# changelog

author: Terje Rosten <terjeros@gmail.com> - 1.43.5-6
changelog:
  - Add forward and backwards weak deps in -gssp subpackage to gnome-shell
  - Remove wrong req. on -kio
  - Let -kio subpackage Supplement kf6-kio-core


author: Sérgio Basto <sergio@serjux.com> - 5.0-0.7.20231006git8d00acdc
changelog:
  - Remove require of libpng12.so.0, lsb-desktop already require libpng
  - redhat-lsb now provides lsb_release, in future maybe we can remove the rest since LSB 5.0 is out of date
  - more cleanups
  - Report that is not LSB compliance, because various components are missing from Fedora, so compliance is not possible


author: Sérgio Basto <sergio@serjux.com> - 5.0-0.10.20231006git8d00acdc
changelog:
  - The packages are architecture-specific, but do not contain any ELF
    binaries with debuginfo to extract, so we need disable debuginfo.


author: Sérgio Basto <sergio@serjux.com> - 5.0-0.13.20231006git8d00acdc
changelog:
  - Remove sub-pacakges: redhat-lsb-core, redhat-lsb-cxx, redhat-lsb-desktop,
    redhat-lsb-languages and redhat-lsb-printing aren't useful for a long time
  - Switch to a noarch package


author: Sérgio Basto <sergio@serjux.com> - 5.0-0.16.20231006git8d00acdc
changelog:
  - Require util-linux
  - Modification of sumamry and description to express that is not compliant with LSB


author: Charalampos Stratakis <cstratak@redhat.com> - 343-3
changelog:
  - Add -mbranch-protection=standard to extension builder flags
  - mbranch-protection=standard from the standard hardening flags on aarch64,
    enables BTI and PAC. PAC is ABI dependent and we want extensions to be
    compatible.


author: Pavel Raiskup <praiskup@redhat.com> 1.7-1
changelog:
  - resalloc-aws-new: run playbook with stdin=/dev/null
  - resalloc-aws-list: no need to double-kill "shutting-down" instances


author: Pavel Raiskup <praiskup@redhat.com> 2.1-1
changelog:
  - The wait-for-ssh script was moved to resalloc-helpers
  - releng: release to all active Fedora releases


author: Jiri Kyjovsky <j1.kyjovsky@gmail.com> 2.3-1
changelog:
  - Add functionality for tagging resource by its crn (j1.kyjovsky@gmail.com)
  - Add option for specifying resource group (j1.kyjovsky@gmail.com)


author: Pavel Raiskup <praiskup@redhat.com> 3.0-1
changelog:
  - Log the instance create request content
  - Allow specifying a list of Floating IPs
  - Drop executable bits from PYTHONPATH scripts


author: Mikel Olasagasti Uranga <mikel@olasagasti.info> - 0.18.0-1
changelog:
  - Update to 0.18.0 - Closes rhbz#2355627 rhbz#2354447 rhbz#2352331
    rhbz#2350845 rhbz#2348839 rhbz#2331990


author: Graham Leggett <minfrin@sharp.fm> - 1.0.6-1
changelog:
  - Add optional jitter to the delay.
  - Avoid the final delay when running a command a specific number of times.
  - Generate the man page during the dist hook, and not at build time.


author: Michel Lind <salimma@fedoraproject.org> - 0.46.2-2
changelog:
  - Run autoreconf since the Git tag does not contain configure
  - Use %%conf conditionally if RPM has it defined


author: Tom Callaway <spot@fedoraproject.org> - 2.8.0-1
changelog:
  - update to 2.8.0
  - filter out the "alternative-link-missing" and "alternative-generic-name-not-symlink" checks
    these reflect the OpenSUSE packaging guidelines, but NOT the Fedora ones (bz2208474)


author: Attila Lakatos <alakatos@redhat.com> - 8.2412.0-1
changelog:
  - Rebase to 8.2412.0
  - Harden rsyslog service unit
  - Disable openssl engines support
    Resolves: rhbz#2320050


author: Jun Aruga <jaruga@redhat.com> - 3.4.7-26
changelog:
  - Upgrade to Ruby 3.4.7.
  - Fix URI Credential Leakage Bypass previous fixes.
    Resolves: CVE-2025-61594
  - Fix REXML denial of service.
    Resolves: rhbz#2396204
    Resolves: CVE-2025-58767


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 4.3.0-3
changelog:
  - Workaround for new gdk-pixbuf with glycin backend dependency (ref: bug
    2387002)
  - F-43: ignore test failure for now


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 4.3.0-5
changelog:
  - Upstream fix for tests with glycin based gdk-pixbuf2 2.43.x
  - Exclude tests on glycin ppc64le for now (bug 2275913)
  - Exclude animation test on i686 on Fedora 43


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 0.1.0-24
changelog:
  - Use recent gem packaging style
  - Modify License tag
  - Use test-unit for testsuite
  - Upstream PR to suppress warnings for literal string


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 3.0.3-2
changelog:
  - Skip blockdiag integration test, python3-blockdiag now FTI
    because of loooong dependency chain breakage with python3.12


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 1:2.2.4-8
changelog:
  - Backport upstream patch for ruby34 hash formatting change
  - Add dependency for rubygem(base64) explicitly


author: Vít Ondruch <vondruch@redhat.com> - 1:2.2.21-1
changelog:
  - Update to Rack 2.2.21
  - CVE-2024-25126: Denial of Service Vulnerability in Rack Content-Type Parsing
    Resolves: rhbz#2265596
  - CVE-2024-26141: Possible DoS Vulnerability with Range Header in Rack
    Resolves: rhbz#2265597
  - CVE-2024-26146: Possible Denial of Service Vulnerability in Rack Header
    Parsing
    Resolves: rhbz#2265598
  - CVE-2025-61780: Improper handling of headers in `Rack::Sendfile` may allow
    proxy bypass
    Resolves: rhbz#2403530
  - CVE-2025-61919: Unbounded read in `Rack::Request` form parsing can lead to
    memory exhaustion
    Resolves: rhbz#2403525
  - CVE-2025-59830: Rack QueryParser has an unsafe default allowing params_limit
    bypass via semicolon-separated parameters
    Resolves: rhbz#2402988
  - CVE-2025-32441: Rack Session Reuse Vulnerability
    Resolves: rhbz#2365053
  - CVE-2025-46727: Unbounded-Parameter DoS in Rack::QueryParser
    Resolves: rhbz#2365000


author: Bradley G Smith <bradley.g.smith@gmail.com> - 2:1.3.3-1
changelog:
  - Update to release v1.3.3
  - Resolves: rhbz#2411664, rhbz#2411410, rhbz#2411148
  - Resolves: rbhz#2410768, rhbz#2410512, rhbz#2410233
  - Resolves: rhbz#2409818, rhbz#2409561, rhbz#2409284
  - Resolves: rhbz#2408345, rhbz#2408091, rhbz#2407818
  - Security. Fixes CVE-2025-31133, CVE-2025-52565, CVE-2025-52881
  - Upstream new feature


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.5.5-1
changelog:
  - Update to version 0.5.5; fixes RHBZ#2397644
  - Security fix for CVE-2025-59825 / GHSA-3wgq-wrwc-vqmv


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.9.1-3
changelog:
  - Disable tests in EPEL
  - Avoid bringing in large dependency trees via the axum and tower-http dev-
    dependencies


author: Benjamin A. Beasley <code@musicinmybrain.net> - 4.0.1-1
changelog:
  - Update to 4.0.1 (close RHBZ#2272915)
  - Reduce the debuginfo level as a workaround for very slow test
    compilation.


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.2.0-1
changelog:
  - Update to verson 1.2.0; Fixes RHBZ#2393793
  - MSRV is now 1.87, edition is 2024
  - The dev-dependency on criterion is now removed via patch rather than
    tomcli


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.5.0-1
changelog:
  - Initial package (close RHBZ#2328487)
  - Re-generate with rust2rpm 27 for a slightly nicer spec file


author: Michel Lind <salimma@fedoraproject.org> - 2.2.1-1
changelog:
  - Update to 2.2.1; Fixes RHBZ#2277401
  - Temporarily remove tests/ because of unsatisfied color-eyre dependency


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.2.16-2
changelog:
  - Don’t mark files included in the library as documentation
  - This affects four Markdown files. Fixes RHBZ#2415111


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.4.1-1
changelog:
  - Update to 0.4.1 (close RHBZ#2277955)
  - Reduce manual editing of the spec file after running rust2rpm
  - Reduce unnecessary (benchmark-only) build dependencies


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.23.1-1
changelog:
  - Update to 1.23.1 (close RHBZ#2349449)
  - Use rust2rpm.toml to exclude license file for unbundled libdeflate
  - Update .rpmlintrc file


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.24.0-1
changelog:
  - Update to 1.24.0 (close RHBZ#2365609)
  - Now that we can easily re-apply Cargo.toml patches when updating, do not
    use tomcli to remove criterion


author: Fedora Release Engineering <releng@fedoraproject.org> - 0.2.0-4
changelog:
  - Unretirement request: pagure.io/releng/issue/12761 Revert "unused leaf
    package for more than two release cycles"


author: Benjamin A. Beasley <code@musicinmybrain.net> - 2.22.0-2
changelog:
  - Update the rust-image-0.25 patch to match what was merged upstream
  - Fewer image formats are now supported.


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.8.8-1
changelog:
  - Update to version 0.8.8; Fixes RHBZ#2311783
  - Add upstream link for fixing mixture of newline styles
  - Backport commit from upstream to fix s390x issues
  - Where possible, patch out "support for common crates" features


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.8.9-2
changelog:
  - Stop patching out the smallvec-1 feature
  - The uv package needs it, beginning with version 0.5.19.


author: Jose Fernandez <me@jrfernandez.com> - 0.14.0-1
changelog:
  - Update to 0.14.0
  - Update from 0.8.0 to 0.14.0
  - Update features: crossterm/serde/termion → ratatui-crossterm/ratatui-
    termion
  - Default feature changed to ratatui-crossterm


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.7.5-4
changelog:
  - Re-generate using rust2rpm 27
  - Since it is now easier to re-use a Cargo.toml patch, we use one to remove
    the postcard dev-dependency instead of depending on tomcli.


author: Robby Callicotte <rcallicotte@fedoraproject.org> - 3007.4-1
changelog:
  - Update to 3007.4 RHBZ#2366381 - Resolves CVE-2024-38824 RHBZ#2372731 -
    Resolves CVE-2024-38824 RHBZ#2372733 - Resolves CVE-2025-22239
    RHBZ#2372732 - Resolves CVE-2025-22239 RHBZ#2372734 - Resolves
    CVE-2025-22236 RHBZ#2372774 - Resolves CVE-2025-22236 RHBZ#2372776 -
    Resolves CVE-2025-22242 RHBZ#2372741 - Resolves CVE-2025-22242
    RHBZ#2372745 - Resolves CVE-2025-22240 RHBZ#2372746 - Resolves
    CVE-2025-22241 RHBZ#2372748 - Resolves CVE-2025-22240 RHBZ#2372752 -
    Resolves CVE-2025-22241 RHBZ#2372753


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.2-2
changelog:
  - Convert STI tests to TMT (rhbz#2383068)
  - use baserelease as that rpmdev-bumpspec can be used
  - cleanly include <crm/crm.h> for crm_system_name and others


author: Vojtech Polasek <vpolasek@redhat.com> - 0.1.72-1
changelog:
  - Update to latest upstream SCAP-Security-Guide-0.1.72 release:
    https://github.com/ComplianceAsCode/content/releases/tag/v0.1.72


author: Jan Černý <jcerny@redhat.com> - 0.1.73-1
changelog:
  - Update to latest upstream release
    https://github.com/ComplianceAsCode/content/releases/tag/v0.1.73


author: Matthew Burket <mburket@redhat.com> - 0.1.74-1
changelog:
  - Update to latest upstream release:
    https://github.com/ComplianceAsCode/content/releases/tag/v0.1.74
  - Remove /usr/bin/python3 from BuildRequires


author: Matthew Burket <mburket@redhat.com> - 0.1.75-1
changelog:
  - Update to latest upstream release
    https://github.com/ComplianceAsCode/content/releases/tag/v0.1.75


author: Evgenii Kolesnikov <ekolesni@redhat.com> - 0.1.76-1
changelog:
  - Update to latest upstream release:
    https://github.com/ComplianceAsCode/content/releases/tag/v0.1.76


author: Matthew Burket <mburket@redhat.com> - 0.1.77-1
changelog:
  - Update to latest upstream release:
    https://github.com/ComplianceAsCode/content/releases/tag/v0.1.77


author: Matthew Burket <mburket@redhat.com> - 0.1.78-1
changelog:
  - Update to latest upstream release:
    https://github.com/ComplianceAsCode/content/releases/tag/v0.1.78


author: Christian Krause <chkr@fedoraproject.org> - 2.8.1-1
changelog:
  - Update to 2.8.1 (#2254942)
  - Fix FTBFS (#2261685)
  - Adjust filenames
  - Set StartupWMClass in desktop file in order to enable the window manager
    to reference the correct desktop file (e.g. needed for the
    task switcher to show the correct application icon)
  - Add upstreamed patch to fix compile issue with GCC 14
  - Update license tag
  - Add BR: libmikmod-devel, libvpx-devel and sonivox-devel


author: Christian Krause <chkr@fedoraproject.org> - 2.9.0-1
changelog:
  - Update to 2.9.0 (#2330987)
  - Fix FTBFS (#2341334)
  - Remove patch already included upstream
  - Add BR: pipewire-jack-audio-connection-kit (needed for fluidsynth)


author: Daniel Rusek <mail@asciiwolf.com> - 1.2.0-4
changelog:
  - Add AppStream metadata
  - Install desktop icon in standard location
  - Do not use hardcoded paths in desktop file


author: Zdenek Pytela <zpytela@redhat.com> - 42.8-1
changelog:
  - Allow gdm create /etc/.pwd.lock with a file transition
  - Allow gdm bind a socket in the /run/systemd/userdbd directory
  - Allow nsswitch_domain connect to xdm over a unix domain socket
  - Allow systemd homed getattr all tmpfs files (bsc#1240883)
  - Allow systemd (PID 1) create lastlog entries
  - Allow systemd_homework_t transition pid files to lvm_var_run_t (bsc#1240883)
  - Allow gnome-remote-desktop speak with tabrmd over dbus (bsc#1244573)
  - Allow nm-dispatcher iscsi and sendmail plugins get pidfs attributes
  - Allow systemd-oomd watch tmpfs dirs
  - Allow chronyc the setgid and setuid capabilities


author: Zdenek Pytela <zpytela@redhat.com> - 42.9-1
changelog:
  - Fix systemd_manage_unit_symlinks() interface definition
  - Support coreos installation methods
  - Add a new type for systemd-ssh-issue PID files
  - Allow gnome-remote-desktop connect to unreserved ports
  - Allow mdadm the CAP_SYS_PTRACE capability
  - Allow iptables manage its private fifo_files in /tmp
  - Allow auditd manage its private run dirs
  - Revert "Allow virt_domain write to virt_image_t files"
  - Exclude tabrmd.if from interfaces list


author: Zdenek Pytela <zpytela@redhat.com> - 42.11-1
changelog:
  - Allow nfs generator create and use netlink sockets
  - Conditionally allow virt guests to read certificates in user home directories
  - xenstored_t needs CAP_SYS_ADMIN for XENSTORETYPE=domain (bsc#1247875)
  - Allow nfs-generator create and use udp sockets
  - Allow kdump search kdumpctl_tmp_t directories
  - Allow init open and read user tmp files
  - Fix the systemd_logind_stream_connect() interface
  - Allow staff and sysadm execute iotop using sudo
  - Allow sudodomains connect to systemd-logind over a unix socket


author: Zdenek Pytela <zpytela@redhat.com> - 42.12-1
changelog:
  - Adjust guest and xguest users policy for sshd-session
  - Allow valkey-server create and use netlink_rdma_socket
  - Allow blueman get attributes of filesystems with extended attributes
  - Update files_search_base_file_types()
  - Allow geoclue get attributes of the /dev/shm filesystem
  - Allow apcupsd get attributes of the /dev/shm filesystem
  - Allow sshd-session read cockpit pid files


author: Zdenek Pytela <zpytela@redhat.com> - 42.13-1
changelog:
  - Allow sshd-auth read generic proc files
  - Allow sshd-auth read and write user domain ptys
  - Allow logwatch read and write sendmail unix stream sockets
  - Allow logwatch domain transition on rpm execution
  - Allow thumb_t mounton its private tmpfs files
  - Allow thumb_t create permission in the user namespace
  - Allow corenet_unconfined_type name_bind to icmp_socket
  - Allow systemd-networkd to manage systemd_networkd_var_lib_t files
  - Allow sshd-session get attributes of sshd vsock socket


author: Zdenek Pytela <zpytela@redhat.com> - 42.14-1
changelog:
  - Define file equivalency for /var/opt
  - Allow virtnodedev_t the perfmon capability
  - Allow nut_upsdrvctl_t the sys_ptrace capability
  - Label /usr/lib/systemd/user/graphical-session-pre.target with xdm_unit_file_t
  - systemd-sysctl: allow rw on binfm_misc_fs_t to set binfmt_misc status
  - Allow cupsd to manage cupsd_rw_etc_t lnk_files
  - Set temporary no-stub resolv.conf file from NetworkManager as net_conf_t
  - Allow spamc read aliases file
  - Mark configfs_t as mountpoint (bsc#1246080)
  - Allow systemd-machined watch cgroup files


author: Zdenek Pytela <zpytela@redhat.com> - 42.15-1
changelog:
  - Allow insights-client manage /etc symlinks
  - Allow insights-client get attributes of the rpm executable
  - Allow nfsidmapd search virt lib directories
  - Allow iotop stream connect to systemd-userdbd
  - Allow gnome-remote-desktop read sssd public files
  - Allow thumb_t stream connect to systemd-userdbd
  - Allow bluez dbus API passing unix domain sockets
  - Allow bluez dbus api pass sockets over dbus
  - Dontaudit systemd-generator connect to sssd over a unix stream socket
  - Allow init watch/watch_reads systemd-machined user ptys
  - Fix syntax error in userdomain.if
  - Allow ras-mc-ctl get attributes of the kmod executable


author: Zdenek Pytela <zpytela@redhat.com> - 42.16-1
changelog:
  - Allow systemd-ssh-issue read kernel sysctls
  - fix: bz2279215 Allow speech-dispatcher access to user home/cache files
  - Allow create kerberos files in postgresql db home
  - Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern
  - Allow shell comamnds in locate systemd service (bsc#1246559)
  - Introduce initrc_nnp_daemon_domain interface
  - Label /var/lib/cosmic-greeter with xdm_var_lib_t
  - Allow setroubleshoot-fixit get attributes of xattr fs


author: Zdenek Pytela <zpytela@redhat.com> - 42.17-1
changelog:
  - Allow sshd-net read and write to sshd vsock socket
  - Update ktls policy
  - Add comprehensive SELinux policy module for bwrap thumbnail generation
  - Revert "Allow thumb_t create permission in the user namespace"
  - Allow systemd-machined read svirt process state
  - Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)
  - Allow sysadm access to TPM
  - Allow tlp get the attributes of the pidfs filesystem
  - Allow kmscon to read netlink_kobject_uevent_socket


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.3.1-15
changelog:
  - Security fix for CVE-2010-1028
  - Various other fixes collected by Debian and contributed back upstream:
    https://github.com/bramstein/sfnt2woff-zopfli/pull/20


author: Mikhail Medvedev 1.0.2-1
changelog:
  - Added Italian translation by Giovanni Scafora
  - Fix errors in RPM spec file
  - Added changelog file


author: Jeremy Cline <jeremycline@linux.microsoft.com> - 0.4.0-1
changelog:
  - Update to v0.4.0
  - The request_timeout_secs configuration has been replaced by
    total_request_timeout_secs and sigul_request_timeout_secs. The total
    request timeout is the amount of time before an individual request is
    terminated. The sigul request timeout is the amount of time the bridge
    will wait for a Sigul request to succeed before canceling and retrying.


author: Dominik Mierzejewski <dominik@greysector.net> - 0.8.2-1
changelog:
  - Upgrade to SIMDe 0.8.2
    Resolves: rhbz#2251016
  - Use upstream ci.sh
  - Fix build on aarch64 and backport some upstream fixes


author: Dominik Mierzejewski <dominik@greysector.net> - 0.8.2-2
changelog:
  - use upstream PR to fix tests with clang on aarch64
  - switch to noarch for the devel subpackage (tests still run on all arches)


author: Ranjan Maitra <aarem@Fedoraproject.org> - 1.4.0-11
changelog:
  - replaced the linking file with magick to convert the .jxl files now used by Fedora for backgrounds.
  - consequently, brought in BuildRequires for ImageMagick and f42-backgrounds-base
  - incorporated Todd Zullinger's patch to drop /var/run/ in favor of __runstatedir__ and dropped slim-tmpfiles.conf


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.68.2
   - FDE: use boot mode for FDE hooks
   - FDE: add snap-bootstrap compatibility check to prevent image
     creation with incompatible snapd and kernel snap
   - FDE: add argon2 out-of-process KDF support
   - FDE: have separate mutex for the sections writing a fresh modeenv
   - FDE: LP: #2099709 update secboot to e07f4ae48e98
   - Confdb: support pruning ephemeral data and process alternative
     types in order
   - core-initrd: look at env to mount directly to /sysroot
   - core-initrd: prepare for Plucky build and split out 24.10
     (Oracular)
   - Fix missing primed packages in snapd snap manifest
   - Interfaces: posix-mq | fix incorrect clobbering of global variable
     and make interface more precise
   - Interfaces: opengl | add more kernel fusion driver files


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.68.3
   - FDE: LP: #2101834 snapd 2.68+ and snap-bootstrap <2.68 fallback to
     old keyring path
   - Fix Plucky snapd deb build issue related to /var/lib/snapd/void
     permissions
   - Fix snapd deb build complaint about ifneq with extra bracket


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.68.4
   - Snap components: LP: #2104933 workaround for classic 24.04/24.10
     models that incorrectly specify core22 instead of core24
   - Update build dependencies


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.69
   - FDE: re-factor listing of the disks based on run mode model and
     model to correctly resolve paths
   - FDE: run snapd from snap-failure with the correct keyring mode
   - Snap components: allow remodeling back to an old snap revision
     that includes components
   - Snap components: fix remodel to a kernel snap that is already
     installed on the system, but not the current kernel due to a
     previous remodel.
   - Snap components: fix for snapctl inputs that can crash snapd
   - Confdb (experimental): load ephemeral data when reading data via
     snapctl get
   - Confdb (experimental): load ephemeral data when reading data via
     snap get
   - Confdb (experimental): rename {plug}-view-changed hook to observe-
     view-{plug}
   - Confdb (experimental): rename confdb assertion to confdb-schema
   - Confdb (experimental): change operator grouping in confdb-control
     assertion
   - Confdb (experimental): add confdb-control API
   - AppArmor: extend the probed features to include the presence of
     files, as well as directories
   - AppArmor prompting (experimental): simplify the listener
   - AppArmor metadata tagging (disabled): probe parser support for
     tags
   - AppArmor metadata tagging (disabled): implement notification
     protocol v5
   - Confidential VMs: sysroot.mount is now dynamically created by
     snap-bootstrap instead of being a static file in the initramfs
   - Confidential VMs: Add new implementation of snap integrity API
   - Non-suid snap-confine: first phase to replace snap-confine suid
     with capabilities to achieve the required permissions
   - Initial changes for dynamic security profiles updates
   - Provide snap icon fallback for /v2/icons without requiring network
     access at runtime
   - Add eMMC gadget update support
   - Support reexec when using /usr/libexec/snapd on the host (Arch
     Linux, openSUSE)
   - Auto detect snap mount dir location on unknown distributions
   - Modify snap-confine AppArmor template to allow all glibc HWCAPS
     subdirectories to prevent launch errors
   - LP: #2102456 update secboot to bf2f40ea35c4 and modify snap-
     bootstrap to remove usage of go templates to reduce size by 4MB
   - Fix snap-bootstrap to mount kernel snap from
     /sysroot/writable/system-data
   - LP: #2106121 fix snap-bootstrap busy loop
   - Fix encoding of time.Time by using omitzero instead of omitempty
     (on go 1.24+)
   - Fix setting snapd permissions through permctl for openSUSE
   - Fix snap struct json tags typo
   - Fix snap pack configure hook permissions check incorrect file mode
   - Fix gadget snap reinstall to honor existing sizes of partitions
   - Fix to update command line when re-executing a snapd tool
   - Fix 'snap validate' of specific missing newline and add error on
     missed case of 'snap validate --refresh' without another action
   - Workaround for snapd-confine time_t size differences between
     architectures
   - Disallow pack and install of snapd, base and os with specific
     configure hooks
   - Drop udev build dependency that is no longer required and add
     missing systemd-dev dependency
   - Build snap-bootstrap with nomanagers tag to decrease size by 1MB
   - Interfaces: polkit | support custom polkit rules
   - Interfaces: opengl | LP: #2088456 fix GLX on nvidia when xorg is
     confined by AppArmor
   - Interfaces: log-observe | add missing udev rule
   - Interfaces: hostname-control | fix call to hostnamectl in core24
   - Interfaces: network-control | allow removing created network
     namespaces
   - Interfaces: scsi-generic | re-enable base declaration for scsi-
     generic plug
   - Interfaces: u2f | add support for Arculus AuthentiKey


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.70
   - FDE: Fix reseal with v1 hook key format
   - FDE: set role in TPM keys
   - AppArmor prompting (experimental): add handling for expired
     requests or listener in the kernel
   - AppArmor prompting: log the notification protocol version
     negotiated with the kernel
   - AppArmor prompting: implement notification protocol v5 (manually
     disabled for now)
   - AppArmor prompting: register listener ID with the kernel and
     resend notifications after snapd restart (requires protocol v5+)
   - AppArmor prompting: select interface from metadata tags and set
     request interface accordingly (requires protocol v5+)
   - AppArmor prompting: include request PID in prompt
   - AppArmor prompting: move the max prompt ID file to a subdirectory
     of the snap run directory
   - AppArmor prompting: avoid race between closing/reading socket fd
   - Confdb (experimental): make save/load hooks mandatory if affecting
     ephemeral
   - Confdb: clear tx state on failed load
   - Confdb: modify 'snap sign' formats JSON in assertion bodies (e.g.
     confdb-schema)
   - Confdb: add NestedEphemeral to confdb schemas
   - Confdb: add early concurrency checks
   - Simplify building Arch package
   - Enable snapd.apparmor on Fedora
   - Build snapd snap with libselinux
   - Emit snapd.apparmor warning only when using apparmor backend
   - When running snap, on system key mismatch e.g. due to network
     attached HOME, trigger and wait for a security profiles
     regeneration
   - Avoid requiring state lock to get user, warnings, or pending
     restarts when handling API requests
   - Start/stop ssh.socket for core24+ when enabling/disabling the ssh
     service
   - Allow providing a different base when overriding snap
   - Modify snap-bootstrap to mount snapd snap directly to /snap
   - Modify snap-bootstrap to mount /lib/{modules,firmware} from snap
     as fallback
   - Modify core-initrd to use systemctl reboot instead of /sbin/reboot
   - Copy the initramfs 'manifest-initramfs.yaml' to initramfs file
     creation directory so it can be copied to the kernel snap
   - Build the early initrd from installed ucode packages
   - Create drivers tree when remodeling from UC20/22 to UC24
   - Load gpio-aggregator module before the helper-service needs it
   - Run 'systemctl start' for mount units to ensure they are run also
     when unchanged
   - Update godbus version to 'v5 v5.1.0'
   - Add support for POST to /v2/system-info with system-key-mismatch
     indication from the client
   - Add 'snap sign --update-timestamp' flag to update timestamp before
     signing
   - Add vfs support for snap-update-ns to use to simulate and evaluate
     mount sequences
   - Add refresh app awareness debug logging
   - Add snap-bootstrap scan-disk subcommand to be called from udev
   - Add feature to inject proxy store assertions in build image
   - Add OP-TEE bindings, enable by default in ARM and ARM64 builds
   - Fix systemd dependency options target to go under 'unit' section
   - Fix snap-bootstrap reading kernel snap instead of base resulting
     in bad modeenv
   - Fix a regression during seeding when using early-config
   - LP: #2107443 reset SHELL to /bin/bash in non-classic snaps
   - Make Azure kernels reboot upon panic
   - Fix snap-confine to not drop capabilities if the original user is
     already root
   - Fix data race when stopping services
   - Fix task dependency issue by temporarily disable re-refresh on
     prerequisite updates
   - Fix compiling against op-tee on armhf
   - Fix dbx update when not using FDE
   - Fix potential validation set deadlock due to bases waiting on
     snaps
   - LP: #2104066 Only cancel notices requests on stop/shutdown
   - Interfaces: bool-file | fix gpio glob pattern as required for
     '[XXXX]*' format
   - Interfaces: system-packages-doc | allow access to
     /usr/local/share/doc
   - Interfaces: ros-snapd-support interface | added new interface
   - Interfaces: udisks2 | allow chown capability
   - Interfaces: system-observe | allow reading cpu.max
   - Interfaces: serial-port | add ttyMAXX to allowed list
   - Interfaces: modified seccomp template to disallow
     'O_NOTIFICATION_PIPE'
   - Interfaces: fwupd | add support for modem-manager plugin
   - Interfaces: gpio-chardev | make unsupported and remove
     experimental flag to hide this feature until gpio-aggregator is
     available
   - Interfaces: hardware-random | fix udev match rule
   - Interfaces: timeserver-control | extend to allow timedatectl
     timesync commands
   - Interfaces: add symlinks backend
   - Interfaces: system key mismatch handling


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.71
   - FDE: auto-repair when recovery key is used
   - FDE: revoke keys on shim update
   - FDE: revoke old TPM keys when dbx has been updated
   - FDE: do not reseal FDE hook keys every time
   - FDE: store keys in the kernel keyring when installing from initrd
   - FDE: allow disabled DMA on Core
   - FDE: snap-bootstrap: do not check for partition in scan-disk on
     CVM
   - FDE: support secboot preinstall check for 25.10+ hybrid installs
     via the /v2/system/{label} endpoint
   - FDE: support generating recovery key at install time via the
     /v2/systems/{label} endpoint
   - FDE: update passphrase quality check at install time via the
     /v2/systems/{label} endpoint
   - FDE: support replacing recovery key at runtime via the new
     /v2/system-volumes endpoint
   - FDE: support checking recovery keys at runtime via the /v2/system-
     volumes endpoint
   - FDE: support enumerating keyslots at runtime via the /v2/system-
     volumes endpoint
   - FDE: support changing passphrase at runtime via the /v2/system-
     volumes endpoint
   - FDE: support passphrase quality check at runtime via the
     /v2/system-volumes endpoint
   - FDE: update secboot to revision 3e181c8edf0f
   - Confdb: support lists and indexed paths on read and write
   - Confdb: alias references must be wrapped in brackets
   - Confdb: support indexed paths in confdb-schema assertion
   - Confdb: make API errors consistent with options
   - Confdb: fetch confdb-schema assertion on access
   - Confdb: prevent --previous from being used in read-side hooks
   - Components: fix snap command with multiple components
   - Components: set revision of seed components to x1
   - Components: unmount extra kernel-modules components mounts
   - AppArmor Prompting: add lifespan "session" for prompting rules
   - AppArmor Prompting: support restoring prompts after snapd restart
   - AppArmor Prompting: limit the extra information included in probed
     AppArmor features and system key
   - Notices: refactor notice state internals
   - SELinux: look for restorecon/matchpathcon at all known locations
     rather than current PATH
   - SELinux: update policy to allow watching cgroups (for RAA), and
     talking to user session agents (service mgmt/refresh)
   - Refresh App Awareness: Fix unexpected inotify file descriptor
     cleanup
   - snap-confine: workaround for glibc fchmodat() fallback and handle
     ENOSYS
   - snap-confine: add support for host policy for limiting users able
     to run snaps
   - LP: #2114923 Reject system key mismatch advise when not yet seeded
   - Use separate lanes for essential and non-essential snaps during
     seeding and allow non-essential installs to retry
   - Fix bug preventing remodel from core18 to core18 when snapd snap
     is unchanged
   - LP: #2112551 Make removal of last active revision of a snap equal
     to snap remove
   - LP: #2114779 Allow non-gpt in fallback mode to support RPi
   - Switch from using systemd LogNamespace to manually controlled
     journal quotas
   - Change snap command trace logging to only log the command names
   - Grant desktop-launch access to /v2/snaps
   - Update code for creating the snap journal stream
   - Switch from using core to snapd snap for snap debug connectivity
   - LP: #2112544 Fix offline remodel case where we switched to a
     channel without an actual refresh
   - LP: #2112332 Exclude snap/snapd/preseeding when generating preseed
     tarball
   - LP: #1952500 Fix snap command progress reporting
   - LP: #1849346 Interfaces: kerberos-tickets |  add new interface
   - Interfaces: u2f | add support for Thetis Pro
   - Interfaces: u2f | add OneSpan device and fix older device
   - Interfaces: pipewire, audio-playback | support pipewire as system
     daemon
   - Interfaces: gpg-keys | allow access to GPG agent sockets
   - Interfaces: usb-gadget | add new interface
   - Interfaces: snap-fde-control, firmware-updater-support | add new
     interfaces to support FDE
   - Interfaces: timezone-control | extend to support timedatectl
     varlink
   - Interfaces: cpu-control | fix rules for accessing IRQ sysfs and
     procfs directories
   - Interfaces: microstack-support | allow SR-IOV attachments
   - Interfaces: modify AppArmor template to allow snaps to read their
     own systemd credentials
   - Interfaces: posix-mq | allow stat on /dev/mqueue
   - LP: #2098780 Interfaces: log-observe | add capability
     dac_read_search
   - Interfaces: block-devices | allow access to ZFS pools and datasets
   - LP: #2033883 Interfaces: block-devices | opt-in access to
     individual partitions
   - Interfaces: accel | add new interface to support accel kernel
     subsystem
   - Interfaces: shutdown | allow client to bind on its side of dbus
     socket
   - Interfaces: modify seccomp template to allow pwritev2
   - Interfaces: modify AppArmor template to allow reading
     /proc/sys/fs/nr_open
   - Packaging: drop snap.failure service for openSUSE
   - Packaging: add SELinux support for openSUSE
   - Packaging: disable optee when using nooptee build tag
   - Packaging: add support for static PIE builds in snapd.mk, drop
     pie.patch from openSUSE
   - Packaging: add libcap2-bin runtime dependency for ubuntu-16.04
   - Packaging: use snapd.mk for packaging on Fedora
   - Packaging: exclude .git directory
   - Packaging: fix DPKG_PARSECHANGELOG assignment
   - Packaging: fix building on Fedora with dpkg installed


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.72
   - FDE: support replacing TPM protected keys at runtime via the
     /v2/system-volumes endpoint
   - FDE: support secboot preinstall check fix actions for 25.10+
     hybrid installs via the /v2/system/{label} endpoint
   - FDE: tweak polkit message to remove jargon
   - FDE: ensure proper sealing with kernel command line defaults
   - FDE: provide generic reseal function
   - FDE: support using OPTEE for protecting keys, as an alternative to
     existing fde-setup hooks (Ubuntu Core only)
   - Confdb: 'snapctl get --view' supports passing default values
   - Confdb: content sub-rules in confdb-schemas inherit their parent
     rule's "access"
   - Confdb: make confdb error kinds used in API more generic
   - Confdb: fully support lists and indexed paths (including unset)
   - Prompting: add notice backend for prompting types (unused for now)
   - Prompting: include request cgroup in prompt
   - Prompting: handle unsupported xattrs
   - Prompting: add permission mapping for the camera interface
   - Notices: read notices from state without state lock
   - Notices: add methods to get notice fields and create, reoccur, and
     deepcopy notice
   - Notices: add notice manager to coordinate separate notice backends
   - Notices: support draining notices from state when notice backend
     registered as producer of a particular notice type
   - Notices: query notice manager from daemon instead of querying
     state for notices directly
   - Packaging: Ubuntu | ignore .git directory
   - Packaging: FIPS | bump deb Go FIPS to 1.23
   - Packaging: snap | bump FIPS toolchain to 1.23
   - Packaging: debian | sync most upstream changes
   - Packaging: debian-sid | depends on libcap2-bin for postint
   - Packaging: Fedora | drop fakeroot
   - Packaging: snap | modify snapd.mk to pass build tags when running
     unit tests
   - Packaging: snap | modify snapd.mk to pass nooptee build tag
   - Packaging: modify Makefile.am to fix snap-confine install profile
     with 'make hack'
   - Packaging: modify Makefile.am to fix out-of-tree use of 'make
     hack'
   - LP: #2122054 Snap installation: skip snap icon download when
     running in a cloud or using a proxy store
   - Snap installation: add timeout to http client when downloading
     snap icon
   - Snap installation: use http(s) proxy for icon downloads
   - LP: #2117558 snap-confine: fix error message with /root/snap not
     accessible
   - snap-confine: fix non-suid limitation by switching to root:root to
     operate v1 freezer
   - core-initrd: do not use writable-paths when not available
   - core-initrd: remove debian folder
   - LP: #1916244 Interfaces: gpio-chardev | re-enable the gpio-chardev
     interface now with the more robust gpio-aggregator configfs kernel
     interface
   - Interfaces: gpio-chardev | exclusive snap connections, raise a
     conflict when both gpio-chardev and gpio are connected
   - Interfaces: gpio-chardev | fix gpio-aggregator module load order
   - Interfaces: ros-snapd-support | grant access to /v2/changes
   - Interfaces: uda-driver-libs, egl-driver-libs, gbm-driver-libs,
     opengl-driver-libs, opengles-driver-libs | new interfaces to
     support nvidia driver components
   - Interfaces: microstack-support | allow DPDK (hugepage related
     permissions)
   - Interfaces: system-observe | allow reading additional files in
     /proc, needed by node-exporter
   - Interfaces: u2f | add Cano Key, Thesis FIDO2 BioFP+ Security Key
     and Kensington VeriMark DT Fingerprint Key to device list
   - Interfaces: snap-interfaces-requests-control | allow shell API
     control
   - Interfaces: fwupd | allow access to Intel CVS sysfs
   - Interfaces: hardware-observe | allow read access to Kernel
     Samepage Merging (KSM)
   - Interfaces: xilinx-dma | support Multi Queue DMA (QDMA) IP
   - Interfaces: spi | relax sysfs permission rules to allow access to
     SPI device node attributes
   - Interfaces: content | introduce compatibility label
   - LP: #2121238 Interfaces: do not expose Kerberos tickets for
     classic snaps
   - Interfaces: ssh-public-keys | allow ro access to public host keys
     with ssh-key
   - Interfaces: Modify AppArmor template to allow listing systemd
     credentials and invoking systemd-creds
   - Interfaces: modify AppArmor template with workarounds for Go 1.35
     cgroup aware GOMAXPROCS
   - Interfaces: modify seccomp template to allow landlock_*
   - Prevent snap hooks from running while relevant snaps are unlinked
   - Make refreshes wait before unlinking snaps if running hooks can be
     affected
   - Fix systemd unit generation by moving "WantedBy=" from section
     "unit" to "install"
   - Add opt-in logging support for snap-update-ns
   - Unhide 'snap help' sign and export-key under Development category
   - LP: #2117121 Cleanly support socket activation for classic snap
   - Add architecture to 'snap version' output
   - Add 'snap debug api' option to disable authentication through
     auth.json
   - Show grade in notes for 'snap info --verbose'
   - Fix preseeding failure due to scan-disk issue on RPi
   - Support 'snap debug api' queries to user session agents
   - LP: #2112626 Improve progress reporting for snap install/refresh
   - Drop legacy BAMF_DESKTOP_FILE_HINT in desktop files
   - Fix /v2/apps error for root user when user services are present
   - LP: #2114704 Extend output to indicate when snap data snapshot was
     created during remove
   - Improve how we handle emmc volumes
   - Improve handling of system-user extra assertions


author: Martin Osvald <mosvald@redhat.com> - 1.8.0.3-1
changelog:
  - Update to 1.8.0.3 (rhbz#2307725)
  - Resolves: CVE-2024-54661 (rhbz#2330520)
  - Resolves: non-working ipv6-join-group option (rhbz#2352860)
  - Resolves: FTBFS in Fedora (rhbz#2385633)


author: Dominik 'Rathann' Mierzejewski <dominik@greysector.net> - 1.1.16-1
changelog:
  - update to 1.1.16 (resolves rhbz#2405379)
  - drop obsolete patches
  - apply upstream patch to fix appstream data


author: Luboš Uhliarik <luhliari@redhat.com> - 7:6.12-2
changelog:
  - Disable ESI support since ESI support has been also removed from squid 7
  - Resolves: CVE-2024-45802 squid: Denial of Service processing ESI
    response content


author: Stephen Gallagher <sgallagh@redhat.com> - 3.0.8-1
changelog:
  - Update to SSCG 3.0.8
  - Fix IP address handling in CA certificate SAN constraints * Add automatic
    single-IP subnet mask to IP addresses in CA name constraints * Update
    help text to show simplified IP format without subnet mask
  - Greatly expand the in-tree test suite


author: Stephen Gallagher <sgallagh@redhat.com> - 4.0.0-1
changelog:
  - Release SSCG 4.0.0
  - Support for ML-DSA keys for post-quantum cryptography (PQC) when built
    against OpenSSL 3.5 or later
  - Support for EC-DSA keys for elliptic curves
  - RSA certificate authority is now created with a minimum key strength of
    4096 bits
  - Improved --help output
  - Deprecated support for generating custom DH parameters
  - Stopped producing the DH parameter file by default (it may be requested
    explicitly with the --dhparams-file argument)
  - Minimum OpenSSL version is now 3.0


author: Sandipan Roy <saroy@redhat.com> - 2.2.0-1
changelog:
  - Update to sslscan 2.2.0
  - Bump bundled OpenSSL to 3.5.0 (minimum supported upstream)
  - Fixes rhbz#2330567


author: Sandipan Roy <sandipan@redhat.com> - 2.2.0-3
changelog:
  - Update sslscan-disable-opensslpull.patch for sslscan 2.2.0
  - Updated patch to work with new Makefile structure in sslscan 2.2.0
  - Fixes build failure where patch was failing to apply
  - Maintains same functionality: removes opensslpull dependency from
    .openssl.is.fresh target


author: Sandipan Roy <sandipan@redhat.com> - 2.2.0-4
changelog:
  - Fix missing TODO file in spec file for sslscan 2.2.0
  - Remove TODO file reference that doesn't exist in sslscan 2.2.0
  - Add INSTALL file to documentation list
  - Fixes RPM build error: File not found TODO


author: Clark Williams <williams@redhat.com> - 1.21.1-1
changelog:
  - Makefile:  update version to 1.20.1
  - scripts:  add a script for running a local build for debuggin
  - stalld: Automatically switch to log-only mode if DL-server present
  - bpf/stalld: Implement and use find_queued_task helper in dequeue_task
  - bpf/stalld: Introduce and use for_each_task_entry/for_each_queued_task macros
  - build/debug: Control optimization and debug levels via DEBUG variable
  - stalld: sched_attr: Do not define for glibc >= 2.41
  - stalld: Refactor verbose logging with dedicated macros
  - stalld/queue_track: Consolidate print_queued_tasks verbosity control
  - gitignore: Add common build and tag files
  - build/debug: Allow DEBUG_STALLD to be controlled by 'DEBUG' Makefile variable
  - build/bpf/stalld: Pave way for DEBUG_STALLD command-line override
  - bpf/stalld: Introduce generic 'log' macro for BPF debug prints
  - bpf/stalld: Unify and generalize debug macro to DEBUG_STALLD


author: Clark Williams <williams@redhat.com> - 1.21.2-1
changelog:
  - Makefile: bump version to v1.20.1
  - bpf: Improve task tracking in sched_switch
  - bpf/stalld: Introduce compute_ctxswc helper and update ctxswc on sched_switch


author: Clark Williams <williams@redhat.com> - 1.21.1-1
changelog:
  - refactor: Remove unused 'exiting' variable
  - bpf: Introduce task_is_rt() helper
  - bpf: Correctly update nr_rt_running on sched_switch
  - Simplify __die() function to use abort()
  - Refactor: Use path length macros in check_dl_server_dir_exists
  - Refactor: Remove duplicated find_debugfs function
  - utils: Remove unused find_mount() function
  - bpf: Reorder functions to prepare for future changes
  - bpf: Pass stalld_cpu_data pointer to queuing functions
  - bpf: Make update_or_add_task() return void
  - bpf: Reuse enqueue_task() in update_or_add_task()
  - bpf: Use tracepoints to avoid fentry startup stall
  - bpf: Centralize monitoring check in get_cpu_data()
  - bpf: Remove unused 'task' variable
  - bpf: Use task_cpu() to get the correct CPU data
  - bpf: Handle wakeup of new tasks with sched_wakeup_new
  - daemon: Refactor cleanup logic into a helper function
  - daemon: Clean up stale tasks during the boost phase
  - bpf: Document and enhance dequeue_task return value
  - bpf: Handle task migrations with sched_migrate_task
  - bpf: a task is dequeued just by setting its pid to 0
  - bpf: Improve logging in stalld.bpf.c
  - bpf: Use BPF CO-RE for task CPU field access
  - bpf: Add const qualifier to task_struct pointers
  - bpf: Add task iterator for initial state snapshot
  - bpf: Simplify task queue management by removing redundant rt parameter
  - bpf: Add cpu to log_task_prefix
  - stalld: Refactor tgid_field handling to use sizeof
  - refactor: Move helper functions to utils.c
  - stalld: Simplify get_cpu_idle_time() function using sscanf
  - refactor: Simplify update_cpu_starving_vector()
  - refactor: Remove unused headers from stalld.c
  - stalld: Extract repeated buffer reallocation pattern
  - stalld: Flatten nested conditionals using early returns
  - refactor: Extract common idle detection pattern into helper function
  - refactor: Standardize memory allocation with calloc-compatible helper
  - bpf: Use CO-RE to check for running tasks
  - systemd:  change systemd service startup to use RuntimeDirectory
  - Makefile: version bump to v1.21.1


author: Clark Williams <williams@redhat.com> - 1.22.1-1
changelog:
  - bpf: Reduce arguments to log() to fix verifier error
  - stalld: Always reset starving vector in merge_taks_info
  - stalld: Remove forced log-only mode with DL-server
  - Makefile: version bump to v1.22.1


author: Clark Williams <williams@redhat.com> - 1.24.1-1
changelog:
  - sched_debug: Unify parsing methods for task_info
  - sched_debug: Fix runqueue task parsing logic and state filtering
  - sched_debug: Fix double-free crash in fill_waiting_task()
  - stalld.c: remove noisy idle report and added report to should_skip_idle_cpus()
  - stalld.c: initialize cpu_info->idle_time to be -1
  - stalld.c: get rid of misleading print about DL-Server
  - stalld.c: Add starvation logging in single-threaded log-only mode
  - stalld: Add -N/--no_idle_detect flag to disable idle detection
  - stalld: Add defensive checks in print_boosted_info
  - Makefile: Add support for legacy kernels
  - scripts: fix run-local if bashism
  - sched_debug: Fix segfault in adaptive/aggressive modes
  - Makefile: Remove redhat-specific checks
  - Makefile: Add a help target
  - Makefile: Check compatible compiler versions
  - stalld.c: Ensure queue_track backend is not referenced when USE_BPF=0
  - Makefile: version bump to v1.24.1


author: Clark Williams <williams@redhat.com> - 1.25.1-1
changelog:
  - docs: add CLAUDE.md, .claude agents, and update .gitignore
  - tests: Add comprehensive test suite with infrastructure and functional tests
  - tests: Add Phase 2 command-line option tests (8 new tests)
  - docs: Add project rules and agent usage guidelines
  - docs: Update context snapshot with Phase 2 completion
  - tests: Add Phase 3.1 core logic tests (starvation detection and parsing)
  - tests: Add Phase 3.2 boosting mechanism tests (DEADLINE, FIFO, restoration)
  - tests: Add Phase 3.3 task merging and idle detection tests - Phase 3 COMPLETE
  - tests: Add RT throttling save/restore helpers
  - tests: Automatically save and restore RT throttling state
  - tests: Fix test_task_merging empty variable errors and add DL-server check
  - tests: Add DL-server save/disable/restore support
  - docs: Update TODO.md with DL-server management and recent improvements
  - docs: Update context snapshot with Phase 3 completion and state management
  - tests: Add legacy test integration and backend selection support
  - test01: add ability to specify backend
  - tests: remove binary accidentally committed
  - tests: Fix cleanup EXIT trap to preserve test exit codes
  - tests: Fix test_log_only.sh timing and starvation reliability
  - tests: Add backend selection support to individual tests
  - saved claude context snapshot and moved CLAUDE.md to .claude dir
  - .claude: Add context-snapshot.json and update CLAUDE.md
  - tests: Fix starvation_gen to create actual RT starvation
  - tests: Fix test_starvation_detection.sh to respect backend selection
  - tests: Fix test_starvation_detection.sh timing and idle detection issues
  - tests: Fix EPERM errors in cleanup by improving process termination handling
  - docs: Update CLAUDE.md with backend selection and debugfs/procfs clarification
  - tests: Fix infinite hang in test_starvation_detection.sh Test 5
  - tests: Rewrite test_cpu_selection.sh to use modern test framework
  - tests: Rewrite test_boost_period.sh to fix hanging issues
  - tests: Fix PID tracking and backgrounding issues in test suite
  - tests: Rewrite test_starvation_threshold.sh to fix undefined variables
  - tests: Fix test_starvation_threshold.sh log file collision issue
  - tests: Update TODO.md with 2025-10-09 progress and old-style test issues
  - tests: Update context snapshot for 2025-10-09 test framework hardening session
  - tests: Rewrite all remaining old-style Phase 2 tests using modern framework
  - tests: Fix EPERM errors in test cleanup by replacing wait with polling
  - tests: Fix Phase 1 test issues (affinity, backend_selection, fifo_boosting)
  - tests: Add -N flag to disable idle detection in starvation/FIFO tests
  - tests: Fix argument ordering in backend selection tests
  - tests: Fix hanging issues in test_boost_duration.sh
  - tests: Fix test_boost_runtime.sh hanging and improve reliability
  - save LLM context
  - add helpers for git-scm-master AI agent
  - tests: Fix output redirection issues in test_affinity.sh
  - test: Fix test_pidfile.sh output handling and CLI options
  - tests: Fix test_boost_period.sh helper integration and reliability
  - test: Fix test_boost_restoration.sh for stability and standard infrastructure
  - docs: Document mass test suite fixes session with 7 tests and 4 critical discoveries
  - tests: Fix grep pattern in test_starvation_threshold.sh for actual log format
  - docs: Update context snapshot for queue_track backend test fixes
  - tests: Implement matrix testing for backends and threading modes
  - docs: Update CLAUDE.md with correct threading mode flags and matrix testing
  - context: Document matrix testing infrastructure implementation
  - tests: Add timeout protection to test01_wrapper.sh
  - Document queue_track backend limitation in test_starvation_threshold.sh
  - docs: Update documentation with segfault fix and queue_track limitation
  - tests: Add FIFO-on-FIFO priority starvation test
  - tests: Enhance starvation_gen and fix test infrastructure
  - .claude: Update context snapshot
  - .claude: Update context snapshot - BPF RT task tracking fix completed
  - tests: Change starvation_gen default work_target to 1
  - .claude: Update context snapshot - 14/16 tests passing with queue_track
  - tests: Improve starvation_gen thread coordination and shutdown
  - .claude: Update context snapshot - starvation_gen improvements and test progress
  - tests: Add --test option to run individual tests by name
  - .claude: Update context snapshot - test infrastructure improvements complete
  - tests: Fix test_boost_restoration to properly test SCHED_FIFO restoration
  - tests: Add SCHED_OTHER option to starvation_gen
  - tests: Update test_boost_restoration Test 3 to use SCHED_OTHER
  - context snapshot
  - tests: Add kworker denylist to test_boost_restoration
  - tests: Fix Test 5 timing and parameter validation
  - tests: Add journal logging for test activity correlation
  - context snapshot
  - tests: Increase test01 timeout and document kworker competition
  - context snapshot
  - tests: Add unified test environment management framework
  - context snapshot
  - tests: Fix timing race conditions in starvation detection tests
  - docs: Update TODO.md with test suite timing race condition fixes
  - docs: Add context snapshot for test suite timing race fixes
  - tests: Fix timing race conditions in starvation detection tests
  - tests: Fix timing race conditions in test_deadline_boosting
  - tests: Fix timing race conditions in 4 remaining functional tests
  - tests: Fix output buffering and kernel worker interference
  - tests: Fix output buffering in test_starvation_detection Test 3
  - docs: Context snapshot for Nov 3 evening session - timing fixes and buffering issues
  - tests: Fix test_starvation_detection Test 3 flawed counting logic
  - tests: Consolidate duplicate helper functions (Part 1 complete)
  - context snapshot
  - bpf: Add BPF CO-RE compatibility for older kernels
  - Makefile: Make BPF compilation verbose
  - Makefile: Append -std=c99 to CFLAGS
  - doc: update Releases.md for repository instructions
  - tests: Fix start_stalld() PID detection for daemon and slow architectures
  - doc: Release notes for v1.25.1 release
  - Makefile: version bump to v1.25.1


author: Benjamin A. Beasley <code@musicinmybrain.net> - 17.1-1
changelog:
  - Update to 17.1 (close RHBZ#2356072)
  - The ppc64le version of Stockfish now uses VSX extensions (POWER8)


author: Jerry James <loganjerry@gmail.com> - 3.2.1-38
changelog:
  - Add patch to fix ambiguous references to StringTemplate
  - Add patch to avoid using deprecated "new Integer" and "new Boolean"
  - Change license to BSD-3-Clause


author: Radovan Sroka <rsroka@redhat.com> - 1.9.15-1.p5
changelog:
  - Rabase to 1.9.15p5
  - sudo-1_9_15p5 is available Resolves: rhbz#2248505
  - TRIAGE CVE-2023-42465 sudo: Targeted Corruption of Register and Stack
    Variables Resolves: rhbz#2255569


author: Björn Esser <besser82@fedoraproject.org> - 1.9.17-1.p1
changelog:
  - Rebase to sudo 1.9.17p1
  - sudo-1_9_16p2 is available Resolves: rhbz#2309626
  - sudo: LPE via host option Resolves: CVE-2025-32462
  - Properly apply system buildflags
  - Use new build macros, drop unneeded %%defattr


author: Attila Kovacs <attipaci@gmail.com> - 1.5.0-1
changelog:
  - Upstream v1.5.0, and streamlined package structure - Switched to CMake
    for the build - devel sub-package now includes CMake / pkgconfig
    configurations - No longer includes cio-data subpackage (no longer needed
    or used) - No longer includes legacy solsys1 / solsys2 ubpackages


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 257.6-1
changelog:
  - Version 257.6
  - Fix for local information disclosure in systemd-coredump (CVE-2025-4598)
  - Fixes for systemd itself, run0, systemd-networkd, "secure" pager, man
    pages, shell completions, sd-boot, sd-varlink
  - Hardware database update


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 257.7-1
changelog:
  - Version 257.7
  - Fixes for systemd itself, systemd-repart, systemd-resolved, systemd-
    vmspawn, systemd-networkd, resolvectl, bootctl, the shared library code,
    man pages, shell completions, and tests.
  - Hardware database is updated.


author: Frank Ch. Eigler <fche@redhat.com> - 5.2-1
changelog:
  - Upstream release, see wiki page below for detailed notes.
    https://sourceware.org/systemtap/wiki/SystemTapReleases


author: Bojan Smojver <bojan@rexursive com> - 4.5.1-5
changelog:
  - Drop unknown configure option --enable-tcpreplay-edit
  - Change tcpdump dependency to package
  - Remove checks for TX_RING support to avoid build problems


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.11.0-86
changelog:
  - Update License expression
  - LicenseRef-Fedora-Temporary-Simple-Library-exception was assigned SPDX
    identifier Simple-Library-Usage-exception


author: Dominik Mierzejewski <dominik@greysector.net> - 140.3.0-2
changelog:
  - Drop unused yasm from build dependencies
    See: https://fedoraproject.org/wiki/Changes/DeprecateYASM
    Resolves: rhbz#2390538


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-2
changelog:
  - Rebuild (xorg-x11-server)
    Fixes CVE-2025-26594, CVE-2025-26595, CVE-2025-26596, CVE-2025-26597,
          CVE-2025-26598, CVE-2025-26599, CVE-2025-26600, CVE-2025-26601


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-6
changelog:
  - Rebuild (xorg-x11-server)
    Fixes: CVE-2025-49175 / CVE-2025-49176 / CVE-2025-49177
           CVE-2025-49178 / CVE-2025-49179 / CVE-2025-49180


author: Didier Fabert <didier.fabert@gmail.com> - 0.1-35.20171025gitab9bbbd
changelog:
  - Stop using deprecated py3_build/py3_install macros https://bugzilla.redhat.com/show_bug.cgi?id=2378474
  - migrated to last commit


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.8.13-1
changelog:
  - update to latest upstream release https://forum.torproject.org/t/new-tor-stable-release-0-4-8-13/15397 (bz#2211726)
  - reviewed and adjusted SPDX license format


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.8.14-1
changelog:
  - update to latest upstream release https://forum.torproject.org/t/stable-release-0-4-8-14/17242 (bz#2211726)


author: Akira TAGOH <tagoh@redhat.com> - 1.9.0-1
changelog:
  - New upstream release.
    Resolves: rhbz#2347165
  - Disable OpenSSL support.
    OpenSSL plugin isn't packaged. should be no harm.


author: Packit <hello@packit.dev> - 0.18.4-1
changelog:
  - Add ioctls for Chromium OS EC devices (thanks Abhinav Baid)
  - Generate "remove" uevent in umockdev_testbed_remove_device() (thanks Bob Henz)
  - Recursively remove children with uevents (thanks Bob Henz)
  - preload: Fix sigmask block and restore race (thanks barath)


author: Packit <hello@packit.dev> - 0.19.0-1
changelog:
  - API: Add UMockdev.Testbed.wait_script() to sync to scripts/evemu replays
  - API: UMockdev.Testbed.load_script_from_string()
  - API: UMockdev.Testbed.load_evemu_events_from_string()
  - Make uevent synthesis thread-safe (thanks Bob Henz)
  - Handle "connection refused" when sending a uevent (thanks Bob Henz)


author: Packit <hello@packit.dev> - 0.19.1-1
changelog:
  - preload: Restore errno in ioctl_emulate_open()
  - preload: Only emulate ioctls on emulated devices
  - Fix ioctl_tree_execute() ret type and initialization (thanks Helge Deller)
  - tests: Disable spidev on big-endian 32-bit platforms (thanks Helge Deller)


author: Packit <hello@packit.dev> - 0.19.4-1
changelog:
  - preload: Hide sticky bit from emulated block dev stat
  - preload: Wrap listxattr()
  - uevent-sender: Retry udev_device_new_from_syspath() on failure
  - uevent_sender: Retry sendmsg() on EAGAIN
  - tests: Adjust for evtest 1.36


author: Jens Petersen <petersen@redhat.com> - 17.0.0-1
changelog:
  - https://www.unicode.org/versions/Unicode17.0.0/
  - https://blog.unicode.org/2025/09/unicode-170-release-announcement.html


author: Enric Balletbo i Serra <eballetbo@redhat.com> - 0.1~git.20250530.3ccaa1a-1
changelog:
  - Check for g_malloc failure in unpack_efi_zboot_image
  - EFI zboot payload offset and size validation
  - Correct and simplify output file writing logic in main
  - Direct gunzip error messages to stderr
  - Improve ZSTD decompression error handling and reporting
  - Suppress unused parameter warnings in zalloc/zfree
  - Initialize z_stream in gunzip to prevent uninitialized use
  - Prevent memory leak in gunzip on inflateInit2 failure
  - Allow output to stdout to provide greater flexibility
  - Refactor output file writing in unzboot
  - Add SPDX license identifier and simplify license header
  - Add EFI application with zstd compression example
  - Append to the name the type of compression


author: Mark Wielaard <mjw@fedoraproject.org> - 3.25.1-3
changelog:
  - Add VALGRIND_3_25_BRANCH patches
    - 0001-Prepare-NEWS-for-branch-3.25.x-fixes.patch
    - 0002-Bug-503241-s390x-Support-z17-changes-to-the-NNPA-ins.patch


author: Mark Wielaard <mjw@fedoraproject.org> - 3.26.0-0.1.RC1
changelog:
  - Upstream 3.26.0-RC1
  - Remove all VALGRIND_3_25_BRANCH and proposed upstream patches
  - Refresh some-stack-protector and some-Wl-z-now patches.
  - Add vgstack to valgrind-gdb.
  - Update License to GPL-3.0-or-later


author: Remi Collet <remi@fedoraproject.org> - 8.0.6-1
changelog:
  - update to 8.0.6
    fixes CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 and CVE-2025-46819
  - update documentation to 8.0.5


author: Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.4.2-1
changelog:
  - New upstream release. A security release
  - Includes fix for CVE-2023-44487 aka VSV00013, rhbz#2243328, HTTP/2 Rapid Reset Attack


author: Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.5.0-1
changelog:
  - New upstream release
  - Moved somethings around to make the diff from the upstream spec less
  - Upped some memory requirements in some of the tests. Necessary on aarch64 and ppc64le (and ppc32)
  - Reduced number of parallel jobs on s390x builders as builds tend to fail when stressed
  - Retired armv7hl


author: Martin Gansser <martinkg@fedoraproject.org> - 2.7.3-1
changelog:
  - Update to 2.7.3
  - Use recent dvbhddevice Source file 3473a7b939d7.zip
  - Add %{name}-2.7.3-remux-radio.patch


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.1706-2
changelog:
  - broken /usr/bin/ex symlink in vim-9.1.1706-1.fc42 (fedora#2392249)
  - vim-common has broken manpages (fedora#2392178)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 3.3.5-1
changelog:
  - Update to version 3.3.5
  - Do not run tests
    - some scripts needed for generating the test certificates are missing


author: Christian Krause <chkr@fedoraproject.org> - 0.5.3^20241114.git11e15a1-2
changelog:
  - Fix issues with /usr/bin/ and /usr/sbin/ merge (#2363531)
  - Always use consolehelper, implicitly allowed for root,
    remove consoleuser sub-package
  - Remove pam_console.so from vpnc.pam (not available anymore)


author: Stephen Smoogen <smooge@fedoraproject.org> - 3.5.4-1
changelog:
  - Moved from 3.3.x to 3.5.x
  - License has changed from MPLv2 AND Boost to MPLv2
  - No longer need to carry the big-endian patch
  - Needed to fix some entries which did not include cstdint


author: Alessandro Astone <alessandro.astone@canonical.com> - 1.4.3-1
changelog:
  - new version (rhbz#2303618)
  - fix python 3.12 error (rhbz#2258411)
  - make it clearer that OTA channels must be provided to `waydroid init`


author: Germano Massullo <germano.massullo@gmail.com> - 2.6.0-1
changelog:
  - 2.6.0 release
  - Removed %define debug_package %{nil}
  - Added -DCMAKE_INSTALL_SYSCONFDIR=%{_sysconfdir}
  - Modified %files section


author: Michal Ruprich <mruprich@redhat.com> - 1.25.0-1
changelog:
  - Update to 1.25.0
  - Rename package from wget to wget1
  - Add wget1-wget subpackage to allow usage as wget


author: Romain Geissler <romain.geissler@amadeus.com> - 2.1.0-10
changelog:
  - Disable explicit OCSP requests by default for privacy reasons.
  - Accept --progress=dot:... for backwards compatibility.


author: Michal Ruprich <mruprich@redhat.com> - 2.2.0-1
changelog:
  - New version 2.2.0
  - Resolves: rhbz#2298879 - Using options -nc and -O simultaneously causes existing files to be clobbered/truncated
  - Resolves: rhbz#2327788 - wget starts using non-working IPv6 addresses on dual stack
  - Resolves: rhbz#2327728 - Crash: "free(): double free detected in tcache 2" when using --load-cookies
  - Resolves: rhbz#2280151 - wget2 always re-downdloads when using custom output filename


author: Sudip Shil <sshil@redhat.com> - 1.0.7-1
changelog:
  - feature added: fontname option, sans-serif would be default
  - feature added: add option to print utf8 hex sequence


author: Sudip Shil <sshil@redhat.com> - 1.0.8-1
changelog:
  - Handling non-printable charcaters
  - Print nicer names for all non-printable characters
  - code rendering


author: Sudip Shil <sshil@redhat.com> - 2.1.0-0
changelog:
  - Added --language (-l) CLI option to detect the default font for a given language code, which detects and prints the default font family that supports the specified language.
  - Introduced valid_langs[] array containing known language codes supported by fontconfig, Rejects invalid language codes early with a clear error message.
  - Checks not only if a font is returned, but whether it actually supports the given language.
  - Updated --help output to include usage for --language option.
  - updated readme with installation, build section.


author: Sudip Shil <sshil@redhat.com> - 2.2.0-1
changelog:
  - Modified input_char to handle multiple words as a single input string, allowing space-separated characters.
  - :: as the delimiter for Fontconfig parameters.
  - help section in better format
  - Modified tests.sh to include new test cases for space-separated inputs and :: parameter handling.


author: Sudip Shil <sshil@redhat.com> - 2.3.0-1
changelog:
  - Improve input handling for -f option and Update test cases in to cover new scenarios and edge cases.
  - now tests.sh can capture segmentation fault and save in test_error txt file
  - Created github workflow action tests.yml in github - if test fails then it is usefull for CI and automation.


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.7.0-9
changelog:
  - Update architectures for asan/tsan/ubsan tests based on GCC 15
  - Adds riscv64 to supported architectures for all three kinds of tsts


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.20091126-47
changelog:
  - Security fix for CVE-2010-1028
  - Various other fixes collected by Debian and contributed back upstream to
    the sfnt2woff-zopfli fork: https://github.com/bramstein/sfnt2woff-
    zopfli/pull/20


author: Davide Cavalca <dcavalca@fedoraproject.org> - 1:2.10-8
changelog:
  - Backport WPA3 support for Broadcom devices. Fixes: rhbz#2226569
  - Enable parsing of IPv6 addresses in RADIUS configuration (#2095296)


author: Sérgio Basto <sergio@serjux.com> - 0.9.16^20230801gita61f364-1
changelog:
  - Update to a61f364e385d98677c04070a994397b287385219 git snapshot from
    2023-08-01 (a support for acquiring a DRM framebuffer with a drm schema
    in -rawfb option)


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.16-1
changelog:
  - Update to xserver 21.1.16 (#2347558)
  - CVE fix for: CVE-2025-26594, CVE-2025-26595, CVE-2025-26596, CVE-2025-26597,
                 CVE-2025-26598, CVE-2025-26599, CVE-2025-26600, CVE-2025-26601


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.17-1
changelog:
  - Update to xserver 21.1.17
  - CVE fix for: CVE-2025-49175, CVE-2025-49176, CVE-2025-49177
                 CVE-2025-49178, CVE-2025-49179, CVE-2025-49180


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.20-1
changelog:
  - Update to xserver 21.1.20 (#2406803)
  - CVE fix for: CVE-2025-62229, CVE-2025-62230, CVE-2025-62231


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.6-1
changelog:
  - xwayland 24.1.6 (#2343992)
  - CVE fix for: CVE-2025-26594, CVE-2025-26595, CVE-2025-26596, CVE-2025-26597,
                 CVE-2025-26598, CVE-2025-26599, CVE-2025-26600, CVE-2025-26601


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.7-1
changelog:
  - Update to xserver 24.1.7
  - CVE fix for: CVE-2025-49175, CVE-2025-49176, CVE-2025-49177
                 CVE-2025-49178, CVE-2025-49179, CVE-2025-49180


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.9-1
changelog:
  - Update to xwayland 24.1.9 (#2406802)
  - CVE fix for: CVE-2025-62229, CVE-2025-62230, CVE-2025-62231


author: Luya Tshimbalanga <luya@fedoraproject.org> - 1.2.6-1
changelog:
  - "Update to 1.2.6" * Fixed compass outline drawing * Exposed selected text
    to the windowing system Details on [release
    notes](https://github.com/xournalpp/xournalpp/releases/tag/v1.2.6)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 0.1.8-3
changelog:
  - Do not hardcode the build type
  - Use CMAKE_BUILD_TYPE RelWithDebInfo to avoid -Werror in compiler flags


author: Richard W.M. Jones <rjones@redhat.com> - 1:5.6.3-2
changelog:
  - perl-Compress-Raw-Lzma dep has been removed, rebuild
    https://src.fedoraproject.org/rpms/perl-Compress-Raw-Lzma/pull-request/3


author: Sandro Mani <manisandro@gmail.com> - 1.22.22-9
changelog:
  - Add CVE-2025-6545_6547.prebundle.patch and regenerate bundle. Fixes CVE-2025-6545 and CVE-2025-6547.


author: Sandro Mani <manisandro@gmail.com> - 1.22.22-11
changelog:
  - Refresh bundle
  - Drop patches obsoleted by new bundle
  - Add yarn-update-jest.prebundle.patch to update jest and avoid some vulerable dependencies
  - Apply fixes for CVE-2025-8262 and CVE-2025-8263


author: Sandro Mani <manisandro@gmail.com> - 1.22.22-12
changelog:
  - Regenerate bundle, fixes CVE-2025-59343
  - Patch out eslint and commitizen devDependencies to reduce dependencies


author: Jean-Baptiste Trystram <jbtrystram@redhat.com> - 0.0.30-3
changelog:
  - Backport patch to fix rollback not sticking from https://github.com/coreos/zincati/pull/1293
    See https://github.com/coreos/fedora-coreos-tracker/issues/1938


