent cgroup alone (rhbz#1161540)
  - qemu: Fix hotplugging cpus with strict memory pinning (rhbz#1161540)
  - util: Fix possible NULL dereference (rhbz#1161540)
  - qemu_driver: fix setting vcpus for offline domain (rhbz#1161540)
  - qemu: migration: Unlock vm on failed ACL check in protocol v2 APIs (CVE-2014-8136)
  - CVE-2015-0236: qemu: Check ACLs when dumping security info from save image (CVE-2015-0236)
  - CVE-2015-0236: qemu: Check ACLs when dumping security info from snapshots (CVE-2015-0236)
  - Check for domain liveness in qemuDomainObjExitMonitor (rhbz#1161024)
  - Mark the domain as active in qemuhotplugtest (rhbz#1161024)
  - Fix vmdef usage while in monitor in qemuDomainHotplugVcpus (rhbz#1161024)
  - Fix vmdef usage while in monitor in BlockStat* APIs (rhbz#1161024)
  - Fix vmdef usage while in monitor in qemu process (rhbz#1161024)
  - Fix vmdef usage after domain crash in monitor on device detach (rhbz#1161024)
  - Fix vmdef usage after domain crash in monitor on device attach (rhbz#1161024)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-16
changelog:
  - qemu: don't setup cpuset.mems if memory mode in numatune is not 'strict' (rhbz#1186094)
  - lxc: don't setup cpuset.mems if memory mode in numatune is not 'strict' (rhbz#1186094)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.13-1
changelog:
  - Rebased to libvirt-1.2.13 (rhbz#1194593)
  - The rebase also fixes the following bugs:
      rhbz#872028, rhbz#907779, rhbz#927252, rhbz#956891, rhbz#1073506
      rhbz#1079917, rhbz#1095637, rhbz#1123767, rhbz#1125764, rhbz#1126762
      rhbz#1130390, rhbz#1131919, rhbz#1132900, rhbz#1135442, rhbz#1138125
      rhbz#1138516, rhbz#1138539, rhbz#1140034, rhbz#1140960, rhbz#1141159
      rhbz#1143921, rhbz#1146334, rhbz#1147195, rhbz#1151942, rhbz#1152404
      rhbz#1152473, rhbz#1153891, rhbz#1155843, rhbz#1158034, rhbz#1158722
      rhbz#1159180, rhbz#1160559, rhbz#1160995, rhbz#1161831, rhbz#1164627
      rhbz#1165485, rhbz#1165993, rhbz#1168849, rhbz#1169183, rhbz#1170092
      rhbz#1170140, rhbz#1170492, rhbz#1171533, rhbz#1171582, rhbz#1172015
      rhbz#1172468, rhbz#1172526, rhbz#1173420, rhbz#1174096, rhbz#1174154
      rhbz#1174569, rhbz#1175123, rhbz#1175449, rhbz#1176503, rhbz#1176510
      rhbz#1177723, rhbz#1178652, rhbz#1178850, rhbz#1178853, rhbz#1178986
      rhbz#1179678, rhbz#1179684, rhbz#1179981, rhbz#1181182, rhbz#1182467
      rhbz#1183869, rhbz#1183890, rhbz#1185165, rhbz#1186175, rhbz#1186199
      rhbz#1186765, rhbz#1186886, rhbz#1188914, rhbz#1189007, rhbz#1190956
      rhbz#1191016, rhbz#1191227, rhbz#1191355, rhbz#1191567, rhbz#1195461
      rhbz#1196503, rhbz#1196528, rhbz#1204017


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.14-1
changelog:
  - Rebased to libvirt-1.2.14 (rhbz#1194593)
  - The rebase also fixes the following bugs:
      rhbz#790583, rhbz#853839, rhbz#872424, rhbz#921426, rhbz#952499
      rhbz#958510, rhbz#1070695, rhbz#1125755, rhbz#1127045, rhbz#1129198
      rhbz#1135491, rhbz#1140958, rhbz#1141119, rhbz#1142631, rhbz#1142636
      rhbz#1143832, rhbz#1155887, rhbz#1161461, rhbz#1163553, rhbz#1164053
      rhbz#1166024, rhbz#1171484, rhbz#1173468, rhbz#1174147, rhbz#1176050
      rhbz#1177219, rhbz#1177237, rhbz#1179533, rhbz#1181062, rhbz#1187012
      rhbz#1187533, rhbz#1190590, rhbz#1196185, rhbz#1196644, rhbz#1196934
      rhbz#1197600, rhbz#1199036, rhbz#1199182, rhbz#1206365, rhbz#1206406
      rhbz#1206987, rhbz#1207122, rhbz#1207937
  - RHEL: Hack around changed Broadwell/Haswell CPUs (rhbz#1199446)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.15-1
changelog:
  - Rebased to libvirt-1.2.15 (rhbz#1194593)
  - The rebase also fixes the following bugs:
      rhbz#858147, rhbz#890606, rhbz#1043436, rhbz#1073305, rhbz#1076708
      rhbz#1084876, rhbz#1147847, rhbz#1161617, rhbz#1165119, rhbz#1168530
      rhbz#1171933, rhbz#1177062, rhbz#1177733, rhbz#1181465, rhbz#1192318
      rhbz#1200634, rhbz#1202606, rhbz#1202704, rhbz#1203628, rhbz#1203931
      rhbz#1206114, rhbz#1206479, rhbz#1206521, rhbz#1206625, rhbz#1207257
      rhbz#1208009, rhbz#1208176, rhbz#1208434, rhbz#1208763, rhbz#1209312
      rhbz#1209394, rhbz#1209813, rhbz#1210159, rhbz#1210545, rhbz#1210650
      rhbz#1210669, rhbz#1211436, rhbz#1211548, rhbz#1211550, rhbz#1213434
      rhbz#1213698, rhbz#1215569, rhbz#1216046


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.15-2
changelog:
  - RHEL: Relax qemu-kvm dependency from libvirt-daemon-kvm (rhbz#1212642)
  - caps: Fix regression defaulting to host arch (rhbz#1219191)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.16-1
changelog:
  - Rebased to libvirt-1.2.16 (rhbz#1194593)
  - The rebase also fixes the following bugs:
      rhbz#847198, rhbz#890648, rhbz#893738, rhbz#976387, rhbz#981546
      rhbz#998813, rhbz#1066375, rhbz#1073233, rhbz#1073305, rhbz#1076354
      rhbz#1131486, rhbz#1143837, rhbz#1146539, rhbz#1159171, rhbz#1159219
      rhbz#1161541, rhbz#1164966, rhbz#1171984, rhbz#1174177, rhbz#1174226
      rhbz#1176020, rhbz#1176739, rhbz#1177599, rhbz#1181074, rhbz#1183893
      rhbz#1191227, rhbz#1194593, rhbz#1195882, rhbz#1197580, rhbz#1204006
      rhbz#1204033, rhbz#1206521, rhbz#1207043, rhbz#1211938, rhbz#1213345
      rhbz#1218145, rhbz#1218577, rhbz#1220195, rhbz#1220265, rhbz#1220474
      rhbz#1220702, rhbz#1220809, rhbz#1221047, rhbz#1221504, rhbz#1223631
      rhbz#1223688, rhbz#1224018, rhbz#1226849


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-1
changelog:
  - Rebased to libvirt-1.2.17 (rhbz#1194593)
  - The rebase also fixes the following bugs:
      rhbz#890648, rhbz#985653, rhbz#1021480, rhbz#1089914, rhbz#1131755
      rhbz#1171933, rhbz#1179680, rhbz#1181087, rhbz#1182388, rhbz#1186797
      rhbz#1186969, rhbz#1194593, rhbz#1196644, rhbz#1200206, rhbz#1201143
      rhbz#1201760, rhbz#1202208, rhbz#1207692, rhbz#1210352, rhbz#1220213
      rhbz#1223177, rhbz#1224053, rhbz#1224088, rhbz#1224233, rhbz#1224587
      rhbz#1225694, rhbz#1226234, rhbz#1226854, rhbz#1227180, rhbz#1227551
      rhbz#1227555, rhbz#1227558, rhbz#1227664, rhbz#1228007, rhbz#1229199
      rhbz#1229592, rhbz#1229666, rhbz#1230039, rhbz#1230137, rhbz#1230664
      rhbz#1232606, rhbz#1232880, rhbz#1234686, rhbz#1234729, rhbz#1235116
      rhbz#1236438, rhbz#1236496, rhbz#1236507, rhbz#1236585, rhbz#1236924
      rhbz#1238153, rhbz#1238338


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-2
changelog:
  - util: bitmap: Don't alloc overly large binary bitmaps (rhbz#1238589)
  - storage: Fix regression in storagePoolUpdateAllState (rhbz#1238610)
  - Separate isa-fdc options generation (rhbz#1227880)
  - Explicitly format the isa-fdc controller for newer q35 machines (rhbz#1227880)
  - Add rhel machine types to qemuDomainMachineNeedsFDC (rhbz#1227880)
  - conf: Don't allow duplicated target names regardless of bus (rhbz#1142631)
  - storage: Revert volume obj list updating after volume creation (4749d82a) (rhbz#1241454)
  - qemu_monitor: Wire up MIGRATION event (rhbz#1212077)
  - qemu: Enable migration events on QMP monitor (rhbz#1212077)
  - qemuDomainGetJobStatsInternal: Support migration events (rhbz#1212077)
  - qemu: Update migration state according to MIGRATION event (rhbz#1212077)
  - qemu: Wait for migration events on domain condition (rhbz#1212077)
  - qemu: Check duplicate WWNs also for hotplugged disks (rhbz#1208009)
  - qemu: move the guest status check before agent config and status check (rhbz#1240979)
  - qemu: report error for non-existing disk in blockjobinfo (rhbz#1241355)
  - virCondWaitUntil: add another return value (rhbz#1147471)
  - virDomainObjSignal: drop this function (rhbz#1147471)
  - monitor: detect that eject fails because the tray is locked (rhbz#1147471)
  - qemu_hotplug: try harder to eject media (rhbz#1147471)
  - qemu: Drop LFs at the end of error from QEMU log (rhbz#1090093)
  - Introduce virHashAtomic (rhbz#1090093)
  - Introduce virErrorCopyNew (rhbz#1090093)
  - RHEL: spec: Require perl-XML-XPath (rhbz#1090093)
  - qemu: Remember incoming migration errors (rhbz#1090093)
  - qemu: Don't report false error from MigrateFinish (rhbz#1090093)
  - qemu: Use error from Finish instead of "unexpectedly failed" (rhbz#1090093)
  - cpu: Add support for MPX and AVX512 Intel features (rhbz#1076170)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-3
changelog:
  - qemuProcessHandleMigrationStatus: Update migration status more frequently (rhbz#1212077)
  - qemuDomainSetNumaParamsLive: Check for NUMA mode more wisely (rhbz#1232663)
  - qemu: process: Improve update of maximum balloon state at startup (rhbz#1242940)
  - storage: Fix pool building when directory already exists (rhbz#1244080)
  - virsh: report error if vcpu number exceed the guest maxvcpu number (rhbz#1160559)
  - cmdVcpuPin: Remove dead code (rhbz#1160559)
  - rpc: Add virNetDaemonHasClients (rhbz#1240283)
  - rpc: Rework timerActive logic in daemon (rhbz#1240283)
  - cgroup: Drop resource partition from virSystemdMakeScopeName (rhbz#1238570)
  - virsh: blockjob: Extract block job info code into a separate function (rhbz#1227551)
  - virsh: cmdBlockJob: Switch to declarative flag interlocking (rhbz#1227551)
  - virsh: blockjob: Split out vshBlockJobSetSpeed from blockJobImpl (rhbz#1227551)
  - virsh: block job: separate abort from blockJobImpl (rhbz#1227551)
  - virsh: Split out block pull implementation from blockJobImpl (rhbz#1227551)
  - virsh: Kill blockJobImpl by moving the final impl into cmdBlockCommit (rhbz#1227551)
  - virsh: Refactor argument checking in cmdBlockCommit (rhbz#1227551)
  - virsh: Refactor argument handling in cmdBlockCopy (rhbz#1227551)
  - virsh: Refactor argument handling in cmdBlockPull (rhbz#1227551)
  - qemu: Update state of block job to READY only if it actually is ready (rhbz#1227551)
  - virsh: Refactor block job waiting in cmdBlockPull (rhbz#1227551)
  - virsh: Refactor block job waiting in cmdBlockCommit (rhbz#1227551)
  - virsh: Refactor block job waiting in cmdBlockCopy (rhbz#1197592)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-4
changelog:
  - qemu: Reject migration with memory-hotplug if destination doesn't support it (rhbz#1248350)
  - qemu: Properly check for incoming migration job (rhbz#1242904)
  - qemu: Do not reset labels when migration fails (rhbz#1242904)
  - qemu: Check for iotune_max support properly (rhbz#1224053)
  - docs: Add Fibre Channel NPIV supported option for volume lun config (rhbz#1238545)
  - conf: Allow error reporting in virDomainDiskSourceIsBlockType (rhbz#1238545)
  - qemu: Forbid image pre-creation for non-shared storage migration (rhbz#1249587)
  - qemu: remove deadcode in qemuDomain{HelperGetVcpus|GetIOThreadsLive} (rhbz#1213713)
  - nodeinfo: Introduce local linuxGetCPUPresentPath (rhbz#1213713)
  - nodeinfo: Add sysfs_prefix to nodeGetCPUCount (rhbz#1213713)
  - nodeinfo: Add sysfs_prefix to nodeGetPresentCPUBitmap (rhbz#1213713)
  - nodeinfo: Add sysfs_prefix to nodeGetCPUBitmap (rhbz#1213713)
  - nodeinfo: Add sysfs_prefix to nodeGetCPUMap (rhbz#1213713)
  - nodeinfo: Add sysfs_prefix to nodeGetInfo (rhbz#1213713)
  - nodeinfo: Add sysfs_prefix to nodeCapsInitNUMA (rhbz#1213713)
  - nodeinfo: Add sysfs_prefix to nodeGetMemoryStats (rhbz#1213713)
  - nodeinfo: fix to parse present cpus rather than possible cpus (rhbz#1213713)
  - tests: Add nodeinfo test for non-present CPUs (rhbz#1213713)
  - nodeinfo: Make sysfs_prefix usage more consistent (rhbz#1213713)
  - nodeinfo: Formatting changes (rhbz#1213713)
  - tests: Restore links in deconfigured-cpus nodeinfo test (rhbz#1213713)
  - nodeinfo: Add nodeGetPresentCPUBitmap() to libvirt_private.syms (rhbz#1213713)
  - nodeinfo: Fix nodeGetCPUBitmap()'s fallback code path (rhbz#1213713)
  - nodeinfo: Introduce linuxGetCPUGlobalPath() (rhbz#1213713)
  - nodeinfo: Introduce linuxGetCPUOnlinePath() (rhbz#1213713)
  - nodeinfo: Rename linuxParseCPUmax() to linuxParseCPUCount() (rhbz#1213713)
  - nodeinfo: Add old kernel compatibility to nodeGetPresentCPUBitmap() (rhbz#1213713)
  - nodeinfo: Remove out parameter from nodeGetCPUBitmap() (rhbz#1213713)
  - nodeinfo: Rename nodeGetCPUBitmap() to nodeGetOnlineCPUBitmap() (rhbz#1213713)
  - nodeinfo: Phase out cpu_set_t usage (rhbz#1213713)
  - nodeinfo: Use nodeGetOnlineCPUBitmap() when parsing node (rhbz#1213713)
  - nodeinfo: Use a bitmap to keep track of node CPUs (rhbz#1213713)
  - nodeinfo: Calculate present and online CPUs only once (rhbz#1213713)
  - nodeinfo: Check for errors when reading core_id (rhbz#1213713)
  - Renamed deconfigured-cpus to allow make dist (rhbz#1213713)
  - tests: Finish rename of the long nodeinfo test case (rhbz#1213713)
  - nodeinfo: Fix output on PPC64 KVM hosts (rhbz#1213713)
  - tests: Prepare for subcore tests (rhbz#1213713)
  - tests: Add subcores1 nodeinfo test (rhbz#1213713)
  - tests: Add subcores2 nodeinfo test (rhbz#1213713)
  - tests: Add subcores3 nodeinfo test (rhbz#1213713)
  - nodeinfo: Fix build failure when KVM headers are not available (rhbz#1213713)
  - qemu: fix some api cannot work when disable cpuset in conf (rhbz#1244664)
  - qemu: Auto assign pci addresses for shared memory devices (rhbz#1165029)
  - conf: Add getter for network routes (rhbz#1094205)
  - network: Add another collision check into networkCheckRouteCollision (rhbz#1094205)
  - docs: Document how libvirt handles companion controllers (rhbz#1069590)
  - qemu: Reject updating unsupported disk information (rhbz#1007228)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-5
changelog:
  - numa_conf: Introduce virDomainNumaGetMaxCPUID (rhbz#1176020)
  - virDomainDefParseXML: Check for malicious cpu ids in <numa/> (rhbz#1176020)
  - conf: more useful error message when pci function is out of range (rhbz#1004596)
  - qemu: Fix reporting of physical capacity for block devices (rhbz#1250982)
  - network: verify proper address family in updates to <host> and <range> (rhbz#1184736)
  - rpc: Remove keepalive_required option (rhbz#1247087)
  - virNetDevBandwidthParseRate: Reject negative values (rhbz#1022292)
  - domain: Fix crash if trying to live update disk <serial> (rhbz#1007228)
  - qemu: fail on attempts to use <filterref> for non-tap network connections (rhbz#1180011)
  - network: validate network NAT range (rhbz#985653)
  - conf: Don't try formating non-existing addresses (rhbz#985653)
  - cpu: Rename {powerpc, ppc} => ppc64 (filesystem) (rhbz#1250977)
  - cpu: Rename {powerpc, ppc} => ppc64 (exported symbols) (rhbz#1250977)
  - cpu: Rename {powerpc, ppc} => ppc64 (internal symbols) (rhbz#1250977)
  - cpu: Indentation changes in the ppc64 driver (rhbz#1250977)
  - cpu: Mark driver functions in ppc64 driver (rhbz#1250977)
  - cpu: Simplify NULL handling in ppc64 driver (rhbz#1250977)
  - cpu: Simplify ppc64ModelFromCPU() (rhbz#1250977)
  - cpu: Reorder functions in the ppc64 driver (rhbz#1250977)
  - cpu: Remove ISA information from CPU map XML (rhbz#1250977)
  - tests: Remove unused file (rhbz#1250977)
  - tests: Improve result handling in cpuTestGuestData() (rhbz#1250977)
  - cpu: Never skip CPU model name check in ppc64 driver (rhbz#1250977)
  - cpu: CPU model names have to match on ppc64 (rhbz#1250977)
  - cpu: Use ppc64Compute() to implement ppc64DriverCompare() (rhbz#1250977)
  - tests: Temporarily disable ppc64 cpu tests (rhbz#1250977)
  - cpu: Align ppc64 CPU data with x86 (rhbz#1250977)
  - cpu: Support multiple PVRs in the ppc64 driver (rhbz#1250977)
  - cpu: Simplify ppc64 part of CPU map XML (rhbz#1250977)
  - cpu: Parse and use PVR masks in the ppc64 driver (rhbz#1250977)
  - cpu: Add POWER8NVL information to CPU map XML (rhbz#1250977)
  - cpu: Implement backwards compatibility in the ppc64 driver (rhbz#1250977)
  - cpu: Forbid model fallback in the ppc64 driver (rhbz#1250977)
  - tests: Re-enable ppc64 cpu tests (rhbz#1250977)
  - tests: Add a bunch of cpu test case for ppc64 (rhbz#1250977)
  - cpu: Fix segfault in the ppc64 driver (rhbz#1250977)
  - qemu: Fix segfault when parsing private domain data (rhbz#1162947)
  - conf: Pass private data to Parse function of XML options (rhbz#1162947)
  - qemu: Keep numad hint after daemon restart (rhbz#1162947)
  - qemu: Use numad information when getting pin information (rhbz#1162947)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-6
changelog:
  - api: Remove check on iothread_id arg in virDomainPinIOThread (rhbz#1251886)
  - api: Adjust comment for virDomainAddIOThread (rhbz#1251886)
  - qemu: Add check for invalid iothread_id in qemuDomainChgIOThread (rhbz#1251886)
  - conf: Check for attach disk usage of iothread=0 (rhbz#1253108)
  - virNetDevBandwidthUpdateRate: turn class_id into integer (rhbz#1252473)
  - bridge_driver: Introduce networkBandwidthChangeAllowed (rhbz#1252473)
  - bridge_driver: Introduce networkBandwidthUpdate (rhbz#1252473)
  - qemuDomainSetInterfaceParameters: Use new functions to update bandwidth (rhbz#1252473)
  - cpu: Don't update host-model guest CPUs on ppc64 (rhbz#1251927)
  - cpu: Better support for ppc64 compatibility modes (rhbz#1251927)
  - cpu: Move check for NULL CPU model inside the driver (rhbz#1251927)
  - tests: Add some compatibility-related cases to the CPU tests (rhbz#1251927)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-7
changelog:
  - Start daemon only after filesystems are mounted (rhbz#1255228)
  - virfile: Add error for root squash change mode failure (rhbz#1253609)
  - virfile: Introduce virFileUnlink (rhbz#1253609)
  - storage: Correct the 'mode' check (rhbz#1253609)
  - storage: Handle failure from refreshVol (rhbz#1253609)
  - util: Add virStringGetFirstWithPrefix (rhbz#1165580)
  - util: Add virCgroupGetBlockDevString (rhbz#1165580)
  - util: Add getters for cgroup block device I/O throttling (rhbz#1165580)
  - lxc: Sync BlkioDevice values when setting them in cgroups (rhbz#1165580)
  - qemu: Sync BlkioDevice values when setting them in cgroups (rhbz#1165580)
  - Allow vfio hotplug of a device to the domain which owns the iommu (rhbz#1256486)
  - hostdev: skip ACS check when using VFIO for device assignment (rhbz#1256486)
  - docs: Clarify unprivileged sgio feature (rhbz#1072736)
  - qemu: Introduce qemuIsSharedHostdev (rhbz#1072736)
  - qemu: Introduce qemuGetHostdevPath (rhbz#1072736)
  - qemu: Refactor qemuCheckSharedDisk to create qemuCheckUnprivSGIO (rhbz#1072736)
  - qemu: Inline qemuGetHostdevPath (rhbz#1072736)
  - qemu: Refactor qemuSetUnprivSGIO return values (rhbz#1072736)
  - qemu: Fix integer/boolean logic in qemuSetUnprivSGIO (rhbz#1072736)
  - RHEL: qemu: Add ability to set sgio values for hostdev (rhbz#1072736)
  - RHEL: qemu: Add check for unpriv sgio for SCSI generic host device (rhbz#1072736)
  - security_selinux: Use proper structure to access socket data (rhbz#1146886)
  - security_dac: Label non-listening sockets (rhbz#1146886)
  - security: Add virSecurityDomainSetDirLabel (rhbz#1146886)
  - security_stack: Add SetDirLabel support (rhbz#1146886)
  - security_selinux: Add SetDirLabel support (rhbz#1146886)
  - security_dac: Add SetDirLabel support (rhbz#1146886)
  - qemu: Fix access to auto-generated socket paths (rhbz#1146886)
  - tests: Use qemuProcessPrepareMonitorChr in qemuxmlnstest (rhbz#1146886)
  - qemu: Label correct per-VM path when starting (rhbz#1146886)
  - selinux: fix compile errors (rhbz#1146886)
  - conf: Add ioeventfd option for controllers (rhbz#1150484)
  - qemu: Enable ioeventfd usage for virtio-scsi controllers (rhbz#1150484)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-8
changelog:
  - util: make virNetDev(Replace|Restore)MacAddress public functions (rhbz#1257004)
  - util: don't use netlink to save/set mac for macvtap+passthrough+802.1Qbh (rhbz#1257004)
  - cpu: Introduce IvyBridge CPU model (rhbz#1254420)
  - examples: Add example polkit ACL rules (rhbz#1115289)
  - qemu: don't use initialized ret in qemuRemoveSharedDevice (rhbz#1072736)
  - qemu: Introduce qemuDomainMachineIsS390CCW (rhbz#1258361)
  - qemu: Need to check for machine.os when using ADDRESS_TYPE_CCW (rhbz#1258361)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-9
changelog:
  - conf: fix crash when parsing a unordered NUMA <cell/> (rhbz#1260846)
  - vmx: Some whitespace cleanup (rhbz#1172544)
  - vmx: The virVMXParseDisk deviceType can be NULL, add some missing checks (rhbz#1172544)
  - vmx: Add handling for CDROM devices with SCSI passthru (rhbz#1172544)
  - qemu: hotplug: Properly clean up drive backend if frontend hotplug fails (rhbz#1262399)
  - qemu: Introduce QEMU_CAPS_DEVICE_RTL8139 (rhbz#1254044)
  - qemu: Introduce QEMU_CAPS_DEVICE_E1000 (rhbz#1254044)
  - qemu: Introduce QEMU_CAPS_DEVICE_VIRTIO_NET (rhbz#1254044)
  - qemu: Try several network devices when looking for a default (rhbz#1254044)
  - qemu: Report error if per-VM directory cannot be created (rhbz#1146886)
  - qemu: Do not allow others into per-VM subdirectories (rhbz#1146886)
  - qemu: Allow others to browse /var/lib/libvirt/qemu (rhbz#1146886)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-10
changelog:
  - virSecuritySELinuxSetSecurityAllLabel: drop useless virFileIsSharedFSType (rhbz#1124841)
  - security_selinux: Replace SELinuxSCSICallbackData with proper struct (rhbz#1124841)
  - virSecurityManager: Track if running as privileged (rhbz#1124841)
  - security_selinux: Take @privileged into account (rhbz#1124841)
  - qemu: Fix using guest architecture as lookup key (rhbz#1260753)
  - virfile: Check for existence of dir in virFileDeleteTree (rhbz#1146886)
  - Revert "qemu: Fix integer/boolean logic in qemuSetUnprivSGIO" (rhbz#1072736)
  - qemu: migration: Relax enforcement of memory hotplug support (rhbz#1252685)
  - conf: Add helper to determine whether memory hotplug is enabled for a vm (rhbz#1252685)
  - qemu: Make memory alignment helper more universal (rhbz#1252685)
  - conf: Drop VIR_DOMAIN_DEF_PARSE_CLOCK_ADJUST flag (rhbz#1252685)
  - conf: Document all VIR_DOMAIN_DEF_PARSE_* flags (rhbz#1252685)
  - conf: Add XML parser flag that will allow us to do incompatible updates (rhbz#1252685)
  - conf: Split memory related post parse stuff into separate function (rhbz#1252685)
  - conf: Rename max_balloon to total_memory (rhbz#1252685)
  - conf: Pre-calculate initial memory size instead of always calculating it (rhbz#1252685)
  - conf: Don't always recalculate initial memory size from NUMA size totals (rhbz#1252685)
  - qemu: command: Align memory sizes only on fresh starts (rhbz#1252685)
  - qemu: ppc64: Align memory sizes to 256MiB blocks (rhbz#1249006)
  - test: Add test to validate that memory sizes don't get updated on migration (rhbz#1252685)
  - qemu: Align memory module sizes to 2MiB (rhbz#1252685)
  - qemu: Refresh memory size only on fresh starts (rhbz#1242940)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-13
changelog:
  - qemu: Add conditions for qemu-kvm use on ppc64 (rhbz#1267882)
  - qemu: Move simplification variable to begining of the function (rhbz#1266856)
  - qemu: Extract -mem-path building into its own function (rhbz#1266856)
  - qemu: Add -mem-path even with numa (rhbz#1266856)
  - qemu: Use memory-backing-file only when needed (rhbz#1266856)
  - qemu: Always update migration times on destination (rhbz#1265902)
  - qemu: Copy completed migration stats only on success (rhbz#1265902)
  - qemu: Introduce flags in qemuMigrationCompleted (rhbz#1265902)
  - qemu: Make updating stats in qemuMigrationCheckJobStatus optional (rhbz#1265902)
  - qemu: Wait until destination QEMU consumes all migration data (rhbz#1265902)


author: Jiri Denemark <jdenemar@redhat.com> - 1.3.1-1
changelog:
  - Rebased to libvirt-1.3.1 (rhbz#1286679)
  - The rebase also fixes the following bugs:
      rhbz#1207692, rhbz#1233115, rhbz#1245476, rhbz#1298065, rhbz#1026136
      rhbz#1207751, rhbz#1210587, rhbz#1250287, rhbz#1253107, rhbz#1254152
      rhbz#1257486, rhbz#1266078, rhbz#1271107, rhbz#1159219, rhbz#1163091
      rhbz#1196711, rhbz#1263574, rhbz#1270427, rhbz#1245525, rhbz#1247987
      rhbz#1248277, rhbz#1249981, rhbz#1251461, rhbz#1256999, rhbz#1264008
      rhbz#1265049, rhbz#1265114, rhbz#1270715, rhbz#1272301, rhbz#1273686
      rhbz#997561, rhbz#1166452, rhbz#1231114, rhbz#1233003, rhbz#1260576
      rhbz#1261432, rhbz#1273480, rhbz#1273491, rhbz#1277781, rhbz#1278404
      rhbz#1281707, rhbz#1282288, rhbz#1285665, rhbz#1288690, rhbz#1292984
      rhbz#921135, rhbz#1025230, rhbz#1240439, rhbz#1266982, rhbz#1270709
      rhbz#1276198, rhbz#1278068, rhbz#1278421, rhbz#1281710, rhbz#1291035
      rhbz#1297020, rhbz#1297690
  - RHEL: Add rhel machine types to qemuDomainMachineNeedsFDC (rhbz#1227880)
  - RHEL: qemu: Support vhost-user-multiqueue with QEMU 2.3 (rhbz#1207692)


author: Jiri Denemark <jdenemar@redhat.com> - 1.3.2-1
changelog:
  - Rebased to libvirt-1.3.2 (rhbz#1286679)
  - The rebase also fixes the following bugs:
      rhbz#1197592, rhbz#1235180, rhbz#1244128, rhbz#1244567, rhbz#1245013
      rhbz#1250331, rhbz#1265694, rhbz#1267256, rhbz#1275039, rhbz#1282846
      rhbz#1283085, rhbz#1286679, rhbz#1290324, rhbz#1293241, rhbz#1293899
      rhbz#1299696, rhbz#1305922


author: Jiri Denemark <jdenemar@redhat.com> - 1.3.3-1
changelog:
  - Rebased to libvirt-1.3.3 (rhbz#1286679)
  - The rebase also fixes the following bugs:
      rhbz#830971, rhbz#986365, rhbz#1151723, rhbz#1195176, rhbz#1249441
      rhbz#1260749, rhbz#1264008, rhbz#1269715, rhbz#1278727, rhbz#1281706
      rhbz#1282744, rhbz#1286679, rhbz#1288000, rhbz#1289363, rhbz#1293804
      rhbz#1306556, rhbz#1308317, rhbz#1313264, rhbz#1313314, rhbz#1314594
      rhbz#1315059, rhbz#1316371, rhbz#1316384, rhbz#1316420, rhbz#1316433
      rhbz#1316465, rhbz#1317531, rhbz#1318569, rhbz#1321546


author: Jiri Denemark <jdenemar@redhat.com> - 1.3.4-1
changelog:
  - Rebased to libvirt-1.3.4 (rhbz#1286679)
  - The rebase also fixes the following bugs:
      rhbz#1002423, rhbz#1004593, rhbz#1038888, rhbz#1103314, rhbz#1220702
      rhbz#1286679, rhbz#1289363, rhbz#1320447, rhbz#1324551, rhbz#1325043
      rhbz#1325075, rhbz#1325757, rhbz#1326270, rhbz#1327499, rhbz#1328401
      rhbz#1329041, rhbz#1329046, rhbz#1329819, rhbz#1331228


author: Jiri Denemark <jdenemar@redhat.com> - 1.3.5-1
changelog:
  - Rebased to libvirt-1.3.5 (rhbz#1286679)
  - The rebase also fixes the following bugs:
      rhbz#1139766, rhbz#1182074, rhbz#1209802, rhbz#1265694, rhbz#1286679
      rhbz#1286709, rhbz#1318993, rhbz#1319044, rhbz#1320836, rhbz#1326660
      rhbz#1327537, rhbz#1328003, rhbz#1328301, rhbz#1329045, rhbz#1336629
      rhbz#1337073, rhbz#1339900, rhbz#1341460


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-1
changelog:
  - Rebased to libvirt-2.0.0 (rhbz#1286679)
  - The rebase also fixes the following bugs:
      rhbz#735385, rhbz#1004602, rhbz#1046833, rhbz#1180092, rhbz#1216281
      rhbz#1283207, rhbz#1286679, rhbz#1289288, rhbz#1302373, rhbz#1304222
      rhbz#1312188, rhbz#1316370, rhbz#1320893, rhbz#1322210, rhbz#1325072
      rhbz#1325080, rhbz#1332446, rhbz#1333248, rhbz#1333404, rhbz#1334237
      rhbz#1335617, rhbz#1335832, rhbz#1337869, rhbz#1341415, rhbz#1342342
      rhbz#1342874, rhbz#1342962, rhbz#1343442, rhbz#1344892, rhbz#1344897
      rhbz#1345743, rhbz#1346723, rhbz#1346724, rhbz#1346730, rhbz#1350688
      rhbz#1351473


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-2
changelog:
  - qemu: Use bootindex whenever possible (rhbz#1323085)
  - qemu: Properly reset spiceMigration flag (rhbz#1151723)
  - qemu: Drop useless SPICE migration code (rhbz#1151723)
  - qemu: Memory locking is only required for KVM guests on ppc64 (rhbz#1350772)
  - virtlogd: make max file size & number of backups configurable (rhbz#1351209)
  - virtlogd: increase max file size to 2 MB (rhbz#1351209)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-3
changelog:
  - qemu: getAutoDumpPath() return value should be dumpfile not domname. (rhbz#1354238)
  - qemu: Copy complete domain def in qemuDomainDefFormatBuf (rhbz#1320470)
  - qemu: Drop default channel path during migration (rhbz#1320470)
  - qemu: Fix migration from old libvirt (rhbz#1320500)
  - Add USB addresses to qemuhotplug test cases (rhbz#1215968)
  - Introduce virDomainUSBDeviceDefForeach (rhbz#1215968)
  - Allow omitting USB port (rhbz#1215968)
  - Store USB port path as an array of integers (rhbz#1215968)
  - Introduce virDomainUSBAddressSet (rhbz#1215968)
  - Add functions for adding USB controllers to addrs (rhbz#1215968)
  - Add functions for adding USB hubs to addrs (rhbz#1215968)
  - Reserve existing USB addresses (rhbz#1215968)
  - Add tests for USB address assignment (rhbz#1215968)
  - Assign addresses to USB devices (rhbz#1215968)
  - Assign addresses on USB device hotplug (rhbz#1215968)
  - Auto-add one hub if there are too many USB devices (rhbz#1215968)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-4
changelog:
  - qemu: hotplug: fix changeable media ejection (rhbz#1359071)
  - lxc: Don't crash by forgetting to ref transient domains (rhbz#1351057)
  - Introduce <iommu> device (rhbz#1235581)
  - Add QEMU_CAPS_DEVICE_INTEL_IOMMU (rhbz#1235581)
  - qemu: format intel-iommu on the command line (rhbz#1235581)
  - qemu_monitor_json: add support to search QOM device path by device alias (rhbz#1358728)
  - hvsupport: Introduce parseSymsFile (rhbz#1286679)
  - hvsupport: use a regex instead of XML::XPath (rhbz#1286679)
  - hvsupport: construct the group regex upfront (rhbz#1286679)
  - hvsupport: skip non-matching lines early (rhbz#1286679)
  - virconf: Fix config file path construction (rhbz#1357364)
  - virDomainHostdevDefFree: Don't leak privateData (rhbz#1357346)
  - virt-admin: Output srv-threadpool-info data as unsigned int rather than signed (rhbz#1356769)
  - util: Introduce virISCSINodeNew (rhbz#1356436)
  - iscsi: Establish connection to target via static target login (rhbz#1356436)
  - storage: Document wiping formatted volume types (rhbz#868771)
  - admin: Retrieve the SASL context for both local and remote connection (rhbz#1361948)
  - daemon: sasl: Don't forget to save SASL username to client's identity (rhbz#1361948)
  - vsh: Make vshInitDebug return int instead of void (rhbz#1357363)
  - tools: Make use of the correct environment variables (rhbz#1357363)
  - util: Add 'usage' for encryption (rhbz#1301021)
  - virStorageEncryptionSecretFree: Don't leak secret lookup definition (rhbz#1301021)
  - encryption: Add luks parsing for storageencryption (rhbz#1301021)
  - encryption: Add <cipher> and <ivgen> to encryption (rhbz#1301021)
  - qemu: Introduce helper qemuDomainSecretDiskCapable (rhbz#1301021)
  - tests: Adjust LUKS tests to use 'volume' secret type (rhbz#1301021)
  - docs: Update docs to reflect LUKS secret changes (rhbz#1301021)
  - qemu: Alter error path cleanup for qemuDomainAttachHostSCSIDevice (rhbz#1301021)
  - qemu: Alter error path cleanup for qemuDomainAttachVirtioDiskDevice (rhbz#1301021)
  - qemu: Alter error path cleanup for qemuDomainAttachSCSIDisk (rhbz#1301021)
  - qemu: Move and rename qemuBufferEscapeComma (rhbz#1301021)
  - storage: Add support to create a luks volume (rhbz#1301021)
  - qemu: Add secinfo for hotplug virtio disk (rhbz#1301021)
  - qemu: Alter the qemuDomainGetSecretAESAlias to add new arg (rhbz#1301021)
  - qemu: Add luks support for domain disk (rhbz#1301021)
  - qemu: Move setting of obj bools for qemuDomainAttachVirtioDiskDevice (rhbz#1301021)
  - qemu: Move setting of encobjAdded for qemuDomainAttachSCSIDisk (rhbz#1301021)
  - storage: Fix error path (rhbz#1301021)
  - qemu: Disallow usage of luks encryption if aes secret not possible (rhbz#1301021)
  - storage: Add extra failure condition for luks volume creation (rhbz#1301021)
  - virstoragefile: refactor virStorageFileMatchesNNN methods (rhbz#1301021)
  - qemu: Make qemuDomainCheckDiskStartupPolicy self-contained (rhbz#1168453)
  - qemu: Remove unnecessary label and its only reference (rhbz#1168453)
  - qemu: Fix support for startupPolicy with volume/pool disks (rhbz#1168453)
  - virsh: Report error when explicit connection fails (rhbz#1356461)
  - tests: Add testing of backing store string parser (rhbz#1134878)
  - util: json: Make first argument of virJSONValueObjectForeachKeyValue const (rhbz#1134878)
  - util: qemu: Add wrapper for JSON -> commandline conversion (rhbz#1134878)
  - util: qemu: Add support for user-passed strings in JSON->commandline (rhbz#1134878)
  - util: qemu: Allow nested objects in JSON -> commandline generator (rhbz#1134878)
  - util: qemu: Allow for different approaches to format JSON arrays (rhbz#1134878)
  - util: qemu: Don't generate any extra commas in virQEMUBuildCommandLineJSON (rhbz#1134878)
  - util: json: Make first argument of virJSONValueCopy const (rhbz#1134878)
  - util: storage: Add parser for qemu's json backing pseudo-protocol (rhbz#1134878)
  - util: storage: Add support for host device backing specified via JSON (rhbz#1134878)
  - util: storage: Add support for URI based backing volumes in qemu's JSON pseudo-protocol (rhbz#1134878)
  - util: storage: Add json pseudo protocol support for gluster volumes (rhbz#1134878)
  - util: storage: Add json pseudo protocol support for iSCSI volumes (rhbz#1134878)
  - util: storage: Add JSON backing volume parser for 'nbd' protocol (rhbz#1134878)
  - util: storage: Add JSON backing store parser for 'sheepdog' protocol (rhbz#1134878)
  - util: storage: Add 'ssh' network storage protocol (rhbz#1134878)
  - util: storage: Add JSON backing volume parser for 'ssh' protocol (rhbz#1134878)
  - qemu: command: Rename qemuBuildNetworkDriveURI to qemuBuildNetworkDriveStr (rhbz#1247521)
  - qemu: command: Split out network disk URI building (rhbz#1247521)
  - qemu: command: Extract drive source command line formatter (rhbz#1247521)
  - qemu: command: Refactor code extracted to qemuBuildDriveSourceStr (rhbz#1247521)
  - storage: gluster: Support multiple hosts in backend functions (rhbz#1247521)
  - util: qemu: Add support for numbered array members (rhbz#1247521)
  - qemu: command: Add infrastructure for object specified disk sources (rhbz#1247521)
  - qemu: command: Add support for multi-host gluster disks (rhbz#1247521)
  - qemu: Need to free fileprops in error path (rhbz#1247521)
  - storage: remove "luks" storage volume type (rhbz#1301021)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-5
changelog:
  - qemu: Fix domain state after reset (rhbz#1269575)
  - rpc: virnetserver: Rename ClientSetProcessingControls to ClientSetLimits (rhbz#1357776)
  - rpc: virnetserver: Move virNetServerCheckLimits which is static up in the file (rhbz#1357776)
  - rpc: virnetserver: Add code to CheckLimits to handle suspending of services (rhbz#1357776)
  - admin: rpc: virnetserver: Fix updating of the client limits (rhbz#1357776)
  - rpc: virnetserver: Remove dead code checking the client limits (rhbz#1357776)
  - storage: Fix a NULL ptr dereference in virStorageBackendCreateQemuImg (rhbz#1363636)
  - qemu: Introduce qemuAliasFromHostdev (rhbz#1289391)
  - qemu: Use the hostdev alias in qemuDomainAttachHostSCSIDevice error path (rhbz#1289391)
  - storage: Don't remove the pool for buildPool failure in storagePoolCreate (rhbz#1362349)
  - lxcDomainCreateXMLWithFiles: Avoid crash (rhbz#1363773)
  - admin: Fix the default uri for session daemon to libvirtd:///session (rhbz#1356858)
  - docs: Distribute subsite.xsl (rhbz#1365004)
  - qemuBuildMachineCommandLine: Follow our pattern (rhbz#1304483)
  - Introduce SMM feature (rhbz#1304483)
  - Introduce @secure attribute to os loader element (rhbz#1304483)
  - qemu: Enable secure boot (rhbz#1304483)
  - qemu: Advertise OVMF_CODE.secboot.fd (rhbz#1304483)
  - tests: Fix broken build (rhbz#1304483)
  - cpu_x86: Introduce x86FeatureIsMigratable (rhbz#1365500)
  - cpu_x86: Properly drop non-migratable features (rhbz#1365500)
  - tests: Add a test for host-model CPU with CMT feature (rhbz#1365500)
  - cpu_x86: Fix host-model CPUs on hosts with CMT (rhbz#1365500)
  - virt-admin: Fix the error when an invalid URI has been provided (rhbz#1365903)
  - conf: improve error log when PCI devices don't match requested controller (rhbz#1363627)
  - conf: don't allow connecting upstream-port directly to pce-expander-bus (rhbz#1361172)
  - conf: restrict where dmi-to-pci-bridge can be connected (rhbz#1363648)
  - conf: restrict expander buses to connect only to a root bus (rhbz#1358712)
  - virNetDevMacVLanCreateWithVPortProfile: Don't mask virNetDevMacVLanTapOpen error (rhbz#1240439)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-6
changelog:
  - qemu_command: don't modify heads for graphics device (rhbz#1366119)
  - virsh: Fix core for cmdSecretGetValue (rhbz#1366611)
  - conf: report an error message for non-existing USB hubs (rhbz#1367130)
  - conf: free the ports array of a USB hub (rhbz#1366097)
  - utils: storage: Fix JSON field name for uri based storage (rhbz#1367260)
  - qemu: Adjust the cur_ballon on coldplug/unplug of dimms (rhbz#1220702)
  - conf: Provide error on undefined iothreadsched entry (rhbz#1366484)
  - qemu: Fix the command line generation for rbd auth using aes secrets (rhbz#1182074)
  - qemu: Fix crash hot plugging luks volume (rhbz#1367259)
  - Revert "admin: Fix the default uri for session daemon to libvirtd:///session" (rhbz#1367269)
  - libvirt: convert to typesafe virConf accessors (rhbz#1367269)
  - admin: Fix default uri config option name s/admin_uri_default/uri_default (rhbz#1367269)
  - virt-admin: Properly fix the default session daemon URI to admin server (rhbz#1367269)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-7
changelog:
  - qemu: caps: Always assume QEMU_CAPS_SMP_TOPOLOGY (rhbz#1097930)
  - conf: Extract code formatting vCPU info (rhbz#1097930)
  - conf: Rename virDomainVcpuInfoPtr to virDomainVcpuDefPtr (rhbz#1097930)
  - conf: Don't report errors from virDomainDefGetVcpu (rhbz#1097930)
  - tests: qemuxml2xml: Format status XML header dynamically (rhbz#1097930)
  - conf: convert def->vcpus to a array of pointers (rhbz#1097930)
  - conf: Add private data for virDomainVcpuDef (rhbz#1097930)
  - qemu: domain: Add vcpu private data structure (rhbz#1097930)
  - qemu: domain: Extract formating and parsing of vCPU thread ids (rhbz#1097930)
  - qemu: Add cpu ID to the vCPU pid list in the status XML (rhbz#1097930)
  - qemu: Store vCPU thread ids in vcpu private data objects (rhbz#1097930)
  - Fix logic in qemuDomainObjPrivateXMLParseVcpu (rhbz#1097930)
  - qemu: Add qemuProcessSetupPid() and use it in qemuProcessSetupIOThread() (rhbz#1097930)
  - qemu: Use qemuProcessSetupPid() in qemuProcessSetupEmulator() (rhbz#1097930)
  - qemu: Use qemuProcessSetupPid() in qemuProcessSetupVcpu() (rhbz#1097930)
  - qemuBuildCpuCommandLine: Don't leak @buf (rhbz#1097930)
  - conf: Make really sure we don't access non-existing vCPUs (rhbz#1097930)
  - conf: Make really sure we don't access non-existing vCPUs again (rhbz#1097930)
  - qemu: capabilities: Drop unused function virQEMUCapsGetMachineTypes (rhbz#1097930)
  - qemu: caps: Sanitize storage of machine type related data (rhbz#1097930)
  - qemu: cap: Refactor access to array in virQEMUCapsProbeQMPMachineTypes (rhbz#1097930)
  - qemu: monitor: Add monitor API for device_add supporting JSON objects (rhbz#1097930)
  - qemu: monitor: Add do-while block to QEMU_CHECK_MONITOR_FULL (rhbz#1097930)
  - qemu: Improve error message in virDomainGetVcpus (rhbz#1097930)
  - qemu: domain: Rename qemuDomainDetectVcpuPids to qemuDomainRefreshVcpuInfo (rhbz#1097930)
  - qemu: monitor: Rename qemuMonitor(JSON|Text)GetCPUInfo (rhbz#1097930)
  - qemu: domain: Improve vCPU data checking in qemuDomainRefreshVcpu (rhbz#1097930)
  - qemu: domain: Simplify return values of qemuDomainRefreshVcpuInfo (rhbz#1097930)
  - internal: Introduce macro for stealing pointers (rhbz#1097930)
  - tests: qemucapabilities: Add data for qemu 2.7.0 (rhbz#1097930)
  - qemu: setcpus: Report better errors (rhbz#1097930)
  - qemu: setvcpus: Extract setting of maximum vcpu count (rhbz#1097930)
  - qemu: driver: Extract setting of live vcpu count (rhbz#1097930)
  - qemu: driver: Split out regular vcpu hotplug code into a function (rhbz#1097930)
  - conf: Provide error on undefined vcpusched entry (rhbz#1097930)
  - qemu: monitor: Return structures from qemuMonitorGetCPUInfo (rhbz#1097930)
  - qemu: monitor: Return struct from qemuMonitor(Text|Json)QueryCPUs (rhbz#1097930)
  - qemu: Add capability for query-hotpluggable-cpus command (rhbz#1097930)
  - qemu: Forbid config when topology based cpu count doesn't match the config (rhbz#1097930)
  - qemu: capabilities: Extract availability of new cpu hotplug for machine types (rhbz#1097930)
  - qemu: monitor: Extract QOM path from query-cpus reply (rhbz#1097930)
  - qemu: monitor: Add support for calling query-hotpluggable-cpus (rhbz#1097930)
  - qemu: monitor: Add algorithm for combining query-(hotpluggable-)-cpus data (rhbz#1097930)
  - tests: Add test infrastructure for qemuMonitorGetCPUInfo (rhbz#1097930)
  - tests: cpu-hotplug: Add data for x86 hotplug with 11+ vcpus (rhbz#1097930)
  - tests: cpu-hotplug: Add data for ppc64 platform including hotplug (rhbz#1097930)
  - tests: cpu-hotplug: Add data for ppc64 out-of-order hotplug (rhbz#1097930)
  - tests: cpu-hotplug: Add data for ppc64 without threads enabled (rhbz#1097930)
  - qemu: domain: Extract cpu-hotplug related data (rhbz#1097930)
  - qemu: domain: Prepare for VCPUs vanishing while libvirt is not running (rhbz#1097930)
  - util: Extract and rename qemuDomainDelCgroupForThread to virCgroupDelThread (rhbz#1097930)
  - conf: Add XML for individual vCPU hotplug (rhbz#1097930)
  - qemu: migration: Prepare for non-contiguous vcpu configurations (rhbz#1097930)
  - qemu: command: Add helper to convert vcpu definition to JSON props (rhbz#1097930)
  - qemu: process: Copy final vcpu order information into the vcpu definition (rhbz#1097930)
  - qemu: command: Add support for sparse vcpu topologies (rhbz#1097930)
  - qemu: Use modern vcpu hotplug approach if possible (rhbz#1097930)
  - qemu: hotplug: Allow marking unplugged devices by alias (rhbz#1097930)
  - qemu: hotplug: Add support for VCPU unplug (rhbz#1224341)
  - virsh: vcpuinfo: Report vcpu number from the structure rather than it's position (rhbz#1097930)
  - qemu: driver: Fix qemuDomainHelperGetVcpus for sparse vcpu topologies (rhbz#1097930)
  - doc: clarify documentation for vcpu order (rhbz#1097930)
  - conf: Don't validate vcpu count in XML parser (rhbz#1097930)
  - qemu: driver: Validate configuration when setting maximum vcpu count (rhbz#1370066)
  - conf: Fix build with picky GCC (rhbz#1097930)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-8
changelog:
  - util: storage: Properly set protocol type when parsing gluster json string (rhbz#1372251)
  - conf: Add IOThread quota and period scheduler/cputune defs (rhbz#1356937)
  - qemu: Add support to get/set IOThread period and quota cgroup values (rhbz#1356937)
  - network: new network forward mode 'open' (rhbz#846810)
  - virtlogd.socket: Tie lifecycle to libvirtd.service (rhbz#1372576)
  - cpu_x86: Fix minimum match custom CPUs on hosts with CMT (rhbz#1365500)
  - qemu: cgroup: Extract temporary relaxing of cgroup setting for vcpu hotplug (rhbz#1097930)
  - qemu: process: Fix start with unpluggable vcpus with NUMA pinning (rhbz#1097930)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-9
changelog:
  - Add helper for removing transient definition (rhbz#1368774)
  - qemu: Remove stale transient def when migration fails (rhbz#1368774)
  - qemu: Don't use query-migrate on destination (rhbz#1374613)
  - conf: allow hotplugging "legacy PCI" device to manually addressed PCIe slot (rhbz#1337490)
  - conf: Add support for virtio-net.rx_queue_size (rhbz#1366989)
  - qemu_capabilities: Introduce virtio-net-*.rx_queue_size (rhbz#1366989)
  - qemu: Implement virtio-net rx_queue_size (rhbz#1366989)
  - audit: Audit information about shmem devices (rhbz#1218603)
  - qemu: monitor: Use a more obvious iterator name (rhbz#1375783)
  - qemu: monitor: qemuMonitorGetCPUInfoHotplug: Add iterator 'anycpu' (rhbz#1375783)
  - qemu: monitor: Add vcpu state information to monitor data (rhbz#1375783)
  - qemu: domain: Don't infer vcpu state (rhbz#1375783)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-10.el7_3.1
changelog:
  - qemu: allow 32 slots on pcie-expander-bus, not just 1 (rhbz#1389369)
  - qemu: Reset post-copy capability after migration (rhbz#1392030)
  - qemuhotplugtest: Only read result_filename if used (rhbz#1392031)
  - schema: Allow shmem to have alias (rhbz#1392031)
  - conf: Allow copying of shmem defs (rhbz#1392031)
  - qemu: Make qemuBuildShmemDevStr static (rhbz#1392031)
  - qemu: Rename qemuBuildShmemDevStr to qemuBuildShmemDevLegacyStr (rhbz#1392031)
  - qemu: Move common checks outside qemuBuildShmemDevLegacyStr (rhbz#1392031)
  - qemu: Reorder shmem params nicely (rhbz#1392031)
  - qemu: Abstract shmem socket path preparation (rhbz#1392031)
  - qemu: Rename qemuBuildShmemBackendStr to qemuBuildShmemBackendChrStr (rhbz#1392031)
  - qemu: Add qemuAssignDeviceShmemAlias and use it (rhbz#1392031)
  - conf: Add some shmem helpers for future use (rhbz#1392031)
  - conf: Remove incorrect check when encoding shmem audit message (rhbz#1389013)
  - conf: Fix virDomainShmemDefFind (rhbz#1392031)
  - conf: Don't complicate find loop (rhbz#1392031)
  - qemu: Disable migration with ivshmem (rhbz#1392031)
  - conf, qemu: Add support for shmem model (rhbz#1392031)
  - conf, qemu: Add newer shmem models (rhbz#1392031)
  - qemu: Add capabilities for ivshmem-{plain, doorbell} (rhbz#1392031)
  - qemu: Save various defaults for shmem (rhbz#1392031)
  - qemu: Support newer ivshmem device variants (rhbz#1392031)
  - qemu: Add support for hot/cold-(un)plug of shmem devices (rhbz#1392031)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-10.el7_3.2
changelog:
  - qemu: Fix double free when live-attaching shmem (rhbz#1392031)
  - qemu: Make sure shmem memory is shared (rhbz#1392031)


author: Jon Masters <jcm@redhat.com> 2:1.0-0.1.pre3
changelog:
  - Bump epoch and use standard Fedora Packaging Guidelines for NVR.
  - Switch to using signed bz2 source and remove dead patch.


author: Prarit Bhargava <prarit@redhat.com> 2:1.0-0.3.6e4e2a00
changelog:
  - Updated sources to deal with various warning issues [701083] [704302]
  - Update URL for new location of Andi's mcelog tree
  - Update n-v-r to include latest git hash


author: Prarit Bhargava <prarit@redhat.com> - 2:1.0-0.13.f30da3d
changelog:
  - Update to upstream commit f30da3d, minor fixes, no features [1085134]
  - Add /var/log/mcelog file [1098864]
  - remove .src.rpm file [1038755]


author: Prarit Bhargava <prarit@redhat.com> - 3:120-1.e7e0ac1
changelog:
  - Add Broadwell-U, Broadwell-DE, and Knights Landing/Xeon Phi Support
  - additional general fixes
  - add mcelog.conf and mcelog.triggers man pages
  - update NVR to 120 to match upstream


author: Prarit Bhargava <prarit@redhat.com> - 3:136-1.e4aca63
changelog:
  - update NVR to 136 to match upstream [1336431]
  - additional general fixes [1336431]
  - Skylake Client support (6,94) (6,78) [1255571]
  - Broadwell SoC/DE, EP & EX support (6,79) [1255572]


author: Paul Lindner <lindner@inuus.com> - 1.2.2-3
changelog:
  - Enable build-time regression tests
  - add dependency on initscripts
  - remove memcached-debug (not needed in dist)
  - above suggestions from Bernard Johnson


author: root <lindner@inuus.com> - 1.2.3-2
changelog:
  - Upgrade to 1.2.3 upstream
  - Adjust make install to preserve man page timestamp
  - Conform with LSB init scripts standards, add force-reload


author: Paul Lindner <lindner@inuus.com> - 1.4.3-1
changelog:
  - Add explicit require on memcached for memcached-devel (resolves 537046)
  - enable-threads option no longer needed
  - Update web site address


author: Paul Lindner <lindner@inuus.com> - 0:1.4.4-1
changelog:
  - Upgraded to upstream memcached-1.4.4 (http://code.google.com/p/memcached/wiki/ReleaseNotes144)
  - Add explicit Epoch to fix issue with broken devel dependencies (resolves 542001)


author: Joe Orton <jorton@redhat.com> - 0:1.4.5-2
changelog:
  - LSB compliance fixes for init script
  - don't run the test suite as root
  - ensure a constant timestamp on the sysconfig file


author: Paul Lindner <lindner@inuus.com> - 0:1.4.7-1
changelog:
  - Upgrade to memcached 1.4.7 (http://code.google.com/p/memcached/wiki/ReleaseNotes147)
  - Fix some rpmlint errors/warnings.


author: Paul Lindner <lindner@mirth.inuus.com> - 0:1.4.13-1
changelog:
  - Upgrade to memcached 1.4.13
  - http://code.google.com/p/memcached/wiki/ReleaseNotes1413
  - http://code.google.com/p/memcached/wiki/ReleaseNotes1412
  - http://code.google.com/p/memcached/wiki/ReleaseNotes1411


author: Joe Orton <jorton@redhat.com> - 0:1.4.15-1
changelog:
  - update to 1.4.15 (#782395)
  - switch to simple systemd service (#878198)
  - use systemd scriptlet macros (Václav Pavlín, #850204)


author: Miroslav Lichvar <mlichvar@redhat.com> - 0:1.4.15-10
changelog:
  - fix binding to IPv6 address (#1298603)
  - enable SASL support (#1263696)
  - don't allow authentication with bad SASL credentials (CVE-2013-7239)


author: Miroslav Lichvar <mlichvar@redhat.com> - 0:1.4.15-10.el7_3.1
changelog:
  - fix vulnerabilities allowing remote code execution (CVE-2016-8704,
    CVE-2016-8705, CVE-2016-8706)


author: Christopher Aillon <caillon@redhat.com> 3.11-0.cvs
changelog:
  - Initial import into Fedora Core, based on a CVS snapshot of
    the NSS_3_11_RTM tag
  - Fix up the pkcs11-devel subpackage to contain the proper headers
  - Build with RPM_OPT_FLAGS
  - No need to have rpath of /usr/lib in the pc file


author: Kai Engert <kengert@redhat.com> - 3.11.3-2
changelog:
  - Revert the attempt to require latest NSPR, as it is not yet available
    in the build infrastructure.


author: Kai Engert <kengert@redhat.com> - 3.11.5-1
changelog:
  - Update to 3.11.5
  - This update fixes two security vulnerabilities with SSL 2
  - Do not use -rpath link option
  - Added several unsupported tools to tools package


author: Kai Engert <kengert@redhat.com> - 3.11.5-2
changelog:
  - Fix rhbz#230545, failure to enable FIPS mode
  - Fix rhbz#220542, make NSS more tolerant of resets when in the 
    middle of prompting for a user password.


author: Kai Engert <kengert@redhat.com> - 3.11.7-2
changelog:
  - Update to 3.11.7, but freebl/softokn remain at 3.11.5.
  - Use a workaround to avoid mozilla bug 51429.


author: Kai Engert <kengert@redhat.com> - 3.11.7-10
changelog:
  - Add /etc/prelink.conf.d/nss-prelink.conf in order to blacklist
    our signed libraries and protect them from modification.


author: Kai Engert <kengert@redhat.com> - 3.11.99.3-2
changelog:
  - Build against gcc 4.3.0, use workaround for bug 432146
  - Run the test suite after the build and abort on failures.


author: Kai Engert <kengert@redhat.com> - 3.12.0.3-3
changelog:
  - nss package should own /etc/prelink.conf.d folder, rhbz#452062
  - use upstream patch to fix test suite abort


author: Kai Engert <kaie@redhat.com> - 3.12.3-3
changelog:
  - ship .chk files instead of running shlibsign at install time
  - include .chk file in softokn-freebl subpackage
  - add patch for upstream nss bug 488350


author: Kai Engert <kaie@redhat.com> - 3.12.3-7
changelog:
  - re-enable test suite
  - add patch for upstream bug 488646 and add newer paypal
    certs in order to make the test suite pass


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-5
changelog:
  - updated pem module incorporates various patches
  - fix off-by-one error when computing size to reduce memory leak. (483855)
  - fix data type to work on x86_64 systems. (429175)
  - fix various memory leaks and free internal objects on module unload. (501080)
  - fix to not clone internal objects in collect_objects().  (501118)
  - fix to not bypass initialization if module arguments are omitted. (501058)
  - fix numerous gcc warnings. (500815)
  - fix to support arbitrarily long password while loading a private key. (500180) 
  - fix memory leak in make_key and memory leaks and return values in pem_mdSession_Login (501191)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-10
changelog:
  - must install libnssutil3.since nss-util is untagged at the moment
  - preserve time stamps when installing various files


author: Elio Maldonado+emaldona@redhat.com - 3.12.3.99.3-11
changelog:
  - split off nss-softokn and nss-util as subpackages with their own rpms
  - first phase of splitting nss-softokn and nss-util as their own packages


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-19
changelog:
  - remove patches that are now in nss-softokn and
  - remove spurious exec-permissions for nss.pc per rpmlint
  - single requires line in nss.pc.in


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-22
changelog:
  - Fix nss-config not to include nssutil
  - Add BuildRequires on nss-softokn and nss-util since build also runs the test suite


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-25
changelog:
  - Remove nss-prelink.conf as signed all shared libraries moved to nss-softokn
  - Add a temprary hack to nss.pc.in to unblock builds


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-29
changelog:
  - Restoring patches 2 and 7 as we still compile all sources
  - Applying the nss-nolocalsql.patch solves nss-tools sqlite dependency problems


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-30
changelog:
  - Fix FORTIFY_SOURCE buffer overflows in test suite on ppc and ppc64 - bug 519766
  - Fixed requires and buildrequires as per recommendations in spec file review


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-2
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - No rpath-link in nss-softokn-config


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - PEM module implements memory management for internal objects - 509705
  - PEM module doesn't crash when processing malformed key files - 512019


author: Elio Maldonado<emaldona@redhat.com - 3.12.4-9
changelog:
  - Install blank databases and configuration file for system shared database
  - nsssysinit queries system for fips mode before relying on environment variable


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-13
changelog:
  - User no longer prompted for a password when listing keys an empty system db (#527048)
  - Fix setup-nsssysinit to handle more general formats (#527051)


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-13.1
changelog:
  - Require nss-softoken of same architecture as nss (#527867)
  - Merge setup-nsssysinit.sh improvements from F-12 (#527051)


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1
changelog:
  - Update to 3.12.5
  - Patch to allow ssl/tls clients to interoperate with servers that require renogiation


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1.5
changelog:
  - Fix nsssysinit to set the default flags on the crypto module (#545779)
  - Remove redundant header from the pem module


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1.6
changelog:
  - Fix nsssysinit to enable apps to use system cert store, patch contributed by David Woodhouse (#546221)
  - Fix spec so sysinit requires coreutils for post install scriplet (#547067)
  - Fix segmentation fault when listing keys or certs in the database, patch contributed by Kamil Dudka (#540387)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-1.1
changelog:
  - Using SSL_RENEGOTIATE_TRANSITIONAL as default while on transition period
  - Disabling ssl tests suites until bug 539183 is resolved


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-3
changelog:
  - Add sed to sysinit requires as setup-nsssysinit.sh requires it (#576071)
  - Update PayPalEE test cert with unexpired one (#580207)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-5
changelog:
  - Update pem source tar to pick up the following bug fixes:
  - PEM - Allow collect objects to search through all objects
  - PEM - Make CopyObject return a new shallow copy
  - PEM - Fix memory leak in pem_mdCryptoOperationRSAPriv


author: Elio Maldonado <emaldona@redhat.com> - 3.12.7-2
changelog:
  - Define NSS_USE_SYSTEM_SQLITE and remove unneeded patch
  - Add comments regarding an unversioned provides which triggers rpmlint warning
  - Build requires nss-softokn-devel >= 3.12.7


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-1
changelog:
  - Update to 3.12.8
  - Prevent disabling of nss-sysinit on package upgrade (#636787)
  - Create pkcs11.txt with correct permissions regardless of umask (#636792) 
  - Setup-nsssysinit.sh reports whether nss-sysinit is turned on or off (#636801)
  - Added provides pkcs11-devel-static to comply with packaging guidelines (#609612)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-3
changelog:
  - Replace posttrans sysinit scriptlet with a triggerpostun one (#636787)
  - Fix and cleanup the setup-nsssysinit.sh script (#636792, #636801)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8.99.2-1
changelog:
  - Update to NSS_3_12_9_BETA2
  - Fix libpnsspem crash when cacert dir contains other directories (#642433)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-5
changelog:
  - Fix the earlier infinite recursion patch (#499444)
  - Remove a header that now nss-softokn-freebl-devel ships


author: Christopher Aillon <caillon@redhat.com> - 3.12.9-6
changelog:
  - Revert patches for 499444 as they use a C++ reserved word and
    cause compilation of Firefox to fail


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-10
changelog:
  - Fix cms headers to not use c++ reserved words (#676036)
  - Reenabling Bug 499444 patches
  - Fix to swap internal key slot on fips mode switches


author: Elio Maldonado <emaldona@redhat.com> - 3.12.10-4
changelog:
  - Enable pluggable ecc support (#712556)
  - Disable the nssdb write-access-on-read-only-dir tests when user is root (#646045)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.11-3
changelog:
  - Fix attempt to free initilized pointer (#717338)
  - Fix leak on pem_CreateObject when given non-existing file name (#734760)
  - Fix pem_Initialize to return CKR_CANT_LOCK on multi-treaded calls (#736410)


author: Elio Maldonado Batiz <emaldona@redhat.com> - 3.13.1-4
changelog:
  - Rebuild with nss-softokn from 3.12 in the buildroot
  - Allows the pem module to statically link against 3.12.x freebl
  - Required for using nss-3.13.x with nss-softokn-3.12.y for a merge inrto rhel git repo
  - Build will be temprarily placed on buildroot override but not pushed in bodhi


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-5
changelog:
  - Statically link the pem module against system freebl found in buildroot
  - Disabling sha224-related powerup selftest until we update softokn
  - Disable sha224 and pss tests which nss-softokn 3.12.x doesn't support


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-6
changelog:
  - Removed unwanted /usr/include/nss3 in front of the normal cflags include path
  - Removed unnecessary patch dealing with CERTDB_TERMINAL_RECORD, it's visible


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-7
changelog:
  - Resolves: Bug 750376 - nss 3.13 breaks sssd TLS
  - Fix how pem is built so that nss-3.13.x works with nss-softokn-3.12.y
  - Only patch blapitest for the lack of sha224 on system freebl
  - Completed the patch to make pem link against system freebl


author: elio maldonado <emaldona@redhat.com> - 3.13.1-9
changelog:
  - Revert to using current nss_softokn_version
  - Patch to deal with lack of sha224 is no longer needed


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-10
changelog:
  - Resolves: Bug 770682 - nss update breaks pidgin-sipe connectivity
  - NSS_SSL_CBC_RANDOM_IV set to 0 by default and changed to 1 on user request


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Pick up fixes from RHEL
  - Resolves: rhbz#800674 - Unable to contact LDAP Server during winsync
  - Resolves: rhbz#800682 - Qpid AMQP daemon fails to load after nss update
  - Resolves: rhbz#800676 - NSS workaround for freebl bug that causes openswan to drop connections


author: Elio Maldonado <emaldona@redhat.com> - 3.13.4-1
changelog:
  - Update to NSS_3_13_4_RTM
  - Update the nss-pem source archive to the latest version
  - Remove no longer needed patches
  - Resolves: Bug 806043 - use pem files interchangeably in a single process
  - Resolves: Bug 806051 - PEM various flaws detected by Coverity
  - Resolves: Bug 806058 - PEM pem_CreateObject leaks memory given a non-existing file name


author: Elio Maldonado <emaldona@redhat.com> - 3.13.4-2
changelog:
  - Resolves: Bug 805723 - Library needs partial RELRO support added
  - Patch coreconf/Linux.mk as done on RHEL 6.2


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-4
changelog:
  - Resolves: Bug 830410 - Missing Requires %{?_isa}
  - Use Requires: %{name}%{?_isa} = %{version}-%{release} on tools
  - Drop zlib requires which rpmlint reports as error E: explicit-lib-dependency zlib
  - Enable sha224 portion of powerup selftest when running test suites
  - Require nspr 4.9.1


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-8
changelog:
  - Rebase pem sources to fedora-hosted upstream to pick up two fixes from rhel-6.3
  - Resolves: rhbz#847460 - Fix invalid read and free on invalid cert load
  - Resolves: rhbz#847462 - PEM module may attempt to free uninitialized pointer 
  - Remove unneeded fix gcc 4.7 c++ issue in secmodt.h that actually undoes the upstream fix


author: Elio Maldonado <emaldona@redhat.com> - 3.14-0.1.rc.1
changelog:
  - Update to NSS_3_14_RC1
  - update nss-589636.patch to apply to httpdserv
  - turn off ocsp tests for now
  - remove no longer needed patches
  - remove headers shipped by nss-util


author: Elio Maldonado <emaldona@redhat.com> - 3.14-2
changelog:
  - Add secmodt.h to the headers installed by nss-devel
  - nss-devel must install secmodt.h which moved from softoken to pk11wrap with nss-3.14


author: Elio Maldonado <emaldona@redhat.com> - 3.14-5
changelog:
  - Fix the spec file so sechash.h gets installed
  - Resolves: rhbz#871882 - missing header: sechash.h in nss 3.14


author: Elio Maldonado <emaldona@redhat.com> - 3.14-6
changelog:
  - Fix a previous unwanted merge from f18
  - Update the SS_SSL_CBC_RANDOM_IV patch to match new sources while
  - Keeping the patch disabled while we are still in rawhide and
  - State in comment that patch is needed for both stable and beta branches
  - Update .gitignore to download only the new sources


author: Elio Maldonado <emaldona@redhat.com> - 3.14-7
changelog:
  - Add a dummy source file for testing /preventing fedpkg breakage
  - Helps test the fedpkg new-sources and upload commands for breakage by nss updates
  - Related to Bug 872124 - nss 3.14 breaks fedpkg new-sources


author: Elio Maldonado <emaldona@redhat.com> - 3.14-8
changelog:
  - Fix pk11wrap locking which fixes 'fedpkg new-sources' and 'fedpkg update' hangs
  - Bug 872124 - nss-3.14 breaks fedpkg new-sources
  - Fix should be considered preliminary since the patch may change upon upstream approval


author: Elio Maldonado <emaldona@redhat.com> - 3.14-9
changelog:
  - Disable bypass code at build time and return failure on attempts to enable at runtime
  - Bug 806588 - Disable SSL PKCS #11 bypass at build time


author: Elio Maldonado <emaldona@redhat.com> - 3.14-11
changelog:
  - Bug 879978 - Install the nssck.api header template in a place where mod_revocator can access it
  - Install nssck.api in /usr/includes/nss3


author: Elio Maldonado <emaldona@redhat.com> - 3.14-12
changelog:
  - Bug 879978 - Install the nssck.api header template where mod_revocator can access it
  - Install nssck.api in /usr/includes/nss3/templates


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3_14_3_RTM
  - sync up pem rsawrapr.c with softoken upstream changes for nss-3.14.3
  - Resolves: rhbz#908257 - CVE-2013-1620 nss: TLS CBC padding timing attack
  - Resolves: rhbz#896651 - PEM module trashes private keys if login fails
  - Resolves: rhbz#909775 - specfile support for AArch64
  - Resolves: rhbz#910584 - certutil -a does not produce ASCII output


author: Kai Engert <kaie@redhat.com> - 3.14.3-9
changelog:
  - Configure libnssckbi.so to use the alternatives system
    in order to prepare for a drop in replacement.


author: Elio Maldonado <emaldona@redhat.com> - 3.15-5
changelog:
  - Install man pages for nss-tools and the nss-config and setup-nsssysinit scripts
  - Resolves: rhbz#606020 - nss security tools lack man pages


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-2
changelog:
  - Update to NSS_3_15_1_RTM
  - Apply various fixes to the man pages and add new ones
  - Enable the iquote.patch to access newly introduced types
  - Add man page for pkcs11.txt configuration file and cert and key databases
  - Add missing option descriptions for {cert|cms|crl}util
  - Resolves: rhbz#948495 - Man page scan results for nss
  - Resolves: rhbz#982723 - Fix path to script in man page for nss-sysinit


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-4
changelog:
  - Install symlink to nss-sysinit.sh without the .sh suffix
  - Resolves: rhbz#982723 - nss-sysinit man page has wrong path for the script


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-1
changelog:
  - Rebase to nss-3.15.2
  - Resolves: rhbz#1012656 - pick up NSS 3.15.2 to fix CVE-2013-1739 and disable MD5 in OCSP/CRL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-2
changelog:
  - Add description of the certutil's --email option to it's manpage
  - Resolves: rhbz#Bug 948495 - Man page scan results for nss


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-4
changelog:
  - Enable fips when system is in fips mode
  - Resolves: rhbz#852023 - FIPS mode detection does not work


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-6
changelog:
  - Fix errors in ssl disabling patches for both library and tests
  - Add s390x to the multilib_arches definition used for alt_ckbi
  - Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-7
changelog:
  - Fix bash syntax error in patch for disabling ssl2 tests
  - Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-8
changelog:
  - Fix patch for disabling ssl2 in ssl to correctly set error code
  - Fix syntax error reported in the build.log even tough it succeeds
  - Add patch top ignore setpolicy result 
  - Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites
  - Resolves: rhbz#1026677 - Attempt to run ipa-client-install fails


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-9
changelog:
  - Fix certutil man page options names to be consistent with help
  - Resolves: rhbz#948495 - man page scan results for nss
  - Remove incorrect count argument in status description in nss-sysinit man page
  - Resolves: rhbz#982723 - man page of nss-sysinit incorrect option descriptions


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-10
changelog:
  - Fix path to script and remove -- from some options in nss-sysinit man page
  - Resolves: rhbz#982723 - man page of nss-sysinit worong path and other flaws


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Revoke trust in one mis-issued anssi certificate
  - Resolves: Bug 1040284 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117) [rhel-7.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Improve pluggable ECC support for ECDSA
  - Resolves: Bug 752980 - [7.0 FEAT] Support ECDSA algorithm in the nss package


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-6
changelog:
  - Fix a coverity scan compile time warning for the pem module
  - Resolves: Bug 1002271 - NSS pem module should not require unique base file names


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-7
changelog:
  - Move several nss-sysinit manpages tar archives to the %files
  - Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-8
changelog:
  - Fix the spec file to apply the nss ecc list patch for bug 752980
  - Resolves: Bug 752980 - Support ECDSA algorithm in the nss package via puggable ecc


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-9
changelog:
  - Rebase to nss-3.15.4
  - Resolves: Bug 1054457 - CVE-2013-1740 nss: false start PR_Recv information disclosure security issue
  - Remove no longer needed patches for manpages that were applied upstream
  - Remove no longer needed patch to disable ocsp stapling tests
  - Update iquote.patch on account of upstream changes
  - Update and rename patch to pem/rsawrapr.c on account of upstream changes
  - Use the pristine upstream sources for nss without repackaging
  - Avoid unneeded manual step which may introduce errors


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-3
changelog:
  - Remove spurious man5 wildcard entry as all manpages are listed by name
  - Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-4
changelog:
  - Update pem sources to latest from nss-pem upstream
  - Pick up pem module fixes verified on RHEL and applied upstream
  - Remove no loger needed pem patches on acccount on this update
  - Add comments documenting the iquote.patch 
  - Resolves: Bug 1054457 - CVE-2013-1740


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-5
changelog:
  - Pick up a fix from rhel-6 and fix an rpm conflict
  - Don't hold issuer cert handles in crl cache
  - Resolves: Bug 1034409 - deadlock in trust domain and object lock
  - Move nss shared db files to the main package
  - Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-6
changelog:
  - Disallow disabling the internal module
  - Resolves: Bug 1056036 - nss segfaults with opencryptoki module


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-1
changelog:
  - Rebase to nss-3.16.2
  - Resolves: Bug 1103252 - Rebase RHEL 7.1 to at least NSS 3.16.1 (FF 31)
  - Fix test failure detection in the %check section
  - Move removal of unwanted source directories to the end of the %prep section
  - Update various patches on account of the rebase
  - Remove unused patches rendered obsolete by the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-2
changelog:
  - Fix libssl and test patches that disable ssl2 support
  - Resolves: Bug 1123435
  - Replace expired PayPal test certificate with current one


author: Elio Maldonado <pbrobinson@redhat.com> 3.16.2-3
changelog:
  - Generic 32/64 bit platform detection (fix ppc64le build)
  - Resolves: Bug 1125619 - nss fails to build on arch: ppc64le (missing dependencies)
  - Fix contributed by Peter Robinson <pbrobinson@redhat.com>


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-10
changelog:
  - Resolves: Bug 1158161 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Support TLS_FALLBACK_SCSV in tstclnt and ssltap


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Restore patch for certutil man page
  - supply missing options descriptions
  - Resolves: Bug 1158161 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-4
changelog:
  - Fix race condition
  - Resolves: Bug 1094468 - 389-ds-base server reported crash in stan_GetCERTCertificate
  - under the replication replay failure condition


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-5
changelog:
  - Reverse the sense of a test in patch to fix pk12util segfault
  - Resolves: Bug 1174527 - Segfault in pk12util when using -l option with certain .p12 files


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-2
changelog:
  - Replace expired PayPal test certificate that breaks the build
  - Resolves: Bug 1200898 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-3
changelog:
  - Fix shell syntax error on nss/tests/all.sh
  - Resolves: Bug 1200898 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
  - Update and reeneable nss-646045.patch on account of the rebase
  - Resolves: Bug 1200898 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-4
changelog:
  - Add support for sha384 tls cipher suites
  - Add support for server-side hde key exchange
  - Add support for DSS+SHA256 ciphersuites


author: Kai Engert <kaie@redhat.com> - 3.19.1-5
changelog:
  - Incremental patches to fix SSL/TLS test suite execution,
    fix the earlier SHA384 patch, and inform clients to use SHA384 with
    certificate_verify if required by NSS.


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-9
changelog:
  - Fix checks to skip ssl2/export cipher suites tests to not skip needed tests
  - Fix libssl ssl2/export disabling patch to handle NULL cipher cases
  - Enable additional cipher suites by default


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-12
changelog:
  - Support TLS > 1.0 by support while still allowing to connect to SSL3 only servers
  - Enable ECDSA cipher suites by default, a subset of the ones requested


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-13
changelog:
  - Reorder the cipher suites and enable two more by default
  - Fix some of the ssauth sni and ocsp stapling tests


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-14
changelog:
  - Update the required_softokn_build_version to -14
  - Add references to bugs filed upstream for new patches
  - Merge ocsp stapling and sslauth sni tests patches into one


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-16
changelog:
  - Fix check for public key size of DSA certificates
  - Use size of prime P not the size of dsa.publicValue


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-17
changelog:
  - Change the required_softokn_build_version back to -13
  - Ensure we use nss-softokn-3.16.2.3-13.el7_1


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-19
changelog:
  - Prevent TLS 1.2 Transcript Collision attacks against MD5 in key exchange protocol
  - Fix a mockbuild reported bad %if condition when using the __isa_bits macro instead of list of 64-bit architectures
  - Change the test to %if 0%{__isa_bits} == 64 as required for building the srpm which is noarch
  - Resolves: Bug 1289884


author: Kai Engert <kaie@redhat.com> - 3.21.0-5
changelog:
  - Merge fixes from the rhel-7.2 branch
  - Fix the SigAlgs sent in certificate_request
  - Ensure all ssl.sh tests are executed
  - Update sslauth test patch to run additional tests


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-13
changelog:
  - Fix reuse of session cache entry
  - Resolves: Bug 1241172 - Certificate verification fails with multiple https urls


author: Kai Engert <kaie@redhat.com> - 3.21.0-14
changelog:
  - Support TLS 1.2 certificate_verify hashes other than PRF,
    backported fix from NSS 3.25 (upstream bug 1179338).


author: Kai Engert <kaie@redhat.com> - 3.21.0-16
changelog:
  - enable ssl_gtests (without extended master secret tests), Bug 1298692
  - call SECMOD_RestartModules in nss_Init, Bug 1317691


author: Dennis Gilmore <dennis@ausil.us> 3.12.3.99.3-10
changelog:
  - dont include the headers in nss-util only in the -devel package
  - nss-util-devel Requires nss-devel since its only providing a subset of the headers.


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-11
changelog:
  - Remove spurious executable permissions from nss-util-config
  - Shorten some descriptions to keep rpmlint happy


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - Apply nss-nolocalsql patch subset for nss-util
  - No rpath-link in nss-util-config


author: Elio Maldonado <emaldona@redhat.com> - 3.13.4-0.1.beta.1
changelog:
  - Update to NSS_3_13_4_BETA1
  - Improve steps to splitting off util from the nss
  - Add executable attribute to the splitting script


author: Elio Maldonado <emaldona@redhat.com> - 3.13.4-2
changelog:
  - Resolves: Bug 805716 - Library needs partial RELRO support added
  - Patch coreconf/Linux.mk as done on RHEL 6.2


author: Elio Maldonado <emaldona@redhat.com> - 3.15.beta1-0.1.beta.1
changelog:
  - Update to NSS_3_15_BETA1
  - Update spec file, patches, and helper scripts on account of a shallower source tree


author: Elio Maldonado <emaldona@redhat.com> - 3.15-0.1.beta1.2
changelog:
  - Don't include prtypes.h from hasht.t
  - Resolves: rhbz#953277 - rawhide build of glibc fails due to fatal error from nss3/hasht.h


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Add the nss-util portion of a fix for a bug in nss and nss-util
  - Resolves: Bug 752980 - Support ECDSA via pluggable ECC in the nss package


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Update to nss-3.15.4
  - Modified the nss-split-util script to use the nss upstream pristine sources
  - Resolves: Bug 1054457 - CVE-2013-1740 nss: false start PR_Recv information disclosure security issue [rhel-7.0]


author: Peter Robinson <pbrobinson@redhat.com> 3.16.2-2
changelog:
  - Generic 32/64 bit platform detection (fix ppc64le build)
  - Resolves: Bug 1126244 - Ensure nss-util is built for 64 bit on ppc64le
  - Fix contributed by Peter Robinson <pbrobinson@redhat.com>


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Bump the release number to be higher than the one for rhel-7.0
  - Resolves: Bug 1158161 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-1
changelog:
  - Rebase to nss-util from nss 3.21
  - Resolves: Bug 1297940 - Rebase RHEL 7.3 to NSS-util 3.21 in preparation for Firefox 45


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-4
changelog:
  - Manual merge from the rhel-7.2 branch
  - Fix one alias for naming compatibility with prior release
  - Remove an unused patch


author: Daiki Ueno <dueno@redhat.com> - 3.21.3-1
changelog:
  - Rebase to nss-3.21.3
  - Remove patch for CVE-2016-1950, which is included in the release
  - Related: Bug 1347908


author: Phil Knirsch <pknirsch@redhat.com> 1.9.1-1
changelog:
  - Added proper BuildRequires
  - Drop ia64 for first build, something fishy with the compiler and warning.


author: Phil Knirsch <pknirsch@redhat.com> 1.9.2-2
changelog:
  - Fixed overflow in plugins/sysfs/sysfs2hpi.c
  - Fixed rebuild problem with latest net-snmp
  - Removed is_simulator patch, not needed anymore


author: Phil Knirsch <pknirsch@redhat.com> 2.0.3-1
changelog:
  - Moved the pkgconfig files to the devel package (#152507)
  - Update to openhpi-2.0.3
  - Had to manually disable ipmi support for now until openhpi builds correctly
    against it again
  - Dropped net-snmp-config patch, not needed anymore


author: Phil Knirsch <pknirsch@redhat.com> 2.0.3-4
changelog:
  - Added the openhpi config file
  - Added missing /var/lib/openhpi dir with proper rights
  - Added a few missing BuildPreReqs


author: Phil Knirsch <pknirsch@redhat.com> - 2.4.1-5
changelog:
  - Had to disable sysfs support due to new libsysfs and incompatible API.
  - Added missing ncurses-devel buildrequires


author: Will Cohen <wcohen@redhat.com>
changelog:
  - Hack to get correct syscall for ia64.
  - Hack to get get timer interupt data.
  - Fix doc/Makefile.am.


author: Will Cohen <wcohen@redhat.com>
changelog:
  - Syscall value for x86_64.
  - Update manpage and documentation.
  - Revise utils/* to deprecate old.
  - Include CPU_P4_HT2 in op_help.c
  - Revise how CPU_TIMER_INT handled.
  - Apply cookie patch for all archs.
  - Correct autogen.sh location.


author: Will Cohen <wcohen@redhat.com>
changelog:
  - turn on build for ppc64
  - change order op_visualise searches lib directories.
  - revise oprofile-0.4-deprecate patch.
  - utils/oprofile kernel range check, --save, and do_dump corrections.
  - update gui to use "--separate=library".


author: Will Cohen <wcohen@redhat.com>
changelog:
  - Use /proc/ksym for module information.
  - Correct separate debuginfo handling.
  - Configure with --enable-abi.


author: Will Cohen <wcohen@redhat.com>
changelog:
  - check min event counts.
  - revised op_to_source output to avoid changing line count.
  - p4event events revised.
  - hammer events revised.


author: Will Cohen <wcohen@redhat.com>
changelog:
  - put in s390.
  - Fix includes for asserts.
  - Make sure elinks is available for html to txt conversion.


author: Will Cohen <wcohen@redhat.com>
changelog:
  - Eliminate AUTOMAKE and ACLOCAL definitions.
  - Correct QTDIR and add oprof_start to file manifests.


author: Will Cohen <wcohen@redhat.com> - 0.9.2-7
changelog:
  - Correct description for package.
  - Correct backtrace documentation. Resolves: rhbz#214793.
  - Correct race condition. Resolves: rhbz#220116.


author: Will Cohen <wcohen@redhat.com> - 0.9.4-12
changelog:
  - Add shadow-utils to requires. Resolves: rhbz #501357
  - Add LGPL license to provided java support. Resolves: rhbz #474666
  - Correct handling of --verbose. Resolves: rhbz #454969


author: Will Cohen <wcohen@redhat.com> - 0.9.5-3
changelog:
  - Allow timer mode to work.
  - Correct location for addditional files in man pages. Resolves: rhbz #508669


author: Will Cohen <wcohen@redhat.com> - 0.9.6-10
changelog:
  - Corrections for i386/arch_perfmon filters.
  - Make nehalem events available.
  - Add AMD family 12/14/15h support.
  - Add Intel westemere support.
  - opcontrol numeric argument checking.


author: Will Cohen <wcohen@redhat.com> - 0.9.7-3
changelog:
  - Use correct macros for /etc and /user/share. rhbz #226222
  - Consistently use macros for buildroot.
  - Preserve timestamp for installed files.
  - Remove the clean section.
  - Fix the source location.
  - Remove unneeded BuildRequires: binutils-devel
  - Remove unneeded depends.
  - Correct Buildreq to java-1.7.0-openjdk-devel.
  - Fix macro-in-comment and macro-in-changelog
  - Remove '.' from Summary lines
  - Correct license GPLv2+ and LGPLv2+.
  - Do not remove oprofile user or group.


author: Will Cohen <wcohen@redhat.com> - 0.9.9-5
changelog:
  - Update Intel Haswell events.
  - Add support for Intel Silvermont (Avoton).
  - Add support for Intel Broadwell.
  - Add support for aarch64.
  - Update IBM power8 events.


author: William Cohen <wcohen@redhat.com> - 0.9.9-11
changelog:
  - Avoid setting POSIXLY_CORRECT for the children tasks of operf and ocount.
  - Fix handling of default unit masks longer than 11 char.
  - Fix extra and default unitmasks selection.
  - Allow operf to record information for Java anon_huges.


author: William Cohen <wcohen@redhat.com> - 0.9.9-17
changelog:
  - Define some  Intel broadwell default unit masks by names
  - Add support for Harrisonville (Denverton SoC)
  - Add support for Skylake-SP server
  - Add support for Kabylake-U/Y
  - Add support for Kabylake-H/S
  - Make Nehalem, Westmere, and Haswell event names unique.


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.4-2
changelog:
  - Reference authors from the project AUTHORS file instead of listing in description
  - Change Source0 to reference the project's Mercurial repo
  - Cleaned up the summaries and descriptions
  - Incorporate the results of Fedora package self-review


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.4-3
changelog:
  - Include an AUTHORS and license file in each package
  - Change the library package name to pacemaker-libs to be more
    Fedora compliant
  - Remove execute permissions from xml related files
  - Reference the new cluster-glue devel package name
  - Update the tarball from upstream to version c9120a53a6ae
    + High: PE: Only prevent migration if the clone dependancy is stopping/starting on the target node
    + High: PE: Bug 2160 - Dont shuffle clones due to colocation
    + High: PE: New implementation of the resource migration (not stop/start) logic
    + Medium: Tools: crm_resource - Prevent use-of-NULL by requiring a resource name for the -A and -a options
    + Medium: PE: Prevent use-of-NULL in find_first_action()
    + Low: Build: Include licensing files


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-0.4.c9120a53a6ae.hg
changelog:
  - Incorporate the feedback from the cluster-glue review
  - Realistically, the version is a 1.0.5 pre-release
  - Use the global directive instead of define for variables
  - Use the haclient/hacluster group/user instead of daemon
  - Use the _configure macro
  - Fix install dependancies


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-1
changelog:
  - Add dependancy on resource-agents
  - Use the version of the configure macro that supplies --prefix, --libdir, etc
  - Update the tarball from upstream to version 462f1569a437 (Pacemaker 1.0.5 final)
    + High: Tools: crm_resource - Advertise --move instead of --migrate
    + Medium: Extra: New node connectivity RA that uses system ping and attrd_updater
    + Medium: crmd: Note that dc-deadtime can be used to mask the brokeness of some switches


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-2
changelog:
  - Add versioned perl dependancy as specified by
      https://fedoraproject.org/wiki/Packaging/Perl#Packages_that_link_to_libperl
  - No longer remove RPATH data, it prevents us finding libperl.so and no other
    libraries were being hardcoded
  - Compile in support for heartbeat
  - Conditionally add heartbeat-devel and corosynclib-devel to the -devel requirements
    depending on which stacks are supported


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-4
changelog:
  - Include the fixes from CoroSync integration testing
  - Move the resource templates - they are not documentation
  - Ensure documentation is placed in a standard location
  - Exclude documentation that is included elsewhere in the package

  - Update the tarball from upstream to version ee19d8e83c2a
    + High: cib: Correctly clean up when both plaintext and tls remote ports are requested
    + High: PE: Bug bnc#515172 - Provide better defaults for lt(e) and gt(e) comparisions
    + High: PE: Bug lf#2197 - Allow master instances placemaker to be influenced by colocation constraints
    + High: PE: Make sure promote/demote pseudo actions are created correctly
    + High: PE: Prevent target-role from promoting more than master-max instances
    + High: ais: Bug lf#2199 - Prevent expected-quorum-votes from being populated with garbage
    + High: ais: Prevent deadlock - dont try to release IPC message if the connection failed
    + High: cib: For validation errors, send back the full CIB so the client can display the errors
    + High: cib: Prevent use-after-free for remote plaintext connections
    + High: crmd: Bug lf#2201 - Prevent use-of-NULL when running heartbeat
    + High: Core: Bug lf#2169 - Allow dtd/schema validation to be disabled
    + High: PE: Bug lf#2106 - Not all anonymous clone children are restarted after configuration change
    + High: PE: Bug lf#2170 - stop-all-resources option had no effect
    + High: PE: Bug lf#2171 - Prevent groups from starting if they depend on a complex resource which cannot
    + High: PE: Disable resource management if stonith-enabled=true and no stonith resources are defined
    + High: PE: Do not include master score if it would prevent allocation
    + High: ais: Avoid excessive load by checking for dead children every 1s (instead of 100ms)
    + High: ais: Bug rh#525589 - Prevent shutdown deadlocks when running on CoroSync
    + High: ais: Gracefully handle changes to the AIS nodeid
    + High: crmd: Bug bnc#527530 - Wait for the transition to complete before leaving S_TRANSITION_ENGINE
    + High: crmd: Prevent use-after-free with LOG_DEBUG_3
    + Medium: xml: Mask the "symmetrical" attribute on rsc_colocation constraints (bnc#540672)
    + Medium (bnc#520707): Tools: crm: new templates ocfs2 and clvm
    + Medium: Build: Invert the disable ais/heartbeat logic so that --without (ais|heartbeat) is available to rpmbuild
    + Medium: PE: Bug lf#2178 - Indicate unmanaged clones
    + Medium: PE: Bug lf#2180 - Include node information for all failed ops
    + Medium: PE: Bug lf#2189 - Incorrect error message when unpacking simple ordering constraint
    + Medium: PE: Correctly log resources that would like to start but cannot
    + Medium: PE: Stop ptest from logging to syslog
    + Medium: ais: Include version details in plugin name
    + Medium: crmd: Requery the resource metadata after every start operation


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-5
changelog:
  - Include patch of changeset 66b7bfd467f3:
    Some clients such as gfs_controld want a cluster name, allow one to be specified in corosync.conf


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.1-0.1-60b7753f7310.hg
changelog:
  - Update the tarball from upstream to version 60b7753f7310
    + First public release of the 1.1 series


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.2-1
changelog:
  - Update the tarball from the upstream 1.1.2 release
    + High: ais: Bug lf#2340 - Force rogue child processes to terminate after waiting 2.5 minutes
    + High: ais: Bug lf#2359 - Default expected votes to 2 inside Corosync/OpenAIS plugin
    + High: ais: Bug lf#2359 - expected-quorum-votes not correctly updated after membership change
    + High: ais: Bug rhbz#525552 - Move non-threadsafe calls to setenv() to after the fork()
    + High: ais: Do not count votes from offline nodes and calculate current votes before sending quorum data
    + High: ais: Ensure the list of active processes sent to clients is always up-to-date
    + High: ais: Fix previous commit, actually return a result in get_process_list()
    + High: ais: Fix two more uses of getpwnam() in non-thread-safe locations
    + High: ais: Look for the correct conf variable for turning on file logging
    + High: ais: Need to find a better and thread-safe way to set core_uses_pid. Disable for now.
    + High: ais: Use the threadsafe version of getpwnam
    + High: Core: Bug lf#2414 - Prevent use-after-free reported by valgrind when doing xpath based deletions
    + High: Core: Bump the feature set due to the new failcount expiry feature
    + High: Core: Fix memory leak in replace_xml_child() reported by valgrind
    + High: Core: fix memory leaks exposed by valgrind
    + High: crmd: Bug 2401 - Improved detection of partially active peers
    + High: crmd: Bug bnc#578644 - Improve handling of cancelled operations caused by resource cleanup
    + High: crmd: Bug lf#2379 - Ensure the cluster terminates when the PE is not available
    + High: crmd: Bug lf#2414 - Prevent use-after-free of the PE connection after it dies
    + High: crmd: Bug lf#2414 - Prevent use-after-free of the stonith-ng connection
    + High: crmd: Do not allow the target_rc to be misused by resource agents
    + High: crmd: Do not ignore action timeouts based on FSA state
    + High: crmd: Ensure we dont get stuck in S_PENDING if we loose an election to someone that never talks to us again
    + High: crmd: Fix memory leaks exposed by valgrind
    + High: crmd: Remove race condition that could lead to multiple instances of a clone being active on a machine
    + High: crmd: Send erase_status_tag() calls to the local CIB when the DC is fenced, since there is no DC to accept them
    + High: crmd: Use global fencing notifications to prevent secondary fencing operations of the DC
    + High: fencing: Account for stonith_get_info() always returning a pointer to the same static buffer
    + High: PE: Allow startup probes to be disabled - their calculation is a major bottleneck for very large clusters
    + High: PE: Bug lf#2317 - Avoid needless restart of primitive depending on a clone
    + High: PE: Bug lf#2358 - Fix master-master anti-colocation
    + High: PE: Bug lf#2361 - Ensure clones observe mandatory ordering constraints if the LHS is unrunnable
    + High: PE: Bug lf#2383 - Combine failcounts for all instances of an anonymous clone on a host
    + High: PE: Bug lf#2384 - Fix intra-set colocation and ordering
    + High: PE: Bug lf#2403 - Enforce mandatory promotion (colocation) constraints
    + High: PE: Bug lf#2412 - Correctly locate clone instances by their prefix
    + High: PE: Correctly implement optional colocation between primitives and clone resources
    + High: PE: Do not be so quick to pull the trigger on nodes that are coming up
    + High: PE: Fix memory leaks exposed by valgrind
    + High: PE: Fix memory leaks reported by valgrind
    + High: PE: Repair handling of unordered groups in RHS ordering constraints
    + High: PE: Rewrite native_merge_weights() to avoid Fix use-after-free
    + High: PE: Suppress duplicate ordering constraints to achieve orders of magnitude speed increases for large clusters
    + High: Shell: add support for xml in cli
    + High: Shell: always reload status if working with the cluster (bnc#590035)
    + High: Shell: check timeouts also against the default-action-timeout property
    + High: Shell: Default to using the status section from the live CIB (bnc#592762)
    + High: Shell: edit multiple meta_attributes sets in resource management (lf#2315)
    + High: Shell: enable comments (lf#2221)
    + High: Shell: implement new cibstatus interface and commands (bnc#580492)
    + High: Shell: improve configure commit (lf#2336)
    + High: Shell: new cibstatus import command (bnc#585471)
    + High: Shell: new configure filter command
    + High: Shell: restore error reporting in options
    + High: Shell: split shell into modules
    + High: Shell: support for the utilization element (old patch for the new structure)
    + High: Shell: update previous node lookup procedure to include the id where necessary
    + High: Tools: crm_mon - fix memory leaks exposed by valgrind


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.2-2
changelog:
  - Resolves rhbz#602239 - Added patch to documentation so that it passes validation
  - High: Core: Bug lf#2401 - Backed out changeset 6e6980376f01


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.3-0.1-b3cb4f4a30ae.hg
changelog:
  - Pre-release version of 1.1.3
    + High: ais: Bug lf2401 - Improved processing when the peer crmd processes join/leave
    + High: ais: fix list of active processes sent to clients (bnc#603685)
    + High: ais: Move the code for finding uid before the fork so that the child does no logging
    + High: ais: Resolve coverity CONSTANT_EXPRESSION_RESULT defects
    + High: cib: Also free query result for xpath operations that return more than one hit
    + High: cib: Attempt to resolve memory corruption when forking a child to write the cib to disk
    + High: cib: Correctly free memory when writing out the cib to disk
    + High: cib: Fix the application of unversioned diffs
    + High: cib: Remove old developmental error logging
    + High: cib: Restructure the 'valid peer' check for deciding which instructions to ignore
    + High: Core: Bug lf#2401 - Backed out changeset 6e6980376f01
    + High: Core: Correctly unpack HA_Messages containing multiple entries with the same name
    + High: Core: crm_count_member() should only track nodes that have the full stack up
    + High: Core: New developmental logging system inspired by the kernel and a PoC from Lars Ellenberg
    + High: crmd: All nodes should see status updates, not just he DC
    + High: crmd: Allow non-DC nodes to clear failcounts too
    + High: crmd: Base DC election on process relative uptime
    + High: crmd: Bug lf#2439 - cancel_op() can also return HA_RSCBUSY
    + High: crmd: Bug lf#2439 - Handle asynchronous notification of resource deletion events
    + High: crmd: Fix assertion failure when performing async resource failures
    + High: crmd: Fix handling of async resource deletion results
    + High: crmd: Include the action for crm graph operations
    + High: crmd: Make sure the membership cache is accurate after a sucessful fencing operation
    + High: crmd: Make sure we always poke the FSA after a transition to clear any TE_HALT actions
    + High: crmd: Offer crm-level membership once the peer starts the crmd process
    + High: crmd: Only need to request quorum update for plugin based clusters
    + High: crmd: Prevent everyone from loosing DC elections by correctly initializing all relevant variables
    + High: crmd: Prevent segmentation fault
    + High: crmd: several fixes for async resource delete
    + High: mcp: Add missing headers when built without heartbeat support
    + High: mcp: New master control process for (re)spawning pacemaker daemons
    + High: PE: Avoid creating invalid ordering constraints for probes that are not needed
    + High: PE: Bug lf#1959 - Fail unmanaged resources should not prevent other services from shutting down
    + High: PE: Bug lf#2422 - Ordering dependencies on partially active groups not observed properly
    + High: PE: Bug lf#2424 - Use notify oepration definition if it exists in the configuration
    + High: PE: Bug lf#2433 - No services should be stopped until probes finish
    + High: PE: Bug lf#2453 - Enforce clone ordering in the absense of colocation constraints
    + High: PE: Correctly detect when there is a real failcount that expired and needs to be cleared
    + High: PE: Correctly handle pseudo action creation
    + High: PE: Correctly order clone startup after group/clone start
    + High: PE: Fix colocation for interleaved clones
    + High: PE: Fix colocation with partially active groups
    + High: PE: Fix potential use-after-free defect from coverity
    + High: PE: Fix previous merge
    + High: PE: Fix use-after-free in order_actions() reported by valgrind
    + High: PE: Prevent endless loop when looking for operation definitions in the configuration
    + High: Resolve coverity RESOURCE_LEAK defects
    + High: Shell: Complete the transition to using crm_attribute instead of crm_failcount and crm_standby
    + High: stonith: Advertise stonith-ng options in the metadata
    + High: stonith: Correctly parse pcmk_host_list parameters that appear on a single line
    + High: stonith: Map poweron/poweroff back to on/off expected by the stonith tool from cluster-glue
    + High: stonith: pass the configuration to the stonith program via environment variables (bnc#620781)
    + High: Support starting plugin-based Pacemaker clusters with the MCP as well
    + High: tools: crm_report - corosync.conf wont necessarily contain the text 'pacemaker' anymore
    + High: tools: crm_simulate - Resolve coverity USE_AFTER_FREE defect
    + High: Tools: Drop the 'pingd' daemon and resource agent in favor of ocf:pacemaker:ping
    + High: Tools: Fix recently introduced use-of-NULL
    + High: Tools: Fix use-after-free defect from coverity


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.3-1
changelog:
  - Upstream release of 1.1.3
    + High: crmd: Use the correct define/size for lrm resource IDs
    + High: crmd: Bug lf#2458 - Ensure stop actions always have the relevant resource attributes
    + High: crmd: Ensure we activate the DC timer if we detect an alternate DC
    + High: mcp: Correctly initialize the string containing the list of active daemons
    + High: mcp: Fix the expansion of the pid file in the init script
    + High: mcp: Tell chkconfig we need to shut down early on
    + High: PE: Bug lf#2476 - Repair on-fail=block for groups and primitive resources
    + High: PE: Do not demote resources because something that requires it can't run
    + High: PE: Rewrite the ordering constraint logic to be simplicity, clarity and maintainability
    + High: PE: Wait until stonith is available, don't fall back to shutdown for nodes requesting termination
    + High: PE: Prevent segfault by ensuring the arguments to do_calculations() are initialized
    + High: stonith: Bug lf#2461 - Prevent segfault by not looking up operations if the hashtable hasn't been initialized yet
    + High: Stonith: Bug lf#2473 - Ensure stonith operations complete within the timeout and are terminated if they run too long
    + High: stonith: Bug lf#2473 - Gracefully handle remote operations that arrive late (after we've done notifications)
    + High: stonith: Bug lf#2473 - Add the timeout at the top level where the daemon is looking for it
    + High: stonith: Bug lf#2473 - Ensure timeouts are included for fencing operations
    + High: Stonith: Use the timeout specified by the user
    + High: Tools: Bug lf#2456 - Fix assertion failure in crm_resource


author: Andrew Beekhof <andrew@beekhof.net> 1.1.4-1
changelog:
  - Upstream release of 1.1.4
  - See included ChangeLog file or http://hg.clusterlabs.org/pacemaker/1.1/file/tip/ChangeLog for details


author: Andrew Beekhof <andrew@beekhof.net> 1.1.6-1
changelog:
  - Upstream release of 1.1.6
  - See included ChangeLog file or http://hg.clusterlabs.org/pacemaker/1.1/file/tip/ChangeLog for details

  - Disabled eSMTP and SNMP support.  Painful to configure and rarely used.
  - Created cli sub-package for non-cluster usage


author: Andrew Beekhof <andrew@beekhof.net> 1.1.6-2
changelog:
  - Do not build in support for heartbeat, snmp, esmtp by default
  - Create a package for cluster unaware libraries to minimze our
    footprint on non-cluster nodes
  - Better package descriptions


author: Andrew Beekhof <andrew@beekhof.net> 1.1.7-0.1-bc7c125.git
changelog:
  - New upstream tarball: bc7c125
  - Pre-release 1.1.7 build to deal with the removal of cman and support for corosync plugins
  - Add libqb as a dependancy


author: Andrew Beekhof <andrew@beekhof.net> 1.1.7-0.3-7742926.git
changelog:
  - New upstream tarball: 7742926
  - Additional Provides and Obsoletes directives to enable upgrading from heartbeat
  - Rebuild now that the Corosync CFG API has been removed


author: Andrew Beekhof <andrew@beekhof.net> Pacemaker-1.1.7-1
changelog:
  - Update source tarball to upstream release: Pacemaker-1.1.7
  - See included ChangeLog file or https://raw.github.com/ClusterLabs/pacemaker/master/ChangeLog for details


author: Andrew Beekhof <andrew@beekhof.net> 1.1.8-1
changelog:
  - Rebuild for upstream 1.1.8 release
  - Documentation disabled pending a functional publican/ImageMagick combination

  - Statistics:
    Changesets: 1019
    Diff:       2107 files changed, 117258 insertions(+), 73606 deletions(-)

  - See included ChangeLog file or https://raw.github.com/ClusterLabs/pacemaker/master/ChangeLog for full details

    + New IPC implementation from libqb
    + New logging implementation from libqb
    + Quieter - info, debug and trace logs are no longer sent to syslog
    + Dropped dependancy on cluster-glue
    + Config and core directories no longer located in heartbeat directories
    + Support for managing systemd services
    + Rewritten local resource management daemon
    + Version bumps for every shared library due to API cleanups
    + Removes crm shell, install/use pcs shell and GUI instead


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.8-4
changelog:
  - Update for new upstream tarball: 5db5f53

    + High: mcp: Re-attach to existing pacemaker components when pacemakerd fails
    + High: pengine: cl#5111 - When clone/master child rsc has on-fail=stop, insure all children stop on failure.
    + High: Replace the use of the insecure mktemp(3) with mkstemp(3)
    + High: Core: Correctly process XML diff's involving element removal
    + High: PE: Correctly unpack active anonymous clones
    + High: PE: Fix clone_zero() and clone_strip() for single character resource names
    + High: IPC: Bug cl#5110 - Prevent 100% CPU usage when looking for synchronous replies
    + High: PE: Bug cl#5101 - Ensure stop order is preserved for partially active groups
    + High: fencing: On failure, only try a topology device once from the remote level.
    + High: fencing: Retry stonith device for duration of action's timeout period.
    + High: PE: Fix memory leak on processing message (bnc#780224)
    + High: fencing: Support 'on_target' option in fencing device metadata for forcing unfence on target node
    + High: PE: Support resources that require unfencing before start
    + High: PE: Support a 'requires' resource meta-attribute for controlling whether it needs quorum, fencing or nothing
    + High: mcp: Only define HA_DEBUGLOG to avoid agent calls to ocf_log printing everything twice
    + High: fencing: Do not start fencing until entire device topology is found or query results timeout.
    + High: Cluster: Allow cman and corosync 2.0 nodes to use a name other than uname()


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-1
changelog:
  - Update for new upstream tarball: Pacemaker-1.1.10-rc1
  - Features added since Pacemaker-1.1.8
    + Performance enhancements for supporting 16 node clusters
    + corosync: Use queues to avoid blocking when sending CPG messages
    + ipc: Compress messages that exceed the configured IPC message limit
    + ipc: Use queues to prevent slow clients from blocking the server
    + ipc: Use shared memory by default
    + lrmd: Support nagios remote monitoring
    + lrmd: Pacemaker Remote Daemon for extending pacemaker functionality outside corosync cluster.
    + pengine: Check for master/slave resources that are not OCF agents
    + pengine: Support a 'requires' resource meta-attribute for controlling whether it needs quorum, fencing or nothing
    + pengine: Support for resource containers
    + pengine: Support resources that require unfencing before start

  - Changes since Pacemaker-1.1.8
    + attrd: Correctly handle deletion of non-existant attributes
    + Bug cl#5135 - Improved detection of the active cluster type
    + Bug rhbz#913093 - Use crm_node instead of uname
    + cib: Prevent ordering changes when applying xml diffs
    + cib: Remove text nodes from cib replace operations
    + crmd: Prevent election storms caused by getrusage() values being too close
    + date/time: Bug cl#5118 - Correctly convert seconds-since-epoch to the current time
    + fencing: Attempt to provide more information that just 'generic error' for failed actions
    + fencing: Correctly record completed but previously unknown fencing operations
    + fencing: Correctly terminate when all device options have been exhausted
    + fencing: cov#739453 - String not null terminated
    + fencing: Do not merge new fencing requests with stale ones from dead nodes
    + fencing: Do not start fencing until entire device topology is found or query results timeout.
    + fencing: Do not wait for the query timeout if all replies have arrived
    + fencing: Fix passing of parameters from CMAN containing '='
    + fencing: Fix non-comparison when sorting devices by priority
    + fencing: On failure, only try a topology device once from the remote level.
    + fencing: Only try peers for non-topology based operations once
    + fencing: Retry stonith device for duration of action's timeout period.
    + ipc: Bug cl#5110 - Prevent 100% CPU usage when looking for synchronous replies
    + mcp: Re-attach to existing pacemaker components when mcp fails
    + pengine: Any location constraint for the slave role applies to all roles
    + pengine: Bug cl#5101 - Ensure stop order is preserved for partially active groups
    + pengine: Bug cl#5140 - Allow set members to be stopped when the subseqent set has require-all=false
    + pengine: Bug cl#5143 - Prevent shuffling of anonymous master/slave instances
    + pengine: Bug rhbz#880249 - Ensure orphan masters are demoted before being stopped
    + pengine: Bug rhbz#880249 - Teach the PE how to recover masters into primitives
    + pengine: cl#5025 - Automatically clear failcount for start/monitor failures after resource parameters change
    + pengine: cl#5099 - Probe operation uses the timeout value from the minimum interval monitor by default (#bnc776386)
    + pengine: cl#5111 - When clone/master child rsc has on-fail=stop, insure all children stop on failure.
    + pengine: cl#5142 - Do not delete orphaned children of an anonymous clone
    + pengine: Correctly unpack active anonymous clones
    + pengine: Ensure previous migrations are closed out before attempting another one
    + pengine: rhbz#902459 - Remove rsc node status for orphan resources
    + Replace the use of the insecure mktemp(3) with mkstemp(3)


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-2
changelog:
  - Update for new upstream tarball: Pacemaker-1.1.10-rc4

  - Features in Pacemaker-1.1.10-rc4:
    + PE: Display a list of nodes on which stopped anonymous clones are not active instead of meaningless clone IDs
    + crm_error: Add the ability to list and print error symbols
    + crm_resource: Implement --ban for moving resources away from nodes and --clear (replaces --unmove)
    + crm_resource: Support OCF tracing when using --force-(check|start|stop)

  - Changes since Pacemaker-1.1.10-rc1

    + Bug cl#5133 - pengine: Correctly observe on-fail=block for failed demote operation
    + Bug cl#5152 - Correctly clean up fenced nodes during membership changes
    + Bug cl#5153 - Correctly display clone failcounts in crm_mon
    + Bug cl#5154 - Do not expire failures when on-fail=block is present
    + Bug pengine: cl#5155 - Block the stop of resources if any depending resource is unmanaged
    + crm_report: Correctly collect logs when 'uname -n' reports fully qualified names
    + Check for and replace non-printing characters with their octal equivalent while exporting xml text
    + Convert all exit codes to positive errno values
    + Core: Ensure the blackbox is saved on abnormal program termination
    + corosync: Detect the loss of members for which we only know the nodeid
    + corosync: Nodes that can persist in sending CPG messages must be alive afterall
    + crmd: Do not get stuck in S_POLICY_ENGINE if a node we couldn't fence returns
    + crmd: Ensure all membership operations can complete while trying to cancel a transition
    + crmd: Everyone who gets a fencing notification should mark the node as down
    + crmd: Initiate node shutdown if another node claims to have successfully fenced us
    + crm_resource: Gracefully fail when --force-* is attempted for stonith resources
    + fencing: Restore the ability to manually confirm that fencing completed
    + pengine: Correctly handle resources that recover before we operate on them
    + pengine: Ensure per-node resource parameters are used during probes
    + pengine: Implement the rest of get_timet_now() and rename to get_effective_time
    + pengine: Mark unrunnable stop actions as "blocked"
    + pengine: Re-initiate active recurring monitors that previously failed but have timed out
    + xml: Restore the ability to embed comments in the cib


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-3
changelog:
  - Update to upstream 838e41e

    + Feature: pengine: Allow active nodes in our current membership to be fenced without quorum
    + Fix: attrd: Fixes deleted attributes during dc election
    + Fix: corosync: Fall back to uname for local nodes
    + Fix: crm_report: Find logs in compressed files
    + Fix: pengine: If fencing is unavailable or disabled, block further recovery for resources that fail to stop
    + Fix: systemd: Ensure we get shut down correctly by systemd


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-5
changelog:
  - Streamline spec file

  - Upstream patch for:
    + cman: Only build migration tools for targets that may use them
    + cib: Ensure we set up hacluster's groups in stand-alone mode

  - Update for new upstream tarball: Pacemaker-1.1.10-rc7

    + Bug cl#5157 - Allow migration in the absence of some colocation constraints
    + Bug cl#5168 - Prevent clones from being bounced around the cluster due to location constraints
    + Bug cl#5170 - Correctly support on-fail=block for clones
    + crmd: CID#1036761 Dereference null return value
    + crmd: cl#5164 - Fixes crmd crash when using pacemaker-remote
    + crmd: Ensure operations for cleaned up resources don't block recovery
    + crmd: Prevent messages for remote crmd clients from being relayed to wrong daemons
    + crmd: Properly handle recurring monitor operations for remote-node agent
    + fencing: Correctly detect existing device entries when registering a new one
    + logging: If SIGTRAP is sent before tracing is turned on, turn it on
    + lrmd: Prevent use-of-NULL in client library
    + pengine: cl#5128 - Support maintenance mode for a single node
    + pengine: cl#5164 - Pengine segfault when calculating transition with remote-nodes.
    + pengine: Do the right thing when admins specify the internal resource instead of the clone
    + systemd: Turn off auto-respawning of systemd services when the cluster starts them


author: Andrew Beekhof <andrew@beekhof.net> Pacemaker-1.1.10-6
changelog:
  - Update source tarball to revision: 368c726 (Pacemaker-1.1.10-rc7)
  - Changesets: 18
  - Diff:       9 files changed, 245 insertions(+), 170 deletions(-)

  - Features added since Pacemaker-1.1.10-rc7
    + crm_resource: Allow options to be set recursively

  - Changes since Pacemaker-1.1.10-rc7
    + Bug cl#5161 - crmd: Prevent memory leak in operation cache
    + cib: Correctly read back archived configurations if the primary is corrupted


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-10
changelog:
  + Fix: pengine: Do not re-allocate clone instances that are blocked in the Stopped state
    + Fix: pengine: Do not allow colocation with blocked clone instances


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-11
changelog:
  + Fix: systemd: Prevent glib assertion - only call g_error_free() with non-NULL arguments
    + Fix: systemd: Prevent additional assertions in g_error_free
    + Fix: logging: glib CRIT messages should not produce core files by default
    + Doc: controld: Update the description
    + Fix: pengine: Correctly account for the location preferences of things colocated with a group
    + Fix: cib: Correctly log short-form xml diffs
    + Fix: crmd: Correcty update the history cache when recurring ops change their return code
    + Log: pengine: Better indicate when a resource has failed
    + Log: crm_mon: Unmunge the output for failed operations


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-13
changelog:
  + Fencing: Support agents that need the host to be unfenced at startup
      Resolves: rhbz#996576
    + crm_report: Collect corosync quorum data
      Resolves: rhbz#839342


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-14
changelog:
  + Fix: xml: Location constraints are allowed to specify a role
    + Bug rhbz#902407 - crm_resource: Handle --ban for master/slave resources as advertised
      Resolves: rhbz#902407


author: David Vossel <dvossel@redhat.com> - 1.1.10-15
changelog:
  + Fix: crmd: Allow transient attributes to be set on remote-nodes.
    + Fix: pengine: Handle orphaned remote-nodes properly
    + Low: cts: Add RemoteLXC regression test.

    Resolves: rhbz#1006465
    Resolves: rhbz#1006471


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-16
changelog:
  - Remove unsupported resource agent
  - Log: crmd: Supply arguments in the correct order
  - Fix: crm_report: Correctly redirect error message to /dev/null
  - Fix: Bug rhbz#1011618 - Consistently use 'Slave' as the role for unpromoted master/slave resources
  - Fix: pengine: Location constraints with role=Started should prevent masters from running at all
  - Fix: crm_resource: Observe --master modifier for --move
  - Provide a meaningful error if --master is used for primitives and groups
  - Fix: Fencing: Observe pcmk_host_list during automatic unfencing
      Resolves: rhbz#996576


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-17
changelog:
  Resolves: rhbz#720543

  - Fix: core: Do not enabled blackbox for cli tools
  - Fix: Command-line tools should stop after an assertion failure
  - Fix: crmd: Dont add node_state to cib, if we have not seen or fenced this node yet
  - Fix: crmd: Correctly update expected state when the previous DC shuts down
  - Fix: crmd: Cache rsc_info retrieved from lrmd and pacemaker_remoted
  - Fix: crmd: Pad internal lrmd rsc_info and metadata retrieval timeout
  - Fix: crm_attribute: Detect orphaned remote-nodes when setting attributes
  - Fix: crm_mon: Prevent use-of-NULL when ping resources do not define a host list
  - Fix: crm_report: Record the output of the collector
  - Fix: crm_report: Do not print garbage when collecting from the local node
  - Fix: crm_resource: Wait for all replies when cleaning up resources
  - Fix: fencing: Do not broadcast suicide if the on action is being executed
  - Fix: fencing: Allow fencing for node after topology entries are deleted
  - Fix: fencing: Deep copy current topology level list on remote op
  - Fix: lrmd: Correctly cancel monitor actions for lsb/systemd/service resources on cleaning up
  - Fix: pengine: Dont prevent clones from running due to dependant resources
  - Fix: pengine: Probe containers not expected to be up
  - Fix: ipc: Raise the default buffer size to 128k
  - Fix: ipc: Use the higher of the configured buffer size or the default
  - Fix: iso8601: Prevent dates from jumping backwards a day in some timezones
  - Fix: remote: Properly version the remote connection protocol
  - Fix: remote: Handle endian changes between client and server and improve forward compatibility
      Resolves: rhbz#720543


author: David Vossel <dvossel@redhat.com> - 1.1.10-19
changelog:
  - Fix: controld: Use the correct variant of dlm_controld for
    corosync-2 clusters

      Resolves: rhbz#1028627


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-20
changelog:
  - Fix: tools: Fixes formatting of remote-nodes in crm_mon and crm_simulate
  - Fix: Corosync: Attempt to retrieve a peers node name if it is not already known
      Resolves: rhbz#720543


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-23
changelog:
  - mcp: Tell systemd not to respawn us if we return 100
  - services: Detect missing agents and permission errors before forking
  - Use native DBus library for systemd support to avoid problematic use of threads
      Resolves: rhbz#720543 (aka. 1057697)


author: David Vossel <dvossel@redhat.com> - 1.1.10-24
changelog:
  - controld: handling startup fencing within the controld agent, not the dlm
      Resolves: rhbz#1064519
  - controld: Do not consider the dlm up until the address list is present
      Resolves: rhbz#1067536


author: David Vossel <dvossel@redhat.com> - 1.1.10-25
changelog:
  - pengine: cl#5187 - Prevent resources in an anti-colocation from even temporarily running on a same node
      Resolves: rhbz#1069284


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-26
changelog:
  - Run automated regression tests after every build
  - Fencing: Send details of stonith_api_time() and stonith_api_kick() to syslog
  - Fencing: Pass the correct options when looking up the history by node name
  - Fencing: stonith_api_time_helper now returns when the most recent fencing operation completed
  - crm_report: Additional dlm detail if dlm_controld is running
  - crmd: Gracefully handle actions that cannot be initiated
  - pengine: Gracefully handle bad values for XML_ATTR_TRANSITION_MAGIC
      Resolves: rhbz#1070916


author: Andrew Beekhof <beekhof@redhat.com> - 1.1.10-27
changelog:
  - crm_resource: Prevent use-of-NULL
  - systemd: Prevent use-of-NULL when determining if an agent exists
  - Fencing: Remove shadow definition and use of variable 'progress'
      Resolves: rhbz#1070916


author: David Vossel <dvossel@redhat.com> - 1.1.10-28
changelog:
  - pengine: fixes invalid transition caused by clones with more than 10 instances
      Resolves: rhbz#1078504


author: Andrew Beekhof <abeekhof@redhat.com> 1.1.10-30
changelog:
  - crmd: Do not erase the status section for unfenced nodes
  - crmd: Correctly react to successful unfencing operations
  - crmd: Report unsuccessful unfencing operations
  - crmd: Do not overwrite existing node state when fencing completes
  - fencing: Correctly record which peer performed the fencing operation
  - fencing: Automatically switch from 'list' to 'status' to 'static-list' if those actions are not advertised in the metadata
  - fencing: Filter self-fencing at the peers to allow unfencing to work correctly
  - pengine: Automatically re-unfence a node if the fencing device definition changes
  - pengine: Fencing devices default to only requiring quorum in order to start
  - pengine: Delay unfencing until after we know the state of all resources that require unfencing
  - pengine: Ensure unfencing occurs before fencing devices are (re-)probed
  - pengine: Ensure unfencing only happens once, even if the transition is interrupted
  - pengine: Do not unfence nodes that are offline, unclean or shutting down
  - pengine: Unfencing is based on device probes, there is no need to unfence when normal resources are found active
  - logging: daemons always get a log file, unless explicitly set to configured 'none'
  - lrmd: Expose logging variables expected by OCF agents
  - crm_report: Suppress logging errors after the target directory has been compressed
  - crm_resource: Wait for the correct number of replies when cleaning up resources
      Resolves: rhbz#1078078


author: David Vossel <dvossel@redhat.com> - 1.1.10-31
changelog:
  - fencing: Fence using all required devices
  - fencing: Execute all required fencing devices regardless of what topology level they are at
  - fencing: default to 'off' when agent does not advertise 'reboot' in metadata
      Resolves: rhbz#1078078


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-32
changelog:
  - Fix: lrmd: Handle systemd reporting 'done' before a resource is actually stopped
      Resolves: rhbz#1111747


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-5
changelog:
  - Update patch level to upstream 031e46c
    - Prevent glib assert triggered by timers being removed from mainloop more than once 
    - Allow rsc discovery to be disabled in certain situations
    - Allow remote-nodes to be placed in maintenance mode
    - Improved sbd integration


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-9
changelog:
  - Update patch level to upstream fb94901
  - Prevent blocking by performing systemd reloads asynchronously


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-10
changelog:
  - Update patch level to upstream 98b6688
  - Support an intelligent resource restart operation
  - Exclusive discovery implies running the resource is only possible on the listed nodes


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-11
changelog:
  - Update patch level to upstream 7dd9022
  - Ensure all internal caches are updated when nodes are removed from the cluster
    Resolves: rhbz#1162727


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-13
changelog:
  - Update patch level to upstream a433de6
  - Ensure we wait for long running systemd stop operations to complete
    Resolves: rhbz#1165423


author: David Vossel <dvossel@redhat.com> - 1.1.12-18
changelog:
  - clone order constraint require-all option.
  - fix memory leaks in crmd and pacemakerd

    Resolves: rhbz#1176210


author: David Vossel <dvossel@redhat.com> - 1.1.12-19
changelog:
  - Imply stop on actions within containers during host fencing
  - acl correctly implement the reference acl direct

    Resolves: rhbz#1117341


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.14-11
changelog:
  - Rebase to upstream 2cccd43d6b7f2525d406251e14ef37626e29c51f (1.1.14+)
  - Resolves: rhbz#1304771
    Resolves: rhbz#1207388
    Resolves: rhbz#1240330
    Resolves: rhbz#1281450
    Resolves: rhbz#1284069
    Resolves: rhbz#1286316
    Resolves: rhbz#1287315
    Resolves: rhbz#1287868
    Resolves: rhbz#1288929
    Resolves: rhbz#1303765
  - This also updates the packaging to follow upstream more closely,
    most importantly moving some files from the pacemaker package to
    pacemaker-cli (including XML schemas, SNMP MIB, attrd_updater command,
    most ocf:pacemaker resource agents, and related man pages),
    and deploying /etc/sysconfig/crm_mon.


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-1
changelog:
  - Rebase to upstream 2c148ac30dfcc2cfb91dc367ed469b6f227a8abc (1.1.15-rc3+)
  - Resolves: rhbz#1304771
    Resolves: rhbz#1040685
    Resolves: rhbz#1219188
    Resolves: rhbz#1235434
    Resolves: rhbz#1268313
    Resolves: rhbz#1284069
    Resolves: rhbz#1287868
    Resolves: rhbz#1288929
    Resolves: rhbz#1312094
    Resolves: rhbz#1314157
    Resolves: rhbz#1321711
    Resolves: rhbz#1338623


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-2
changelog:
  - Rebase to upstream 25920dbdbc7594fc944a963036996f724c63a8b8 (1.1.15-rc4)
  - Resolves: rhbz#1304771
    Resolves: rhbz#773656
    Resolves: rhbz#1240330
    Resolves: rhbz#1281450
    Resolves: rhbz#1286316
    Resolves: rhbz#1287315
    Resolves: rhbz#1323544


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-3
changelog:
  - Rebase to upstream e174ec84857e087210b9dacee3318f8203176129 (1.1.15)
  - Resolves: rhbz#1304771
    Resolves: rhbz#1303765
    Resolves: rhbz#1327469
    Resolves: rhbz#1337688
    Resolves: rhbz#1345876
    Resolves: rhbz#1346726


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-8
changelog:
  - Quote timestamp-format correctly in alert_snmp.sh.sample
  - Unregister CIB callbacks correctly
  - Print resources section heading consistently in crm_mon output
  - Resolves: rhbz#773656
  - Resolves: rhbz#1361533


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-10
changelog:
  - Only clear remote node operation history on startup
  - Resend a lost shutdown request
  - Correctly detect and report invalid configurations
  - Don't include manual page for resource agent that isn't included
  - Resolves: rhbz#1288929
  - Resolves: rhbz#1310486
  - Resolves: rhbz#1352039


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-11
changelog:
  - Sanitize readable CIB output collected by crm_report
  - Document crm_report --sos-mode option
  - Speed up crm_report on Pacemaker Remote nodes
  - Avoid sbd fencing when upgrading pacemaker_remote package
  - Resolves: rhbz#1219188
  - Resolves: rhbz#1235434
  - Resolves: rhbz#1323544
  - Resolves: rhbz#1372009


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.0-2
changelog:
  - Bugzilla Bug #668839 - Review Request: pki-core
  -   Added component versioning comments
  -   Updated JSS from "4.2.6-10" to "4.2.6-12"
  -   Modified installation section to preserve timestamps
  -   Removed sectional comments


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.0-3
changelog:
  - Bugzilla Bug #668839 - Review Request: pki-core
  -   Removed empty "pre" from "pki-ca"
  -   Consolidated directory ownership
  -   Corrected file ownership within subpackages
  -   Removed all versioning from NSS and NSPR packages


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.1-1
changelog:
  - Allow 'pki-native-tools' to be installed independently of 'pki-setup'
  - Removed explicit 'pki-setup' requirement from 'pki-ca'
    (since it already requires 'pki-common')
  - 'pki-setup'
  -     Bugzilla Bug #223343 - pkicreate: should add 'pkiuser' to nfast group
  -     Bugzilla Bug #629377 - Selinux errors during pkicreate CA, KRA, OCSP
        and TKS.
  -     Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port
        fowarding for agent services
  -     Bugzilla Bug #632425 - Port to tomcat6
  -     Bugzilla Bug #606946 - Convert Native Tools to use ldapAPI from
        OpenLDAP instead of the Mozldap
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #658926 - org.apache.commons.lang class not found on F13
  -     Bugzilla Bug #661514 - CMAKE build system requires rules to make
        javadocs
  -     Bugzilla Bug #665388 - jakarta-* jars have been renamed to apache-*,
        pkicreate fails Fedora 14 and above
  -     Bugzilla Bug #23346 - Two conflicting ACL list definitions in source
        repository
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  - 'pki-symkey'
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #644056 - CS build contains warnings
  - 'pki-native-tools'
  -     template change
  -     Bugzilla Bug #606946 - Convert Native Tools to use ldapAPI from
        OpenLDAP instead of the Mozldap
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #644056 - CS build contains warnings
  - 'pki-util'
  -     Bugzilla Bug #615814 - rhcs80 - profile policyConstraintsCritical
        cannot be set to true
  -     Bugzilla Bug #224945 - javadocs has missing descriptions, contains
        empty packages
  -     Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes.
  -     Bugzilla Bug #621338 - Include a server randomly-generated 16 byte
        senderNonce in all signed SCEP responses.
  -     Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade
        attack in SCEP
  -     Bugzilla Bug #621334 - Provide an option to set default hash algorithm
        for signing SCEP response messages.
  -     Bugzilla Bug #635033 - At installation wizard selecting key types other
        than CA's signing cert will fail
  -     Bugzilla Bug #645874 - rfe ecc - add ecc curve name support in JSS and
        CS interface
  -     Bugzilla Bug #488253 - com.netscape.cmsutil.ocsp.BasicOCSPResponse
        ASN.1 encoding/decoding is broken
  -     Bugzilla Bug #551410 - com.netscape.cmsutil.ocsp.TBSRequest ASN.1
        encoding/decoding is incomplete
  -     Bugzilla Bug #550331 - com.netscape.cmsutil.ocsp.ResponseData ASN.1
        encoding/decoding is incomplete
  -     Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit
        policy extension to 5 only
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml)
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #661514 - CMAKE build system requires rules to make
        javadocs
  -     Bugzilla Bug #658188 - remove remaining references to tomcat5
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  -     Bugzilla Bug #223319 - Certificate Status inconsistency between token
        db and CA
  -     Bugzilla Bug #531137 - RHCS 7.1 - Running out of Java Heap Memory
        During CRL Generation
  - 'pki-java-tools'
  -     Bugzilla Bug #224945 - javadocs has missing descriptions, contains
        empty packages
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #659004 - CC: AuditVerify hardcoded with SHA-1
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #661514 - CMAKE build system requires rules to make
        javadocs
  -     Bugzilla Bug #662156 - HttpClient is hard-coded to handle only up to
        5000 bytes
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  - 'pki-common'
  -     Bugzilla Bug #583822 - CC: ACL issues from CA interface CC doc review
  -     Bugzilla Bug #623745 - SessionTimer with LDAPSecurityDomainSessionTable
        started before configuration completed
  -     Bugzilla Bug #620925 - CC: auditor needs to be able to download audit
        logs in the java subsystems
  -     Bugzilla Bug #615827 - rhcs80 - profile policies need more than 5
        policy mappings (seem hardcoded)
  -     Bugzilla Bug #224945 - javadocs has missing descriptions, contains
        empty packages
  -     Bugzilla Bug #548699 - subCA's admin certificate should be generated by
        itself
  -     Bugzilla Bug #621322 - Provide switch disabling SCEP support in CA
  -     Bugzilla Bug #563386 - rhcs80 ca crash on invalid inputs to profile
        caAgentServerCert (null cert_request)
  -     Bugzilla Bug #621339 - SCEP one-time PIN can be used an unlimited
        number of times
  -     Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml
        as part of CC interface review
  -     Bugzilla Bug #629677 - TPS: token enrollment fails.
  -     Bugzilla Bug #621350 - Unauthenticated user can decrypt a one-time PIN
        in a SCEP request
  -     Bugzilla Bug #503838 - rhcs71-80 external publishing ldap connection
        pools not reliable - improve connections or discovery
  -     Bugzilla Bug #629769 - password decryption logs plain text password
  -     Bugzilla Bug #583823 - CC: Auditing issues found as result of
        CC - interface review
  -     Bugzilla Bug #632425 - Port to tomcat6
  -     Bugzilla Bug #586700 - OCSP Server throws fatal error while using
        OCSP console for renewing SSL Server certificate.
  -     Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes.
  -     Bugzilla Bug #621338 - Include a server randomly-generated 16 byte
        senderNonce in all signed SCEP responses.
  -     Bugzilla Bug #607380 - CC: Make sure Java Console can configure all
        security relevant config items
  -     Bugzilla Bug #558100 - host challenge of the Secure Channel needs to be
        generated on TKS instead of TPS.
  -     Bugzilla Bug #489342 -
        com.netscape.cms.servlet.common.CMCOutputTemplate.java
        doesn't support EC
  -     Bugzilla Bug #630121 - OCSP responder lacking option to delete or
        disable a CA that it serves
  -     Bugzilla Bug #634663 - CA CMC response default hard-coded to SHA1
  -     Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade
        attack in SCEP
  -     Bugzilla Bug #621334 - Provide an option to set default hash algorithm
        for signing SCEP response messages.
  -     Bugzilla Bug #635033 - At installation wizard selecting key types other
        than CA's signing cert will fail
  -     Bugzilla Bug #621341 - Add CA support for new SCEP key pair dedicated
        for SCEP signing and encryption.
  -     Bugzilla Bug #223336 - ECC: unable to clone a ECC CA
  -     Bugzilla Bug #539781 - rhcs 71 - CRLs Partitioned
        by Reason Code - onlySomeReasons ?
  -     Bugzilla Bug #637330 - CC feature: Key Management - provide signature
        verification functions (JAVA subsystems)
  -     Bugzilla Bug #223313 - should do random generated IV param
        for symmetric keys
  -     Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port
        fowarding for agent services
  -     Bugzilla Bug #630176 - Improve reliability of the LdapAnonConnFactory
  -     Bugzilla Bug #524916 - ECC key constraints plug-ins should be based on
        ECC curve names (not on key sizes).
  -     Bugzilla Bug #516632 - RHCS 7.1 - CS Incorrectly Issuing Multiple
        Certificates from the Same Request
  -     Bugzilla Bug #648757 - expose and use updated cert verification
        function in JSS
  -     Bugzilla Bug #638242 - Installation Wizard: at SizePanel, fix selection
        of signature algorithm; and for ECC curves
  -     Bugzilla Bug #451874 - RFE - Java console - Certificate Wizard missing
        e.c. support
  -     Bugzilla Bug #651040 - cloning shoud not include sslserver
  -     Bugzilla Bug #542863 - RHCS8: Default cert audit nickname written to
        CS.cfg files imcomplete when the cert is stored on a hsm
  -     Bugzilla Bug #360721 - New Feature: Profile Integrity Check . . .
  -     Bugzilla Bug #651916 - kra and ocsp are using incorrect ports
        to talk to CA and complete configuration in DonePanel
  -     Bugzilla Bug #642359 - CC Feature - need to verify certificate when it
        is added
  -     Bugzilla Bug #653713 - CC: setting trust on a CIMC cert requires
        auditing
  -     Bugzilla Bug #489385 - references to rhpki
  -     Bugzilla Bug #499494 - change CA defaults to SHA2
  -     Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit
        policy extension to 5 only
  -     Bugzilla Bug #649910 - Console: an auditor or agent can be added to
        an administrator group.
  -     Bugzilla Bug #632425 - Port to tomcat6
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml)
  -     Bugzilla Bug #653576 - tomcat5 does not always run filters on servlets
        as expected
  -     Bugzilla Bug #642357 - CC Feature- Self-Test plugins only check for
        validity
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #659004 - CC: AuditVerify hardcoded with SHA-1
  -     Bugzilla Bug #661196 - ECC(with nethsm) subca configuration fails with
        Key Type RSA Not Matched despite using ECC key pairs for rootCA & subCA.
  -     Bugzilla Bug #661889 - The Servlet TPSRevokeCert of the CA returns an
        error to TPS even if certificate in question is already revoked.
  -     Bugzilla Bug #663546 - Disable the functionalities that are not exposed
        in the console
  -     Bugzilla Bug #661514 - CMAKE build system requires rules to make
        javadocs
  -     Bugzilla Bug #658188 - remove remaining references to tomcat5
  -     Bugzilla Bug #649343 - Publishing queue should recover from CA crash.
  -     Bugzilla Bug #491183 - rhcs rfe - add rfc 4523 support for pkiUser and
        pkiCA, obsolete 2252 and 2256
  -     Bugzilla Bug #640710 - Current SCEP implementation does not support HSMs
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  -     Bugzilla Bug #661142 - Verification should fail when
        a revoked certificate is added
  -     Bugzilla Bug #642741 - CS build uses deprecated functions
  -     Bugzilla Bug #670337 - CA Clone configuration throws TCP connection error
  -     Bugzilla Bug #662127 - CC doc Error: SignedAuditLog expiration time
        interface is no longer available through console
  - 'pki-selinux'
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #667153 - store nuxwdog passwords in kernel ring buffer -
        selinux changes
  - 'pki-ca'
  -     Bugzilla Bug #583822 - CC: ACL issues from CA interface CC doc review
  -     Bugzilla Bug #620925 - CC: auditor needs to be able to download audit
        logs in the java subsystems
  -     Bugzilla Bug #621322 - Provide switch disabling SCEP support in CA
  -     Bugzilla Bug #583824 - CC: Duplicate servlet mappings found as part of
        CC interface doc review
  -     Bugzilla Bug #621602 - pkiconsole: Click on 'Publishing' option with
        admin privilege throws error "You are not authorized to perform this
        operation".
  -     Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml
        as part of CC interface review
  -     Bugzilla Bug #583823 - CC: Auditing issues found as result of
        CC - interface review
  -     Bugzilla Bug #519291 - Deleting a CRL Issuing Point after edits throws
        'Internal Server Error'.
  -     Bugzilla Bug #586700 - OCSP Server throws fatal error while using
        OCSP console for renewing SSL Server certificate.
  -     Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes.
  -     Bugzilla Bug #621338 - Include a server randomly-generated 16 byte
        senderNonce in all signed SCEP responses.
  -     Bugzilla Bug #558100 - host challenge of the Secure Channel needs to be
        generated on TKS instead of TPS.
  -     Bugzilla Bug #630121 - OCSP responder lacking option to delete or
        disable a CA that it serves
  -     Bugzilla Bug #634663 - CA CMC response default hard-coded to SHA1
  -     Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade
        attack in SCEP
  -     Bugzilla Bug #621334 - Provide an option to set default hash algorithm
        for signing SCEP response messages.
  -     Bugzilla Bug #539781 - rhcs 71 - CRLs Partitioned
        by Reason Code - onlySomeReasons ?
  -     Bugzilla Bug #637330 - CC feature: Key Management - provide signature
        verification functions (JAVA subsystems)
  -     Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port
        fowarding for agent services
  -     Bugzilla Bug #524916 - ECC key constraints plug-ins should be based on
        ECC curve names (not on key sizes).
  -     Bugzilla Bug #516632 - RHCS 7.1 - CS Incorrectly Issuing Multiple
        Certificates from the Same Request
  -     Bugzilla Bug #638242 - Installation Wizard: at SizePanel, fix selection
        of signature algorithm; and for ECC curves
  -     Bugzilla Bug #529945 - (Instructions and sample only) CS 8.0 GA
        release -- DRM and TKS do not seem to have CRL checking enabled
  -     Bugzilla Bug #609641 - CC: need procedure (and possibly tools) to help
        correctly set up CC environment
  -     Bugzilla Bug #509481 - RFE: support sMIMECapabilities extensions in
        certificates (RFC 4262)
  -     Bugzilla Bug #651916 - kra and ocsp are using incorrect ports
        to talk to CA and complete configuration in DonePanel
  -     Bugzilla Bug #511990 - rhcs 7.3, 8.0 - re-activate missing object
        signing support in RHCS
  -     Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml)
  -     Bugzilla Bug #489385 - references to rhpki
  -     Bugzilla Bug #499494 - change CA defaults to SHA2
  -     Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit
        policy extension to 5 only
  -     Bugzilla Bug #649910 - Console: an auditor or agent can be added to
        an administrator group.
  -     Bugzilla Bug #632425 - Port to tomcat6
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #653576 - tomcat5 does not always run filters on servlets
        as expected
  -     Bugzilla Bug #642357 - CC Feature- Self-Test plugins only check for
        validity
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #661128 - incorrect CA ports used for revoke, unrevoke
        certs in TPS
  -     Bugzilla Bug #512496 - RFE rhcs80 - crl updates and scheduling feature 
  -     Bugzilla Bug #661196 - ECC(with nethsm) subca configuration fails with
        Key Type RSA Not Matched despite using ECC key pairs for rootCA & subCA.
  -     Bugzilla Bug #649343 - Publishing queue should recover from CA crash.
  -     Bugzilla Bug #491183 - rhcs rfe - add rfc 4523 support for pkiUser and
        pkiCA, obsolete 2252 and 2256
  -     Bugzilla Bug #223346 - Two conflicting ACL list definitions in source
        repository
  -     Bugzilla Bug #640710 - Current SCEP implementation does not support HSMs
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  -     Bugzilla Bug #661142 - Verification should fail when
        a revoked certificate is added
  -     Bugzilla Bug #668100 - DRM storage cert has OCSP signing extended key
        usage
  -     Bugzilla Bug #662127 - CC doc Error: SignedAuditLog expiration time
        interface is no longer available through console
  -     Bugzilla Bug #531137 - RHCS 7.1 - Running out of Java Heap Memory
        During CRL Generation
  - 'pki-silent'
  -     Bugzilla Bug #627309 - pkisilent subca configuration fails.
  -     Bugzilla Bug #640091 - pkisilent panels need to match with changed java
        subsystems
  -     Bugzilla Bug #527322 - pkisilent ConfigureDRM should configure DRM
        Clone.
  -     Bugzilla Bug #643053 - pkisilent DRM configuration fails
  -     Bugzilla Bug #583754 - pki-silent needs an option to configure signing
        algorithm for CA certificates
  -     Bugzilla Bug #489385 - references to rhpki
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml)
  -     Bugzilla Bug #640042 - TPS Installlation Wizard: need to move Module
        Panel up to before Security Domain Panel
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #588323 - Failed to enable cipher 0xc001
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  -     Bugzilla Bug #645895 - pkisilent: add ability to select ECC curves,
        signing algorithm
  -     Bugzilla Bug #658641 - pkisilent doesn't not properly handle passwords
        with special characters
  -     Bugzilla Bug #642741 - CS build uses deprecated functions


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.1-2
changelog:
  - 'pki-symkey'
  -     Bugzilla Bug #671265 - pki-symkey jar version incorrect
  - 'pki-common'
  -     Bugzilla Bug #564207 - Searches for completed requests in the agent
        interface returns zero entries


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.1-3
changelog:
  - Bugzilla Bug #656661 - Please Update Spec File to use 'ghost' on files
    in /var/run and /var/lock


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.2-1
changelog:
  - Bugzilla Bug #673233 - Rebase pki-core to pick the latest features and fixes
  - 'pki-setup'
  -     Bugzilla Bug #673638 - Installation within IPA hangs
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  -     Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided
        by 'netscape.security.provider' package
  - 'pki-common'
  -     Bugzilla Bug #672291 - CA is not publishing certificates issued using
        "Manual User Dual-Use Certificate Enrollment"
  -     Bugzilla Bug #670337 - CA Clone configuration throws TCP connection
        error.
  -     Bugzilla Bug #504056 - Completed SCEP requests are assigned to the
        "begin" state instead of "complete".
  -     Bugzilla Bug #504055 - SCEP requests are not properly populated
  -     Bugzilla Bug #564207 - Searches for completed requests in the agent
        interface returns zero entries
  -     Bugzilla Bug #672291 - CA is not publishing certificates issued using
        "Manual User Dual-Use Certificate Enrollment" -
  -     Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided
        by 'netscape.security.provider' package
  -     Bugzilla Bug #672920 - CA console: adding policy to a profile throws
        'Duplicate policy' error in some cases.
  -     Bugzilla Bug #673199 - init script returns control before web apps have
        started
  -     Bugzilla Bug #674917 - Restore identification of Tomcat-based PKI
        subsystem instances
  - 'pki-selinux'
  - 'pki-ca'
  -     Bugzilla Bug #504013 - sscep request is rejected due to authentication
        error if submitted through one time pin router certificate enrollment.
  -     Bugzilla Bug #672111 - CC doc: certServer.usrgrp.administration missing
        information
  -     Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml
        as part of CC interface review
  -     Bugzilla Bug #672333 - Creation of RA agent fails in IPA installation
  -     Bugzilla Bug #674917 - Restore identification of Tomcat-based PKI
        subsystem instances
  - 'pki-silent'
  -     Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided
        by 'netscape.security.provider' package


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-1
changelog:
  - 'pki-common'
  -     Bugzilla Bug #674894 - ipactl restart : an annoy output line
  -     Bugzilla Bug #675179 - ipactl restart : an annoy output line


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-2
changelog:
  - 'pki-common'
  -     Bugzilla Bug #676051 - IPA installation failing - Fails to create CA
        instance
  -     Bugzilla Bug #676182 - IPA installation failing - Fails to create CA
        instance


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.4-1
changelog:
  - Bugzilla Bug #688763 - Rebase updated Dogtag Packages for Fedora 15 (alpha)
  - Bugzilla Bug #676182 - IPA installation failing - Fails to create CA
    instance
  - Bugzilla Bug #675742 - Profile caIPAserviceCert Not Found
  - 'pki-setup'
  -     Bugzilla Bug #678157 - uninitialized variable warnings from Perl
  -     Bugzilla Bug #679574 - Velocity fails to load all dependent classes
  -     Bugzilla Bug #680420 - xml-commons-apis.jar dependency
  -     Bugzilla Bug #682013 - pkisilent needs xml-commons-apis.jar in it's
        classpath
  -     Bugzilla Bug #673508 - CS8 64 bit pkicreate script uses wrong library
        name for SafeNet LunaSA
  - 'pki-common'
  -     Bugzilla Bug #673638 - Installation within IPA hangs
  -     Bugzilla Bug #678715 - netstat loop fixes needed
  -     Bugzilla Bug #673609 - CC: authorize() call needs to be added to
        getStats servlet
  - 'pki-selinux'
  -     Bugzilla Bug #674195: SELinux error message thrown during token
        enrollment
  - 'pki-ca'
  -     Bugzilla Bug #673638 - Installation within IPA hangs
  -     Bugzilla Bug #673609 - CC: authorize() call needs to be added to
        getStats servlet
  -     Bugzilla Bug #676330 - init script cannot start service
  - 'pki-silent'
  -     Bugzilla Bug #682013 - pkisilent needs xml-commons-apis.jar in it's
        classpath


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.5-1
changelog:
  - Bugzilla Bug #690950 - Update Dogtag Packages for Fedora 15 (beta)
  - Require "jss >= 4.2.6-15" as a build and runtime requirement
  - Require "tomcatjss >= 2.1.1" as a build and runtime requirement
    for Fedora 15 and later platforms
  - 'pki-setup'
  -     Bugzilla Bug #688287 - Add "deprecation" notice regarding using
        "shared ports" in pkicreate -help . . .
  -     Bugzilla Bug #688251 - Dogtag installation under IPA takes
        too much time - SELinux policy compilation
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  -     Bugzilla Bug #689501 - ExtJoiner tool fails to join the multiple
        extensions
  - 'pki-common'
  -     Bugzilla Bug #683581 - CA configuration with ECC(Default
        EC curve-nistp521) CA fails with 'signing operation failed'
  -     Bugzilla Bug #689662 - ocsp publishing needs to be re-enabled
        on the EE port
  - 'pki-selinux'
  -     Bugzilla Bug #684871 - ldaps selinux link change
  - 'pki-ca'
  -     Bugzilla Bug #683581 - CA configuration with ECC(Default
        EC curve-nistp521) CA fails with 'signing operation failed'
  -     Bugzilla Bug #684381 - CS.cfg specifies incorrect type of comments
  -     Bugzilla Bug #689453 - CRMFPopClient request to CA's unsecure port
        throws file not found exception.(profile and CS.cfg only)
  - 'pki-silent'


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.6-1
changelog:
  - Bugzilla Bug #690950 - Update Dogtag Packages for Fedora 15 (beta)
  - Bugzilla Bug #693327 - Missing requires: tomcatjss
  - 'pki-setup'
  -     Bugzilla Bug #690626 - pkiremove removes the registry entry for
        all instances on a machine
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  -     Bugzilla Bug #689453 - CRMFPopClient request to CA's unsecure port
        throws file not found exception.
  - 'pki-common'
  -     Bugzilla Bug #692990 - Audit log messages needed to match CC doc:
        DRM Recovery audit log messages
  - 'pki-selinux'
  - 'pki-ca'
  - 'pki-silent'


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.7-1
changelog:
  - 'pki-setup'
  -     Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser
  -     Bugzilla Bug #694569 - parameter used by pkiremove not updated
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  - 'pki-common'
  -     Bugzilla Bug #695403 - Editing signedaudit or transaction, system logs
        throws 'Invalid protocol' for OCSP subsystems
  -     Bugzilla Bug #694569 - parameter used by pkiremove not updated
  -     Bugzilla Bug #695015 - Serial No. of a revoked certificate is not
        populated in the CA signedAudit messages
  -     Bugzilla Bug #694143 - CA Agent not returning specified request
  -     Bugzilla Bug #695015 - Serial No. of a revoked certificate is not
        populated in the CA signedAudit messages
  -     Bugzilla Bug #698885 - Race conditions during IPA installation
  - 'pki-selinux'
  - 'pki-ca'
  -     Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser
  -     Bugzilla Bug #699837 - service command is not fully backwards compatible
        with Dogtag pki subsystems
  - 'pki-silent'


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.8-1
changelog:
  - 'pki-setup'
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  -     Bugzilla Bug #532548 - Tool to do DRM re-key
  - 'pki-common'
  - 'pki-selinux'
  - 'pki-ca'
  - 'pki-silent'


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.8-2
changelog:
  - 'pki-setup'
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  -     Added 'DRMTool.cfg' configuration file to inventory
  - 'pki-common'
  - 'pki-selinux'
  - 'pki-ca'
  - 'pki-silent'


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.9-1
changelog:
  - Updated release of 'jss'
  - Updated release of 'tomcatjss' for Fedora 15
  - 'pki-setup'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser
         (jdennis)
  -      Bugzilla Bug #694569 - parameter used by pkiremove not updated (alee)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-symkey'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-native-tools'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #717765 - TPS configuration: logging into security domain
         from tps does not work with clientauth=want. (alee)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-util'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-java-tools'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #532548 - Tool to do DRM re-key (mharmsen)
  -      Bugzilla Bug #532548 - Tool to do DRM re-key (config file and record
         processing) (mharmsen)
  -      Bugzilla Bug #532548 - Tool to do DRM re-key (tweaks) (mharmsen)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-common'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #695403 - Editing signedaudit or transaction, system
         logs throws 'Invalid protocol' for OCSP subsystems (alee)
  -      Bugzilla Bug #694569 - parameter used by pkiremove not updated (alee)
  -      Bugzilla Bug #695015 - Serial No. of a revoked certificate is not
         populated in the CA signedAudit messages (alee)
  -      Bugzilla Bug #694143 - CA Agent not returning specified request (awnuk)
  -      Bugzilla Bug #695015 - Serial No. of a revoked certificate is not
         populated in the CA signedAudit messages (jmagne)
  -      Bugzilla Bug #698885 - Race conditions during IPA installation (alee)
  -      Bugzilla Bug #704792 - CC_LAB_EVAL: CA agent interface:
         SubjectID=$Unidentified$ fails audit evaluation (jmagne)
  -      Bugzilla Bug #705914 - SCEP mishandles nicknames when processing
         subsequent SCEP requests. (awnuk)
  -      Bugzilla Bug #661142 - Verification should fail when a revoked
         certificate is added. (jmagne)
  -      Bugzilla Bug #707416 - CC_LAB_EVAL: Security Domain: missing audit msgs
         for modify/add (alee)
  -      Bugzilla Bug #707416 - additional audit messages for GetCookie (alee)
  -      Bugzilla Bug #707607 - Published certificate summary has list of
         non-published certificates with succeeded status (jmagne)
  -      Bugzilla Bug #717813 - EV_AUDIT_LOG_SHUTDOWN audit log not generated
         for tps and ca on server shutdown (jmagne)
  -      Bugzilla Bug #697939 - DRM signed audit log message - operation should
         be read instead of modify (jmagne)
  -      Bugzilla Bug #718427 - When audit log is full, server continue to
         function. (alee)
  -      Bugzilla Bug #718607 - CC_LAB_EVAL: No AUTH message is generated in
         CA's signedaudit log when a directory based user enrollment is
         performed (jmagne)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-selinux'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #720503 - RA and TPS require additional SELinux
         permissions to run in "Enforcing" mode (alee)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-ca'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser
         (jdennis)
  -      Bugzilla Bug #699837 - service command is not fully backwards
         compatible with Dogtag pki subsystems (mharmsen)
  -      Bugzilla Bug #649910 - Console: an auditor or agent can be added to an
         administrator group. (jmagne)
  -      Bugzilla Bug #707416 - CC_LAB_EVAL: Security Domain: missing audit msgs
         for modify/add (alee)
  -      Bugzilla Bug #716269 - make ra authenticated profiles non-visible on ee
         pages (alee)
  -      Bugzilla Bug #718621 - CC_LAB_EVAL: PRIVATE_KEY_ARCHIVE_REQUEST occurs
         for a revocation invoked by EE user (awnuk)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-silent'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)


