# changelog

author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-14
changelog:
  - pull fix for keeping track of the message type when parsing FAST requests in
    the KDC (RT#7605, #951965)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-15
changelog:
  - backport fix for not being able to verify the list of transited realms
    in GSS acceptors (RT#7639, #959685)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-15.1
changelog:
  - backport fix for trying all compatible keys when not being strict about
    acceptor names while reading AP-REQs (RT#7883, #1081611)


author: Tomas Smetana <tsmetana@redhat.com> 20070328-2
changelog:
  - fix wrong exit status of spawned process after SIGSTOP
  - fix building of debuginfo package, add %{?dist} to release
  - fix handling of SIGTTOU in non-interactive shell
  - remove useless builtins


author: Tomas Smetana <tsmetana@redhat.com> 20071105-2
changelog:
  - fix #405381 - ksh will not handle $(xxx) when typeset -r IFS
  - fix #386501 - bad group in spec file


author: Michal Hlavinka <mhlavink@redhat.com> - 20100202-6
changelog:
  - fix infinite loop when whence builtin is used with -q option (#587127)
  - fix stdin for double command substitution (#584704)


author: Michal Hlavinka <mhlavink@redhat.com> - 20100621-3
changelog:
  - fix file io race condition when file was created, but still does not exist (#660319)
  - use 'alternatives' for (m)ksh switching (#659658)
  - do not forget to restore file handles after execution of sourced script (#651888)
  - fix bug when here document got sometimes truncated (#644362)
  - do not forget to close autoloaded file with function definition (#643811)
  - fix wrong typeset handling of arrays that could caused a crash (#637052)
  - fix minor issues in man page (#619692)
  - fix crash when ksh get SIGPIPE while already executing signal handler (#616691)
  - fix wrong output redirection in SIGPIPE trap (#616684)
  - add RLIMIT_RTPRIO and RLIMIT_NICE support to ulimit (#582690)


author: Michal Hlavinka <mhlavink@redhat.com> - 20100621-7
changelog:
  - ksh did not wait for pipeline to complete when pipefail option was used (#702016)
  - completion used after an environment variable reported bad susbstituion error (#702015)
  - ksh child exit code not preserved correctly (#702013)
  - do not change $0 in posix function (#702011)
  - fix man page information about default value for PATH variable (#702008)
  - do not use invalid PID values in ksh kill built-in (#701890)
  - fix crashe when IFS is unset inside a function (#683734)
  - do not count empty array elements (#702014)


author: Michal Hlavinka <mhlavink@redhat.com> - 20100621-14
changelog:
  - fix data corruption in a here-document section of a script at byte 8192 (#786787)
  - restore tty settings after timed out read (#577223)
  - do not create extra process when it's not needed (#781976)
  - fix file descriptor leak (#781498)
  - do not segfault on incorrect oop code (#743840)


author: Michal Hlavinka <mhlavink@redhat.com> - 20100621-19
changelog:
  - assigning a right justified typedef'd variable to a smaller one
    could corrupt the result (#846678)
  - fix exporting of l/r-justified variable (#846678)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-2
changelog:
  - fix overflow in subshell loop (#858263)
  - set default editing mode to emacs (#761551)
  - ksh -m did not turn monitor mode on (#960034)
  - prevent fork bomb trigered by SIGSTP (#922851)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-10.4
changelog:
  - reading a file via command substitution did not work when any of stdin,
    stdout or stderr were closed (#1072456)


author: Tim Powers <timp@redhat.com>
changelog:
  - patched to build with gcc-2.96
  - use gcc instead of c++ for CXX, otherwise you expose an ICE in gcc when
    using g++ on two files, one being a C++ source, and the other a C source.
    Using gcc does the correct thing.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - explicitly list the modules which are built when the package compiles, so
    that module build failures (for whatever reason) get caught


author: Nalin Dahyabhai <nalin@redhat.com> 2.6.9-1
changelog:
  - include patch based on patch from Ulf Härnhammar to fix unsafe use of
    sscanf when reading http directory listings (CAN-2003-0963)
  - include patch based on patch from Ulf Härnhammar to fix compile warnings
    modified based on input from Solar Designer


author: Nalin Dahyabhai <nalin@redhat.com> 2.6.10-1
changelog:
  - update to 2.6.10, which folds in the previous patches
  - configure with --with-debug so that we get useful debug info


author: Nalin Dahyabhai <nalin@redhat.com> 2.6.10-3
changelog:
  - add patch to avoid DoS when connecting to HTTP servers (or "HTTP" "servers")
    which don't provide status headers, or provide empty lines instead of status
    headers


author: Jason Vas Dias <jvdias@redhat.com> - 3.3.2-1
changelog:
  - *** PLEASE COULD ANYONE MODIFYING lftp TEST IT BEFORE SUBMITTING! ***
    (and preferably contact the lftp package maintainer (me) first - thank you!)
    bug 171096 : 'mget files in lftp causes abort' (core dump actually)
    resulted from not doing so .
    See http://lftp.yar.ru :
  	Recent events:2005-10-17: 
  	lftp-3.3.2 released. Fixed a coredump caused by double-free.


author: Jason Vas Dias<jvdias@redhat.com> - 3.3.5-1
changelog:
  - Upgrade to version 3.3.5
  - fix bug bz172376 : host lookups should use any address found after timeout


author: Jason Vas Dias<jvdias@redhat.com> - 3.3.5-4
changelog:
  - fix bug 176315: openssl libraries not being picked up - gnutls was instead
  - improvements to bug 172376 fix


author: Maros Barabas <mbarabas@redhat.com> - 3.5.10-3
changelog:
  - Correct mistake removing devel package & calling chkconfig
  - Resolves #235436
  - Removing automake autoconf
  - Resolves #225984


author: Martin Nagy <mnagy@redhat.com> - 3.6.1-1
changelog:
  - upgrade to upstream version 3.6.1
  - remove rpath and make some spec file changes for review (#225984)
  - remove old patches
  - fix core dumping when html tag has its argument empty
  - use own libtool


author: Jiri Skala <jskala@redhat.com> - 4.0.9-1
changelog:
  - Resolves: #602838 - CVE-2010-2251 lftp: multiple HTTP client download filename vulnerability
  - re-base to latest upstream version


author: Mike A. Harris <mharris@redhat.com> 0.99.0-2
changelog:
  - Renamed package to prepend "xorg-x11" to the name for consistency with
    the rest of the X11R7 packages.
  - Added "Requires: %{name} = %{version}-%{release}" dependency to devel
    subpackage to ensure the devel package matches the installed shared libs.
  - Added virtual "Provides: lib<name>" and "Provides: lib<name>-devel" to
    allow applications to use implementation agnostic dependencies.
  - Added post/postun scripts which call ldconfig.
  - Added Conflicts with XFree86-libs and xorg-x11-libs to runtime package,
    and Conflicts with XFree86-devel and xorg-x11-devel to devel package.


author: Mike A. Harris <mharris@redhat.com> 0.99.0-3
changelog:
  - Changed all virtual BuildRequires to the "xorg-x11-" prefixed non-virtual
    package names, as we want xorg-x11 libs to explicitly build against
    X.Org supplied libs, rather than "any implementation", which is what the
    virtual provides is intended for.
  - Added freetype-devel build dependency


author: Mike A. Harris <mharris@redhat.com> 0.99.0-4
changelog:
  - Added xorg-x11-proto-devel dependency to 'devel' subpackage, because the
    libXfont headers use some of the protocol headers, but the autotooling of
    libXfont doesn't autodetect this yet.  Discovered when bdftopcf failed to
    compile while trying to package xorg-x11-font-utils, even though libXfont
    headers were installed.


author: Mike A. Harris <mharris@redhat.com> 0.99.0-5
changelog:
  - Renamed package to remove xorg-x11 from the name due to unanimous decision
    between developers.
  - Use Fedora Extras style BuildRoot tag.
  - Disable static library creation by default.
  - Add missing defattr to devel subpackage
  - Add missing documentation files to doc macro
  - Fix BuildRequires to use new libX* style package names


author: Mike A. Harris <mharris@redhat.com> 0.99.1-1
changelog:
  - Updated libXfont to version 0.99.1 from X11R7 RC1
  - Remove libfontcache* from file manifests, as it is static linked into Xfont


author: Mike A. Harris <mharris@redhat.com> 0.99.2-1
changelog:
  - Updated libXfont to version 0.99.2 from X11R7 RC2
  - Changed 'Conflicts: XFree86-devel, xorg-x11-devel' to 'Obsoletes'
  - Changed 'Conflicts: XFree86-libs, xorg-x11-libs' to 'Obsoletes'


author: Mike A. Harris <mharris@redhat.com> 0.99.2-3
changelog:
  - Added libXfont-0.99.2-fontdir-attrib-fix-bug-172997.patch to remove
    conditionalization of FONTDIRATTRIB from sources instead of tweaking
    CFLAGS for bug (#172997, fdo#5047).


author: Mike A. Harris <mharris@redhat.com> 0.99.3-1
changelog:
  - Updated libXfont to version 0.99.3 from X11R7 RC3
  - Added "Requires(pre): xorg-x11-filesystem >= 0.99.2-3", to ensure
    that /usr/lib/X11 and /usr/include/X11 pre-exist.
  - Removed 'x' suffix from manpage directories to match RC3 upstream.
  - Removed libXfont-0.99.2-fontdir-attrib-fix-bug-172997.patch, which is now
    integrated upstream.


author: Adam Jackson <ajax@redhat.com> 1.2.3-2.fc7
changelog:
  - libXfont-1.2.3-namespace-pollution.patch: Hide some symbols from the dynamic
    linker to avoid colliding with other libs.


author: Adam Jackson <ajax@redhat.com> 1.3.3-1
changelog:
  - libXfont 1.3.3.
  - libXfont-1.3.1-fast-retry.patch: Retry font server connections faster.
    (#443070)


author: Soren Sandmann <ssp@redhat.com> 1.4.5-3
changelog:
  - cve-2013-6462.patch: sscanf overflow (bug 1049684)
  - sscanf-hardening.patch: Some other sscanf hardening fixes (1049684)


author: Dhaval Giani <dhaval@linux.vnet.ibm.com> 0.32.1-1
changelog:
  * Tue Feb 24 2009 Balbir Singh <balbir@linux.vnet.ibm.com> 0.33-1
  - Update to 0.33, spec file changes to add Makefiles and pam_cgroup module


author: Jan Safranek <jsafrane@redhat.com> 0.36-4
changelog:
  - Fix libcgroup.so link to the right soname (#599367)
  - Fix segmentation fault in cgget tool (#601071)
  - Fix lscgroup commandline parsing (#601095)


author: Jan Safranek <jsafrane@redhat.com> 0.36-5
changelog:
  - Relax the dependency on redhat-lsb package (#607537)
  - Fix installation of -devel libraries (#607538)


author: Jan Safranek <jsafrane@redhat.com> 0.37-1.el6
changelog:
  - Updated to 0.37
    - added new 'cgsnapshot' tool to generate cgconfig.conf (#649195)
    - fixed 'cgget' reading long variable values like devices.list (#626127)
    - fixed reading list of mounted controllers on library init (#635984)
    - fixed the library not to change current working directory when creating
      groups (#628895)
    - new user 'cgred' was added for better security - /bin/cgexec tool is no
      longer SUID to root but SGID to the new 'cgred' user, which has write
      access to /var/run/cgred.socket
    - may other fixes an enhancements
  - Removed rpath from compiled binaries
  - Fixed spelling and rpmlint errors in the .spec file (#634939)
  - Fixed exit code of cgclassify tool (#667957)


author: Jan Safranek <jsafrane@redhat.com> 0.37-2.el6
changelog:
  - Fixed buffer overflow when parsing cgexec command line parameters.
  - Added checking of source of netlink messages to cgrulesengd daemon.
  - Resolves: CVE-2011-1006 CVE-2011-1022


author: Jan Safranek <jsafrane@redhat.com> 0.37-3.el6
changelog:
  - Fixed 'cgred' group not being created as system-group during installation
    of the package.
  - Resolves: #715413


author: Peter Schiffer <pschiffe@redhat.com> 0.37-5
changelog:
  - resolves: #819137
    fixed bug when lscgroup was ltrimming path which wasn't prefixed with slash
  - resolves: #773544
    made --sticky option effective when setuid(2) and setgid(2)
  - resolves: #849757
    added inotify fd to scan running tasks and set control groups
  - resolves: #738737
    logging improvement


author: Peter Schiffer <pschiffe@redhat.com> 0.37-6
changelog:
  - related: #738737
    updated logging improvement
  - resolves: #877042
    fixed coverity finding in libcgroup-0.37-add-inotify-fd.patch
  - resolves: #869990
    fixed bug when cgconfig service was failing to start on read only file systems


author: Peter Schiffer <pschiffe@redhat.com> 0.37-8
changelog:
  - resolves: #912425
    fixed problem when cgred service could segfault if entry in cgrules.conf file
    doesn't specify procname


author: Peter Schiffer <pschiffe@redhat.com> 0.37-10
changelog:
  - resolves: #921328
    cgred service can now start with an empty configuration file
  - resolves: #863172
    cgconfig now sets group write permissions on files in the cgroup
  - resolves: #916397
    fixed cgrulesengd segfault
  - resolves: #924399
    fixed bug when the cgrulesengd had different logging level from the library
  - resolves: #951724
    fixed cgget(1) man page
  - resolves: #809550
    removed -s option from cgcreate(1) man page
  - resolves: #913286
    fixed adding control subgroups after cgrulesengd has started
  - resolves: #753334
    fixed bug when cgconfig fails to parse commas in the cgconfig.conf file


author: Peter Schiffer <pschiffe@redhat.com> 0.40.rc1-1
changelog:
  - resolves: #589535
    rebase to 0.40.rc1
    added support for automated cgroup creation following a template


author: Peter Schiffer <pschiffe@redhat.com> 0.40.rc1-2
changelog:
  - fixed coverity findings
  - resolves: #738620
    relabel cgred.pid file after service starts
  - resolves: #961844
    increase start priority for cgred service


author: Peter Schiffer <pschiffe@redhat.com> 0.40.rc1-4
changelog:
  - related: #913286
    fixed performance regression when starting cgred service
  - related: #589535
    fixed templates


author: Richard W.M. Jones <rjones@redhat.com> - 1.0-6
changelog:
  - Require libguestfs 1.7.17 (newer version in RHEL 6.1).
  - Require febootstrap-supermin-helper instead of febootstrap
    resolves: RHBZ#670299.


author: Simo Sorce <ssorce@redhat.com> - 0.3.0-2
changelog:
  - Try to fix build adding automake as an explicit BuildRequire
  - Add also a couple of last minute patches from upstream


author: Jakub Hrozek <jhrozek@redhat.com> - 0.3.2-1
changelog:
  - bugfix release 0.3.2
  - includes previous release patches
  - change permissions of the /etc/sssd/sssd.conf to 0600


author: Simo Sorce <ssorce@redhat.com> - 0.4.1-1
changelog:
  - add missing configure check that broke stopping the daemon
  - also fix default config to add a missing required option


author: Jakub Hrozek <jhrozek@redhat.com> - 0.4.1-4
changelog:
  - Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
    without a password. (Patch by Stephen Gallagher)


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.0-1
changelog:
  - Ensure that the configuration upgrade script always writes the config
    file with 0600 permissions
  - Eliminate an infinite loop in group enumerations


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.1-1
changelog:
  - Add SSSDConfig API
  - Update polish translation for 0.6.0
  - Fix long timeout on ldap operation
  - Make dp requests more robust


author: Stephen Gallagher <sgallagh@redhat.com> - 0.7.1-1
changelog:
  - Fix segfault in sssd_pam when cache_credentials was enabled
  - Update the sample configuration
  - Fix upgrade issues caused by data provider service removal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.2-1
changelog:
  - Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
  - Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
  - Several segfault bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.3-1
changelog:
  - Fixes link error on platforms that do not do implicit linking
  - Fixes double-free segfault in PAM
  - Fixes double-free error in async resolver
  - Fixes support for TCP-based DNS lookups in async resolver
  - Fixes memory alignment issues on ARM processors
  - Manpage fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-1.pre20100317git0ea7f19
changelog:
  - Release candidate for SSSD 1.1
  - Add simple access provider
  - Create subpackages for libcollection, libini_config, libdhash and librefarray
  - Support IPv6
  - Support LDAP referrals
  - Fix cache issues
  - Better feedback from PAM when offline


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-2
changelog:
  - Release SSSD 1.1.0 final
  - Fix two potential segfaults
  - Fix memory leak in monitor
  - Better error message for unusable confdb


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.1-1
changelog:
  - New upstream release 1.1.1
  - Fixed the IPA provider (which was segfaulting at start)
  - Fixed a bug in the SSSDConfig API causing some options to revert to
  - their defaults
  - This impacted the Authconfig UI
  - Ensure that SASL binds to LDAP auto-retry when interrupted by a signal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.91-10
changelog:
  - Release new upstream version 1.1.91
  - Enhancements when using SSSD with FreeIPA v2
  - Support for deferred kinit
  - Support for DNS SRV records for failover


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.92-11
changelog:
  - New LDAP access provider allows for filtering user access by LDAP attribute
  - Reduced default timeout for detecting offline status with LDAP
  - GSSAPI ticket lifetime made configurable
  - Better offline->online transition support in Kerberos


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-12
changelog:
  - New stable upstream version 1.2.0
  - Support ServiceGroups for FreeIPA v2 HBAC rules
  - Fix long-standing issue with auth_provider = proxy
  - Better logging for TLS issues in LDAP
  - Resolves: rhbz#584001 - Rebase sssd to 1.2
  - Resolves: rhbz#584017 - Unconfiguring sssd leaves KDC locator file
  - Resolves: rhbz#587384 - authconfig fails if krb5_kpasswd in sssd.conf
  - Resolves: rhbz#587743 - Need to replicate pam_ldap's pam_filter in sssd.conf
  - Resolves: rhbz#590134 - sssd: auth_provider = proxy regression
  - Resolves: rhbz#591131 - Kerberos provider needs to rewrite kdcinfo file when
  -                         going online
  - Resolves: rhbz#591136 - Change SSSD ipa BE to handle new structure of the
  -                         HBAC rule


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-13
changelog:
  - Resolves: rhbz#598670 - Ccache file of a user is removed too early
  - Resolves: rhbz#599057 - Incomplete comparison of a service name in
  -                         IPA access provider
  - Resolves: rhbz#598496 - Failure with IPA access provider
  - Resolves: rhbz#599027 - Makefile typo causes SSSD not to use the
  -                         kernel keyring


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-14
changelog:
  - Resolves: rhbz#593696 - Empty list of simple_allow_users causes sssd service
  -                         to fail while restart
  - Resolves: rhbz#600352 - Wrapping the value for "ldap_access_filter" in
  -                         parentheses causes ldap_search_ext to fail
  - Resolves: rhbz#600468 - Segfault in krb5_child
  - Related:  rhbz#601770 - SSSD in RHEL 6.0 should ship with zero open Coverity
  -                         bugs.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-15
changelog:
  - New upstream bugfix release 1.2.1
  - Resolves: rhbz#601770 - SSSD in RHEL 6.0 should ship with zero open Coverity
  -                         bugs.
  - Resolves: rhbz#603041 - Remove unnecessary option krb5_changepw_principal
  - Resolves: rhbz#604704 - authconfig should provide error with no trace back
  -                         if disabling sssd when sssd is not enabled
  - Resolves: rhbz#591873 - Connecting to the network after an offline kerberos
  -                         auth logs continuous error messages to sssd_ldap.log
  - Resolves: rhbz#596295 - Authentication fails for user from the second domain
  -                         when the same user name is filtered out from the
  -                         first domain
  - Related:  rhbz#598559 - Update translation files for SSSD before RHEL 6
  -                         final


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-19
changelog:
  - Resolves: rhbz#606836 - libcollection needs an soname bump before RHEL 6
  -                         final
  - Resolves: rhbz#608661 - SASL with OpenLDAP server fails
  - Resolves: rhbz#608688 - SSSD doesn't properly request RootDSE attributes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-20
changelog:
  - Resolves: rhbz#591715 - sssd should emit warnings if there are problems with
  -                         /etc/krb5.keytab file


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-21
changelog:
  - Resolves: rhbz#607233 - SSSD users cannot log in through GDM
  -                       - Real issue was that long-running services
  -                       - do not reconnect if sssd is restarted


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-23
changelog:
  - Resolves: rhbz#617623 - SSSD suffers from serious performance issues on
  -                         initgroups calls


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-32
changelog:
  - Resolves: rhbz#633406 - the krb5 locator plugin isn't packaged for multilib
  - Resolves: rhbz#633487 - SSSD initgroups does not behave as expected


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-28.1
changelog:
  - Resolves: rhbz#637070 - the krb5 locator plugin isn't packaged for multilib
  - Resolves: rhbz#642412 - SSSD initgroups does not behave as expected


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-35
changelog:
  - Resolves: rhbz#645449 - 'getent passwd <username>' returns nothing if its
  -                         uidNumber gt 2147483647


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-28.4
changelog:
  - Resolves: rhbz#660592 - SSSD shutdown sometimes hangs
  - Resolves: rhbz#660585 - getent passwd <username>' returns nothing if its
  -                         uidNumber gt 2147483647


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.0-1
changelog:
  - Related: rhbz#644072 - Rebase SSSD to 1.5
  - New upstream release 1.5.0
  - Fixed issues with LDAP search filters that needed to be escaped
  - Add Kerberos FAST support on platforms that support it
  - Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
  - Added a Kerberos access provider to honor .k5login
  - Addressed several thread-safety issues in the sss_client code
  - Improved support for delayed online Kerberos auth
  - Significantly reduced time between connecting to the network/VPN and
  - acquiring a TGT
  - Added feature for automatic Kerberos ticket renewal
  - Provides the kerberos ticket for long-lived processes or cron jobs
  - even when the user logs out
  - Added several new features to the LDAP access provider
  - Support for 'shadow' access control
  - Support for authorizedService access control
  - Ability to mix-and-match LDAP access control features
  - Added an option for a separate password-change LDAP server for those
  - platforms where LDAP referrals are not supported
  - Added support for manpage translations


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-1
changelog:
  - Resolves: rhbz#670259 - Refresh SSSD in 6.1 to 1.5.1
  - New upstream release 1.5.1
  - Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
  - Vast performance improvements when enumerate = true
  - All PAM actions will now perform a forced initgroups lookup instead of just
  - a user information lookup
  -   This guarantees that all group information is available to other
  -   providers, such as the simple provider.
  - For backwards-compatibility, DNS lookups will also fall back to trying the
  - SSSD domain name as a DNS discovery domain.
  - Support for more password expiration policies in LDAP
  -    389 Directory Server
  -    FreeIPA
  -    ActiveDirectory
  - Support for ldap_tls_{cert,key,cipher_suite} config options
  - Assorted bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-3
changelog:
  - Related:  rhbz#670259 - Refresh SSSD in 6.1 to 1.5.1
  - Also add the updated ding-libs to the BuildRequires


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-4
changelog:
  - Resolves: rhbz#674172 - Group members are not sanitized in nested group
  - processing
  - Put translated tool manpages into the sssd-tools subpackage


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-5
changelog:
  - Resolves: rhbz#674164 - sss_obfuscate fails if there's no domain named
  -                         "default"
  - Resolves: rhbz#674515 - -p option always uses empty string to obfuscate
  -                         password
  - Resolves: rhbz#674141 - Traceback call messages displayed while
  -                         "sss_obfuscate" command is executed as a non-root
  -                         user


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-6
changelog:
  - Resolves: rhbz#670511 - SSSD and sftp-only jailed users with pubkey login
  - Resolves: rhbz#675284 - "no matching rule" message logged on all successful
  -                         requests
  - Resolves: rhbz#676911 - SSSD attempts to use START_TLS over LDAPS for
  -                         authentication


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-7
changelog:
  - Resolves: rhbz#677588 - sssd crashes at the next tgt renewals it tries
  - Resolves: rhbz#678410 - name service caches names, so id command shows
  -                         recently deleted users
  - Resolves: rhbz#678614 - SSSD needs to look at IPA's compat tree for
  -                         netgroups


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-8
changelog:
  - Resolves: rhbz#678593 - User information not updated on login for secondary
  -                         domains
  - Resolves: rhbz#678777 - IPA provider does not update removed group
  -                         memberships on initgroups


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-9
changelog:
  - Resolves: rhbz#679082 - SSSD IPA provider should honor the krb5_realm option
  - Resolves: rhbz#677318 - Does not read renewable ccache at startup


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-10
changelog:
  - Related: rhbz#678614 - SSSD needs to look at IPA's compat tree for netgroups
  - Related: rhbz#679082 - SSSD IPA provider should honor the krb5_realm option


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-11
changelog:
  - Resolves: rhbz#682340 - sssd-be segmentation fault - ipa-client on
  -                         ipa-server
  - Resolves: rhbz#680440 - sssd does not handle kerberos server IP change
  - Resolves: rhbz#680442 - Dynamic DNS update fails if multiple servers are
  -                         given in ipa_server config option
  - Resolves: rhbz#680932 - Do not delete sysdb memberOf if there is no memberOf
  -                         attribute on the server
  - Resolves: rhbz#682807 - sssd_nss core dumps with certain lookups


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-12
changelog:
  - Resolves: rhbz#682850 - IPA provider should use realm instead of ipa_domain
  -                         for base DN


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-13
changelog:
  - Related: rhbz#680440 - sssd does not handle kerberos server IP change
  -   SSSD was staying with the old server if it was still online


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-14
changelog:
  - Resolves: rhbz#683255 - sudo/ldap lookup via sssd gets stuck for 5min
  -                         waiting on netgroup
  - Resolves: rhbz#683431 - sssd consumes 100% CPU
  - Related: rhbz#680440  - sssd does not handle kerberos server IP change


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-15
changelog:
  - Resolves: rhbz#683860 - Skip users and groups that have incomplete contents
  - Resolves: rhbz#688491 - authconfig fails when access_provider is set as krb5
  -                         in sssd.conf


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-16
changelog:
  - Resolves: rhbz#683158 - SSSD breaks on RDNs with a comma in them
  - Resolves: rhbz#689886 - group memberships are not populated correctly during
  -                         IPA provider initgroups
  - Resolves: rhbz#683885 - SSSD should skip over groups with multiple names


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-20
changelog:
  - Resolves: rhbz#690131 - Traceback messages seen while interrupting
  -                         sss_obfuscate using ctrl+d
  - Resolves: rhbz#690421 - [abrt] sssd-1.2.1-28.el6_0.4: _talloc_free: Process
  -                         /usr/libexec/sssd/sssd_be was killed by signal 11
  -                         (SIGSEGV)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-21
changelog:
  - Resolves: rhbz#690866 - Groups with a zero-length memberuid attribute can
  -                         cause SSSD to stop caching and responding to
  -                         requests


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-23
changelog:
  - Resolves: rhbz#691678 - SSSD needs to fall back to 'cn' for GECOS
  -                         information


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-24
changelog:
  - Resolves: rhbz#692472 - Process /usr/libexec/sssd/sssd_be was killed by
  -                         signal 11 (SIGSEGV)
  -                         Fix is to not attempt to resolve nameless servers


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-25
changelog:
  - Resolves: rhbz#694783 - SSSD crashes during getent when anonymous bind is
  -                         disabled


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-26
changelog:
  - Resolves: rhbz#694444 - Unable to resolve SRV record when called with
  -                         _srv_,<fixed ldap uri> in ldap_uri
  - Related:  rhbz#694783 - SSSD crashes during getent when anonymous bind is
  -                         disabled


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-27
changelog:
  - Related:  rhbz#694783 - SSSD crashes during getent when anonymous bind is
  -                         disabled


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-28
changelog:
  - Related:  rhbz#691678 - SSSD needs to fall back to 'cn' for GECOS
  -                         information


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-32
changelog:
  - Related: rhbz#693818 - Automatic TGT renewal overwrites cached password
  - Fix typo causing build breakage


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-33
changelog:
  - Related: rhbz#693818 - Automatic TGT renewal overwrites cached password
  - Fix segfault in TGT renewal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-34
changelog:
  - Resolves: rhbz#701700 - sssd client libraries use select() but should use
  -                         poll() instead


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-35
changelog:
  - Resolves: rhbz#707282 - latest sssd fails if ldap_default_authtok_type is
  -                         not mentioned
  - Resolves: rhbz#692404 - rfc2307bis groups are being enumerated even when the
  -                         gidNumber is out of the range of min_id,max_id.
  - Resolves: rhbz#699530 - Users with a local group as their primary GID are
  -                         denied access by the simple access provider
  - Resolves: rhbz#700172 - RFE: SSSD should support paged LDAP lookups
  - Resolves: rhbz#705434 - IPA provider fails initgroups() if user is not a
  -                         member of any group
  - Resolves: rhbz#703624 - SSSD's async resolver only tries the first
  -                         nameserver in /etc/resolv.conf


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-36
changelog:
  - Resolves: rhbz#698723 - kpasswd fails when using sssd and
  -                         kadmin server != kdc server


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-37
changelog:
  - Resolves: rhbz#707513 - Unable to authenticate users when username
  -                         contains "\0"


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-38
changelog:
  - Resolves: rhbz#707627 - Include valid "ldap_uri" formats in sssd-ldap man
  -                         page


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-39
changelog:
  - Resolves: rhbz#709342 - Typo in negative cache notification for initgroups()
  - Resolves: rhbz#708009 - "renew_all_tgts" and "renew_handlers" messages are
  -                         being logged multiple times when the provider comes
  -                         back online
  - Resolves: rhbz#707997 - The IPA provider does not work with IPv6
  - Resolves: rhbz#677327 - [RFE] Support overriding attribute value
  - Resolves: rhbz#692090 - SSSD is not populating nested groups in
  -                         Active Directory


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-41
changelog:
  - Resolves: rhbz#713961 - libsss_ldap segfault at login against OpenLDAP
  - Resolves: rhbz#713438 - sssd shuts down if inotify crashes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-42
changelog:
  - Resolves: rhbz#711416 - During the change password operation the ccache is
  -                         not replaced by a new one if the old one isn't
  -                         active anymore
  - Resolves: rhbz#715609 - Certificate validation fails with message
  -                         "Connection error: TLS: hostname does not match CN
  -                         in peer certificate"
  - Resolves: rhbz#719089 - IPA dynamic DNS update mangles AAAA records
  - Resolves: rhbz#721052 - sssd does not handle kerberos server IP change
  -                         Honor TTL values when resolving hostnames


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-43
changelog:
  - Related:  rhbz#721052 - sssd does not handle kerberos server IP change
  -                         Use ares_search instead of ares_query to honor
  -                         search entries in /etc/resolv.conf


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-44
changelog:
  - Resolves: rhbz#700828 - Process /usr/libexec/sssd/sssd_be was killed by
                            signal 11 (SIGSEGV) when ldap_uri is misconfigured
  - Resolves: rhbz#726438 - sssd doesn't honor ldap supportedControls 
  - Resolves: rhbz#726466 - HBAC rule evaluation does not support extended
                            UTF-8 languages
  - Resolves: rhbz#718250 - Remove DENY rules from the HBAC access provider
  - Resolves: rhbz#728267 - When non-posix groups are skipped, initgroups
                            returns random GID
  - Resolves: rhbz#726475 - sssd_pam leaks file descriptors
  - Resolves: rhbz#725868 - Explicitly ignore groups with gidNumber = 0


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-45
changelog:
  - Related:  rhbz#726466 - HBAC rule evaluation does not support extended
                            UTF-8 languages
  - Related:  rhbz#718250 - Remove DENY rules from the HBAC access provider
  - Fixes an issue on big endian platforms


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-46
changelog:
  - Related:  rhbz#728267 - When non-posix groups are skipped, initgroups
                            returns random GID


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-47
changelog:
  - Resolves: rhbz#728961 - Provide a mechanism for vetoing the use of certain
                            shells


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-49
changelog:
  - Resolves: rhbz#732010 - LDAP+GSSAPI needs explicit Kerberos realm
  - Resolves: rhbz#733382 - SSSD should pick a user/group name when there are
                            multi-valued names
  - Resolves: rhbz#733409 - Improve password policy error message
  - Resolves: rhbz#733663 - Authentication fails when there exists an empty
                            hbacsvcgroup
  - Resolves: rhbz#732935 - Add LDAP provider option to set
                            LDAP_OPT_X_SASL_NOCANON
  - Resolves: rhbz#734101 - sssd blocks login of ipa-users


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-50
changelog:
  - Resolves: rhbz#736314 - sssd crashes during auth while there exists multiple
                            external hosts along with managed host
  - Resolves: rhbz#732974 - [RFE] Have SSSD cache properly with
    krb5_validate = True and SElinux enabled


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-51
changelog:
  - Resolves: rhbz#737157 - "System error" appears in log during change password
                            operation of a user in openldap server with ppolicy
                            enabled
  - Resolves: rhbz#737172 - "Unknown (private extension) error(21853), (null)"
                            messages are logged during change password operation
                            of a user in openldap server with ppolicy enabled


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-52
changelog:
  - Resolves: rhbz#728343 - SSSD taking 5 minutes to log in
  - Resolves: rhbz#739850 - Coverity defects newly introduced in rhel 6.2


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-53
changelog:
  - Resolves: rhbz#741751 - HBAC rule evaluation does not properly handle host
                            groups
  - Resolves: rhbz#740501 - SSSD not functional after "self" reboot
  - Resolves: rhbz#742539 - HBAC: Hostname comparisons should be
                            case-insensitive


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-55
changelog:
  - Resolves: rhbz#738621 - Lookup fails for non-primary usernames with
                            multi-valued uid
  - Resolves: rhbz#738629 - Group lookups doesn't return it's member for
                            sometime when the member has multi-valued uid
  - Resolves: rhbz#742295 - Use an explicit base 10 when converting uidNumber
                            to integer
  - Resolves: rhbz#733382 - SSSD should pick a user/group name when there are
                            multi-valued names


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-56
changelog:
  - Resolves: rhbz#742278 - Rework the example config
  - Resolves: rhbz#746037 - Only access sssd_nss internal hash table if it was
                            initialized
  - Resolves: rhbz#742526 - SSSD's man pages are missing information
  - Resolves: rhbz#743841 - SSSD can crash due to dbus server removing a UNIX
                            socket


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-57
changelog:
  - Resolves: rhbz#743925 - HBAC processing is very slow when dealing with
                            FreeIPA deployments with large numbers of hosts
  - Resolves: rhbz#745966 - sssd_pam segfaults on sssd restart
  - Related:  rhbz#743841 - SSSD can crash due to dbus server removing a UNIX
                            socket


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-59
changelog:
  - Resolves: rhbz#742288 - RFC2307bis initgroups calls are slow
  - Resolves: rhbz#746654 - SSSD backend gets killed on slow systems
  - Related:  rhbz#743925 - HBAC processing is very slow when dealing with
                            FreeIPA deployments with large numbers of hosts
                            Fixes a crash introduced by the earlier patch.
  - Related:  rhbz#733382 - SSSD should pick a user/group name when there are
                            multi-valued names
                            Fixes for internationalization


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-60
changelog:
  - Related:  rhbz#743841 - SSSD can crash due to dbus server removing a UNIX
                            socket


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-64
changelog:
  - Resolves: rhbz#749822 - SSSD may go into infinite loop during RFC2307bis
                            initgroups when groups appear in multiple nesting
                            levels


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-67
changelog:
  - Resolves: rhbz#753842 - sssd_nss crashes when passed invalid UTF-8 for the
                            username in getpwnam()
  - Resolves: rhbz#758157 - LDAP failover not working if server refuses
                            connections


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-2.beta2
changelog:
  - Related:  rhbz#735422 - Rebase SSSD to 1.8.0 in RHEL 6.3
  - Resolves: rhbz#786553 - sssd on ppc64 doesn't pull cyrus-sasl-gssapi.ppc as
                            a dependancy
  - Resolves: rhbz#785909 - --debug-timestamps=1 is not passed to providers
  - Resolves: rhbz#785908 - ldap_*_search_base doesn't fully limit the group and
                            netgroup search base correctly
  - Resolves: rhbz#785907 - [RFE] Add support to request canonicalization on krb
                            AS requests
  - Resolves: rhbz#785905 - [RFE] DEBUG timestamps should offer higher precision
  - Resolves: rhbz#785904 - [RFE] SSSD should have --version option
  - Resolves: rhbz#785902 - Errors with empty loginShell and proxy provider
  - Resolves: rhbz#785898 - Enable midway cache refresh by default
  - Resolves: rhbz#785888 - sssd returns empty netgroup at a second request for
                            a non-existing netgroup
  - Resolves: rhbz#785884 - Honour TTL when resolving host names
  - Resolves: rhbz#785883 - check DNS records before updates
  - Resolves: rhbz#785881 - List the keytab to pick the princiapl to use instead
                            of guessing
  - Resolves: rhbz#785880 - debug_level in sssd.conf overrides command-line
  - Resolves: rhbz#785879 - sss_obfuscate/python config parser modifies config
                            file too much
  - Resolves: rhbz#785877 - on reconnect we need to detect that a ipa/ds server
                            has been reinitialized
  - Resolves: rhbz#785741 - sssd.api.conf and sssd.api.d should not be in /etc
  - Resolves: rhbz#773660 - Kerberos errors should go to syslog
  - Resolves: rhbz#772163 - Iterator loop reuse cases a tight loop in the native
                            IPA netgroups code
  - Resolves: rhbz#771706 - sssd_be crashes during auth when there exists UTF
                            source host group in an hbacrule
  - Resolves: rhbz#771702 - sssd_pam crashes during change password operation
                            against a IPA server
  - Resolves: rhbz#771361 - case_sensitive function not working as intended for
                            ldap
  - Resolves: rhbz#768935 - Crash when applying settings
  - Resolves: rhbz#766941 - The full dyndns update message should be logged into
                            debug logs
  - Resolves: rhbz#766930 - [RFE] Add a new option to override home directory
                            value
  - Resolves: rhbz#766913 - [RFE] Add option to select validate and FAST keytab
                            principal name
  - Resolves: rhbz#766907 - Use [...] for IPv6 addresses in kdc info files
  - Resolves: rhbz#766904 - [RFE] Create a command line tool to change the debug
                            levels on the fly
  - Resolves: rhbz#766876 - [RFE] Make HBAC srchost processing optional
  - Resolves: rhbz#766141 - [RFE] SSSD should support FreeIPA's internal
                            netgroup representation
  - Resolves: rhbz#761582 - [RFE] Add ldap_sasl_minssf option
  - Resolves: rhbz#759186 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process
                            /usr/sbin/sssd was killed by signal 11 (SIGSEGV)
  - Resolves: rhbz#755506 - [RFE] Add host-based (pam_host_attr) access control
  - Resolves: rhbz#753876 - [RFE] Add support for the services map
  - Resolves: rhbz#746181 - "getgrgid call returned more than one result" after
                            group name change in MSAD
  - Resolves: rhbz#744197 - [RFE] close LDAP connection to the server when idle
                            for some (configurable) time
  - Resolves: rhbz#742510 - [RFE] Separate Cache Timeouts for SSSD
  - Related:  rhbz#742509 - [RFE] Add SSSD Tool to purge cache
  - Resolves: rhbz#742052 - id -G group resolution takes extremely long
  - Resolves: rhbz#739312 - [RFE] sssd does not set shadowLastChange
  - Resolves: rhbz#736150 - [RFE] SSSD should support multiple search bases
  - Resolves: rhbz#735827 - [RFE] Ability to set a domain as case sensitive or
                            insensitive
  - Resolves: rhbz#735405 - [RFE] Option to disable warnings for unknown users
  - Resolves: rhbz#728212 - [RFE] sssd does not handle when paging control
                            disabled for openldap
  - Resolves: rhbz#726467 - SSSD takes 30+ seconds to login
  - Resolves: rhbz#721289 - Process /usr/libexec/sssd/sssd_be was killed by
                            signal 11 during auth when password for the user is
                            not set


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-3.beta2
changelog:
  - Handle filtering python Provides in a safer way
  - Related:  rhbz#735422 - Rebase SSSD to 1.8.0 in RHEL 6.3


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-4.beta3
changelog:
  - Resolves: rhbz#761570 - [RFE] support looking up autofs maps via SSSD
  - Resolves: rhbz#788979 - sssd crashes during initgroups against a user
                            belonging to nested rfc2307bis group


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-5
changelog:
  - Resolves: rhbz#753763 - Provide logging configuration compatibility on
                            SSSD 1.5/1.6 upgrade
  - Resolves: rhbz#785871 - wrong build dependency on nscd
  - Resolves: rhbz#785873 - IPA host search base cannot be set
  - Resolves: rhbz#791208 - Entries lacking a POSIX username value break group
                            lookups
  - Resolves: rhbz#796307 - Simple Paged Search control needs to be used more
                            sparingly
  - Resolves: rhbz#797282 - sssd-1.5.1-66.el6.x86_64 needs
                            openldap >= openldap-2.4.23-20.el6.x86_64
  - Resolves: rhbz#787035 - ipa - sssd slow response with thousands of user
                            entries
  - Resolves: rhbz#742509 - [RFE] Add SSSD Tool to purge cache
  - Resolves: rhbz#772297 - Fails to update if all nisNetgroupTriple or
                            memberNisNetgroup entries are deleted from a
                            netgroup
  - Resolves: rhbz#783138 - Backend occasionally goes offline under heavy load
  - Resolves: rhbz#797975 - sssd_be: The requested target is not configured is
                            logged at each login
  - Resolves: rhbz#735422 - Rebase SSSD to 1.8.0 in RHEL 6.3


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-6
changelog:
  - Fix multilib-clean issue due to upgrade script
  - Related:  rhbz#753763 - Provide logging configuration compatibility on
                            SSSD 1.5/1.6 upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-7
changelog:
  - Fix multilib-clean issue due to upgrade script
  - Use a patch and install the script to python_sitelib
  - Related:  rhbz#753763 - Provide logging configuration compatibility on
                            SSSD 1.5/1.6 upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-8
changelog:
  - Fix multilib-clean issue due to upgrade script
  - Fix typo in the patch
  - Related:  rhbz#753763 - Provide logging configuration compatibility on
                            SSSD 1.5/1.6 upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-9
changelog:
  - Fix multilib-clean issue due to upgrade script
  - Remove old copy from the spec file
  - Related:  rhbz#753763 - Provide logging configuration compatibility on
                            SSSD 1.5/1.6 upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-10
changelog:
  - Fix explicit requires to use openldap instead of openldap-libs
  - Related:  rhbz#797282 - sssd-1.5.1-66.el6.x86_64 needs
                            openldap >= openldap-2.4.23-20.el6.x86_64


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-11
changelog:
  - Do not auto-upgrade debug levels
  - Tool still available for manual use
  - Reverts:  rhbz#753763 - Provide logging configuration compatibility on
                            SSSD 1.5/1.6 upgrade
  - Resolves: rhbz#798881 - Install-time warnings
  - Resolves: rhbz#798774 - IPA provider should assume that ipa_domain is also
                            the dns_discovery_domain
  - Resolves: rhbz#798655 - Password logins failing due to a process with high
                            UID


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-12
changelog:
  - Resolves: rhbz#801407 - sssd_nss gets hung processing identical search
                            requests
  - Resolves: rhbz#801451 - Logging in with ssh pub key should consult
                            authentication authority policies
  - Resolves: rhbz#795562 - Infinite loop checking Kerberos credentials
  - Resolves: rhbz#798317 - sssd crashes when ipa_hbac_support_srchost is set to
                            true
  - Resolves: rhbz#799039 - --debug option for sss_debuglevel doesn't work
  - Resolves: rhbz#799915 - Unable to lookup netgroups with case_sensitive=false
  - Resolves: rhbz#799929 - Raise limits for max num of files sssd_nss/sssd_pam
                            can use
  - Resolves: rhbz#799971 - sssd_be crashes on shutdown
  - Resolves: rhbz#801533 - sssd_be crashes when resolving non-trivial nested
                            group structure
  - Resolves: rhbz#801368 - Group lookups doesn't return members with proxy
                            provider configured
  - Resolves: rhbz#801377 - getent returns non-existing netgroup name, when sssd
                            is configured as proxy provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-15
changelog:
  - Update translations
  - Resolves: rhbz#802372 - Pick up latest translation files for SSSD
  - Resolves: rhbz#802207 - getent netgroup hangs when
                            "use_fully_qualified_names = TRUE" in sssd
  - Related:  rhbz#801451 - Logging in with ssh pub key should consult
                            authentication authority policies


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-17
changelog:
  - Related:  rhbz#802207 - getent netgroup hangs when
                            "use_fully_qualified_names = TRUE" in sssd
  - Resolves: rhbz#801719 - "Error looking up public keys" while ssh to replica
                            using IP address
  - Resolves: rhbz#803659 - Service lookup shows case sensitive names twice with
                            case_sensitive=false
  - Resolves: rhbz#803842 - Unable to bind to LDAP server when minssf set
  - Resolves: rhbz#805034 - accessing an undefined variable might cause crash
  - Resolves: rhbz#805108 - sss_ssh_knownhostproxy infinite loop hangs SSH login


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-18
changelog:
  - Resolves: rhbz#804057 - Initial service lookups having name with uppercase
                            alphabets doesn't work
  - Resolves: rhbz#804065 - Service lookup using case-sensitive protocol names
                            doesn't work when case_sensitive=false
  - Resolves: rhbz#805281 - sssd: Uses the wrong key when there a multiple
                            realms in a single keytab
  - Resolves: rhbz#805452 - Unable to lookup user, group, netgroup aliases with
                            case_sensitive=false
  - Resolves: rhbz#805918 - Wrong resolv_status might cause crash when name
                            resolution times out
  - Resolves: rhbz#805431 - NFS files/folders are mapped to nobody user if NFS
                            top level directory is chowned by a SSSD user


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-20
changelog:
  - Related: rhbz#805452  - Unable to lookup user, group, netgroup aliases with
                            case_sensitive=false


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-21
changelog:
  - Resolves: rhbz#808458 - Authconfig crashes when sets krb realm
  - Resolves: rhbz#808597 - sssd_nss crashes on request when no back end is
                            running
  - Resolves: rhbz#808107 - Coverity revealed memory management defects


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-22
changelog:
  - Fix typo in patch for SSH umask
  - Related:  rhbz#808107 - Coverity revealed memory management defects


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-23
changelog:
  - Resolves: rhbz#805924 - SSSD should attempt to get the RootDSE after binding
  - Resolves: rhbz#814237 - sdap_check_aliases must not error when detects the
                            same user
  - Resolves: rhbz#812281 - autofs client: map name length used as key length
  - Related:  rhbz#784870 - SSSD fails during autodetection of search bases for
                            new LDAP features
  - Related:  rhbz#814269 - sssd-1.5.1-66.el6_2.3.x86_64 freezes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-24
changelog:
  - Resolves: rhbz#805431 - NFS files/folders are mapped to nobody user if NFS
                            top level directory is chowned by a SSSD user


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-25
changelog:
  - Resolves: rhbz#816616 - group members are now lowercased in case insensitive
                            domains


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-26
changelog:
  - Resolves: rhbz#818642 - Auth fails for user with non-default attribute names
  - Resolves: rhbz#819063 - sssd fails to provide partial data till paged search
                            returns "Size Limit Exceeded"
  - Resolves: rhbz#820585 - Group enumeration fails in proxy provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-27
changelog:
  - Resolves: rhbz#820759 - AVC denial seen on sssd upgrade during ipa-client
                            upgrade
  - Resolves: rhbz#821044 - sss_groupadd no longer detects duplicate GID numbers


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-28
changelog:
  - Resolves: rhbz#822236 - SSSD netgroups do not honor
                            entry_cache_nowait_percentage


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-29
changelog:
  - Resolves: rhbz#824062 - sssd_be crashed with SIGSEGV in
                            _tevent_schedule_immediate()


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-30
changelog:
  - Resolves: rhbz#824616 - sssd_nss crashes when configured with
                            use_fully_qualified_names = true


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-31
changelog:
  - Resolves: rhbz#825028 - Service lookups by port number doesn't work on
                            s390x/ppc64 arches


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-32
changelog:
  - Fix protocol break for services map
  - Related:  rhbz#825028 - Service lookups by port number doesn't work on
                            s390x/ppc64 arches


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.0-33
changelog:
  - Resolves: rhbz#840089 - Update the shadowLastChange attribute
                            with days since the Epoch, not seconds


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-1.rc1
changelog:
  - Rebase to 1.9.0 RC1
  - Resolves: rhbz#827606 - Rebase SSSD to 1.9 in 6.4
  - Bump the selinux-policy version number to pull in required fixes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-2
changelog:
  - Fix the "ca" translation of the sssd-simple manual page
  - Related: rhbz#827606 - Rebase SSSD to 1.9 in 6.4


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-5
changelog:
  - Do not send SIGKILL to service right after sending SIGTERM
  - Resolves: #771975
  - Fix the initial sudo smart refresh
  - Resolves: #869013
  - Implement password authentication for users from trusted domains
  - Resolves: #869071
  - LDAP child crashed with a wrong keytab
  - Resolves: #869150
  - The sssd_nss process grows the memory consumption over time
  - Resolves: #869443


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-6
changelog:
  - Resolves: rhbz#871576 - sssd does not resolve group names from AD
  - Resolves: rhbz#872324 - pam: fd leak when writing the selinux login file
                            in the pam responder
  - Resolves: rhbz#871424 - authconfig chokes on sssd.conf with chpass_provider
                            directive


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-7
changelog:
  - Resolves: rhbz#873032 - Move sss_cache to the main subpackage
  - Resolves: rhbz#829740 - Init script reports complete before sssd is actually
                            working
  - Resolves: rhbz#869466 - SSSD starts multiple processes due to syntax error in
                            ldap_uri
  - Resolves: rhbz#870505 - sss_cache: Multiple domains not handled properly
  - Resolves: rhbz#867933 - invalidating the memcache with sss_cache doesn't work
                            if the sssd is not running
  - Resolves: rhbz#872110 - User appears twice on looking up a nested group


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-9
changelog:
  - Resolves: rhbz#873988 - Man page issue to list 'force_timeout' as an
                            option for the [sssd] section


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-10
changelog:
  - Resolves: rhbz#872180 - subdomains: Invalid sub-domain request type
  - Related: rhbz#867933 - invalidating the memcache with sss_cache doesn't work
                           if the sssd is not running


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-12
changelog:
  - Resolves: rhbz#870278 -  ipa client setup should configure host properly
                             in a trust is in place


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-16
changelog:
  - Resolves: rhbz#875738 - offline authentication failure always returns
                            System Error


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-19
changelog:
  - Resolves: rhbz#877130 - LDAP provider fails to save empty groups
  - Related: rhbz#869466 - check the return value of waitpid()


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-20
changelog:
  - Resolves: rhbz#877126 - subdomains code does not save the proper
                            user/group name


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-21
changelog:
  - Resolves: rhbz#877354 - ldap_connection_expire_timeout doesn't expire
                            ldap connections


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-22
changelog:
  - Resolves: rhbz#861075 - SSSD_NSS failure to gracefully restart
                            after sbus failure


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-25
changelog:
  - Resolves: rhbz#878262 - ipa password auth failing for user principal
                            name when shorter than IPA Realm name
  - Resolves: rhbz#871843 - Nested groups are not retrieved appropriately
                            from cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-26
changelog:
  - Resolves: rhbz#874673 - user id lookup fails using proxy provider
  - Fix a possibly uninitialized variable in the LDAP provider
  - Related: rhbz#877130


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-27
changelog:
  - Resolves: rhbz#824244 - sssd does not warn into sssd.log for broken
                            configurations


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-28
changelog:
  - Resolves: rhbz#874616 - Silence the DEBUG messages when ID mapping code
                            skips a built-in group


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-31
changelog:
  - Resolves: rhbz#882076 - SSSD crashes when c-ares returns success but an
                            empty hostent during the DNS update
  - Do not version libsss_sudo, it's not supposed to be linked against, but
    dlopened (Related: rhbz#761573)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-32
changelog:
  - Resolves: rhbz#875677 - password expiry warning message doesn't appear
                            during auth
  - Fix potential NULL dereference when skipping built-in AD groups
    (Related: rhbz#874616)
  - Add missing parameter to DEBUG message (Related: rhbz#829742)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-34
changelog:
  - Resolves: rhbz#877974 - updating top-level group does not reflect ghost
                            members correctly
  - Resolves: rhbz#880159 - delete operation is not implemented for ghost users


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-35
changelog:
  - Resolves: rhbz#882290 - arithmetic bug in the SSSD causes netgroup
                            midpoint refresh to be always set to 10 seconds


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-36
changelog:
  - Resolves: rhbz#883336 - sssd crashes during start if id_provider is
                            not mentioned


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-37
changelog:
  - Resolves: rhbz#884480 - user is not removed from group membership during
                            initgroups
  - Fix incorrect synchronization in mmap cache (Related: #789507)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-38
changelog:
  - Resolves: rhbz#882923 - Negative cache timeout is not working for proxy
                            provider
  - Link sss_ssh_authorizedkeys and sss_ssh_knowhostsproxy with the client
    libraries (Related: #870060)
  - Move sss_ssh_knownhosts documentation to the correct section
    (Related: #870060)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-39
changelog:
  - Resolves: rhbz#882221 - Offline sudo denies access with expired
                            entry_cache_timeout
  - Fix several bugs found by Coverity and clang:
  - Check the return value of diff_gid_lists (Related: #869071)
  - Move misplaced sysdb assignment (Related: #827606)
  - Remove dead assignment (Related: #827606)
  - Fix copy-n-paste error in the memberof plugin (Related: #877974)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-40
changelog:
  - Resolves: rhbz#880546 - krb5_kpasswd failover doesn't work
  - Fix the error handler in sss_mc_create_file (Related: #789507)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-42
changelog:
  - Resolves: rhbz#885105 - sudo denies access with disabled
                            ldap_sudo_use_host_filter


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-43
changelog:
  - Resolves: rhbz#880176 - memberUid required for primary groups to match
                            sudo rule


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-44
changelog:
  - Resolves: rhbz#878419 - sss_userdel doesn't remove entries from in-memory
                            cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-45
changelog:
  - Resolves: rhbz#858345 - pam_sss(crond:account): Request to sssd
                            failed. Timer expired


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-46
changelog:
  - Resolves: rhbz#884600 - ldap_chpass_uri failover fails on using same
                            hostname


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-47
changelog:
  - Resolves: rhbz#882923 - Negative cache timeout is not working for proxy
                            provider


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-48
changelog:
  - Resolves: rhbz#880956 - Primary server status is not always reset after
                            failover to backup server happened
  - Silence a compilation warning in the memberof plugin (Related: rhbz#877974)
  - Do not steal resolv result on error (Related: rhbz#882076)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-49
changelog:
  - Resolves: rhbz#884666 - sudo: if first full refresh fails, schedule
                            another first full refresh


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-50
changelog:
  - Resolves: rhbz#870045 - always reread the master map from LDAP
  - Resolves: rhbz#876531 - sss_cache does not work for automount maps


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-52
changelog:
  - Related: rhbz#875851 - sysdb upgrade failed converting db to 0.11
  - Include more debugging during the sysdb upgrade


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-53
changelog:
  - Resolves: rhbz#885078 - sssd_nss crashes during enumeration if the
                            enumeration is taking too long


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-54
changelog:
  - Resolves: rhbz#888614 - Failure in memberof can lead to failed database
                            update


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-57
changelog:
  - Resolves: rhbz#886091 - Disallow root SSH public key authentication
  - Add default section to switch statement (Related: rhbz#884666)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-58
changelog:
  - Resolves: rhbz#889168 - krb5 ticket renewal does not read the renewable
                            tickets from cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-62
changelog:
  - Resolves: rhbz#886848 - user id lookup fails for case sensitive users
                            using proxy provider


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-64
changelog:
  - Resolves: rhbz#891356 - Smart refresh doesn't notice "defaults" addition
                            with OpenLDAP


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-66
changelog:
  - Resolves: rhbz#874579 - sssd caching not working as expected for selinux
                            usermap contexts


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-67
changelog:
  - Resolves: rhbz#878583 - IPA Trust does not show secondary groups for AD
                            Users for commands like id and getent


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-68
changelog:
  - Resolves: rhbz#887961 - AD provider: getgrgid removes nested group
                            memberships


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-71
changelog:
  - Resolves: rhbz#895132 - Modifications using sss_usermod tool are not
                            reflected in memory cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-72
changelog:
  - Resolves: rhbz#894997 - sssd_be crashes looking up members with groups
                            outside the nesting limit


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-73
changelog:
  - Resolves: rhbz895615 - ipa-client-automount: autofs failed in s390x and
                           ppc64 platform


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-74
changelog:
  - Resolves: rhbz894381 - memory cache is not updated after user is deleted
                           from ldb cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-78
changelog:
  - Resolves: rhbz#896476 - SSSD should warn when pam_pwd_expiration_warning
                            value is higher than passwordWarning LDAP attribute.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-79
changelog:
  - Resolves: rhbz#902716 - Rule mismatch isn't noticed before smart refresh
                            on ppc64 and s390x


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-80
changelog:
  - Resolves: rhbz#903078 - Out-of-bounds read flaws in
                            autofs and ssh services responders


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-81
changelog:
  - Resolves: rhbz#903078 - TOCTOU race conditions by copying
                            and removing directory trees


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-82
changelog:
  - Resolves: rhbz#888614 - Failure in memberof can lead to failed
                            database update


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-84
changelog:
  - Resolves: rhbz#911329 - pwd_expiration_warning has wrong default for
                            Kerberos


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-85
changelog:
  - Fix pwd_expiration_warning=0
  - Resolves: rhbz#911329 - pwd_expiration_warning has wrong default for
                            Kerberos


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-86
changelog:
  - Resolves: rhbz#911299 - sssd: simple access provider flaw prevents intended
                            ACL use when client to an AD provider


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-88
changelog:
  - Resolves: #950874: Simple access control always denies uppercased users
                       in case insensitive domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-90
changelog:
  - Resolves: #953165 - Enabling enumeration causes sssd_be process to
                        utilize 100% of the CPU


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-91
changelog:
  - Resolves: #967636 - SSSD frequently fails to return automount maps
                        from LDAP


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-93
changelog:
  - Resolves: #987479 - libsss_sudo should depend on sudo package with
                        sssd support


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-94
changelog:
  - Call restorecon on memcache files to force the right context on upgrades
  - Resolves: #987456 - RHEL6 sssd upgrade restorecon workaround for
                        /var/lib/sss/mc context


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-95
changelog:
  - Mention that enumeration should be discouraged
  - Resolves: #988381 - clarify the disadvantages of enumeration in sssd.conf


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-96
changelog:
  - Resolves: #988525 - sssd fails instead of skipping when a sudo ldap
                        filter returns entries with multiple CNs


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-97
changelog:
  - Resolves: #986379 - sss_cache -N/-n should invalidate the hash table
                        in sssd_nss


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-98
changelog:
  - Resolves: #979046 - sssd_be goes to 99% CPU and causes significant login
                        delays when client is under load


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-99
changelog:
  - Clarify the min_id/max_id limits further
  - Resolves: #978994 - SSSD filter out ldap user/group if uid/gid is zero


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-101
changelog:
  - Resolves: #976273 - [RFE] Add a new override_homedir expansion for the
                        "original value"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-104
changelog:
  - Resolves: #971435 - Enhance sssd init script so that it would source
                        a configuration


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-106
changelog:
  - Format patch to configure sysv script differently
  - RHEL-6 patch(1) apparently doesn't like the output of git format-patch
   -M -C and doesn't properly copy files on renames
  - Resolves: #971435 - Enhance sssd init script so that it would source a
    configuration.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-108
changelog:
  - Set correct state of SRV servers on resolving error
  - Resolves: #954275 - sssd fails connect to IPA server during boot when
                        spanning tree is enabled in network router.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-109
changelog:
  - Use permissive control when adding ghost users
  - Resolves: #928797 - cyclic group memberships may not work depending on
                        order of operations


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-112
changelog:
  - Resolves: #918394 - sssd etas 99% CPU and runs out of file descriptors
                        when clearing cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-113
changelog:
  - Resolves: #916997 - getgrnam / getgrgid for large user groups
                        is too slow due to range retrieval functionality


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-114
changelog:
  - Resolves: #914433 - sssd pam write_selinux_login_file creating the temp
                        file for SELinux data failed


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-115
changelog:
  - Apply a forgotten dependency for patch #254
  - Related: #916997 - getgrnam / getgrgid for large user groups
                       is too slow due to range retrieval functionality
  - Add two fixes for better handling of faulty SRV processing
  - Related: #954275 - sssd fails connect to IPA server during boot when
                       spanning tree is enabled in network router.
  - Remove enumerate=true from example in man page
  - Related: #988381 - clarify the disadvantages of enumeration in sssd.conf


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-117
changelog:
  - Resolves: #966757 - SSSD failover doesn't work if the first DNS server
                       in resolv.conf is unavailable


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-119
changelog:
  - Resolves: #948830 - sssd do too many disk writes causing delay in
                        "getent netgroup allmachines-netgroup" nested netgroups.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-120
changelog:
  - Resolves: #983028 - passwd returns "Authentication token manipulation
                        error" when entering wrong current password


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-121
changelog:
  - Print password complexity hint when password change fails with
    constraint violation
  - Related: #983028 - passwd returns "Authentication token manipulation
                       error" when entering wrong current password


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-122
changelog:
  - Make IPA SELinux provider aware of subdomain users
  - Resolves: #954342 - In IPA AD trust setup, the sssd logs throws
                        'sysdb_search_user_by_name failed' error when
                        AD user tries to login via ipa client.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-123
changelog:
  - Silence restorecon on clean install
  - Resolves: #987456 - RHEL6 sssd upgrade restorecon workaround for
                        /var/lib/sss/mc context


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-124
changelog:
  - Resolves: #1002161 - large number of sudo rules results in error -
                         Unable to create response: Invalid argument


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-125
changelog:
  - Resolves: #997406 - sssd_nss core dumps under load
  - Resolves: #984814 - sssd_nss terminated with segmentation fault


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-126
changelog:
  - Make IPA SELinux provider aware of subdomain users
  - A better version of already committed patch
  - Resolves: #954342 - In IPA AD trust setup, the sssd logs throws
                        'sysdb_search_user_by_name failed' error when
                        AD user tries to login via ipa client.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-128
changelog:
  - More upstream fixes to prevent memcache crashes
  - Related: #997406 - sssd_nss core dumps under load


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-129
changelog:
  - Do not crash when LDAP disconnects while a search is still in progress
  - Resolves: #1019979 - sssd_be segfault when authenticating against active
                         directory


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-129.1
changelog:
  - Inherit UID limits for subdomains
  - Resolves: #1028046 - Creating system accounts on a IdM client takes up
                         to 10 minutes when AD trust is configured in the IdM.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-129.2
changelog:
  - Allow combination of proxy id backend and LDAP auth backend
  - Resolves: #1032966 - SSSD: Allow for custom attributes in RDN when using
                         id_provider = proxy


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-129.3
changelog:
  - Resolves: #1036168 - sssd can't retrieve auto.master when using the
                         "default_domain_suffix" option in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-129.4
changelog:
  - Resolves: #1044905 - sssd_nss grows memory footprint when netgroups
                         are requested


author: Tom Lane <tgl@redhat.com> 1.2.1-1
changelog:
  - Imported into RHEL-6 from Fedora 18
  - Dropped separate utils subpackage, because existing packages might expect
    that Requires: libjpeg is enough to pull in the command-line tools;
    we should only alter the subpackage breakdown in a new RHEL branch
  - Dropped turbojpeg build, because it doesn't seem ready for prime time
    and isn't part of our RHEL-6 requirements anyway
  Resolves: #788687


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - Put changelog at the end
  - Move .so files to devel subpackage
  - Don't mess with ld.so.conf
  - Don't use %{prefix}, this isn't a relocatable package
  - Don't define a bad docdir
  - Add BuildRequires
  - Use %{_tmppath}
  - Don't define name, version etc. on top of the file (why 
    do so many do that?)
  - s/Copyright/License/


author: Alexander Larsson <alexl@redhat.com>
changelog:
  - Add a patch that moves the includes to librsvg-1/librsvg
  - in preparation for a later librsvg 2 library.


author: Dan Williams <dcbw@redhat.com> - 2.6.4-7
changelog:
  - Fix usage of "%{_bindir}/update-gdk-pixbuf-loaders %{_host}" 
    to point to right place and architecture


author: Matthias Clasen <mclasen@redhat.com> - 2.8.1-2
changelog:
  - Must use the same rpm macro for the host triplet as the
    gtk2 package, otherwise things can fall apart.  (#137676)


author: Matthias Clasen <mclasen@redhat.com> - 2.16.0-4
changelog:
  - Don't call xmlCleanupParser, it breaks other users of thread-private
    storage
    Resolves: #578568


author: Jasper St. Pierre <jasper@redhat.com> - 2.26.0-6.1
changelog:
  - Fix build by linking in -lm
  - io: Implement strict network policy (CVE-2013-1881)
    Resolves: #1049155


author: John H Terpstra <jht@samba.anu.edu.au>
changelog:
  - Many optimisations (some suggested by Manoj Kasichainula <manojk@io.com>
  - Use of chkconfig in place of individual symlinks to /etc/rc.d/init/smb
  - Compounded make line
  - Updated smb.init restart mechanism
  - Use compound mkdir -p line instead of individual calls to mkdir
  - Fixed smb.conf file path for log files
  - Fixed smb.conf file path for incoming smb print spool directory
  - Added a number of options to smb.conf file
  - Added smbadduser command (missed from all previous RPMs) - Doooh!
  - Added smbuser file and smb.conf file updates for username map


author: Erik Troan <ewt@redhat.com>
changelog:
  - made the %postun script a tad less agressive; no reason to remove
    the logs or lock file (after all, if the lock file is still there,
    samba is still running)
  - the %postun and %preun should only exectute if this is the final
    removal
  - migrated %triggerpostun from Red Hat's samba package to work around
    packaging problems in some Red Hat samba releases


author: Bill Nottingham <notting@redhat.com>
changelog:
  - add a mount.smb to make smb mounting a little easier.
  - smb filesystems apparently don't work on alpha. Oops.


author: Bill Nottingham <notting@redhat.com>
changelog:
  - update to 2.0.5
  - fix mount.smb - smbmount options changed again.........
  - fix postun. oops.
  - update some stuff from the samba team's spec file.


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - use cp rather than mv to preserve /etc/services perms (#4938 et al).
  - use mktemp to generate /etc/tmp.XXXXXX file name.
  - add prereqs on sed/mktemp/killall (need to move killall to /bin).
  - fix trigger syntax (i.e. "samba < 1.9.18p7" not "samba < samba-1.9.18p7")


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix yp_get_default_domain in autoconf
  - only link against readline for smbclient
  - fix log rotation (#9909)


author: Than Ngo <than@redhat.de>
changelog:
  - add initdir macro to handle the initscript directory
  - add a new macro to handle /etc/pam.d/system-auth


author: Bill Nottingham <notting@redhat.com>
changelog:
  - move initscript back
  - remove 'Using Samba' book from %doc 
  - move stuff to /etc/samba (#13708)
  - default configuration tweaks (#13704)
  - some logrotate tweaks


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix swat only_from line (#18726, others)
  - fix attempt to write outside buildroot on install (#17943)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - set a default CA certificate path in smb.conf (#19010)
  - require openssl >= 0.9.5a-20 to make sure we have a ca-bundle.crt file


author: Bill Nottingham <notting@redhat.com>
changelog:
  - i18n-ize initscript
  - add a sysconfig file for daemon options (#23550)
  - clarify smbpasswd man page (#23370)
  - build with LFS support (#22388)
  - avoid extraneous pam error messages (#10666)
  - add Urban Widmark's bug fixes for smbmount (#19623)
  - fix setgid directory modes (#11911)
  - split swat into subpackage (#19706)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - tweak the PAM code some more to try to do a setcred() after initgroups()
  - pull in all of the optflags on i386 and sparc
  - don't explicitly enable Kerberos support -- it's only used for password
    checking, and if PAM is enabled it's a no-op anyway


author: Helge Deller <hdeller@redhat.de>
changelog:
  - updated to samba 2.2.0
  - moved codepages to %{_datadir}/samba/codepages
  - use all available CPUs for building rpm packages
  - use %{_xxx} defines at most places in spec-file
  - "License:" replaces "Copyright:"
  - dropped excludearch sparc
  - de-activated japanese patches 100 and 200 for now 
    (they need to be fixed and tested wth 2.2.0)
  - separated swat.desktop file from spec-file and added
    german translations
  - moved /etc/sysconfig/samba to a separate source-file
  - use htmlview instead of direct call to netscape in 
    swat.desktop-file


author: Helge Deller <hdeller@redhat.de>
changelog:
  - build as 2.2.0-1 release
  - skip the documentation-directories docbook, manpages and yodldocs
  - don't include *.sgml documentation in package
  - moved codepage-directory to /usr/share/samba/codepages
  - make it compile with glibc-2.2.3-10 and kernel-headers-2.4.2-2


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  (these changes are from the non-head version)
  - Don't include /usr/sbin/samba, it's the same as the initscript
  - unset TMPDIR, as samba can't write into a TMPDIR owned 
    by root (#41193)
  - Add pidfile: lines for smbd and nmbd and a config: line
    in the initscript  (#15343)
  - don't use make -j
  - explicitly include /usr/share/samba, not just the files in it


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - Use /var/cache/samba instead of /var/lock/samba 
  - Remove "domain controller" keyword from smb.conf, it's 
    deprecated (from #13704)
  - Sync some examples with smb.conf.default
  - Fix password synchronization (#16987)


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - Don't include smbpasswd in samba, it's in samba-common (#51598)
  - Add a disabled "obey pam restrictions" statement - it's not
    active, as we use encrypted passwords, but if the admin turns
    encrypted passwords off the choice is available. (#31351)


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.2-3
changelog:
  - Add "--with-utmp" to configure options (#55372)
  - Include winbind, pam_smbpass.so, rpcclient and smbcacls
  - start using /var/cache/samba, we need to keep state and there is
    more than just locks involved


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.2-5
changelog:
  - Teach smbadduser about "getent passwd" 
  - Fix more pid-file references
  - Add (conditional) winbindd startup to the initscript, configured in
    /etc/sysconfig/samba


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.2-6
changelog:
  - Move winbind files to samba-common. Add separate initscript for
    winbind 
  - Fixes for winbind - protect global variables with mutex, use
    more secure getenv


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.3a-3
changelog:
  - include interfaces.o in pam_smbpass.so, which needs symbols from interfaces.o
    (patch posted to samba-list by Ilia Chipitsine)


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.5-7
changelog:
  - Enable VFS support and compile the "recycling" module (#69796)
  - more selective includes of the examples dir


author: Jay Fenlason <fenlason@redhat.com> 2.2.7a-3
changelog:
  - edited spec file to put .so files in the correct directories
    on 64-bit platforms that have 32-bit compatability issues
    (sparc64, x86_64, etc).  This fixes bugzilla #83782.
  - Added samba-2.2.7a-error.patch from twaugh.  This fixes
    bugzilla #82454.


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.7a-4
changelog:
  - relink libnss_wins.so with SHLD="%{__cc} -lnsl" to force libnss_wins.so to
    link with libnsl, avoiding unresolved symbol errors on functions in libnsl


author: Jay Fenlason <fenlason@redhat.com> 2.2.8-0
changelog:
  - Upgrade to 2.2.8
  - removed commented out patches.
  - removed old patches and .md5 files from the repository.
  - remove duplicate /sbin/chkconfig --del winbind which causes
    warnings when removing samba.
  - Fixed minor bug in smbprint that causes it to fail when called with
    more than 10 parameters: the accounting file (and spool directory
    derived from it) were being set wrong due to missing {}.  This closes
    bug #86473.
  - updated smb.conf patch, includes new defaults to close bug #84822.


author: Jay Fenlason <fenlason@redhat.com> 2.2.8a-1
changelog:
  - upgrade to 2.2.8a
  - remove old .md5 files
  - add "pid directory = /var/run" to the smb.conf file.  Fixes #88495
  - Patch from jra@dp.samba.org to fix a delete-on-close regression


author: Jay Fenlason <fenlason@redhat.com> 2.2.8a-2
changelog:
  - add libsmbclient.so for gnome-vfs-extras
  - Edit specfile to specify /var/run for pid files
  - Move /tmp/.winbindd/socket to /var/run/winbindd/socket


author: Jay Fenlason <fenlason@redhat.com> 3.0.0-3beta3
changelog:
  - Merge from 3.0.0-2beta3.3E
  - (Correct log file names (#100981).)
  - (Fix pidfile directory in samab.log)
  - (Remove obsolete samba-3.0.0beta2.tar.bz2.md5 file)
  - (Move libsmbclient to the -common package (#99449))


author: Jay Fenlason <fenlason@redhat.com> 3.0.0-15
changelog:
  - New 3.0.0 final release
  - merge nmbd-netbiosname and testparm patches from 3E branch
  - updated the -logfiles patch to work against 3.0.0
  - updated the pie patch
  - update the VERSION file during build
  - use make -j if avaliable
  - merge the winbindd_privileged change from 3E
  - merge the "rm /usr/lib" patch that allows Samba to build on 64-bit
    platforms despite the broken Makefile


author: Felipe Alfaro Solana <felipe_alfaro@linuxmail.org> 3.0.1-1
changelog:
  - Update to 3.0.1
  - Removed testparm patch as it's already merged
  - Removed Samba.7* man pages
  - Fixed .buildroot patch
  - Fixed .pie patch
  - Added new /usr/bin/tdbdump file


author: Jay Fenlason <fenlason@redhat.com> 3.0.2-3rc2
changelog:
  - add %dir entries for %{_libdir}/samba and %{_libdir}/samba/charset
  - Upgrade to new upstream version
  - build mount.cifs for the new cifs filesystem in the 2.6 kernel.


author: Jay Fenlason <fenlason@redhat.com> 3.0.2-5
changelog:
  - New upstream version: 3.0.2 final includes security fix for #114995
    (CAN-2004-0082)
  - Edit postun script for the -common package to restart winbind when
    appropriate.  Fixes bugzilla #114051.


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Change all requires lines to list an explicit epoch.  Closes #102715
  - Add an explicit Epoch so that %{epoch} is defined.


author: Jay Fenlason <fenlason@redhat.com> 3.0.3-1.pre1
changelog:
  - New upstream version.
  - Updated -pie and -logfiles patches for 3.0.3pre1
  - add krb5-devel to buildrequires, fixes #116560
  - Add patch from Miloslav Trmac (mitr@volny.cz) to allow non-root to run
    "service smb status".  This fixes #116559


author: Jay Fenlason <fenlason@redhat.com> 3.0.3-2.pre2
changelog:
  - New upstream version  
  - Updated configure line to remove --with-fhs and to explicitly set all
    the directories that --with-fhs was setting.  We were overriding most of
    them anyway.  This closes #118598


author: jay Fenlason <fenlason@redhat.com> 3.0.3-3.rc1
changelog:
  - New upstream version
  - updated spec file to make libsmbclient.so executable.  This closes
    bugzilla #121356


author: Jay Fenlason <fenlason@redhat.com> 3.0.3-5
changelog:
  - Patch to allow password changes from machines patched with
    Microsoft hotfix MS04-011.
  - Include patches for https://bugzilla.samba.org/show_bug.cgi?id=1302
    and https://bugzilla.samba.org/show_bug.cgi?id=1309


author: Jay Fenlason <fenlason@redhat.com> 3.0.5.0pre1.0
changelog:
  - New upstream version
  - use % { SOURCE1 } instead of a hardcoded path
  - include -winbind patch from Gerald (Jerry) Carter (jerry@samba.org)
    https://bugzilla.samba.org/show_bug.cgi?id=1315
    to make winbindd work against Windows versions that do not have
    128 bit encryption enabled.
  - Moved %{_bindir}/net to the -common package, so that folks who just
    want to use winbind, etc don't have to install -client in order to
    "net join" their domain.
  - New upstream version obsoletes the patches added in 3.0.3-5
  - Remove smbgetrc.5 man page, since we don't ship smbget.


author: Jay Fenlason <fenlason@redhat.com> 3.0.5-0.pre1.1
changelog:
  - Backport base64_decode patche to close CAN-2004-0500
  - Backport hash patch to close CAN-2004-0686
  - use_authtok patch from Nalin Dahyabhai <nalin@redhat.com>
  - smbclient-kerberos patch from Alexander Larsson <alexl@redhat.com>
  - passwd patch uses "*" instead of "x" for "hashed" passwords for
    accounts created by winbind.  "x" means "password is in /etc/shadow" to
    brain-damaged pam_unix module.


author: Jay Fenlason <fenlason@redhat.com> 3.0.5-2
changelog:
  - Upgrade to 3.0.5, which is a regression from 3.0.5pre1 for a
    security fix.
  - Include the 3.0.4-backport patch from the 3E branch.  This restores
    some of the 3.0.5pre1 and 3.0.5rc1 functionality.


author: Jason Vas Dias <jvdias@redhat.com> 3.0.5-3
changelog:
  - Removed '-pie' patch - 3.0.5 uses -fPIC/-PIC, and the combination
  - resulted in executables getting corrupt stacks, causing smbmnt to
  - get a SIGBUS in the mount() call (bug 127420).


author: Jay Fenlason <fenlason@redhat.com> 3.0.6-3
changelog:
  - New upstream version.
  - Include post 3.0.6 patch from "Gerald (Jerry) Carter" <jerry@samba.org>
    to fix a duplicate in the LDAP schema.
  - Include 64-bit timestamp patch from Ravikumar (rkumar@hp.com)
    to allow correct timestamp handling on 64-bit platforms and fix #126109.
  - reenable the -pie patch.  Samba is too widely used, and too vulnerable
    to potential security holes to disable an important security feature
    like -pie.  The correct fix is to have the toolchain not create broken
    executables when programs compiled -pie are stripped.
  - Remove obsolete patches.
  - Modify this spec file to put libsmbclient.{a,so} in the right place on
    x86_64 machines.


author: Jay Fenlason <fenlason@redhat.com> 3.0.7-3
changelog:
  - Upgrade to 3.0.7, which fixes CAN-2004-0807 CAN-2004-0808
    This obsoletes the 3.0.6-schema patch.
  - Update BuildRequires line to include openldap-devel openssl-devel
    and cups-devel


author: Jay Fenlason <fenlason@redhat.com> 3.0.7-4
changelog:
  - Update docs section to not carryover the docs/manpages directory
    This moved many files from /usr/share/doc/samba-3.0.7/docs/* to
    /usr/share/doc/samba-3.0.7/*
  - Modify spec file as suggested by Rex Dieter (rdieter@math.unl.edu)
    to correctly create libsmbclient.so.0 and to use %_initrddir instead
    of rolling our own.  This closes #132642
  - Add patch to default "use sendfile" to no, since sendfile appears to
    be broken
  - Add patch from Volker Lendecke <vl@samba.org> to help make
    ldapsam_compat work again.
  - Add patch from "Vince Brimhall" <vbrimhall@novell.com> for ldapsam_compat
    These two patches close bugzilla #132169


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Include patch from Steven Lawrance (slawrance@yahoo.com) that modifies
    smbmnt to work with 32-bit uids.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-0.pre1.2
changelog:
  - Re-enable the x_fclose patch that was accidentally disabled
    in 3.0.8-0.pre1.1.  This closes #135832
  - include Nalin's -fqdn and -salt patches.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-0.pre1.3
changelog:
  - disable the -salt patch, because it causes undefined references in
    libsmbclient that prevent gnome-vfs from building.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-2
changelog:
  - New upstream version fixes CAN-2004-0930.  This obsoletes the
    disable-sendfile, salt, signing-shortkey and fqdn patches.
  - Add my <fenlason@redhat.com> ugly non-ascii-domain patch.
  - Updated the pie patch for 3.0.8.
  - Updated the logfiles patch for 3.0.8.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-3
changelog:
  - Include the corrected docs tarball, and use it instead of the
    obsolete docs from the upstream 3.0.8 tarball.
  - Update the logfiles patch to work with the updated docs.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-3.1
changelog:
  - Rescue the install.mount.smbfs patch from Juanjo Villaplana
    (villapla@si.uji.es) to prevent building the srpm from trashing your
    installed /usr/bin/smbmount


author: Than Ngo <than@redhat.com> 3.0.8-4
changelog:
  - fix unresolved symbols in libsmbclient which caused applications
    such as KDE's konqueror to fail when accessing smb:// URLs. #139894


author: Jay Fenlason <fenlason@redhat.com> 3.0.9-2
changelog:
  - New upstream release.  This obsoletes the -secret patch.
    Include my changetrustpw patch to make "net ads changetrustpw" stop
    aborting.  This closes #134694
  - Remove obsolete triggers for ancient samba versions.
  - Move /var/log/samba to the -common rpm.  This closes #76628
  - Remove the hack needed to get around the bad docs files in the
    3.0.8 tarball.
  - Change the comment in winbind.init to point at the correct pidfile.
    This closes #76641


author: Jay Fenlason <fenlason@redhat.com> 3.0.10-2
changelog:
  - New upstream release that closes CAN-2004-1154  bz#142544
  - Include the -64bit patch from Nalin.  This closes bz#142873
  - Update the -logfiles patch to work with 3.0.10
  - Create /var/run/winbindd and make it part of the -common rpm to close
    bz#142242


author: Jay Fenlason <fenlason@redhat.com> 3.0.10-4
changelog:
  - Update the -man patch to fix ntlm_auth.1 too.
  - Move pam_smbpass.so to the -common package, so both the 32
    and 64-bit versions will be installed on multiarch platforms.
    This closes bz#143617
  - Added new -delim patch to fix mount.cifs so it can accept
    passwords with commas in them (via environment or credentials
    file) to close bz#144198


author: Jay Fenlason <fenlason@redhat.com> 3.0.11-3
changelog:
  - add -gcc4 patch to compile with gcc 4.
  - remove the now obsolete -smbclient-kerberos.patch
  - Include four upstream patches from
    http://samba.org/~jerry/patches/post-3.0.11/
    (Slightly modified the winbind_find_dc_v2 patch to apply easily with
    rpmbuild).


author: Jay Fenlason <fenlason@redhat.com> 3.0.11-4
changelog:
  - Use the updated filter-requires-samba.sh file, so we don't accidentally
    pick up a dependency on perl(Crypt::SmbHash)


author: Jay Fenlason <fenlason@redhat.com> 3.0.13-2
changelog:
  - New upstream release
  - add my -quoting patch, to fix swat with strings that contain
    html meta-characters, and to use correct quote characters in
    lists, closing bz#134310
  - include the upstream winbindd_2k3sp1 patch
  - include the -smbclient patch.
  - include the -hang patch from upstream.


author: Jay Fenlason <fenlason@redhat.com> 3.0.14a-2
changelog:
  - New upstream release.
  - the -64bit-timestamps, -clitar, -establish_trust, user_rights_v1,
    winbind_find_dc_v2 patches are now obsolete.


author: Jay Fenlason <fenlason@redhat.com> 3.0.20-2
changelog:
  - New upstream release
    Includes five upstream patches -bug3010_v1, -groupname_enumeration_v3,
      -regcreatekey_winxp_v1, -usrmgr_groups_v1, and -winbindd_v1
    This obsoletes the -pie and -delim patches
    the -warning and -gcc4 patches are obsolete too
    The -man, -passwd, and -smbspool patches were updated to match 3.0.20pre1
    Also, the -quoting patch was implemented differently upstream
    There is now a umount.cifs executable and manpage
    We run autogen.sh as part of the build phase
    The testprns command is now gone
    libsmbclient now has a man page
  - Include -bug106483 patch to close
    bz#106483 smbclient: -N negates the provided password, despite documentation
  - Added the -warnings patch to quiet some compiler warnings.
  - Removed many obsolete patches from CVS.


author: Jay Fenlason <fenlason@redhat.com> 3.0.20b-2
changelog:
  - turn on -DLDAP_DEPRECATED to allow access to ldap functions that have
    been depricated in 2.3.11, but which don't have well-documented
    replacements (ldap_simple_bind_s(), for example).
  - Upgrade to 3.0.20b, which includes all the previous upstream patches.
  - Updated the -warnings patch for 3.0.20a.
  - Include  --with-shared-modules=idmap_ad,idmap_rid to close
    bz#156810 --with-shared-modules=idmap_ad,idmap_rid
  - Include the new samba.pamd from Tomas Mraz (tmraz@redhat.com) to close
    bz#170259 pam_stack is deprecated


author: Jay Fenlason <fenlason@redhat.com> 3.0.21b-2
changelog:
  - New upstream version.
  - Since the rawhide kernel has dropped support for smbfs, remove smbmount
    and smbumount.  Users should use mount.cifs instead.
  - Upgrade to 3.0.21b


author: Jay Fenlason <fenlason@redhat.com> 3.0.23-0.RC3
changelog:
  - New upstream RC release.
  - Update the -logfiles, and -passwd patches for
    3.0.23rc3
  - Include the change to smb.init from Bastien Nocera <bnocera@redhat.com>)
    to close
    bz#182560 Wrong retval for initscript when smbd is dead
  - Update this spec file to build with 3.0.23rc3
  - Remove the -install.mount.smbfs patch, since we don't install
    mount.smbfs any more.


author: Jay Fenlason <fenlason@redhat.com> 3.0.23-2
changelog:
  - New upstream release.
  - Use modified filter-requires-samba.sh from packaging/RHEL/setup/
    to get rid of bogus dependency on perl(Unicode::MapUTF8)
  - Update the -logfiles and -smb.conf patches to work with 3.0.23


author: Jay Fenlason <fenlason@redhat.com> 3.0.23a-3
changelog:
  - Fix the -logfiles patch to close
    bz#199607 Samba compiled with wrong log path.
    bz#199206 smb.conf has incorrect log file path


author: Simo Sorce <ssorce@redhat.com> 3.0.24-2.fc7
changelog:
  - New upstream release
  - Fix packaging issue wrt idmap modules used only by smbd
  - Addedd Vista Patchset for compatibility with Windows Vista
  - Change default of "msdfs root", it seem to cause problems with
    some applications and it has been proposed to change it for
    3.0.25 upstream


author: Simo Sorce <ssorce@redhat.com> 3.0.24-3.fc7
changelog:
  - Directories reorg, tdb files must go to /var/lib, not
    to /var/cache, add migration script in %post common
  - Split out libsmbclient, devel and doc packages
  - Remove libmsrpc.[h|so] for now as they are not really usable
  - Remove kill -HUP from rotate, samba use -HUP for other things
    noit to reopen logs


author: Simo Sorce <ssorce@redhat.com> 3.0.24-5.fc7
changelog:
  - actually use the correct samba.pamd file not the old samba.pamd.stack file
  - fix logifles and use upstream convention of log.* instead of our old *.log
    Winbindd creates its own log.* files anyway so we will be more consistent
  - install our own (enhanced) default smb.conf file
  - Fix pam_winbind acct_mgmt PAM result code (prevented local users from
    logging in). Fixed by Guenther.
  - move some files from samba to samba-common as they are used with winbindd
    as well


author: Simo Sorce <ssorce@redhat.com> 3.0.24-6.fc7
changelog:
  - do not put comments inline on smb.conf options, they may be read
    as part of the value (for example log files names)


author: Simo Sorce <ssorce@redhat.com> 3.0.24-7.fc7
changelog:
  - make winbindd start earlier in the init process, at the same time
    ypbind is usually started as well
  - add a sepoarate init script for nmbd called nmb, we need to be able
    to restart nmbd without dropping al smbd connections unnecessarily


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - remove patch for bug 106483 as it introduces a new bug that prevents
    the use of a credentials file with the smbclient tar command
  - move the samba private dir from being the same as the config dir
    (/etc/samba) to /var/lib/samba/private


author: Simo Sorce <ssorce@redhat.com> 3.0.24-9.fc7
changelog:
  - integrate most of merge review proposed changes (bug #226387)
  - remove libsmbclient-devel-static and simply stop shipping the
    static version of smbclient as it seem this is deprecated and
    actively discouraged


author: Simo Sorce <ssorce@redhat.com> 3.0.24-10.fc7
changelog:
  - set passdb backend = tdbsam as default in smb.conf
  - remove samba-docs dependency from swat, that was a mistake
  - put back COPYING and other files in samba-common
  - put examples in samba not in samba-docs
  - leave only stuff under docs/ in samba-doc


author: Guenther Deschner <gdeschner@redhat.com> 3.0.24-11.fc7
changelog:
  - enable PAM and NSS dlopen checks during build
  - fix unresolved symbols in libnss_wins.so (bug #198230)


author: Simo Sorce <ssorce@redhat.com> 3.0.24-12.fc7
changelog:
  - fixes in smb.conf
  - advice in smb.conf to put scripts in /var/lib/samba/scripts
  - create /var/lib/samba/scripts so that selinux can be happy
  - fix Vista problems with msdfs errors


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - fixes in the spec file
  - moved to 3.0.25rc1
  - addedd patches (merged upstream so they will be removed in 3.0.25rc2)


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - update to 3.0.25a as it contains many fixes
  - add a fix for pam_smbpass made by Günther but committed upstream after 3.0.25a was cut.


author: Simo Sorce <ssorce@redhat.com> 3.2.0-0.pre1.fc9
changelog:
  - New major relase, minor switched from 0 to 2
  - License change, the code is now GPLv3+
  - Numerous improvements and bugfixes included
  - package libsmbsharemodes too
  - remove smbldap-tools as they are already packaged separately in Fedora
  - Fix bug 245506


author: Simo Sorce <ssorce@redhat.com> - 3.2.0-0.pre1.3
changelog:
  - Try to fix GCC 4.3 build
  - Add --with-dnsupdate flag and also make sure other flags are required just to
    be sure the features are included without relying on autodetection to be
    successful


author: Guenther Deschner <gdeschner@redhat.com> - 3.3.0-0.25
changelog:
  - Update to 3.3.0 final
  - Add upstream fix for ldap connections to AD (Bug #6073)
  - Remove bogus perl dependencies (resolves: #473051)


author: Simo Sorce <ssorce@redhat.com> - 3.3.1-0.29
changelog:
  - Make the talloc and ldb packages optionsl and disable their build within
    the samba3 package, they are now built as part of the samba4 package
    until they will both be released as independent packages.


author: Simo Sorce <ssorce@redhat.com> - 3.3.2-0.33
changelog:
  - Fix nmbd init script nmbd reload was causing smbd not nmbd to reload the
    configuration
  - Fix upstream bug 6224, nmbd was waiting 5+ minutes before running elections on
    startup, causing your own machine not to show up in the network for 5 minutes
    if it was the only client in that workgroup (fix committed upstream)


author: Guenther Deschner <gdeschner@redhat.com> - 3.4.0-0.41
changelog:
  - Fix Bug #6551 (vuid and tid not set in sessionsetupX and tconX)
  - Specify required talloc and tdb version for BuildRequires


author: Simo Sorce <ssorce@redhat.com> - 3.4.2-47
changelog:
  - Spec file cleanup
  - Fix sources upstream location
  - Remove conditionals to build talloc and tdb, now they are completely indepent
    packages in Fedora
  - Add defattr() where missing
  - Turn all tabs into 4 spaces
  - Remove unused migration script
  - Split winbind-clients out of main winbind package to avoid multilib to include
    huge packages for no good reason


author: Guenther Deschner <gdeschner@redhat.com> - 3.4.2-49
changelog:
  - Add missing defattrs in specfile
  - Fix upstream tarball url in specfile
  - Cleanup unapplied patch
  - related: #543948


author: Guenther Deschner <gdeschner@redhat.com> - 3.5.1-56
changelog:
  - Update to 3.5.1
  - Security update that resolves CVE-2010-0728
  - Remove cifs.upcall and mount.cifs entirely
  - related: #556558


author: Guenther Deschner <gdeschner@redhat.com> - 3.5.8-89
changelog:
  - Fix printcap handling and cups spooler interaction
  - resolves: #709070
  - Fix spoolss form index mixup (wrong papersize)
  - resolves: #703393


author: Guenther Deschner <gdeschner@redhat.com> - 3.5.8-91
changelog:
  - Fix lsa lookupsids calls over ncacn_ip_tcp that caused getent passwd queries
    to fail
  - resolves: #709641


author: - Andreas Schneider <asn@redhat.com> - 3.6.8-131
changelog:
  - Handle error if invalid ports have been specified gracefully.
  - resolves: #845760
  - Fix printing regression with builtin forms.
  - resolves: #860967


author: - Andreas Schneider <asn@redhat.com> - 3.6.8-136
changelog:
  - Fix loading the imap hash module.
  - resolves: #864045
  - Fix raw printing support.
  - related: #857942


author: - Alexander Bokovoy <abokovoy@redhat.com> - 3.6.8-137
changelog:
  - Use alternatives to configure winbind_krb5_locator.so.
  - Move wbinfo and ntlm_auth to the correct package so samba4 can
    correctly handle conflicts.
  - resolves: #864950


author: - Andreas Schneider <asn@redhat.com> - 3.6.9-152
changelog:
  - Fix 'map untrusted to domain' with NTLMv2.
  - resolves: #961932
  - Fix the username map optimization.
  - resolves: #952268
  - Fix 'net ads keytab add' not respecting the case.
  - resolves: #955683
  - Fix write operations as guest with security = share
  - resolves: #953025
  - Fix pam_winbind upn to username conversion if you have different seperator.
  - resolves: #949613
  - Change chkconfig order to start winbind before netfs.
  - resolves: #948623
  - Fix cache issue when resoliving groups without domain name.
  - resolves: #927383


author: - Andreas Schneider <asn@redhat.com> - 3.6.9-153
changelog:
  - Fix overwrite of errno in check_parent_exists().
  - resolves: #966489
  - Fix dir code using dirfd() without vectoring trough VFS calls.
  - resolves: #971283


author: - Andreas Schneider <asn@redhat.com> - 3.6.9-155
changelog:
  - Check for system libtevent and require version 0.9.18.
  - Use tevent epoll backend in winbind.
  - resolves: #951175


author: - Andreas Schneider <asn@redhat.com> - 3.6.9-156
changelog:
  - Fix PIDL parsing with newer versions of gcc.
  - Fix dereferencing a unique pointer in the WKSSVC server.
  - resolves: #980382


author: - Andreas Schneider <asn@redhat.com> - 3.6.9-158
changelog:
  - resolves: #984808 - CVE-2013-4124: DoS via integer overflow when reading
                        an EA list


author: - Andreas Schneider <asn@redhat.com> - 3.6.9-159
changelog:
  - resolves: #995109 - net ads join - segmentation fault if no realm has been
                        specified.
  - List all vfs, auth and charset modules in the spec file.


author: - Andreas Schneider <asn@redhat.com> - 3.6.9-160
changelog:
  - resolves: #948071 - Group membership is not correct on logins with new
                        AD groups.
  - resolves: #953985 - User and group info not return from a Trusted Domain.


author: - Andreas Schneider <asn@redhat.com> - 3.6.9-161
changelog:
  - resolves: #997338 - Fix smbstatus as non root user.
  - resolves: #1003689 - Fix Windows 8 printer driver support.


author: - Andreas Schneider <asn@redhat.com> - 3.6.9-164
changelog:
  - resolves: #1008574 - Fix offline logon cache not updating for cross child
                         domain group membership.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - enable zip and jpeg codecs
  - change defattr in normal package to 0755
  - add defattr to -devel package


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move man pages from devel package to the regular one
  - integrate Frank Warmerdam's fixed .fax handling code (keep until next release
    of libtiff)
  - fix fax2ps breakage (bug #8345)


author: Phil Knirsch <phil@redhat.de>
changelog:
  - Fixed ia64 problem with tiffinfo. Was general 64 bit arch problem where s390x
    and ia64 were missing (#52129).


author: Matthias Clasen <mclasen@redhat.com> - 3.7.1-3
changelog:
  - Drop the largefile patch again
  - Fix a problem with the handling of alpha channels
  - Fix an integer overflow in tiffdump (#143576)


author: Matthias Saou <http://freshrpms.net/> 3.7.4-2
changelog:
  - Remove useless explicit dependencies.
  - Minor spec file cleanups.
  - Move make check to %check.
  - Add _smp_mflags.


author: Matthias Clasen <mclasen@redhat.com>
changelog:
  - Fix several vulnerabilities (CVE-2006-3460 CVE-2006-3461
    CVE-2006-3462 CVE-2006-3463 CVE-2006-3464 CVE-2006-3465)


author: Jindrich Novy <jnovy@redhat.com> - 3.8.2-6
changelog:
  - fix CVE-2006-2193, tiff2pdf buffer overflow (#194362)
  - fix typo in man page for tiffset (#186297)
  - use %{?dist}


author: Tom Lane <tgl@redhat.com> 3.8.2-8
changelog:
  - Restore static library to distribution, in a separate -static subpackage
  Resolves: #219905
  - Don't apply multilib header hack to unrecognized architectures
  Resolves: #233091
  - Remove documentation for programs we don't ship
  Resolves: #205079
  Related: #185145


author: Tom Lane <tgl@redhat.com> 3.8.2-11
changelog:
  - Fix LZW decoding vulnerabilities (CVE-2008-2327)
  Related: #458674
  - Use -fno-strict-aliasing per rpmdiff recommendation


author: Tom Lane <tgl@redhat.com> 3.9.2-3
changelog:
  - Sync with F-12, including:
  - Update to libtiff 3.9.2; stop carrying a lot of old patches
  - Apply Warmerdam's partial fix for bug #460322 ... better than nothing.
  - Use build system's libtool instead of what package contains;
    among other cleanup this gets rid of unwanted rpath specs in executables
  - add sparc/sparc64 to multilib header support
  - Apply Adam Goode's fix for Warmerdam's fix
  Resolves: #552360
  Resolves: #533353
  - Add some defenses to prevent tiffcmp from crashing on downsampled JPEG
    images; this isn't enough to make it really work correctly though


author: Tom Lane <tgl@redhat.com> 3.9.4-1
changelog:
  - Update to libtiff 3.9.4, for numerous bug fixes including fixes for
    CVE-2010-1411, CVE-2010-2065, CVE-2010-2067, CVE-2010-2233
  Resolves: #606708, #588784, #589034, #603024
  - Add fixes for multiple SIGSEGV problems
  Resolves: #603081, #603699, #603703


author: Tom Lane <tgl@redhat.com> 3.9.4-3
changelog:
  - Fix incorrect fix for CVE-2011-0192
  Resolves: #688830
  - Add fix for CVE-2011-1167
  Resolves: #688743


author: Tom Lane <tgl@redhat.com> 3.9.4-8
changelog:
  - Fix incomplete patch for CVE-2012-3401
  - Add libtiff-tiffinfo-exif.patch so that our test case for CVE-2012-5581 works
    with pre-4.0.2 libtiff
  Resolves: #885311


author: Steve Dickson <steved@redhat.com> 0.1.7-2
changelog:
  - Uncommented tcp6 and udp6 in the default /etc/netconfig file.
  - Added hooks to used the libgssapi library.


author: <steved@redhat.com> 0.1.7-6
changelog:
  - Fixed potential buffer overflow in xdr_strings
  - Added a optimization to bindresvport that allows more
    ports to be tried.


author: <steved@redhat.com> 0.1.7-9
changelog:
  - Fixed mutex lock problem in clnt_raw_create()
  - Ignore the return value of snprintf() and use strlen() instead
    to bump the pointer in clnt_sperror()
  - A couple ntohs() were needed in bindresvport_sa()
  - Added IP_RECVERR processing with to clnt_dg_call() so
    application will see errors instead of timing out
  - Make sure remote address (xp_rtaddr) is populated
    with the correct type of address.
  - Change the order of network ids in /etc/netconfg
    putting ipv4 ids before ipv6.
  - Bumped up Release from 8 to 9.


author: Steve Dickson <steved@redhat.com> 0.1.7-11
changelog:
  - Made tcp6/udp6 network ids no longer visible in the netconfig
    file since the ipv6 code is not fully baked yet in rpcbind. (bz 249121)


author: Steve Dickson <steved@redhat.com> 0.1.9-5
changelog:
  - Fix for taddr2addr conversion bug of local addresses
  - Fixed some of warnings in: src/auth_time.c, src/clnt_dg.c and
    src/clnt_raw.c
  - Added some #ifdef NOTUSED around some code in src/rpbc_clnt.c
    that was not being used...


author: Steve Dickson <steved@redhat.com> 0.1.10-3
changelog:
  - backwards compatibility: fix order of fields in TI-RPC's 
    svc_req (bz 481388)
  - Removed a number warnings.


author: Steve Dickson <steved@redhat.com> 0.1.10-6
changelog:
  - libtirpc: set r_netid and r_owner in __rpcb_findaddr_timed
  - libtirpc: be sure to free cl_netid and cl_tp
  - libtirpc: must free saved wire verifier when destroying context


author: Tom "spot" Callaway <tcallawa@redhat.com> 0.1.11-3
changelog:
  - Replace the Sun RPC license with the BSD license, with the explicit permission of Sun Microsystems


author: Steve Dickson <steved@redhat.com> 0.2.0-2
changelog:
  - Updated to latest upstream tag: 0-2-1-rc2
      rpcb_clnt: RPC_PROGNOTREGISTERED is a permanent error
      clnt_dg: Fix infinite loop when datagram call times ou
      Updated .gitignore file
      Replace the hard coded path name with the top_srcdir macrc
      Added 'doc' to the SUBDIRS list so make install work correctly.


author: Steve Dickson <steved@redhat.com> 0.2.0-3
changelog:
  - Updated to latest upstream tag: 0-2-1-rc3
      Fixed the --disable-gss options
      Fixed a number of warnings
      Change how architectures are define in xdr_float.c


author: Daniel Veillard <veillard@redhat.com> 0.0.6-1
changelog:
  - added error handling APIs
  - small bug fixes
  - improve python bindings
  - augment documentation and regression tests


author: Daniel Veillard <veillard@redhat.com> 0.1.0-1
changelog:
  - various fixes
  - new APIs: for Node information and Reboot
  - virsh improvements and extensions
  - documentation updates and man page
  - enhancement and fixes of the XML description format


author: Daniel Veillard <veillard@redhat.com> 0.1.1-1
changelog:
  - extend and cleanup the driver infrastructure and code
  - python examples
  - extend uuid support
  - bug fixes, buffer handling cleanups
  - support for new Xen hypervisor API
  - test driver for unit testing
  - virsh --conect argument


author: Daniel Veillard <veillard@redhat.com> 0.1.4-1
changelog:
  - vCPUs and affinity support
  - more complete XML, console and boot options
  - specific features support
  - enforced read-only connections
  - various improvements, bug fixes


author: Daniel Veillard <veillard@redhat.com> 0.1.5-1
changelog:
  - new release
  - bug fixes
  - support for new hypervisor calls
  - early code for config files and defined domains


author: Daniel Veillard <veillard@redhat.com> 0.1.6-1
changelog:
  - Support for localization
  - Support for new Xen-3.0.3 cdrom and disk configuration
  - Support for setting VNC port
  - Fix bug when running against xen-3.0.2 hypercalls
  - Fix reconnection problem when talking directly to http xend


author: Daniel Veillard <veillard@redhat.com> 0.1.7-1
changelog:
  - Fix bug when running against xen-3.0.3 hypercalls
  - Fix memory bug when getting vcpus info from xend


author: Daniel Veillard <veillard@redhat.com> 0.1.8-1
changelog:
  - fix missing page size detection code for ia64
  - fix mlock size when getting domain info list from hypervisor
  - vcpu number initialization
  - don't label crashed domains as shut off
  - fix virsh man page
  - blktapdd support for alternate drivers like blktap
  - memory leak fixes (xend interface and XML parsing)
  - compile fix
  - mlock/munlock size fixes


author: Daniel Veillard <veillard@redhat.com> 0.1.9-1
changelog:
  - better error reporting
  - python bindings fixes and extensions
  - add support for shareable drives
  - add support for non-bridge style networking
  - hot plug device support
  - added support for inactive domains
  - API to dump core of domains
  - various bug fixes, cleanups and improvements
  - updated the localization


author: Daniel Veillard <veillard@redhat.com> 0.1.10-1.fc7
changelog:
  - support for inactive Xen domains
  - improved support for Xen display and vnc
  - a few bug fixes
  - localization updates


author: Daniel P. Berrange <berrange@redhat.com> - 0.2.0-2.fc7
changelog:
  - Fixed path to qemu daemon for autostart
  - Fixed generation of <features> block in XML
  - Pre-create config directory at startup


author: Daniel P. Berrange <berrange@redhat.com> - 0.2.0-3.fc7
changelog:
  - Disable kqemu support since its not in Fedora qemu binary
  - Fix for -vnc arg syntax change in 0.9.0  QEMU


author: Daniel Veillard <veillard@redhat.com> - 0.2.1-1
changelog:
  - Release of 0.2.1
  - lot of bug and portability fixes
  - Add support for network autostart and init scripts
  - New API to detect the virtualization capabilities of a host
  - Documentation updates


author: Jeremy Katz <katzj@redhat.com> - 0.2.1-2.fc7
changelog:
  - don't require xen; we don't need the daemon and can control non-xen now
  - fix scriptlet error (need to own more directories)
  - update description text


author: Daniel Veillard <veillard@redhat.com> - 0.2.3-1
changelog:
  - Release of 0.2.3
  - lot of assorted bugfixes and cleanups
  - support for Xen-3.1
  - new scheduler API


author: Daniel Veillard <veillard@redhat.com> - 0.3.0-1
changelog:
  - Release of 0.3.0
  - Secure remote access support
  - unification of daemons
  - lots of assorted bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.3.1-1
changelog:
  - Release of 0.3.1
  - localtime clock support
  - PS/2 and USB input devices
  - lots of assorted bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.3.2-1
changelog:
  - Release of 0.3.2
  - API for domains migration
  - APIs for collecting statistics on disks and interfaces
  - lots of assorted bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.3.3-1
changelog:
  - Release of 0.3.3
  - Avahi support
  - NUMA support
  - lots of assorted improvements, bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.4.0-1
changelog:
  - Release of 0.4.0
  - SASL based authentication
  - PolicyKit authentication
  - improved NUMA and statistics support
  - lots of assorted improvements, bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.4.1-1
changelog:
  - Release of 0.4.1
  - Storage APIs
  - xenner support
  - lots of assorted improvements, bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.7.0-1
changelog:
  - ESX, VBox3, Power Hypervisor drivers
  - new net filesystem glusterfs
  - Storage cloning for LVM and Disk backends
  - interface implementation based on netcf
  - Support cgroups in QEMU driver
  - QEmu hotplug NIC support
  - a lot of fixes


author: Mark McLoughlin <markmc@redhat.com> - 0.7.0-2
changelog:
  - Make sure qemu can access kernel/initrd (bug #516034)
  - Set perms on /var/lib/libvirt/boot to 0711 (bug #516034)


author: Mark McLoughlin <markmc@redhat.com> - 0.7.0-5
changelog:
  - Add PCI host device hotplug support
  - Allow PCI bus reset to reset other devices (#499678)
  - Fix stupid PCI reset error message (bug #499678)
  - Allow PM reset on multi-function PCI devices (bug #515689)
  - Re-attach PCI host devices after guest shuts down (bug #499561)
  - Fix list corruption after disk hot-unplug
  - Fix minor 'virsh nodedev-list --tree' annoyance


author: Mark McLoughlin <markmc@redhat.com> - 0.7.1-0.2.gitfac3f4c
changelog:
  - Update to newer snapshot of 0.7.1
  - Stop libvirt using untrusted 'info vcpus' PID data (#520864)
  - Support relabelling of USB and PCI devices
  - Enable multipath storage support
  - Restart libvirtd upon RPM upgrade


author: Daniel Veillard <veillard@redhat.com> - 0.7.1-1
changelog:
  - Upstream release of 0.7.1
  - ESX, VBox driver updates
  - mutipath support
  - support for encrypted (qcow) volume
  - compressed save image format for Qemu/KVM
  - QEmu host PCI device hotplug support
  - configuration of huge pages in guests
  - a lot of fixes


author: Mark McLoughlin <markmc@redhat.com> - 0.7.1-8
changelog:
  - Disable sound backend, even when selinux is disabled (#524499)
  - Re-label qcow2 backing files (#497131)


author: Mark McLoughlin <markmc@redhat.com> - 0.7.1-10
changelog:
  - Create /var/log/libvirt/{lxc,uml} dirs for logrotate
  - Make libvirt-python dependon on libvirt-client
  - Sync misc minor changes from upstream spec


author: Mark McLoughlin <markmc@redhat.com> - 0.7.1-11
changelog:
  - Fix libvirtd memory leak during error reply sending (#528162)
  - Add several PCI hot-unplug typo fixes from upstream


author: Daniel Veillard <veillard@redhat.com> - 0.7.2-1
changelog:
  - Upstream release of 0.7.2
  - Allow to define ESX domains
  - Allows suspend and resulme of LXC domains
  - API for data streams
  - many bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.7.4-1
changelog:
  - upstream release of 0.7.4
  - udev node device backend
  - API to check object properties
  - better QEmu monitor processing
  - MAC address based port filtering for qemu
  - support IPv6 and multiple addresses per interfaces
  - a lot of fixes


author: Daniel Veillard <veillard@redhat.com> - 0.7.5-1
changelog:
  - Add new API virDomainMemoryStats
  - Public API and domain extension for CPU flags
  - vbox: Add support for version 3.1
  - Support QEMU's virtual FAT block device driver
  - a lot of fixes


author: Daniel Veillard <veillard@redhat.com> - 0.7.6-0.pre20100121
changelog:
  - Push a prerelease version of 0.7.6 for testing in Beta1
  - Allow specifying -cpu model/flags for qemu
  - Resolves: rhbz#515213
  - Add async qemu machine protocol to libvirt based on JSON QEmu API
  - Resolves: rhbz#518701
  - Allow for static PCI address assignment to all devices
  - Resolves: rhbz#481924
  - expose qemu's -fda fat:floppy feature (525074)
  - configuration of virtual CPU topology (sockets, threads, cores) (538015)
  - rewrite file chown'ing code to use security driver framework (547545 )
  - cannot create a headless KVM virtual machine (548127)
  - Improve virsh schedular parameters documentation (548485)
  - Fail to delete a inactive pool using command "virsh pool-delete" (530985)
  - virsh man page updation for using container (lxc:///) (528709)
  - Command 'virsh vcpuinfo' returns libvirt error in RHEL6 with KVM (522829)
  - Expose information about host CPU flags in capabilities (518062)


author: Daniel Veillard <veillard@redhat.com> - 0.7.6-1
changelog:
  - upstream release of 0.7.6
  - Use QEmu new device adressing when possible
  - Implement CPU topology support for QEMU driver
  - Implement SCSI controller hotplug/unplug for QEMU
  - Implement support for multi IQN
  - a lot of fixes and improvements
  - Resolves: rhbz#558761


author: Daniel Veillard <veillard@redhat.com> - 0.7.6-2
changelog:
  - enable JSON interface, desactivated by default in 0.7.6
  - Resolves: rhbz#563189
  - make sure cgroups are installed and that cgconfig service is on
  - Resolves: rhbz#531263


author: Daniel P. Berrange <berrange@redhat.com> - 0.7.6-3
changelog:
  - Fix balloon units handling in JSON mode (rhbz #566261)
  - Invoke qmp_capabilities at monitor startup (rhbz #563189)


author: Daniel Veillard <veillard@redhat.com> - 0.7.7-1
changelog:
  - macvtap support (rhbz#553348)
  - async job handling (rhbz #515278)
  - virtio channel (rhbz#515281)
  - computing baseline CPU
  - virDomain{Attach,Detach}DeviceFlags
  - Improve libvirt error reporting for failed migrations (rhbz#528793)
  - qemu driver support CPU hotplug (rhbz#533138)
  - wrong (octal) device number for attaching USB devices (rhbz#549840)
  - cannot save domain into root_squashing nfs export (rhbz#558763)
  - assorted bug fixes and lots of cleanups


author: Daniel Veillard <veillard@redhat.com> - 0.7.8-0.pre20100312
changelog:
  - preview for 0.7.8 rebase
  - Extra non upstream basic patch for spice and XQL
  - Resolves: rhbz#515264
  - Resolves: rhbz#515265
  - connected virsh dies with a SIGPIPE after libvirtd restart
  - Resolves: rhbz#526656
  - error when running logrotate on s/390x arch
  - Resolves: rhbz#547514


author: Daniel Veillard <veillard@redhat.com> - 0.7.8-0.pre20100322
changelog:
  - preview #2 for 0.7.8 rebase
  - migration max downtime API
  - Resolves: rhbz#561935
  - allow suspend during migration
  - Resolves: rhbz#561934
  - support vhost net mode at qemu startup for net devices
  - Resolves: rhbz#540391
  - read-only device access support for qemu
  - Resolves: rhbz#556769
  - LSB compliance of libvirtd init script
  - Resolves: rhbz#538701
  - No domain vcpu information output when using JSON monitor
  - Resolves: rhbz#572051
  - "qemudDomainSetMaxMemory" does not work and should be removed
  - Resolves: rhbz#572146
  - after setvcpus, any virsh command will be hung
  - Resolves: rhbz#572193
  - virsh interactive terminal crash or hung
  - Resolves: rhbz#572376
  - virsh hangs after core dump
  - Resolves: rhbz#572544
  - Fix very slow file allocation on ext3


author: Daniel Veillard <veillard@redhat.com> - 0.7.8-0.pre20100330
changelog:
  - preview #3 for 0.7.8 rebase
  - kvm hpet support
  - Resolves: rhbz#576973
  - hook scripts support
  - Resolves: rhbz#569965
  - Need to add time keeping abstraction
  - Resolves: rhbz#557285
  - notification of guest reboot
  - Resolves: rhbz#527572
  - Ability to preserve RTC clock adjustments across guest reboots
  - Resolves: rhbz#515273
  - Notifications of guest stopping due to disk I/O errors
  - Resolves: rhbz#515270
  - VNC ticketing support (524623) spice still needed
  - VNC client disconnect/connect events (515268) spice still needed


author: Daniel Veillard <veillard@redhat.com> - 0.8.0-0.pre20100407
changelog:
  - preview #4 for 0.8.0 rebase
  - snapshot API
  - domain with disk on root-squashing nfs and security driver mismatch
  - Resolves: rhbz#578630
  - Fail to read xml when restore domain
  - Resolves: rhbz#577719
  - loop "virsh cd" in virsh interactive terminal generate unknown error
  - Resolves: rhbz#572380
  - support setting qemu's -drive werror=stop/enospc with configuration
  - Resolves: rhbz#526231


author: Daniel Veillard <veillard@redhat.com> - 0.8.0-1
changelog:
  - official 0.8.0 upstream release
  - Resolves: rhbz#558761
  - new patch set of patches for RHEL-6 SPICE and addons
  - Enable QMP/ JSON mode in the QEMU monitor
  - Resolves: rhbz#563189
  - Support configuration of SPICE as a graphics protocol
  - Resolves: rhbz#515265
  - vnc (and spice) ticketing
  - Resolves: rhbz#524623
  - enable spice tls encryption in domainXML, and which channels are encrypted
  - Resolves: rhbz#573382
  - notification of VNC/SPICE client disconnect/connect events
  - Resolves: rhbz#515268


author: Daniel P. Berrange <berrange@redhat.com> - 0.8.0-2
changelog:
  - Refresh SPICE patches to fix test failures
  - Related: rhbz#515265, rhbz#524623, rhbz#573382
  - Enable test suite during build, disabling tests that don't work in mock
  - Related: rhbz#558761


author: Daniel Veillard <veillard@redhat.com> - 0.8.0-3
changelog:
  - Build ESX support in
  - Resolves: rhbz#581966
  - a batch of network filter fixes, IBM request and upstream fixes
  - Resolves: rhbz#579993
  - couple of patchs to fix device handling with QMP
  - Related: rhbz#563189
  - fix python binding for snapshotting
  - spec file fixes for nwfiler build and RHEL-5 virt-v2v specific rebuild


author: Daniel Veillard <veillard@redhat.com> - 0.8.0-4
changelog:
  - Fix libvirtd startup when avahi failed to look up local host name
  - CPU selection fixes
  - Resolves: rhbz#581627
  - fix migration poll value
  - Resolves: rhbz#584928
  - crash dump job caused libvirt hang
  - Resolves: rhbz#580853
  - Fix initial VCPU pinning in qemu driver
  - Resolves: rhbz#578434
  - fix cpu hotplug command names


author: Daniel Veillard <veillard@redhat.com> - 0.8.1-2
changelog:
  - Don't wipe generated iface target in active domains (588046)
  - Fix LXC domain lookup and error handling (586361)
  - Fix a protocol breakage introduced in libvirt-0.8.0
  - Add support for nic hotplug in QEMU/KVM (589978)
  - Seemless migration of spice graphics clients (589989)
  - fix build with ESX support
  - Resolves: rhbz#581966
  - fix multilib problem (587231)


author: Daniel Veillard <veillard@redhat.com> - 0.8.1-3
changelog:
  - missing python bindings due to older XML api
  - Resolves: rhbz#589453
  - Fix two possible crashes in JSON event dispatch
  - Resolves: rhbz#586353
  - Fix handling of disk backing stores with cgroups
  - Resolves: rhbz#581476
  - virsh schedinfo --set error handling on unknow parameters
  - Resolves: rhbz#586632
  - Apply extra patches for nwfilter
  - Resolves: rhbz#588554
  - Fix hang during concurrent guest migrations
  - Resolves: rhbz#582278


author: Dave Allan <dallan@redhat.com> - 0.8.1-5
changelog:
  - Don't reset user/group/security label for any files on shared filesystems
  - Resolves: rhbz#578889
  - Make saved state labelling ignore the dynamic_ownership parameter
  - Resolves: rhbz#588562
  - Fix & protect against NULL pointer dereference in monitor code
  - Resolves: rhbz#591076
  - Fix virFileResolveLink return value
  - Resolves: rhbz#591363
  - Add support for SSE4.1 and SSE4.2 CPU features
  - Resolves: rhbz#592977


author: Dave Allan <dallan@redhat.com> - 0.8.1-6
changelog:
  - Support seamless migration of SPICE graphics clients (refresh)
  - Resolves: rhbz#591551
  - Fix swapping of PCI vendor & product names in udev backend
  - Resolves: rhbz#578419
  - Fix cgroup setup code to cope with root squashing NFS
  - Resolves: rhbz#593193
  - Fix startup error reporting race
  - Resolves: rhbz#591272


author: Dave Allan <dallan@redhat.com> - 0.8.1-7
changelog:
  - Fix sign extension error in libvirt's parsing of qemu options
  - Resolves: rhbz#592070
  - Graceful shutdown/suspend of libvirt guests on host shutdown
  - Resolves: rhbz#566647
  - Fix pci device hotplug
  - Resolves: rhbz#572867
  - Support 802.1Qbg and bh
  - Resolves: rhbz#532760, rhbz#570949, rhbz#590110, rhbz#570923


author: Dave Allan <dallan@redhat.com> - 0.8.1-8
changelog:
  - Ensure virtio serial has stable addressing
  - Resolves: rhbz#586665
  - SELinux socket labelling on QEMU monitor socket for MLS
  - Resolves: rhbz#593739
  - Fix enumeration of partitions in disks with a trailing digit in path
  - Resolves: rhbz#593785
  - Enable probing of VPC disk format type
  - Resolves: rhbz#597981
  - Delete UNIX domain sockets upon daemon shutdown
  - Resolves: rhbz#598163
  - Fix Migration failure 'canonical hostname pointed to localhost'
  - Resolves: rhbz#589864
  - Fix up the python bindings for snapshotting
  - Resolves: rhbz#591839
  - Sanitize pool target paths
  - Resolves: rhbz#593565
  - Prevent host network conflicts
  - Resolves: rhbz#594494
  - Support 802.1Qbg and bh (vnlink/VEPA) (refresh)
  - Resolves: rhbz#590110


author: Dave Allan <dallan@redhat.com> - 0.8.1-9
changelog:
  - Touch libvirt-guests lockfile
  - Resolves: rhbz#566647
  - Add qemu.conf option for clearing capabilities
  - Resolves: rhbz#593903
  - Add support for launching guest in paused state
  - Resolves: rhbz#589465
  - Add virsh vol-pool command
  - Resolves: rhbz#602217
  - Add vol commands to virsh man page
  - Resolves: rhbz#600640
  - Remove bogus migrate error messages
  - Resolves: rhbz#601575


author: Dave Allan <dallan@redhat.com> - 0.8.1-10
changelog:
  - Add multiIQN XML output
  - Resolves: rhbz#587700
  - Fix udev node device parent-child device relationships
  - Resolves: rhbz#593995
  - Fix leaks in udev device add/remove
  - Resolves: rhbz#595490
  - Fix device destroy return value
  - Resolves: rhbz#597998
  - Update nodedev scsi_host data before use
  - Resolves: rhbz#600048
  - Display wireless devices in nodedev list
  - Resolves: rhbz#604811
  - Show pool and domain persistence
  - Resolves: rhbz#603696
  - Fix cleanup after failing to hotplug a PCI device
  - Resolves: rhbz#605168
  - Add '-nodefconfig' command line arg to QEMU
  - Resolves: rhbz#602778
  - Switch to private redhat namespace for QMP I/O error reason
  - Resolves: rhbz#586353
  - Improve error messages for missing drivers & unsupported functions
  - Resolves: rhbz#595609
  - macvtap: get interface index if not provided
  - Resolves: rhbz#605187
  - Fix leaks in remote code
  - Resolves: rhbz#603442
  - Add an optional switch --uuid to the virsh vol-pool command
  - Resolves: rhbz#604929
  - Change per-connection hashes to be indexed by UUIDs
  - Resolves: rhbz#603494
  - Run virsh from libvirt-guests script with /dev/null on stdin
  - Resolves: rhbz#606314
  - Increase dd block size to speed up domain save
  - Resolves: rhbz#601775
  - Fix reference counting bugs on qemu monitor
  - Resolves: rhbz#602660
  - Add missing action parameter in IO error callback
  - Resolves: rhbz#607157


author: Dave Allan <dallan@redhat.com> - 0.8.1-11
changelog:
  - Do not block during incoming migration
  - Resolves: rhbz#579440
  - Label serial devices
  - Resolves: rhbz#585249
  - parthelper: fix compilation without optimization
  - Related: rhbz#593785
  - Fix name/UUID uniqueness checking in storage/network
  - Resolves: rhbz#593951
  - Don't squash file permissions when migration fails
  - Resolves: rhbz#607922
  - Properly handle 'usbX' sysfs files
  - Resolves: rhbz#603867
  - add pool support to vol-key command & improve vol commands help
  - Resolves: rhbz#598365
  - document attach-disk better
  - Resolves: rhbz#601143
  - Config iptables to allow tftp port if network <tftp> element exists
  - Resolves: rhbz#607294
  - Fix failure to generate python bindings when libvirt.h.in is updated
  - Related: rhbz#589465
  - Allow all interface names
  - Resolves: rhbz#593907
  - Fix nodedevice refcounting
  - Resolves: rhbz#608753
  - Move nwfilter functions inside extern C and fix a locking bug
  - Resolves: rhbz#597391
  - Fix failure to restore qemu domains with selinux enforcing
  - Resolves: rhbz#590975
  - Check for presence of qemu -nodefconfig option before using it
  - Resolves: rhbz#608859


author: Dave Allan <dallan@redhat.com> - 0.8.1-12
changelog:
  - Don't invoke destroy callback from qemuMonitorOpen() failure paths
  - Resolves: rhbz#609060
  - virFileResolveLink: guarantee an absolute path
  - Resolves: rhbz#608092
  - SPICE patches have translatable strings without format args
  - Resolves: rhbz#608917
  - No way to pass disk format type to pool-define-as nor pool-create-as
  - Resolves: rhbz#597790
  - Fix enforcement of direction of traffic for rules describing incoming traffic
  - Resolves: rhbz#606889
  - Clarify virsh help pool-create-as text
  - Resolves: rhbz#609044


author: Dave Allan <dallan@redhat.com> - 0.8.1-14
changelog:
  - Support virtio disk hotplug in JSON mode
  - Resolves: rhbz#573946
  - Fix QEMU monitor JSON crash
  - Resolves: rhbz#604585
  - CVE-2010-2237 CVE-2010-2238 CVE-2010-2239
  - Resolves: rhbz#607817
  - CVE-2010-2242 Apply a source port mapping to virtual network masquerading
  - Resolves: rhbz#608049
  - Fix hang if QEMU exits (almost) immediately
  - Resolves: rhbz#610056
  - Support new CPU models provided by qemu-kvm
  - Resolves: rhbz#605830
  - Fix comparison of two host CPUs
  - Resolves: rhbz#611401
  - Don't mess with the CPU returned by arch driver
  - Resolves: rhbz#613014
  - Fail when CPU type cannot be detected from XML
  - Resolves: rhbz#613760
  - Use -nodefconfig when probing for CPU models
  - Resolves: rhbz#613764
  - cpuCompare: Fix crash on unexpected CPU XML
  - Resolves: rhbz#613765
  - Properly report failure to create raw storage volume files
  - Related: rhbz#547543
  - Fix IOErrorReasonCallback python bindings
  - Related: rhbz#586353
  - Parthelper: canonicalize block device paths
  - Related: rhbz#593785


author: Dave Allan <dallan@redhat.com> - 0.8.1-16
changelog:
  - Make PCI device ordering consistent with older releases
  - Resolves: rhbz#592026
  - Fix libvirtd hang during concurrent bi-directional migration
  - Resolves: rhbz#599590


author: Dave Allan <dallan@redhat.com> - 0.8.1-17
changelog:
  - Set a stable & high MAC addr for guest TAP devices
  - Resolves: rhbz#616517
  - Fix bogus commit of -16 patches
  - Related: rhbz#592026
  - Related: rhbz#599590


author: Dave Allan <dallan@redhat.com> - 0.8.1-19
changelog:
  - Add character device backend activating QEMU internal spice agent
  - Resolves: rhbz#615757
  - Make libvirt-guests initscript Fedora compliant
  - Resolves: rhbz#617300


author: Dave Allan <dallan@redhat.com> - 0.8.1-21
changelog:
  - Fix multiple PCI device assignment bugs
  - Resolves: rhbz#617116
  - Fix the ACS checking in the PCI code
  - Resolves: rhbz#615218
  - Disable boot=on when not using KVM
  - Resolves: rhbz#594068
  - Don't leak delay string when freeing virInterfaceBridgeDefs
  - Resolves: rhbz#620837


author: Dave Allan <dallan@redhat.com> - 0.8.1-22
changelog:
  - Mitigate asynchronous device_del
  - Resolves: rhbz#609437
  - Fix PCI address allocation
  - Resolves: rhbz#618484
  - Make nodeinfo skip offline CPUs
  - Resolves: rhbz#622515


author: Daniel Veillard <veillard@redhat.com> - 0.8.1-25
changelog:
  - fix PXE booting on the virtual network
  - Resolves: rhbz#623951
  - fix tunelled migration
  - Resolves: rhbz#624062


author: Dave Allan <dallan@redhat.com> - 0.8.1-26
changelog:
  - Fix problem with capabilities XML generation
  - Resolves: rhbz#620847
  - Correctly reserve and release PCI slots
  - Resolves: rhbz#623877


author: Daniel Veillard <veillard@redhat.com> - 0.8.1-27
changelog:
  - build -26 hit a miscompilation error c.f. 624895 drop -j2
  - Resolves: rhbz#620847
  - Resolves: rhbz#623877


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.1-28.el6
changelog:
  - Fix JSON migrate_set_downtime command (rhbz#561935)
  - Make SASL work over UNIX domain sockets (rhbz#641687)
  - Let qemu group look below /var/lib/libvirt/qemu/ (rhbz#643407)
  - Fix save/restore on root_squashed NFS (rhbz#643884)
  - Fix race on multiple migration (rhbz#638285)
  - Export host information through SMBIOS to guests (rhbz#526224)
  - Support forcing a CDROM eject (rhbz#626305)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.1-29.el6
changelog:
  - spec file cleanups (rhbz#649523)
  - Fix deadlock on concurrent multiple bidirectional migration (rhbz#659310)
  - Fix funny error in clock-variable (rhbz#660194)
  - Export host information through SMBIOS to guests (rhbz#526224)
  - Ensure device is deleted from guest after unplug (rhbz#644015)
  - Distinguish between QEMU domain shutdown and crash (rhbz#656845)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-1.el6
changelog:
  - Rebased to upstream 0.8.7 (rhbz#653985)
  - The following bugs got fixed by the rebase:
      rhbz#586124, rhbz#595350, rhbz#611793, rhbz#611822, rhbz#617439,
      rhbz#620363, rhbz#626873, rhbz#627143, rhbz#628772, rhbz#639595,
      rhbz#639603, rhbz#656795, rhbz#658657, rhbz#659855, rhbz#660706,
      rhbz#664406, rhbz#665446


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-2.el6
changelog:
  - Fix spec file which was not fully rebased to 0.8.7 (rhbz#653985, rhbz#660706)
  - Skip IB700 watchdog device when assigning PCI slots (rhbz#667091)
  - Improve error reporting when parsing dhcp info (rhbz#653300)
  - Don't chown saved image back to root if dynamic_ownership=0 (rhbz#661720)
  - Fix core dumps if unix_sock_group is set (rhbz#623166)
  - Add support for Westmere CPU model (rhbz#656248)
  - Add XML config switch to enable/disable vhost-net support (rhbz#643050)
  - Enable tuning of qemu network tap device "sndbuf" size (rhbz#665293)
  - Support for explicit boot device ordering (rhbz#646895)
  - Avoid qemu holding migration fd indefinitely (rhbz#620363)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-3.el6
changelog:
  - Report error if invalid type specified for character device (rhbz#638968)
  - Improve log for domain related APIs (rhbz#640202)
  - Reject SDL graphic if it's not supported by qemu (rhbz#633326)
  - Don't lose track of events when callbacks are slow (rhbz#624252)
  - Fail if per-device boot is used but deviceboot is not supported (rhbz#670399)
  - Avoid sending STOPPED event twice (rhbz#666158)
  - Fix issues introduced by dependency patches for rhbz#646895


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-4.el6
changelog:
  - Fix event-handling data race (rhbz#671567)
  - Add support for VNC over a unix domain socket (rhbz#651415)
  - Support intel 'ich6' model (rhbz#648486)
  - Do not use virtio-serial port 0 for generic ports (rhbz#670394)
  - Set SELinux context label of pipes used for qemu migration (rhbz#667756)
  - Support customizable x509 certificate paths for client (rhbz#629510)
  - Round up capacity for LVM volume creation (rhbz#670529)
  - Show error prompt when trying to managed save a shutoff domain (rhbz#672449)
  - Report more proper error for unsupported graphics (rhbz#671319)
  - Expand the man page text for virsh setmaxmem (rhbz#622534)
  - Fix event-handling allocation crash (rhbz#671564)
  - Require --mac to avoid detach-interface ambiguity (rhbz#671050)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-5.el6
changelog:
  - Docs for customizable x509 certificate paths for client (rhbz#629510)
  - Fix tests for VNC over a unix domain socket (rhbz#651415)
  - Fix problems with peer-to-peer migration (rhbz#673434)
  - Fix tunneled migration broken since 0.8.7-2 (rhbz#672199)
  - Update docs for cpu_shares setting (rhbz#641187)
  - Fix possible hang if SASL is used (rhbz#672226)
  - Cancel migration in progress when virsh gets Ctrl-C (rhbz#635353)
  - Enhance virsh migrate command (rhbz#619039)
  - Support for specifying AIO mode for qemu disks (rhbz#591703)
  - Don't leave domain paused after restore (rhbz#670278)
  - Fix possible deadlock/crash in qemu driver (rhbz#673588)
  - Add shortcut for qemu HMP pass through (rhbz#628940)
  - Fix error message when attach device fails (rhbz#675030)
  - Support for booting from assigned PCI devices (rhbz#646895)
  - Improve handling of unlimited value for memory tunables (rhbz#669069)
  - Add smartcard support (rhbz#641834)
  - Remove some RHEL-specific patches which are no longer required (rhbz#653985)
  - Support for disabling/enabling KSM per domain (rhbz#635419)
  - Add --all flag to virsh freecell command (rhbz#653530)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-6.el6
changelog:
  - Fix typo in parsing of spice 'auth' data (rhbz#676374)
  - Fix attach-interface regression (rhbz#676686)
  - Block I/O tunables via blkio cgroups controller (rhbz#632492)
  - Support SCSI RAID type & lower log level for unknown types (rhbz#675771)
  - Only initialize/cleanup libpciaccess once (rhbz#675698)
  - Imprint all logs with version + package build information (rhbz#673226)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-7.el6
changelog:
  - Properly escape special characters in domain names (rhbz#676908)
  - Fix enum type declaration (rhbz#628940)
  - Fix cleanup on VM state after failed QEMU startup (rhbz#673588)
  - Fix XML generation for smartcards (rhbz#677308)
  - Ignore failure of "qemu -M ?" on older qemu (rhbz#676563)
  - Fix typo in setting up SPICE passwords (rhbz#677709)
  - Avoid NULL dereference in virDomainMemoryStats (rhbz#677484)
  - Avoid NULL dereference on error in qemu driver (rhbz#677493)
  - Fix error message when saving a shutoff domain (rhbz#677547)
  - Create enough volumes for mpath pool (rhbz#677231)
  - Allow to delete device mapper disk partition (rhbz#611443)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-8.el6
changelog:
  - Fix --all flag of virsh freecell to really show all cells (rhbz#653530)
  - Add txmode attribute to interface XML for virtio backend (rhbz#629662)
  - Give each virtual network bridge its own fixed MAC address (rhbz#609463)
  - Fix virsh snapshot-list with --quiet option (rhbz#678833)
  - Delay IFF_UP'ing 802.1Qbh interface until migration final stage (rhbz#678826)
  - Fix several memory bugs (rhbz#679164)
  - Fix virt-pki-validate when CERTTOOL is missing (rhbz#679153)
  - Fix memory corruption in virFileAbsPath (rhbz#680281)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-9.el6
changelog:
  - Reorder nwfilter match extensions relative to state match (rhbz#678139)
  - Avoid overwriting error message in qemu driver (rhbz#678870)
  - Allow removing hash entries in virHashForEach (rhbz#681459)
  - Avoid double close on qemu domain restore (rhbz#672725)
  - Fix DomainObj refcounting/hashtable races in qemu driver (rhbz#670848)
  - Fix several memory leaks (rhbz#682249)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-11.el6
changelog:
  - Support vram specification for qxl graphics (rhbz#673578)
  - Fix parsing int options in virsh (rhbz#639587)
  - Use -o encryption=on instead of -e for qemu-img (rhbz#676984)
  - Support domain snapshots with current QMP (rhbz#589076)
  - Update auditing support (rhbz#642785)
  - Only request sound cgroup ACL when required (rhbz#680398)
  - Allow fine-tuning of device ACL permissions (rhbz#683163)
  - Support vhost in attach-interface (rhbz#683276)
  - Don't request cgroup ACL access for /dev/net/tun (rhbz#683305)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-12.el6
changelog:
  - Fix vram settings for qxl graphics (rhbz#673578)
  - Free stream when domain shuts down while its console is open (rhbz#682741)
  - Use hardcoded python path in libvirt.py (rhbz#684204)
  - Add missing checks for read only connections (CVE-2011-1146)
  - Eliminate potential null pointer deref when auditing macvtap devices (rhbz#642785)
  - Insert error messages to avoid a quiet abortion of commands (rhbz#605660)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-13.el6
changelog:
  - Properly report error in virConnectDomainXMLToNative (CVE-2011-1146)
  - Handle DNS over IPv6 (rhbz#687896)
  - Start dnsmasq even if no dhcp ranges/hosts are specified (rhbz#687291)
  - Use a separate dhcp leases file for each network (rhbz#687551)
  - Fix a possible crash in storage driver (rhbz#684712)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-14.el6
changelog:
  - Fix delayed events when SASL is active (rhbz#624252)
  - Fix ref-counting bugs (rhbz#688774)
  - Log an error if on failure to connect to netlink socket (rhbz#689001)
  - Log error and abort network startup when radvd isn't found (rhbz#688957)
  - Add PCI sysfs reset access rights to qemu (rhbz#689002)
  - Fix regression with qemu:///session URI (rhbz#684655)
  - Avoid leaking PCI config fd into qemu (rhbz#687993)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-15.el6
changelog:
  - Fix return value for virJSONValueFromString if it fails (rhbz#688723)
  - Fix positioning to end of qemu log file (rhbz#689986)
  - Initialization error of qemuCgroupData in Qemu host usb hotplug (rhbz#690183)
  - 8021Qbh: Use preassociate-rr during the migration prepare stage (rhbz#684870)
  - Make error reporting in libvirtd thread safe (rhbz#689374)
  - Add missing dependencies (rhbz#690022)
  - Fix restoring a compressed save image (rhbz#691034)
  - Fix label restore bugs in qemu driver (rhbz#690737)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-16.el6
changelog:
  - nwfilter: Enable rejection of packets (rhbz#681948)
  - Revert all previous error log priority hacks (rhbz#587603)
  - Filter out certain expected error messages from libvirtd (rhbz#587603)
  - qemu: Unlock qemu driver before return from domain save (rhbz#688774)
  - Do not send monitor command after monitor meet error (rhbz#688774)
  - qemu: Ignore libvirt debug messages in qemu log (rhbz#681492)
  - virsh: Fix memtune's help message for swap_hard_limit (rhbz#680190)
  - virsh: Fix documentation for memtune command (rhbz#680190)
  - docs: Fix typo (rhbz#680190)
  - Fix typo in systemtap tapset directory name (rhbz#693701)
  - qemu: Ignore unusable binaries (rhbz#676563)
  - qemu: Support for overriding NPROC limit (rhbz#674602)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-17.el6
changelog:
  - Don't return an error on failure to create blkio controller (rhbz#689030)
  - Fix possible infinite loop in remote driver (rhbz#691514)
  - qemu: Remove the managed state file only if restoring succeeded (rhbz#692998)
  - docs: Tweak virsh restore warning (rhbz#692998)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-18.el6
changelog:
  - network: Fix NULL dereference during error recovery (rhbz#696660)
  - virsh: Fix regression in parsing optional integer (rhbz#693963)
  - util: Fix crash when removing entries during hash iteration (rhbz#693385)
  - Experimental libvirtd upstart job (rhbz#678084)


author: Jiri Denemark <jdenemar@redhat.com> - libvirt-0.9.1-1.el6
changelog:
  - Rebased to upstream 0.9.1 (rhbz#705814)
  - The rebase also fixes the following bugs:
      rhbz#587276, rhbz#591058, rhbz#592170, rhbz#598792, rhbz#673814,
      rhbz#677228, rhbz#681458, rhbz#682237, rhbz#692745, rhbz#693932,
      rhbz#694382, rhbz#695653, rhbz#698071, rhbz#698197, rhbz#698208,
      rhbz#698490, rhbz#701305


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.2-1.el6
changelog:
  - Rebased to upstream 0.9.2 (rhbz#705814)
  - The rebase also fixes the following bugs:
      rhbz#569567, rhbz#691830, rhbz#607526, rhbz#609650, rhbz#632495,
      rhbz#640603, rhbz#658713, rhbz#669549, rhbz#677229, rhbz#678548,
      rhbz#640603, rhbz#682237, rhbz#683005, rhbz#684848, rhbz#688859,
      rhbz#690695, rhbz#692355, rhbz#693203, rhbz#694516, rhbz#697650,
      rhbz#698133, rhbz#702044, rhbz#704124, rhbz#704144, rhbz#705405,
      rhbz#706869, rhbz#706883, rhbz#706966, rhbz#707173, rhbz#707257,
      rhbz#707298, rhbz#709576, rhbz#709776, rhbz#710150, rhbz#711151


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.3-1.el6
changelog:
  - Rebased to upstream 0.9.3 (rhbz#705814)
  - The rebase also fixes the following bugs:
      rhbz#591974, rhbz#632499, rhbz#641087, rhbz#664629, rhbz#679668,
      rhbz#682121, rhbz#693648, rhbz#693650, rhbz#693661, rhbz#698340,
      rhbz#698825, rhbz#698861, rhbz#701394, rhbz#707439, rhbz#707530,
      rhbz#715355, rhbz#716826, rhbz#717203, rhbz#718143, rhbz#712050,
      rhbz#715184


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.3-2.el6
changelog:
  - Fix mistaken order of server cert/key parameters in constructor (rhbz#719838)
  - qemu: Don't chown files on NFS share if dynamic_ownership is off (rhbz#716478)
  - util: Don't try to fchown files opened as non-root (rhbz#707257)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.3-4.el6
changelog:
  - storage: Avoid memory leak on metadata fetching (rhbz#707155)
  - graphics: Add support for action_if_connected in qemu (rhbz#707212)
  - qemu: Save domain status ASAP after creating qemu process (rhbz#707894)
  - bios: Add support for SGA (rhbz#711598)
  - pci: Initialize state values on reattach (rhbz#713697)
  - Keep consistence between code and doc on log level and usage (rhbz#716888)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.3-8.el6
changelog:
  - libvirt crash when running domains and vdsm is restarted (rhbz#723811)
  - connect to hypervisor with unconfigured tls/tcp connection pbm (rhbz#723442)
  - virsh list produced segmentation fault when libvirtd is not up (rhbz#723843)
  - clientcert.pem validation failure cause libvirtd crash (rhbz#723881)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-0rc1.el6
changelog:
  - rebased to upstream 0.9.4 release candidate 1 (rhbz#705814)
  - the rebase also fixes the following bugs:
      rhbz#603039, rhbz#632499, rhbz#632760, rhbz#643947, rhbz#678027,
      rhbz#697742, rhbz#697841, rhbz#704836, rhbz#707530, rhbz#720350,
      rhbz#720889, rhbz#721335, rhbz#722862


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-0rc2.el6
changelog:
  - rebased to upstream 0.9.4 release candidate 2 (rhbz#705814)
  - the rebase also fixes the following bugs:
      rhbz#667624, rhbz#669586, rhbz#682084, rhbz#707155, rhbz#707212,
      rhbz#725322, rhbz#725935, rhbz#725950


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-1.el6
changelog:
  - Rebased to upstream 0.9.4 (rhbz#705814)
  - The rebase also fixes the following bugs:
      rhbz#634653, rhbz#707212, rhbz#722806, rhbz#723862, rhbz#726304,
      rhbz#726398, rhbz#727047, rhbz#727094


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-2.el6
changelog:
  - daemon: Unlink unix socket paths on shutdown (rhbz#725702)
  - rpc:Fix sasl session relocking intead of unlocking it (rhbz#729198)
  - network: Eliminate lag in updating dnsmasq hosts files (rhbz#727982)
  - Don't mount /dev for application containers (rhbz#728835)
  - support connected parameter in set_password (rhbz#707212)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-3.el6
changelog:
  - Fix large files support (rhbz#728992)
  - qemu: Avoid overwriting errors from virGetHostname (rhbz#729567)
  - qemu: Fix -chardev udp if parameters are omitted (rhbz#689761)
  - managedsave: Prohibit use on transient domains (rhbz#729714)
  - nwfilter: Tolerate disappearing interfaces while instantiating filter (rhbz#729945)
  - docs: Describe new virtual switch configuration in network XML docs (rhbz#643947)
  - storage: Directory shouldn't be listed as type 'file' (rhbz#727088)
  - virsh: Add dir type for listing volumes with vol-list (rhbz#727088)
  - qemu: Avoid crash on process attach (rhbz#730615)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-4.el6
changelog:
  - Bugfix: Check stdoutWatch before removing the handler. (rhbz#730600)
  - daemon: Fix regression of libvirtd reloading support (rhbz#730428)
  - libvirtd.init.in: Stop/restart() - wrong return value in case of failure (rhbz#730510)
  - Add API for duplicating a socket/client file descriptor (rhbz#720269)
  - Add backlog parameter to virNetSocketListen (rhbz#720269)
  - Support changing UNIX socket owner in virNetSocketNewListenUNIX (rhbz#720269)
  - qemu: Refactor do{Tunnel, Native}Migrate functions (rhbz#720269)
  - qemu: Use virNetSocket for tunneled migration (rhbz#720269)
  - qemu: Use fd: protocol for migration (rhbz#720269)
  - qemu: Support event_idx parameter for virtio disk and net devices (rhbz#725448)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-5.el6
changelog:
  - patch problem for seamless SPICE migration (rhbz#730753)
  - macvtap: Fix getPhysfn to get the PF of a direct attach network interface (rhbz#732082)
  - SSL spice session can't be kept during migration (rhbz#729874)
  - Storage driver should flush host cache after cloning volumes (rhbz#689416)
  - Documentation for CFS bandwidth limiting cgroup (rhbz#692769)
  - libvirt error message should show the uri content but not (null) (rhbz#730244)
  - libvirtd.conf error causes libvirtd to exit silently (rhbz#728654)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-6.el6
changelog:
  - daemon: Move TLS initialization to virInitialize (rhbz#732893)
  - Fix command test wrt gnutls initialize & fix debugging (rhbz#732893)
  - qemu: Init reattaching related members pciDevice before reattach (rhbz#728203)
  - qemu: error if qemu monitor command not found for BlockJob (rhbz#727502)
  - virsh: error if specified bandwidth is invalid for blockjob (rhbz#727502)
  - util: Only fchown newly created files in virFileOpenAs (rhbz#534010)
  - screenshot: Implement multiple screen support (rhbz#710489)
  - security: Rename SetSocketLabel APIs to SetDaemonSocketLabel (rhbz#731243)
  - security: Introduce SetSocketLabel (rhbz#731243)
  - qemu: Correctly label migration TCP socket (rhbz#731243)
  - snapshot: Don't leak resources on qemu snapshot failure (rhbz#733499)
  - Fix memory leak while scanning snapshots (rhbz#674537)
  - qemu: Minor formatting cleanup (rhbz#674537)
  - Swap virDomain and virDomainSnapshot declaration (rhbz#674537)
  - snapshot: Only pass snapshot to qemu command line when reverting (rhbz#674537)
  - snapshot: Track current snapshot across restarts (rhbz#674537)
  - send-key: Fix scan keycode map (rhbz#733597)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-7.el6
changelog:
  - qemu: Properly label outgoing pipe for tunneled migration (rhbz#733998)
  - snapshot: Forbid snapshot on autodestroy domain (rhbz#733806)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-8.el6
changelog:
  - qemu: Fix a regression of domain save (rhbz#735011)
  - virsh: Improve send-key documentation (rhbz#699847)
  - start: Allow discarding managed save (rhbz#730750)
  - virsh: Support 'virsh start --force-boot' on older servers (rhbz#730750)
  - maint: Fix comment typos (rhbz#730750)
  - qemu: Refactor file opening (rhbz#730750)
  - qemu: Detect incomplete save files (rhbz#730750)
  - virsh: Avoid memory leak on cmdVolCreateAs (rhbz#735008)
  - snapshot: Fix corner case on OOM during creation (rhbz#674537)
  - Ensure stream is aborted when exiting console (rhbz#731673)
  - following for (rhbz#731583, rhbz#731579, rhbz#731584, rhbz#731673):
  - Ensure client streams are closed when marking a client for close
  - Fix race condition in abort of stream
  - Tweak debugging message in RPC client code
  - Don't attempt to read from a stream if it is closed
  - Ensure async packets never get marked for sync replies
  - Ignore unused streams in virStreamAbort
  - rpc: Don't close connection if program is unknown
  - rpc: Fix a typo in debugging log in virNetServerProgramSendStreamData
  - stream: Remove redundant reference to client while sending stream data
  - Fix memory leak dispatching domain events
  - Avoid use-after-free on streams, due to message callbacks
  - Fix tracking of RPC messages wrt streams
  - Fix parted sector size assumption (rhbz#735441)
  - Fix incorrect path length check in sanlock lockspace setup (rhbz#735443)
  - Fix sanlock socket security labelling (rhbz#735442)
  - Remove bogus virSecurityManagerSetProcessFDLabel method (rhbz#735442)
  - security: Fix build (rhbz#735442)
  - Fix keymap used to talk with QEMU (rhbz#632499)
  - virsh: Fix snapshot-create-as to handle arbitrary names (rhbz#735495)
  - virsh: Add virsh snapshot-current --name (rhbz#735495)
  - virsh: Add snapshot-parent (rhbz#735495)
  - virsh: Don't reject undefine on active domain (rhbz#735495)
  - virsh: Fix logic bug (rhbz#735495)
  - virsh: Fix dead store (rhbz#735495)
  - virsh: Tweak misleading wording (rhbz#735495)
  - virsh: Concatenate qemu-monitor-command arguments (rhbz#735495)
  - maint: Treat more libxml2 functions as free-like (rhbz#735495)
  - xml: Add another convenience function (rhbz#735495)
  - maint: Simplify lots of libxml2 clients (rhbz#735495)
  - virsh: Add list --managed-save (rhbz#735495)
  - virsh: Prefer unsigned flags (rhbz#735495)
  - snapshot: Add snapshot-list --parent to virsh (rhbz#735495)
  - qemu: Allow to undefine a running domain (rhbz#735498)
  - test: Allow to undefine a running domain (rhbz#735498)
  - build: Fix typo in recent test patch (rhbz#735498)
  - test: Rewrite test to match change in behavior (rhbz#735498)
  - virsh: Properly interleave shared stdout and stderr (rhbz#735498)
  - snapshot: Better events when starting paused (rhbz#733762)
  - snapshot: Fine-tune ability to start paused (rhbz#733762)
  - snapshot: Expose --running and --paused in virsh (rhbz#733762)
  - snapshot: Fine-tune qemu saved images starting paused (rhbz#733762)
  - snapshot: Improve reverting to qemu paused snapshots (rhbz#733762)
  - snapshot: Properly revert qemu to offline snapshots (rhbz#733762)
  - snapshot: Fine-tune qemu snapshot revert states (rhbz#733762)
  - snapshot: Properly revert qemu to offline snapshots (rhbz#733762)
  - snapshot: Fine-tune qemu snapshot revert states (rhbz#733762)
  - snapshot: Speed up snapshot location (rhbz#733529)
  - snapshot: Avoid crash when deleting qemu snapshots (rhbz#733529)
  - snapshot: Track current domain across deletion of children (rhbz#733529)
  - snapshot: Simplify acting on just children (rhbz#733529)
  - snapshot: Allow deletion of just snapshot metadata (rhbz#735457)
  - snapshot: Let qemu discard only snapshot metadata (rhbz#735457)
  - snapshot: Identify which snapshots have metadata (rhbz#735457)
  - snapshot: Reflect new dumpxml and list options in virsh (rhbz#735457)
  - snapshot: Identify qemu snapshot roots (rhbz#735457)
  - snapshot: Allow recreation of metadata (rhbz#735457)
  - snapshot: Refactor virsh snapshot creation (rhbz#735457)
  - snapshot: Improve virsh snapshot-create, add snapshot-edit (rhbz#735457)
  - snapshot: Add qemu snapshot creation without metadata (rhbz#735457)
  - snapshot: Add qemu snapshot redefine support (rhbz#735457)
  - vbox, xenapi: Add virDomainUndefineFlags (rhbz#735457)
  - snapshot: Prevent stranding snapshot data on domain destruction (rhbz#735457)
  - snapshot: Teach virsh about new undefine flags (rhbz#735457)
  - snapshot: Refactor some qemu code (rhbz#735457)
  - snapshot: Cache qemu-img location (rhbz#735457)
  - snapshot: Support new undefine flags in qemu (rhbz#735457)
  - snapshot: Prevent migration from stranding snapshot data (rhbz#735457)
  - snapshot: Refactor domain xml output (rhbz#735553)
  - snapshot: Allow full domain xml in snapshot (rhbz#735553)
  - snapshot: Correctly escape generated xml (rhbz#735553)
  - snapshot: Update rng to support full domain in xml (rhbz#735553)
  - snapshot: Store qemu domain details in xml (rhbz#735553)
  - schedinfo: Update man page about virsh schedinfo command (unknown)
  - snapshot: Additions to domain xml for disks (rhbz#638510)
  - snapshot: Reject transient disks where code is not ready (rhbz#638510)
  - snapshot: Introduce new deletion flag (rhbz#638510)
  - snapshot: Expose new delete flag in virsh (rhbz#638510)
  - snapshot: Allow halting after snapshot (rhbz#638510)
  - snapshot: Expose halt-after-creation in virsh (rhbz#638510)
  - snapshot: Support extra state in snapshots (unknown)
  - snapshot: Add <disks> to snapshot xml (rhbz#638510)
  - snapshot: Also support disks by path (rhbz#638510)
  - snapshot: Add virsh domblklist command (rhbz#638510)
  - snapshot: Add flag for requesting disk snapshot (rhbz#638510)
  - snapshot: Wire up disk-only flag to snapshot-create (rhbz#638510)
  - snapshot: Reject unimplemented disk snapshot features (rhbz#638510)
  - snapshot: Make it possible to audit external snapshot (rhbz#638510)
  - snapshot: Wire up new qemu monitor command (rhbz#638510)
  - snapshot: Wire up live qemu disk snapshots (rhbz#638510)
  - snapshot: Use SELinux and lock manager with external snapshots (rhbz#638510)
  - daemon: Create priority workers pool (rhbz#692663)
  - qemu: Introduce job queue size limit (rhbz#692663)
  - qemu: Deal with stucked qemu on daemon startup (rhbz#692663)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-10.el6
changelog:
  - virterror: Fix error message for VIR_ERR_INVALID_ARG (rhbz#689388)
  - remote: Refuse connecting to remote socket (rhbz#689388)
  - Threadpool: Initialize new dynamic workers (rhbz#692663)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-11.el6
changelog:
  - blockinfo: Fix qemu regression in handling disk name (rhbz#736603)
  - doc: Fix incorrect option in send-key (rhbz#736297)
  - virsh: Fix typo in opts_send_key (rhbz#736297)
  - rpc: Avoid memory leak on virNetTLSContextValidCertificate (rhbz#735650)
  - tests: Avoid memory leak on testTLSSessionInit (rhbz#735650)
  - qemu: Fix seamless SPICE migration with older qemu (rhbz#730753)
  - snapshot: Fix regression with system checkpoints (rhbz#736682)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-12.el6
changelog:
  - selinux: Detect virt_use_nfs boolean set (rhbz#589922)
  - virnetsocket: Pass KRB5CCNAME env variable (rhbz#737176)
  - snapshot: Fix double free of qemuImgBinary (rhbz#737010)
  - qemu_api: Modify apibuild.py to generate docs for QEMU APIs (rhbz#736040)
  - qemu_api: Update Makefile for subdir docs (rhbz#736040)
  - qemu_api: Add comments for API virDomainQemuMonitorCommand (rhbz#736040)
  - qemu_api: Add override XML and C files for QEMU APIs (rhbz#736040)
  - qemu_api: Update Py binding generator to generate files for QEMU APIs (rhbz#736040)
  - qemu_api: Update Makefile to generate libvirtmod_qemu lib (rhbz#736040)
  - qemu_api: Update libvirt spec file (rhbz#736040)
  - Remove two references to files not generated (rhbz#736040)
  - qemu_api: Doc improvements (rhbz#736040)
  - python: Fix libvirt.py generation to include virterror info (rhbz#736040)
  - snapshot: New APIs for inspecting snapshot object (rhbz#735457)
  - snapshot: Use new API for less work (rhbz#735457)
  - snapshot: ABI stability must include memory sizing (rhbz#735553)
  - spec: Require augeas for sanlock (rhbz#738314)
  - sanlock: Add missing test command in virt-sanlock-cleanup.in (rhbz#738534)
  - snapshot: Tweak snapshot-create-as diskspec docs (rhbz#738411)
  - qemu: Hold conn open for all threads started by qemuProcessReconnectAll (rhbz#738778)
  - rpc: Convert unknown procedures to VIR_ERR_NO_SUPPORT (rhbz#738439)
  - Prevent crash from dlclose() of libvirt.so (rhbz#739167)
  - doc: Add statment about permissions needed to do a core dump (rhbz#738146)
  - snapshot: Affect persistent xml after disk snapshot (rhbz#738676)
  - snapshot: Allow disk snapshots of qcow2 disks (rhbz#738676)
  - qemu: Prevent disk corruption on domain shutdown (rhbz#734773)
  - qemu: Introduce shutdown reason for paused state (rhbz#734773)
  - qemu: Fix shutoff reason when domain crashes (rhbz#739641)
  - qemu: Properly detect crash of a rebooted domain (rhbz#739641)
  - qemu: Avoid memory leak (rhbz#739704)
  - remote: Avoid memory leak (rhbz#739704)
  - util: Avoid memory leak (rhbz#739704)
  - Fix memory leak parsing 'relabel' attribute in domain security XML (rhbz#739704)
  - Don't leak memory if a cgroup is mounted multiple times (rhbz#739704)
  - network: Eliminate potential memory leak on parse failure (rhbz#739704)
  - virsh: doc: Fix supported driver types for attach-disk command (rhbz#738970)
  - Do not log invalid operations in libvirtd logs (rhbz#590807)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-13.el6
changelog:
  - Fix crash on events due to allocation errors (rhbz#737881)
  - remote: Fix crash on OOM (rhbz#737881)
  - Fix persistent migration config save (rhbz#738148)
  - qemu: Transfer inactive XML among cookie (rhbz#738148)
  - storage: Ensure the device path exists before refreshing disk pool (rhbz#611442)
  - Store max migration bandwidth in qemuDomainObjPrivate struct (rhbz#740099)
  - Save migration speed in qemuDomainMigrateSetMaxSpeed (rhbz#740099)
  - Set qemu migration speed unlimited when migrating to file (rhbz#740099)
  - Use max bandwidth from qemuDomainObjPrivate struct when migrating (rhbz#740099)
  - build: Silence warning on 32-bit build (rhbz#740099)
  - conf: Assign newDef of active domain as persistent conf if it is NULL (rhbz#728428)
  - qemu: Avoid dereferencing a NULL pointer (rhbz#739704)
  - sanlock: Fix memory leak (rhbz#739704)
  - virsh: Fix regression in argv parsing (rhbz#740168)
  - snapshot: Fix logic bug in qemu undefine (rhbz#735457)
  - snapshot: Prepare to remove transient snapshot metadata (rhbz#735457)
  - snapshot: Remove snapshot metadata on transient exit (rhbz#735457)
  - snapshot: Also delete empty directory (rhbz#735457)
  - virsh: Do not ignore the specified flags for cmdSaveImageDefine (rhbz#740508)
  - selinux: Correctly report warning if virt_use_nfs not set (rhbz#589922)
  - qemu: Properly hot-unplug drives (rhbz#696596)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-14.el6
changelog:
  - Fix synchronous reading of stream data (rhbz#741337)
  - qemu: Add ability to set PCI device "rombar" on or off (rhbz#738095)
  - virsh: Better document --copy-storage migrate options (rhbz#677220)
  - virsh: Enhance documentation of commands starting jobs (rhbz#705237)
  - qemu: Always remove domain object if MigratePrepare fails (rhbz#741251)
  - security: Properly chown/label bidirectional and unidirectional fifos (rhbz#740478)
  - qemu: Check domain status details when reconnecting monitor (rhbz#617890)
  - qemu: Finish domain shutdown on reconnect (rhbz#617890)
  - qemu: Avoid loop of fake reboots (rhbz#617890)
  - qemu: Preserve fakeReboot flag in domain status (rhbz#617890)
  - snapshot: Fix man page typos (rhbz#740686)
  - docs: Document virsh nodedev-* commands (rhbz#740686)
  - docs: Document node device XML (rhbz#740686)
  - qemu: Add return value check (rhbz#739704)
  - qemu: Check for ejected media during startup and migration (rhbz#725673)
  - virsh: Update man page for cpu_shares parameter (rhbz#639591)
  - virsh: Describe attach-interface parameter target (rhbz#698899)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-15.el6
changelog:
  - Add virFileLock and virFileUnlock APIs (rhbz#728153)
  - Move pidfile functions into util/virpidfile.{c, h} (rhbz#728153)
  - Introduce functions for checking whether a pidfile is valid (rhbz#728153)
  - Add some APIs which use locking for crashsafe pidfile handling (rhbz#728153)
  - Convert libvirtd to use crash-safe pidfile APIs (rhbz#728153)
  - build: Fix recent build failures (rhbz#728153)
  - daemon: Don't remove pidfiles in init scripts (rhbz#728153)
  - daemon: Modify init script to detect upstart managed libvirtd (rhbz#728153)
  - qemu: Check for outstanding async job too (rhbz#742277)
  - qemu: Make PCI multifunction support more manual (rhbz#727530)
  - network: Fill in bandwidth from portgroup for all forward modes (rhbz#743176)
  - snapshot: Refactor virsh snapshot parent computation (rhbz#742410)
  - snapshot: Better virsh handling of missing current, parent (rhbz#742410)
  - qemu: Fix migration with dname (rhbz#740533)
  - qemu: Correct misspelled 'enospc' option, and only use for werror (rhbz#730909)
  - snapshot: Add REVERT_FORCE to API (rhbz#742615)
  - snapshot: Use qemu-img on disks in use at time of snapshot (rhbz#742615)
  - snapshot: Enforce REVERT_FORCE on qemu (rhbz#742615)
  - init: Raise default system aio limits (rhbz#740899)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-16.el6
changelog:
  - qemu: Enable multifunction for older qemu (rhbz#738388)
  - qemu: Don't fail virDomainGetInfo if we can't update balloon info (rhbz#741217)
  - qemu: Leave rerror policy at default when enospace is requested (rhbz#730909)
  - snapshot: Fix virsh error message typo (rhbz#735457)
  - snapshot: Let virsh edit disk snapshots (rhbz#744071)
  - snapshot: Simplify redefinition of disk snapshot (rhbz#744071)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-17.el6
changelog:
  - Fix deadlock when the RPC program is unknown (rhbz#743843)
  - qemuDomainAttach: Initialize pidfile variable (rhbz#744548)
  - storage: Do not use comma as seperator for lvs output (rhbz#727474)
  - snapshot: Avoid accidental renames with snapshot-edit (rhbz#744724)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-18.el6
changelog:
  - virDomainCoreDump: Introduce VIR_DUMP_RESET flag (rhbz#632498)
  - qemu: Implement VIR_DUMP_RESET (rhbz#632498)
  - qemu: Check for domain being active on successful job acquire (rhbz#745734)
  - Set to NULL members that have been freed to prevent crashes (rhbz#746075)
  - virFDStream: Close also given errfd (fd leak) (rhbz#746075)
  - qemu: Silence Coverity false positive (rhbz#739704)
  - command: Avoid fd leak on failure (rhbz#739704)
  - build: Add compiler attributes to virUUIDParse (rhbz#739704)
  - qemu: Check for json allocation failure (rhbz#739704)
  - qemu: Fix text block info parsing (rhbz#739704)
  - storage: Plug memory leak on error (rhbz#739704)
  - conf: Plug memory leak on error (rhbz#739704)
  - qemu: Plug memory leak on migration (rhbz#739704)
  - macvtap: Plug memory leak for 802.1Qbh (rhbz#739704)
  - macvtap: Avoid invalid free (rhbz#739704)
  - Update to require sanlock 1.8 for license compliance (rhbz#739518)
  - events: Propose a separate lock for event queue (rhbz#743817)
  - util: Make getaddrinfo failure nonfatal in virGetHostname (rhbz#738915)
  - qemu: Make sure BeginJob is always followed by EndJob (rhbz#746268)
  - pci: Fix pciDeviceListSteal on multiple devices (rhbz#733587)
  - qemu: Do not reattach PCI device used by other domain when shutdown (rhbz#733587)
  - qemu: Honor the orginal PCI dev properties when reattaching (rhbz#736214)
  - daemon: Always advertise libvirtd service (rhbz#726616)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-20.el6
changelog:
  - qemu: Avoid leaking uninit data from hotplug to dumpxml (rhbz#747516)
  - storage: Plug iscsi memory leak (rhbz#747516)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-21.el6
changelog:
  - docs: Document managed=yes of hostdev passthrough (rhbz#740686)
  - ServerClient: Flush cached data (rhbz#748025)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-1.el6
changelog:
  - Rebase to upstream 0.9.10 (rhbz#752433)
  - Add support for sVirt in the LXC driver
  - block rebase: add new API virDomainBlockRebase
  - API: Add api to set and get domain metadata
  - virDomainGetDiskErrors public API
  - conf: add rawio attribute to disk element of domain XML
  - Add new public API virDomainGetCPUStats()
  - Introduce virDomainPMSuspendForDuration API
  - resize: add virStorageVolResize() API
  - Add a virt-host-validate command to sanity check HV config
  - Add new virDomainShutdownFlags API
  - QEMU guest agent support
  - many improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-2.el6
changelog:
  - qemu: Set capabilities based on supported monitor commands (rhbz#766958)
  - qemu: Implement DomainPMSuspendForDuration (rhbz#766958)
  - snapshot: Fix snapshot deletion use-after-free (rhbz#790744)
  - storage: Allow runtime detection of scrub (rhbz#725013)
  - qemu: Unlock monitor when connecting to dest qemu fails (rhbz#783968)
  - qemu: Prevent crash of libvirtd without guest agent (rhbz#790745)
  - python: Expose virDomain{G,S}etInterfaceParameters APIs in python binding (rhbz#770971)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-3.el6
changelog:
  - storage: Allow runtime detection of scrub missing build dep (rhbz#725013)
  - daemon: Plug memory leak (rhbz#795978)
  - daemon: Fix logic bug with virAsprintf (rhbz#795978)
  - util: Fix virFileAccessibleAs return path from parent (rhbz#795093)
  - Add support for unsafe migration (rhbz#751631)
  - virsh: Add --unsafe option to migrate command (rhbz#751631)
  - Introduce virStorageFileIsClusterFS (rhbz#751631)
  - qemu: Forbid migration with cache != none (rhbz#751631)
  - qemu: Nicer error message on failed graceful destroy (rhbz#795656)
  - Error out when using SPICE TLS with spice_tls=0 (rhbz#790436)
  - Revert "spec: Mark directories in /var/run as ghosts" (rhbz#788985)
  - Fixed URI parsing (rhbz#785164)
  - virsh: Fix informational message in iface-bridge command (rhbz#797066)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-4.el6
changelog:
  - Improve error reporting when virsh console is run without a TTY (rhbz#729940)
  - pidfile: Make checking binary path in virPidFileRead optional (rhbz#729940)
  - Add flags for virDomainOpenConsole (rhbz#729940)
  - virsh: Add support for VIR_DOMAIN_CONSOLE_* flags (rhbz#729940)
  - fdstream: Emit stream abort callback even if poll() doesnt. (rhbz#729940)
  - fdstream: Add internal callback on stream close (rhbz#729940)
  - util: Add helpers for safe domain console operations (rhbz#729940)
  - qemu: Add ability to abort existing console while creating new one (rhbz#729940)
  - Fixed service handling in specfile (rhbz#786770)
  - qemu: Don't emit tls-port spice option if port is -1 (rhbz#798220)
  - docs: Comments wiping supported algorithms (rhbz#725013)
  - libvirt-guests: Add documentation and clean up to use virsh's improved list (rhbz#693758)
  - libvirt-guests: Don't try to do a managed-save of transient guests (rhbz#693758)
  - virsh: Enhance list command to ease creation of shell scripts (rhbz#693758)
  - libvirt-guests: Check if URI is reachable before launching commands (rhbz#720691)
  - hooks: Add support for capturing hook output (rhbz#795127)
  - qemu: Add pre-migration hook (rhbz#795127)
  - Support for cpu64-rhel* qemu cpu models (rhbz#768450)
  - util: Add netlink event handling to virnetlink.c (rhbz#693842)
  - Add de-association handling to macvlan code (rhbz#693842)
  - qemu: Add ibmvscsi controller model (rhbz#782034)
  - qemu: Add virtio-scsi controller model (rhbz#782034)
  - conf: Add helper function to look up disk controller model (rhbz#782034)
  - conf: Introduce new attribute for device address format (rhbz#782034)
  - qemu: New cap flag to indicate if channel is supported by scsi-disk (rhbz#782034)
  - qemu: Build command line for the new address format (rhbz#782034)
  - tests: Add tests for virtio-scsi and ibmvscsi controllers (rhbz#782034)
  - virsh: Two new helper functions for disk device changes (rhbz#713932)
  - virsh: Use vshFindDisk and vshPrepareDiskXML in cmdDetachDisk (rhbz#713932)
  - virsh: New command cmdChangeMedia (rhbz#713932)
  - qemu: Require json for block jobs (rhbz#799055)
  - qemu: Pass block pull backing file to monitor (rhbz#799055)
  - virsh: Expose partial pull (rhbz#799055)
  - libvirt-guests: Add parallel startup and shutdown of guests (rhbz#625362)
  - qemu: Shared or readonly disks are always safe wrt migration (rhbz#751631)
  - util: Eliminate crash in virNetDevMacVLanCreateWithVPortProfile (rhbz#693842)
  - rpc: Fix client crash on connection close (rhbz#800185)
  - conf: Add missing device types to virDomainDevice(Type|Def) (rhbz#691539)
  - conf: Relocate virDomainDeviceDef and virDomainHostdevDef (rhbz#691539)
  - conf: Reorder static functions in domain_conf.c (rhbz#691539)
  - qemu: Rename virDomainDeviceInfoPtr variables to avoid confusion (rhbz#691539)
  - conf: Add device pointer to args of virDomainDeviceInfoIterate callback (rhbz#691539)
  - conf: Make hostdev info a separate object (rhbz#691539)
  - conf: HostdevDef parse/format helper functions (rhbz#691539)
  - conf: Give each hostdevdef a parent pointer (rhbz#691539)
  - conf: Put subsys part of virDomainHostdevDef into its own struct (rhbz#691539)
  - conf: Hostdev utility functions (rhbz#691539)
  - qemu: Re-order functions in qemu_hotplug.c (rhbz#691539)
  - qemu: Refactor hotplug detach of hostdevs (rhbz#691539)
  - conf: Parse/format type='hostdev' network interfaces (rhbz#691539)
  - qemu: Support type='hostdev' network devices at domain start (rhbz#691539)
  - conf: Change virDomainNetRemove from static to global (rhbz#691539)
  - qemu: Use virDomainNetRemove instead of inline code (rhbz#691539)
  - qemu: Support type=hostdev network device live hotplug attach/detach (rhbz#691539)
  - util: Two new pci util functions (rhbz#691539)
  - util: Support functions for mac/portprofile associations on hostdev (rhbz#691539)
  - util: Changes to support portprofiles for hostdevs (rhbz#691539)
  - qemu: Install port profile and mac address on netdev hostdevs (rhbz#691539)
  - Fix build after commit e3ba4025 (rhbz#693842)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-5.el6
changelog:
  - Avoid global variable shadowed (rhbz#737726)
  - Add nodeGetCPUmap() for getting available CPU IDs in a cpumap. (rhbz#737726)
  - Qemu driver for virDomainGetCPUstats using cpuacct cgroup. (rhbz#737726)
  - Cpu-stats command shows cpu statistics information of a domain. (rhbz#737726)
  - Ensure max_id is initialized in linuxParseCPUmap() (rhbz#737726)
  - rpc: Allow truncated return for virDomainGetCPUStats (rhbz#737726)
  - qemu: Don't parse device twice in attach/detach (rhbz#770031)
  - sanlock: Fix condition left crippled while debugging (rhbz#785736)
  - sanlock: Use STREQ_NULLABLE instead of STREQ on strings that may be null (rhbz#785736)
  - qemu: Fix startupPolicy for snapshot-revert (rhbz#798938)
  - util: Don't overflow on errno in virFileAccessibleAs (rhbz#798938)
  - blockResize: Add flag for bytes (rhbz#796526)
  - docs: Use correct terminology for 1024 bytes (rhbz#796526)
  - api: Add overflow error (rhbz#796526)
  - util: New function for scaling numbers (rhbz#796526)
  - xml: Share 'unit' in RNG (rhbz#796526)
  - xml: Output memory unit for clarity (rhbz#796526)
  - storage: Support more scaling suffixes (rhbz#796526)
  - xml: Drop unenforced minimum memory limit from RNG (rhbz#796526)
  - xml: Use long long internally, to centralize overflow checks (rhbz#796526)
  - xml: Use better types for memory values (rhbz#796526)
  - xml: Allow scaled memory on input (rhbz#796526)
  - virsh: Add option aliases (rhbz#796526)
  - virsh: Use option aliases (rhbz#796526)
  - virsh: Add command aliases, and rename nodedev-detach (rhbz#796526)
  - virsh: Improve storage unit parsing (rhbz#796526)
  - virsh: Improve memory unit parsing (rhbz#796526)
  - qemuBuildCommandLine: Don't add tlsPort if none set (rhbz#801443)
  - Removed more AMD-specific features from cpu64-rhel* models (rhbz#768450)
  - qemu: Support disk filenames with comma (rhbz#801970)
  - cpustats: Collect VM user and sys times (miss python bindings) (rhbz#800366)
  - cpustats: Report user and sys times (rhbz#800366)
  - qemu: Fix (managed)save and snapshots with host mode CPU (rhbz#801160)
  - qemu: Make block io tuning smarter (rhbz#770683)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-6.el6
changelog:
  - cpu: Add new flag supported by qemu to the cpu definition (rhbz#767364)
  - Added support for AMD Bulldozer CPU (rhbz#767364)
  - graphics: Cleanup port policy (rhbz#801443)
  - qemu: Reverse condition in qemuDomainCheckDiskPresence (rhbz#798938)
  - cpu: Add cpu definition for Intel Sandy Bridge cpu type (rhbz#761005)
  - cpu: Disable tsc-deadline feature not supported in qemu on RHEL 6.3 (rhbz#761005)
  - qemu: Support numad (rhbz#769930)
  - numad: Fix typo and warning (rhbz#769930)
  - qemu: Use scsi-block for lun passthrough instead of scsi-disk (rhbz#782034)
  - util: Make virDomainLeaseDefFree global (rhbz#802851)
  - qemu: Don't 'remove' hostdev objects from domain if operation fails (rhbz#802851)
  - util: Eliminate device object leaks related to virDomain*Remove*() (rhbz#802851)
  - virsh: Fix invalid free (rhbz#803591)
  - qemu: Eliminate memory leak in qemuDomainUpdateDeviceConfig (rhbz#802854)
  - qemu: Support persistent hotplug of <hostdev> devices (rhbz#802856)
  - qemu: Fix segfault when detaching non-existent network device (rhbz#802644)
  - remote: Fix migration leaks (rhbz#798497)
  - virsh: Trim aliases from -h output (rhbz#796526)
  - Fix handling of blkio deviceWeight empty string (rhbz#804028)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-7.el6
changelog:
  - snapshot: Make quiesce a bit safer (rhbz#804210)
  - python: Avoid memory leaks on libvirt_virNodeGetMemoryStats (rhbz#770944)
  - qemu: Use unlimited speed when migrating to file (rhbz#740099)
  - qemu: Add support for domain cleanup callbacks (rhbz#795305)
  - qemu: Avoid dangling migration-in job on shutoff domains (rhbz#795305)
  - qemu: Add connection close callbacks (rhbz#795305)
  - qemu: Make autodestroy utilize connection close callbacks (rhbz#795305)
  - qemu: Avoid dangling migration-out job when client dies (rhbz#795305)
  - python: Avoid memory leaks on libvirt_virNodeGetCPUStats (rhbz#770943)
  - util: Consolidate duplicated error messages in virnetlink.c (rhbz#693842)
  - python: Add virDomainGetCPUStats python binding API (rhbz#800366)
  - snapshot: Add qemu capability for 'transaction' command (rhbz#782457)
  - snapshot: Add atomic create flag (rhbz#782457)
  - snapshot: Make offline qemu snapshots atomic (rhbz#782457)
  - snapshot: Rudimentary qemu support for atomic disk snapshot (rhbz#782457)
  - snapshot: Add support for qemu transaction command (rhbz#782457)
  - snapshot: Wire up qemu transaction command (rhbz#782457)
  - snapshot: Improve qemu handling of reused snapshot targets (rhbz#782457)
  - Clarify virsh freecell manpage entry (rhbz#698521)
  - Add support for event tray moved of removable disks (rhbz#575160)
  - docs: Add documentation for new attribute tray of disk target (rhbz#575160)
  - conf: Parse and for the tray attribute (rhbz#575160)
  - qemu: Do not start with source for removable disks if tray is open (rhbz#575160)
  - qemu: Prohibit setting tray status as open for block type disk (rhbz#575160)
  - qemu: Update tray status while tray moved event is emitted (rhbz#575160)
  - build: Fix incorrect enum declaration (rhbz#575160)
  - spec: Add missed dependancy for numad (rhbz#769930)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-9.el6
changelog:
  - qemu: Avoid entering monitor with locked driver (rhbz#803186)
  - snapshot: Don't pass NULL to QMP command creation (rhbz#807147)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-10.el6
changelog:
  - python: Add new helper functions for python to C conversion (rhbz#807751)
  - python: Make python APIs use these helper functions (rhbz#807751)
  - python: Improve conversion validation (rhbz#807751)
  - qemu_agent: Issue guest-sync prior to every command (rhbz#808527)
  - qemu: Fix memory leak in virDomainGetVcpus (rhbz#808979)
  - qemu: Reflect any memory rounding back to xml (rhbz#808522)
  - conf: Allow fuzz in XML with cur balloon > max (rhbz#808522)
  - qemu: Start nested job in qemuDomainCheckEjectableMedia (rhbz#803186)
  - virsh: Clarify escape sequence (rhbz#808652)
  - virsh: Plug memory leaks on failure path (rhbz#807555)
  - conf: Prevent crash of libvirtd without channel target name (rhbz#808371)
  - qemu: Don't leak temporary list of USB devices (rhbz#808459)
  - qemu: Delete USB devices used by domain on stop (rhbz#808459)
  - qemu: Build activeUsbHostdevs list on process reconnect (rhbz#808459)
  - qemu: Fix virtio+macvtap migration from 6.3 to older hosts (rhbz#806633)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-11.el6
changelog:
  - test: Fix segfault in networkxml2argvtest (rhbz#810100)
  - conf: Plug memory leaks on virDomainDiskDefParseXML (rhbz#575160)
  - qemu_ga: Don't overwrite errors on FSThaw (rhbz#808527)
  - Fix parallel build in docs/ directory (rhbz#810559)
  - qemu: Make migration fail when port profile association fails on the dst host (rhbz#811026)
  - Wire up <loader> to set the QEMU BIOS path (rhbz#811227)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-12.el6
changelog:
  - blockjob: Add qemu capabilities related to block pull jobs (rhbz#811683)
  - blockjob: Add API for async virDomainBlockJobAbort (rhbz#811683)
  - blockjob: Optimize JSON event handler lookup (rhbz#811683)
  - blockjob: Wire up qemu async virDomainBlockJobAbort (rhbz#811683)
  - blockjob: Allow for fast-finishing job (rhbz#811683)
  - virsh: Minor syntactic cleanups (rhbz#811683)
  - qemu: Use consistent error when qemu binary is too old (rhbz#811683)
  - blockjob: Add virsh blockpull --wait (rhbz#811683)
  - qemu: Fix deadlock when qemuDomainOpenConsole cleans up a connection (rhbz#811497)
  - qemu: Fix deadlock when qemuDomainOpenConsole cleans up a connection (rhbz#811497)
  - qemu: Fix mem leak in qemuProcessInitCpuAffinity (rhbz#810157)
  - numad: Convert node list to cpumap before setting affinity (rhbz#810157)
  - numad: Ignore cpuset if placement is auto (rhbz#810157)
  - conf: Do not parse cpuset only if the placement is auto (rhbz#810157)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-13.el6
changelog:
  - Fix a problem in the patchset, rhbz#811497 one was applied twice in -12
  - qemu, util: On restart of libvirt restart vepa callbacks (rhbz#812430)
  - qemu, util: Fix netlink callback registration for migration (rhbz#812430)
  - util: Only register callbacks for CREATE operations in virnetdevmacvlan.c (rhbz#812430)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-14.el6
changelog:
  - blockjob: Add new API flags (rhbz#638506)
  - blockjob: Add 'blockcopy' to virsh (rhbz#638506)
  - blockjob: Enhance xml to track mirrors across libvirtd restart (rhbz#638506)
  - blockjob: React to active block copy (rhbz#638506)
  - blockjob: Add qemu capabilities related to block jobs (rhbz#638506)
  - blockjob: Return appropriate event and info (rhbz#638506)
  - blockjob: Support pivot operation on cancel (rhbz#638506)
  - blockjob: Make drive-reopen safer (rhbz#638506)
  - blockjob: Implement block copy for qemu (rhbz#638506)
  - blockjob: Allow for existing files (rhbz#638506)
  - blockjob: Allow mirroring under SELinux (rhbz#638506)
  - blockjob: Accommodate RHEL backport names (rhbz#638506)
  - virsh: Avoid strtol (rhbz#813972)
  - conf: Tighten up XML integer parsing (rhbz#813972)
  - snapshot: Fix memory leak on error (rhbz#782457)
  - virsh: Avoid uninitialized memory usage (rhbz#814080)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-15.el6
changelog:
  - qemu: Improve errors related to offline domains (rhbz#816662)
  - blockjob: Check for active vm before checking blockcopy bits (rhbz#816662)
  - qemu: Preserve original error during migration (rhbz#807907)
  - rpc: Discard non-blocking calls only when necessary (rhbz#807907)
  - qemu: Fix detection of failed migration (rhbz#807907)
  - qemu: Avoid bogus error at the end of tunnelled migration (rhbz#807907)
  - qemu: Make sure qemu can access its directory in hugetlbfs (rhbz#815206)
  - virsh: Fix docs for list command (rhbz#814021)
  - virsh: Fix and clarify the --title flag for the list command in man page (rhbz#814021)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-16.el6
changelog:
  - qemuOpenFile: Don't force chown on NFS (rhbz#810241)
  - util: Fix crash when starting macvtap interfaces (rhbz#815270)
  - qemu: Fix segfault when host CPU is empty (rhbz#817078)
  - blockjob: Allow speed setting in block copy (rhbz#815791)
  - blockjob: Fix block-stream bandwidth race (rhbz#815791)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-17.el6
changelog:
  - qemu: Don't modify domain on failed blockiotune (rhbz#819014)
  - qemu: Reject blockiotune if qemu too old (rhbz#819014)
  - qemu: Don't use virDomainDefFormat* directly (rhbz#815503)
  - qemu: Emit compatible XML when migrating a domain (rhbz#815503)
  - usb: Create functions to search usb device accurately (rhbz#815755)
  - qemu: Call usb search function for hostdev initialization and hotplug (rhbz#815755)
  - virsh: Avoid heap corruption leading to virsh abort (rhbz#819636)
  - util: Fix libvirtd startup failure due to netlink error (rhbz#816465)
  - util: Allow specifying both src and dst pid in virNetlinkCommand (rhbz#816465)
  - util: Function to get local nl_pid used by netlink event socket (rhbz#816465)
  - util: Set src_pid for virNetlinkCommand when appropriate (rhbz#816465)
  - domain_conf: Add "usbredir" to list of valid spice channels (rhbz#819498)
  - domain_conf: Add "default" to list of valid spice channels (rhbz#819499)
  - snapshot: Allow block devices past cgroup (rhbz#810200)
  - blockjob: Allow block devices past cgroup (rhbz#810200)
  - util: Avoid libvirtd crash in virNetDevTapCreate (rhbz#817234)
  - python: Fix the forward_null error in Python binding codes (rhbz#771021)
  - xen: Fix resource leak in xen driver (rhbz#771021)
  - test: Fix resource leak in test driver (rhbz#771021)
  - node: Fix resource leak in nodeinfo.c (rhbz#771021)
  - virnet: Fix resource leak in virnetlink.c (rhbz#771021)
  - vmx: Fix resource leak (rhbz#771021)
  - qemu: Fix resource leak (rhbz#771021)
  - uuid: Fix possible non-terminated string (rhbz#771021)
  - node_device: Fix possible non-terminated string (rhbz#771021)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-18.el6
changelog:
  - numad: Set memory policy from numad advisory nodeset (rhbz#810157)
  - numad: Copy 'placement' of <numatune> to <vcpu> by default (rhbz#810157)
  - numad: Always output 'placement' of <vcpu> (rhbz#810157)
  - qemu: Avoid the memory allocation and freeing (rhbz#810157)
  - numad: Divide cur_balloon by 1024 before passing it to numad (rhbz#810157)
  - numad: Check numactl-devel if compiled with numad support (rhbz#810157)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-19.el6
changelog:
  - build: Fix the typo in configure.ac (rhbz#820461)
  - qemu: Fix build when !HAVE_NUMACTL (rhbz#820461)
  - usb: Fix crash when failing to attach a second usb device (rhbz#815755)
  - qemu: Use the CPU index in capabilities to map NUMA node to cpu list. (rhbz#820461)
  - qemu: Set memory policy using cgroup if placement is auto (rhbz#820461)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-20.el6
changelog:
  - Fix virDomainDeviceInfoIsSet() to check all struct fields (rhbz#820869)
  - Fix logic for assigning PCI addresses to USB2 companion controllers (rhbz#820869)
  - Set a sensible default master start port for ehci companion controllers (rhbz#820869)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-21.el6
changelog:
  - qemu: Rollback on used USB devices (rhbz#743671)
  - qemu: Don't delete USB device on failed qemuPrepareHostdevUSBDevices (rhbz#743671)
  - Revert "rpc: Discard non-blocking calls only when necessary" (rhbz#821468)


author: Eric Blake <eblake@redhat.com> - libvirt-0.9.10-21.el6_3.1
changelog:
  - avoid closing uninitialized fd (rhbz#827050)
  - avoid fd leak (rhbz#827050)
  - command: avoid double close bugs (rhbz#827050)
  - fdstream: avoid double close bug (rhbz#827050)
  - command: check for fork error before closing fd (rhbz#827050)
  - qemu: avoid closing fd more than once (rhbz#827050)
  - Disable keepalives by default (rhbz#832184)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.13-1.el6
changelog:
  - first rebase for 6.4 more to come
  - kvm-guest failed to start; double-close bug in libvirt (rhbz#823716)
  - potential to deadlock libvirt on EPIPE (rhbz#827234)
  - fix keepalive issues (rhbz#832081)
  - CPU topology parsing bug on special NUMA platform (rhbz#828729)
  - libvirtd will crash when tight loop of hotplug/unplug PCI device (rhbz#822373)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.10.0-0rc0.el6
changelog:
  - New build based on upstream snapshot 0.10.0-0rc0 (rhbz#836934)
  - Cleanup and rebase of the few RHEL-only patches


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.10.0-1.el6
changelog:
  - New build based on upstream release 0.10.0 (rhbz#836934)
  - agent: add qemuAgentArbitraryCommand() for general qemu agent command
  - Introduce virDomainPinEmulator and virDomainGetEmulatorPinInfo functions
  - network: use firewalld instead of iptables, when available
  - network: make network driver vlan-aware
  - esx: Implement network driver
  - Various LXC improvements
  - Add virDomainGetHostname
  - a lot of bug fixes, improvements and portability work


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.10.2-1.el6
changelog:
  - New build based on upstream release 0.10.2 (rhbz#836934)
  - network: define new API virNetworkUpdate
  - add support for QEmu sandbox support
  - blockjob: add virDomainBlockCommit
  - New APIs to get/set Node memory parameters
  - new API virConnectListAllSecrets
  - new API virConnectListAllNWFilters
  - new API virConnectListAllNodeDevices
  - new API virConnectListAllInterfaces
  - new API virConnectListAllNetworks
  - new API virStoragePoolListAllVolumes
  - Add PMSUSPENDED life cycle event
  - new API virStorageListAllStoragePools
  - Add per-guest S3/S4 state configuration
  - qemu: Support for Block Device IO Limits
  - a lot of bug fixes, improvements and portability work


author: Jiri Denemark <jdenemar@redhat.com> - libvirt-0.10.2-2.el6
changelog:
  - qemu: Wait for SPICE to migrate (rhbz#836135)
  - lxc: Correctly report active cgroups (rhbz#860907)
  - network: Backend for virNetworkUpdate of interface list (rhbz#844404)
  - Fix start of containers with custom root filesystem (rhbz#861564)
  - Correct checking of virStrcpyStatic() return value (rhbz#864122)


author: Jiri Denemark <jdenemar@redhat.com> - libvirt-0.10.2-3.el6
changelog:
  - conf: Rename life cycle actions to event actions (rhbz#832156)
  - conf: Add on_lockfailure event configuration (rhbz#832156)
  - locking: Add const char * parameter to avoid ugly typecasts (rhbz#832156)
  - locking: Pass hypervisor driver name when acquiring locks (rhbz#832156)
  - locking: Add support for lock failure action (rhbz#832156)
  - locking: Implement lock failure action in sanlock driver (rhbz#832156)
  - conf: Add support for startupPolicy for USB devices (rhbz#843560)
  - qemu: Introduce qemuFindHostdevUSBDevice (rhbz#843560)
  - qemu: Add option to treat missing USB devices as success (rhbz#843560)
  - qemu: Implement startupPolicy for USB passed through devices (rhbz#843560)
  - Add MIGRATABLE flag for virDomainGetXMLDesc (rhbz#843560)
  - qemu: Make save/restore with USB devices usable (rhbz#843560)
  - conf: Mark missing optional USB devices in domain XML (rhbz#843560)
  - security: Also parse user/group names instead of just IDs for DAC labels (rhbz#860519)
  - doc: Update description about security labels on formatdomain.html (rhbz#860519)
  - util: Extend virGetUserID and virGetGroupID to support names and IDs (rhbz#860519)
  - security: Update user and group parsing in security_dac.c (rhbz#860519)
  - doc: Update description about user/group in qemu.conf (rhbz#860519)
  - Fix kvm_pv_eoi with kvmclock (rhbz#860971)
  - Change qemuSetSchedularParameters to use AFFECT_CURRENT (rhbz#852260)
  - Fix handling of itanium arch name in QEMU driver (rhbz#863115)
  - Add a qemu capabilities cache manager (rhbz#863115)
  - Switch over to use cache for building QEMU capabilities (rhbz#863115)
  - Remove probing of flags when launching QEMU guests (rhbz#863115)
  - Remove probing of machine types when canonicalizing XML (rhbz#863115)
  - Remove probing of CPU models when launching QEMU guests (rhbz#863115)
  - Make qemuCapsProbeMachineTypes & qemuCapsProbeCPUModels static (rhbz#863115)
  - Remove xenner support (rhbz#863115)
  - Refactor guest init to support qemu-system-i386 binary too (rhbz#863115)
  - Add a qemuMonitorGetVersion() method for QMP query-version command (rhbz#863115)
  - Add a qemuMonitorGetMachines() method for QMP query-machines command (rhbz#863115)
  - Add a qemuMonitorGetCPUDefinitions method for QMP query-cpu-definitions command (rhbz#863115)
  - Add a qemuMonitorGetCommands() method for QMP query-commands command (rhbz#863115)
  - Add a qemuMonitorGetEvents() method for QMP query-events command (rhbz#863115)
  - Add a qemuMonitorGetObjectTypes() method for QMP qom-list-types command (rhbz#863115)
  - Add a qemuMonitorGetObjectProps() method for QMP device-list-properties command (rhbz#863115)
  - Add a qemuMonitorGetTargetArch() method for QMP query-target command (rhbz#863115)
  - Remove some unused includes in QEMU code (rhbz#863115)
  - Move command/event capabilities detection out of QEMU monitor code (rhbz#863115)
  - Fix regression starting QEMU instances without query-events (rhbz#863115)
  - Refactor qemuCapsParseDeviceStr to work from data tables (rhbz#863115)
  - Fix QEMU test with 1.2.0 help output (rhbz#863115)
  - Ignore error from query-cpu-definitions (rhbz#863115)
  - Fix potential deadlock when agent is closed (rhbz#859712)
  - Fix (rare) deadlock in QEMU monitor callbacks (rhbz#859712)
  - Convert virLXCMonitor to use virObject (rhbz#864336)
  - Remove pointless virLXCProcessMonitorDestroy method (rhbz#864336)
  - Simplify some redundant locking while unref'ing objects (rhbz#859712)
  - Fix deadlock in handling EOF in LXC monitor (rhbz#864336)
  - Avoid bogus I/O event errors when closing the QEMU monitor (rhbz#859712)
  - qemu: Fix parsing of x86 CPU models (rhbz#864097)
  - python: Keep consistent handling of Python integer conversion (rhbz#816609)
  - esx: Fix and improve esxListAllDomains function (rhbz#864384)
  - virsh: Block SIGINT while getting BlockJobInfo (rhbz#845448)
  - spec: Add support for libssh2 transport (rhbz#513363)
  - Revert "Use XDG Base Directories instead of storing in home directory" (rhbz#859331)
  - doc: Sort out the relationship between <vcpu>, <vcpupin>, and <emulatorpin> (rhbz#855218)
  - conf: Ignore vcpupin for not onlined vcpus when parsing (rhbz#855218)
  - conf: Initialize the pinning policy for vcpus (rhbz#855218)
  - qemu: Create or remove cgroup when doing vcpu hotpluging (rhbz#857013)
  - qemu: Initialize cpuset for hotplugged vcpu as def->cpuset (rhbz#855218)
  - conf: Ignore emulatorpin if vcpu placement is auto (rhbz#855218)
  - qemu: Ignore def->cpumask if emulatorpin is specified (rhbz#855218)
  - Avoid straying </cpuset> (rhbz#855218)
  - conf: Fix virDevicePCIAddressEqual args (rhbz#805071)
  - conf: VirDomainDeviceInfoCopy utility function (rhbz#805071)
  - qemu: Reorganize qemuDomainChangeNet and qemuDomainChangeNetBridge (rhbz#805071)
  - Add support for SUSPEND_DISK event (rhbz#839661)


author: Jiri Denemark <jdenemar@redhat.com> - libvirt-0.10.2-4.el6
changelog:
  - node_memory: Add new parameter field to tune the new sysfs knob (rhbz#840113)
  - daemon: Fix removing abstract namespaces (rhbz#859331)
  - tests: Fix domain-events python test (rhbz#839661)
  - conf: Fix crash with cleanup (rhbz#866288)
  - spec: Add runtime requirement for libssh2 (rhbz#866508)
  - spec: Require newer sanlock on recent distros (rhbz#832156)
  - spec: Require newer sanlock on recent distros 2 (rhbz#832156)


author: Jiri Denemark <jdenemar@redhat.com> - libvirt-0.10.2-5.el6
changelog:
  - qemu: Clear async job when p2p migration fails early (rhbz#867412)
  - qemu: Pin the emulator when only cpuset is specified (rhbz#867372)
  - qemu: Correctly wait for spice to migrate (rhbz#867724)
  - qemu: Fixed default machine detection in qemuCapsParseMachineTypesStr (rhbz#867764)
  - conf: Make tri-state feature options more universal (rhbz#864606)
  - conf: Add support for HyperV Enlightenment features (rhbz#864606)
  - qemu: Add support for HyperV Enlightenment feature "relaxed" (rhbz#864606)
  - network: Set to NULL after virNetworkDefFree() (rhbz#866364)
  - qemu: Always format CPU topology (rhbz#866999)
  - qemu: Don't fail without emulatorpin or cpumask (rhbz#867372)
  - qemu: Allow migration with host USB devices (rhbz#843560)
  - qemu: Do not require hostuuid in migration cookie (rhbz#863059)
  - network: Free/null newDef if network fails to start (rhbz#866364)
  - migrate: v2: Use VIR_DOMAIN_XML_MIGRATABLE when available (rhbz#856864)
  - qemu: Avoid holding the driver lock in trivial snapshot API's (rhbz#772088)
  - storage: List more file types (rhbz#772088)
  - storage: Treat 'aio' like 'raw' at parse time (rhbz#772088)
  - storage: Match RNG to supported driver types (rhbz#772088)
  - storage: Use enum for default driver type (rhbz#772088)
  - storage: Use enum for disk driver type (rhbz#772088)
  - storage: Use enum for snapshot driver type (rhbz#772088)
  - storage: Don't probe non-files (rhbz#772088)
  - storage: Get entire metadata chain in one call (rhbz#772088)
  - storage: Don't require caller to pre-allocate metadata struct (rhbz#772088)
  - storage: Remember relative names in backing chain (rhbz#772088)
  - storage: Make it easier to find file within chain (rhbz#772088)
  - storage: Cache backing chain while qemu domain is live (rhbz#772088)
  - storage: Use cache to walk backing chain (rhbz#772088)
  - blockjob: Remove unused parameters after previous patch (rhbz#772088)
  - blockjob: Manage qemu block-commit monitor command (rhbz#772088)
  - blockjob: Wire up online qemu block-commit (rhbz#772088)
  - blockjob: Implement shallow commit flag in qemu (rhbz#772088)
  - blockjob: Refactor qemu disk chain permission grants (rhbz#772088)
  - blockjob: Properly label disks for qemu block-commit (rhbz#772088)
  - blockjob: Avoid segv on early error (rhbz#772088)
  - blockjob: Accommodate early RHEL backport naming (rhbz#772088)
  - virsh: Fix segfault of snapshot-list (rhbz#837544)
  - network: Always create dnsmasq hosts and addnhosts files, even if empty (rhbz#868389)
  - network: Don't allow multiple default portgroups (rhbz#868483)
  - selinux: Use raw contexts (rhbz#851981)
  - selinux: Add security selinux function to label tapfd (rhbz#851981)
  - selinux: Use raw contexts 2 (rhbz#851981)
  - selinux: Fix wrong tapfd relablling (rhbz#851981)
  - selinux: Remove unused variables in socket labelling (rhbz#851981)
  - selinux: Relabel tapfd in qemuPhysIfaceConnect (rhbz#851981)
  - storage: Let format probing work on root-squash NFS (rhbz#856247)
  - snapshot: Sanity check when reusing file for snapshot (rhbz#856247)
  - blockjob: Add qemu capabilities related to block jobs (rhbz#856247)
  - blockjob: React to active block copy (rhbz#856247)
  - blockjob: Return appropriate event and info (rhbz#856247)
  - blockjob: Support pivot operation on cancel (rhbz#856247)
  - blockjob: Make drive-reopen safer (rhbz#856247)
  - blockjob: Implement block copy for qemu (rhbz#856247)
  - blockjob: Allow for existing files in block-copy (rhbz#856247)
  - blockjob: Allow mirroring under SELinux and cgroup (rhbz#856247)
  - blockjob: Relabel entire existing chain (rhbz#856247)


author: Jiri Denemark <jdenemar@redhat.com> - libvirt-0.10.2-6.el6
changelog:
  - xml: Omit domain name from comment if it contains double hyphen (rhbz#868692)
  - cpu: Add recently added cpu feature flags. (rhbz#797283)
  - esx: Update version checks for vSphere 5.1 (rhbz#865670)
  - qemu: Add helper to prepare cpumap for affinity setting (rhbz#869096)
  - qemu: Keep the affinity when creating cgroup for emulator thread (rhbz#869096)
  - qemu: Prohibit chaning affinity of domain process if placement is 'auto' (rhbz#870099)
  - network: Fix networkValidate check for default portgroup and vlan (rhbz#868483)
  - qemu: Fix attach/detach of netdevs with matching mac addrs (rhbz#862515)
  - snapshot: Improve snapshot-list error message (rhbz#869100)
  - virsh: Remove --flags from nodesuspend (rhbz#869508)
  - virsh: Fix POD syntax (rhbz#870273)
  - xml: Print uuids in the warning (rhbz#868692)
  - blockjob: Support both RHEL and upstream qemu drive-mirror (rhbz#871055)


author: Jiri Denemark <jdenemar@redhat.com> - libvirt-0.10.2-7.el6
changelog:
  - sanlock: Introduce 'user' and 'group' conf variables (rhbz#820173)
  - esx: Fix connection to ESX 5.1 (rhbz#865670)
  - cpu: Fix definition of flag smap (rhbz#797283)
  - util: Do a better job of matching up pids with their binaries (rhbz#871201)
  - qemu: Fix EmulatorPinInfo without emulatorpin (rhbz#871312)
  - build: Fix RPM build for non-x86 platforms (rhbz#820173)
  - qemu: Report errors from iohelper (rhbz#866369)
  - build: Fix linking with systemtap probes (rhbz#866369)
  - iohelper: Fdatasync() at the end (rhbz#866369)
  - net-update docs: S/domain/network/ (rhbz#872104)
  - cpu: Add newly added cpu flags (rhbz#838127)
  - cpu: Add AMD Opteron G5 cpu model (rhbz#838127)
  - cpu: Add Intel Haswell cpu model (rhbz#843087)
  - snapshot: New XML for external system checkpoint (rhbz#638512)
  - snapshot: Improve disk align checking (rhbz#638512)
  - snapshot: Populate new XML info for qemu snapshots (rhbz#638512)
  - snapshot: Merge pre-snapshot checks (rhbz#638512)
  - qemu: Fix possible race when pausing guest (rhbz#638512)
  - qemu: Clean up snapshot retrieval to use the new helper (rhbz#638512)
  - qemu: Split out domain memory saving code to allow reuse (rhbz#638512)
  - snapshot: Add flag to enable creating checkpoints in live state (rhbz#638512)
  - snapshot: qemu: Add async job type for snapshots (rhbz#638512)
  - snapshot: qemu: Rename qemuDomainSnapshotCreateActive (rhbz#638512)
  - snapshot: qemu: Add support for external checkpoints (rhbz#638512)
  - snapshot: qemu: Remove restrictions preventing external checkpoints (rhbz#638512)


author: Jiri Denemark <jdenemar@redhat.com> - libvirt-0.10.2-8.el6
changelog:
  - iohelper: Don't report errors on special FDs (rhbz#866369)
  - esx: Yet another connection fix for 5.1 (rhbz#873538)
  - qemu: Don't corrupt pointer in qemuDomainSaveMemory() (rhbz#873537)
  - build: Place attributes in correct location (rhbz#873934)
  - Introduce new VIR_DOMAIN_EVENT_SUSPENDED_API_ERROR event (rhbz#866388)
  - qemu: Emit event if 'cont' fails (rhbz#866388)
  - virsh: Make ,, escape parsing common (rhbz#874171)
  - virsh: Add snapshot-create-as memspec support (rhbz#874171)
  - qemu: Fix domain ID numbering race condition (rhbz#874330)
  - qemu: Allow migration to be cancelled at prepare phase (rhbz#873792)
  - AbortJob: Fix documentation (rhbz#873792)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-9
changelog:
  - util: Improve error reporting from absolutePathFromBaseFile helper (rhbz#874860)
  - storage: Fix broken backing chain (rhbz#874860)
  - nodeinfo: Add check and workaround to guarantee valid cpu topologies (rhbz#874050)
  - nodeinfotest: Add test data for 2 processor host with broken NUMA (rhbz#874050)
  - nodeinfotest: Add test data from a AMD bulldozer machine. (rhbz#874050)
  - virsh: save: Report an error if XML file can't be read (rhbz#876868)
  - virsh: Fix uninitialized variable in cmdSnapshotEdit (rhbz#877303)
  - qemu: Allow larger discrepency between memory & currentMemory in domain xml (rhbz#873134)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-10
changelog:
  - Add note about numeric domain names to manpage (rhbz#824253)
  - Use virNetServerRun instead of custom main loop (rhbz#867246)
  - qemu: Fix RBD attach regression (rhbz#878862)
  - qemu: Stop recursive detection of image chains when an image is missing (rhbz#878862)
  - Fix exiting of libvirt_lxc program on container quit (rhbz#879360)
  - snapshot: qemu: Add support for external inactive snapshots (rhbz#876816)
  - conf: Fix private symbols exported by files in conf (rhbz#876816)
  - snapshot: qemu: Fix detection of external snapshots when deleting (rhbz#876816)
  - snapshot: Require user to supply external memory file name (rhbz#876816)
  - snapshot: Add two more filter sets to API (rhbz#876817)
  - snapshot: Add virsh back-compat support for new filters (rhbz#876817)
  - snapshot: Implement new filter sets (rhbz#876817)
  - snapshot: Expose location through virsh snapshot-info (rhbz#876817)
  - sanlock: Retry after EINPROGRESS (rhbz#820173)
  - storage: Fix logical volume cloning (rhbz#879780)
  - cpu: Add Intel Haswell cpu model (fix previous downstream definition) (rhbz#879282)
  - virsh: Report error when taking a snapshot with empty --memspec argument (rhbz#879130)
  - lxc: Don't crash if no security driver is specified in libvirt_lxc (rhbz#880064)
  - lxc: Avoid segfault of libvirt_lxc helper on early cleanup paths (rhbz#880064)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-11
changelog:
  - Fix uninitialized variable in virLXCControllerSetupDevPTS (rhbz#880064)
  - storage: Fix device detach regression with cgroup ACLs (rhbz#876828)
  - storage: Fix bug of fs pool destroying (rhbz#878400)
  - qemu: Fix a crash when save file can't be opened (rhbz#880919)
  - bitmap: Fix typo to use UL type of integer constant in virBitmapIsAllSet (rhbz#876415)
  - virsh: Rewrite cmdDomDisplay (rhbz#878779)
  - network: Fix crash when portgroup has no name (rhbz#879473)
  - util: Capabilities detection for dnsmasq (rhbz#882265)
  - util: New virSocketAddrIsPrivate function (rhbz#882265)
  - network: Use dnsmasq --bind-dynamic when available (rhbz#882265)
  - storage: Fix scsi detach regression with cgroup ACLs (rhbz#876828)
  - libssh2_session: Support DSS keys as well (rhbz#878376)
  - virsh: Fix error messages in iface-bridge (rhbz#878376)
  - virsh: Check the return value of virStoragePoolGetAutostart (rhbz#878376)
  - conf: Check the return value of virXPathNodeSet (rhbz#878376)
  - conf: snapshot: Check return value of virDomainSnapshotObjListNum (rhbz#878376)
  - util: Fix virBitmap allocation in virProcessInfoGetAffinity (rhbz#878376)
  - virsh: Use correct sizeof when allocating cpumap (rhbz#878376)
  - rpc: Don't destroy xdr before creating it in virNetMessageEncodeHeader (rhbz#878376)
  - virsh: Do timing even for unusable connections (rhbz#878376)
  - conf: Fix uninitialized variable in virDomainListSnapshots (rhbz#878376)
  - Fix error handling in virSecurityManagerGetMountOptions (rhbz#878376)
  - conf: Prevent crash with no uuid in cephx auth secret (rhbz#878376)
  - conf: Fix virDomainNetGetActualDirect*() and BridgeName() (rhbz#881480)
  - virsh: Report errors if arguments of the schedinfo command are incorrect (rhbz#882915)
  - systemd: Require dbus service (rhbz#830201)
  - spec: Require dbus-daemon when using libvirtd in Fedora (rhbz#830201)
  - qemu: Don't free PCI device if adding it to activePciHostdevs fails (rhbz#877095)
  - util: Slightly refactor PCI list functions (rhbz#877095)
  - qemu: Fix memory (and FD) leak on PCI device detach (rhbz#877095)
  - util: Do not keep PCI device config file open (rhbz#877095)
  - node_memory: Improve the docs (rhbz#872656)
  - node_memory: Do not fail if there is parameter unsupported (rhbz#872656)
  - node_memory: Fix bug of node_memory_tune (rhbz#872656)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-12
changelog:
  - qemu: Eliminate bogus error log when changing netdev's bridge (rhbz#885838)
  - remote: Avoid the thread race condition (rhbz#866524)
  - storage: Error out earlier if the volume target path already exists (rhbz#832302)
  - dnsmasq: Fix parsing of the version number (rhbz#885727)
  - qemu: Restart CPUs with valid async job type when doing external snapshots (rhbz#885081)
  - examples: Fix balloon event callback (rhbz#884650)
  - util: Don't fail virGetGroupIDByName when group not found (rhbz#883832)
  - util: Don't fail virGetUserIDByName when user not found (rhbz#883832)
  - util: Rework error reporting in virGet(User|Group)IDByName (rhbz#883832)
  - util: Fix warning message in previous patch (rhbz#883832)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-13
changelog:
  - network: Prevent dnsmasq from listening on localhost (rhbz#886821)
  - sanlock: Re-add lockspace unconditionally (rhbz#820173)
  - Fix "virsh create" example (rhbz#887187)
  - docs: Fix some typos in examples (rhbz#887187)
  - network: Don't require private addresses if dnsmasq uses SO_BINDTODEVICE (rhbz#882265)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-14
changelog:
  - util: Add missing error log messages when failing to get netlink VFINFO (rhbz#889319)
  - util: Fix functions that retrieve SRIOV VF info (rhbz#889319)
  - util: Fix botched check for new netlink request filters (rhbz#889319)
  - blockjob: Fix memleak that prevented block pivot (rhbz#888426)
  - sanlock: Chown lease files as well (rhbz#820173)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-15
changelog:
  - snapshot: conf: Make virDomainSnapshotIsExternal more reusable (rhbz#889407)
  - snapshot: qemu: Separate logic blocks with newlines (rhbz#889407)
  - snapshot: qemu: Fix segfault and vanishing snapshots when redefining (rhbz#889407)
  - snapshot: qemu: Allow redefinition of external snapshots (rhbz#889407)
  - util: Prepare helpers for unpriv_sgio setting (rhbz#878578)
  - qemu: Add a hash table for the shared disks (rhbz#878578)
  - docs: Add docs and rng schema for new XML tag sgio (rhbz#878578)
  - conf: Parse and format the new XML (rhbz#878578)
  - qemu: Set unpriv_sgio when starting domain and attaching disk (rhbz#878578)
  - qemu: Check if the shared disk's cdbfilter conflicts with others (rhbz#878578)
  - qemu: Relax hard RSS limit (rhbz#891653)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-16
changelog:
  - qemu_agent: Remove agent reference only when disposing it (rhbz#892079)
  - Add RESUME event listener to qemu monitor. (rhbz#894085)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-17
changelog:
  - storage: Fix lvcreate parameter for backingStore. (rhbz#896398)
  - qemu: Don't return success if creation of snapshot save file fails (rhbz#896403)
  - qemu: Reject attempts to create snapshots with names containig '/' (rhbz#896403)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-18
changelog:
  - rpc: Fix crash on error paths of message dispatching (CVE-2013-0170)
  - spec: Disable libssh2 support (rhbz#513363)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-19
changelog:
  - xen: Resolve resource leak with 'cpuset' (rhbz#888503)
  - schema: Make the cpuset type reusable across schema files (rhbz#888503)
  - schemas: Add schemas for more CPU topology information in the caps XML (rhbz#888503)
  - conf: Split out NUMA topology formatting to simplify access to data (rhbz#888503)
  - capabilities: Switch CPU data in NUMA topology to a struct (rhbz#888503)
  - capabilities: Add additional data to the NUMA topology info (rhbz#888503)
  - test: Add support for thread and core information for the test driver (rhbz#888503)
  - xen: Initialize variable before using (rhbz#888503)
  - xen: Actually fix the uninitialized variable (rhbz#888503)
  - spice: Properly reserve tlsPort when no port specified (rhbz#913244)
  - qemu_agent: Ignore expected EOFs (rhbz#892079)
  - qemu: Nicer error message if live disk snapshot unsupported (rhbz#882077)
  - qemu: Destroy domain on decompression binary error (rhbz#894723)
  - qemu: Run lzop with '--ignore-warn' (rhbz#894723)
  - Don't ignore return value of qemuProcessKill (rhbz#903238)
  - Fix race condition when destroying guests (rhbz#903238)
  - Log warning if storage magic matches, but version does not (rhbz#903248)
  - Add lots of debugging to storage file probing code (rhbz#903248)
  - Fix probing of QED file format (rhbz#903248)
  - util: Add virendian.h macros (rhbz#903248)
  - util: Use new virendian.h macros (rhbz#903248)
  - storage: Rearrange functions (rhbz#903248)
  - storage: Prepare for refactoring (rhbz#903248)
  - storage: Refactor metadata lookup (rhbz#903248)
  - storage: Don't follow backing chain symlinks too eagerly (rhbz#903248)
  - storage: Test backing chain traversal (rhbz#903248)
  - qemu: Check backing chains even when cgroup is omitted (rhbz#896013)
  - python: Fix bindings for virDomainSnapshotGet{Domain,Connect} (rhbz#895882)
  - qemu: Add checking in helpers for sgio setting (rhbz#908073)
  - qemu: Merge qemuCheckSharedDisk into qemuAddSharedDisk (rhbz#908073)
  - qemu: Record names of domain which uses the shared disk in hash table (rhbz#908073)
  - qemu: Update shared disk table when reconnecting qemu process (rhbz#908073)
  - qemu: Move the shared disk adding and sgio setting prior to attaching (rhbz#908073)
  - qemu: Remove the shared disk entry if the operation is ejecting or updating (rhbz#908073)
  - qemu: Fix the memory leak (rhbz#908073)
  - Fix crash changing CDROM media (rhbz#908073)
  - qemu: Avoid NULL dereference in qemuSharedDiskEntryFree (rhbz#908073)
  - qemu: Do not set unpriv_sgio if neither supported nor requested (rhbz#914677)
  - Use size_t instead of int for virDomainDefPtr struct (rhbz#896604)
  - util: Add VIR_(APPEND|INSERT|DELETE)_ELEMENT (rhbz#896604)
  - qemu: Fix QMP detection of QXL graphics (rhbz#896604)
  - qemu: Add qemu vga devices caps and one cap to mark them usable (rhbz#896604)
  - conf: Add optional attribte primary to video <model> element (rhbz#896604)
  - qemu: Use newer -device video device in qemu commandline (rhbz#896604)
  - tests: Add one -device video device testcase (rhbz#896604)
  - qemu: Detect VGA_QXL capability correctly (rhbz#896604)
  - qemu: Support ram bar size for qxl devices (rhbz#896604)
  - conf: Don't leak 'primary' video property on error (rhbz#896604)
  - storage: lvm: Don't overwrite lvcreate errors (rhbz#912179)
  - storage: lvm: Lvcreate fails with allocation=0, don't do that (rhbz#912179)
  - storage: Cleanup logical volume creation code (rhbz#912179)
  - docs: Clarify semantics of sparse storage volumes (rhbz#912179)
  - storage: Fix memory leak with regfree(reg) call. (rhbz#906299)
  - storage: Resource resource leak using 'tmp_vols' (rhbz#906299)
  - interface: Resolve resource leak wth 'tmp_iface_objs' (rhbz#906299)
  - locking: Resolve resource leaks on non error path (rhbz#906299)
  - selinux: Resolve resource leak using the default disk label (rhbz#906299)
  - storage: Resolve resource leaks with cmd processing (rhbz#906299)
  - domain_conf: Resolve resource leaks found by Valgrind (rhbz#906299)
  - qemu_command: Resolve resource leaks found by Valgrind (rhbz#906299)
  - storage: Need to add virCommandFree() (rhbz#906299)
  - qemu: Fix startupPolicy regression (rhbz#896013)
  - util: Retry NLM_F_REQUEST with different values of IFLA_EXT_MASK (rhbz#923963)
  - security_manager: Don't manipulate domain XML in virDomainDefGetSecurityLabelDef (rhbz#923946)
  - security: Don't add seclabel of type none if there's already a seclabel (rhbz#923946)
  - libvirt_private.syms: Correctly export seclabel APIs (rhbz#923946)
  - security_manager.c: Append seclabel iff generated (rhbz#923946)
  - rpc: Fix client crash when server drops connection (rhbz#921538)
  - storage: Fix volume cloning for logical volume. (rhbz#948678)
  - qemu: Allow migration over IPv6 (rhbz#846013)
  - qemu: Set IPv6 migration capability when dump-guest-core is present (rhbz#846013)
  - remote: Don't call NULL closeFreeCallback (rhbz#911609)
  - libvirt: Increase connection reference count for callbacks (rhbz#911609)
  - virsh: Unregister the connection close notifier upon termination (rhbz#911609)
  - virsh: Move cmdConnect from virsh-host.c to virsh.c (rhbz#911609)
  - virsh: Register and unregister the close callback also in cmdConnect (rhbz#911609)
  - rpc: Fix connection close callback race condition and memory corruption/crash (rhbz#911609)
  - tests: Fix qemumonitorjsontest deadlock when the machine is under load (rhbz#951227)
  - Avoid use of free'd memory in auto destroy callback (rhbz#950286)
  - Fix crash in QEMU auto-destroy with transient guests (rhbz#950286)
  - daemon: Fix leak after listing volumes (CVE-2013-1962)
  - Don't try to add non-existant devices to ACL (rhbz#922153)
  - Avoid spamming logs with cgroups warnings (rhbz#922153)
  - audit: Properly encode device path in cgroup audit (rhbz#922203)
  - qemu: Set correct migrate host in client_migrate_info (rhbz#920441)
  - qemu: Fix crash in migration of graphics-less guests. (rhbz#920441)
  - Fix F_DUPFD_CLOEXEC operation args (rhbz#961034)
  - cgroup: Be robust against cgroup movement races (rhbz#903433)
  - virsocket: Introduce virSocketAddrIsWildcard (rhbz#920441)
  - qemuDomainMigrateGraphicsRelocate: Use then new virSocketAddrIsWildcard (rhbz#920441)
  - virSocketAddrIsWildcard: Use IN6_IS_ADDR_UNSPECIFIED correctly (rhbz#920441)
  - libvirt: lxc: Don't mkdir when selinux is disabled (rhbz#915485)
  - Don't mount selinux fs in LXC if selinux is disabled (rhbz#915485)
  - virsh: Don't print --(null) in vol-name and vol-pool (rhbz#924571)
  - virsh: Fix docs for "virsh setmaxmem" (rhbz#924648)
  - qemu: Remove managed save flag from VM when starting with --force-boot (rhbz#917510)
  - qemu: Don't update count of vCPUs if hot-unplug has failed (rhbz#895424)
  - conf: net: Fix deadlock if assignment of network def fails (rhbz#921777)
  - RPC: Support up to 16384 cpus on the host and 4096 in the guest (rhbz#960683)
  - conf: Don't fail to parse <boot> when parsing a single device (rhbz#895294)
  - conf: Allow for non-contiguous device boot orders (rhbz#889961)
  - qemuDomainChangeGraphics: Check listen address change by listen type (rhbz#976401)
  - build: Fix build with -Werror (rhbz#976401)
  - qemuDomainBlockStatsFlags: Guard disk lookup with a domain job (rhbz#916315)
  - qemu: Don't fail to shutdown domains with unresponsive agent (rhbz#889635)
  - qemu: Wrap controllers code into dummy loop (rhbz#870003)
  - qemu: Add controllers in specified order (rhbz#870003)
  - tests: Add test for controller order (rhbz#870003)
  - bandwidth: Attach sfq to leaf node (rhbz#895340)
  - bandwidth: Create hierarchical shaping classes (rhbz#895340)
  - remote: Forbid default "/session" connections when using ssh transport (rhbz#847822)
  - remote: Fix client crash when URI path is empty when using ssh (rhbz#847822)
  - udev: Fix crash in libudev logging (rhbz#971904)
  - iscsi: Don't leak portal string when starting a pool (rhbz#975392)
  - storage: Avoid double virCommandFree in virStorageBackendLogicalDeletePool (rhbz#921387)
  - manual: Fix copy-paste errors (rhbz#923613)
  - esx: Support virtualHW version 9 (rhbz#955575)
  - manual: Add info about migrateuri in virsh manual (rhbz#878765)
  - conf: Fix cpumask leak in virDomainDefFree (rhbz#977430)
  - qemu: Avoid leaking uri in qemuMigrationPrepareDirect (rhbz#977961)
  - Document that runtime changes may be lost after S4 suspend (rhbz#872419)
  - virsh iface-bridge: Ignore delay if stp is turned off (rhbz#892403)
  - virsh: Obey pool-or-uuid spec when creating volumes (rhbz#970495)
  - Add method for checking if a string is (probably) a log message (rhbz#954248)
  - Convert QEMU driver to use virLogProbablyLogMessage (rhbz#954248)
  - util: Escapes special characters in VIR_LOG_REGEX (rhbz#954248)
  - qemu: Move QEMU log reading into a separate function (rhbz#954248)
  - qemu: Ignore libvirt logs when reading QEMU error output (rhbz#954248)
  - logging: Make log regexp more compact (and readable) (rhbz#954248)
  - qemu: Do not report unsafe migration for local files (rhbz#913363)
  - Plug leak in virCgroupMoveTask (rhbz#978352)
  - Fix invalid read in virCgroupGetValueStr (rhbz#978356)
  - pci: Initialize virtual_functions array pointer to avoid segfault (rhbz#980339)
  - Node device driver: update driver name during dumpxml (rhbz#979330)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-20
changelog:
  - qemu: Don't force port=0 for SPICE (rhbz#975751)
  - qemu: Refactor graphics code to not hardcode a single display (rhbz#975751)
  - qemu: Graphics support for simultaneous one of each sdl, vnc, spice (rhbz#975751)
  - qemu: Don't miss errors when changing graphics passwords (rhbz#975751)
  - qemu: Allow seamless migration for domains with multiple graphics (rhbz#975751)
  - qemu_migration: Move waiting for SPICE migration (rhbz#920205)
  - util: Refactor iptables command construction into multiple steps (rhbz#851455)
  - net: Support set public ip range for forward mode nat (rhbz#851455)
  - net: Add support for specifying port range for forward mode nat (rhbz#851455)
  - qemu_migrate: Dispose listen address if set from config (rhbz#971485)
  - qemu: Remove maximum cpu limit when setting processor count using the API (rhbz#855296)
  - qemu_agent: Introduce helpers for agent based CPU hot(un)plug (rhbz#924400)
  - virsh-domain: Refactor cmdVcpucount and fix output on inactive domains (rhbz#924400)
  - API: Introduce VIR_DOMAIN_VCPU_AGENT, for agent based CPU hot(un)plug (rhbz#924400)
  - qemu: Implement request of vCPU state using the guest agent (rhbz#924400)
  - qemu: Implement support for VIR_DOMAIN_VCPU_AGENT in qemuDomainSetVcpusFlags (rhbz#924400)
  - qemuDomainGetVcpusFlags: Initialize ncpuinfo (rhbz#924400)
  - Fix commit 29c1e913e459058c12d02b3f4b767b3dd428a498 (rhbz#924400)
  - qemu: Make qemuMigrationIsAllowed more reusable (rhbz#972675)
  - qemu: Cancel migration if guest encoutners I/O error while migrating (rhbz#972675)
  - qemu: Forbid migration of machines with I/O errors (rhbz#972675)
  - migration: Make erroring out on I/O error controllable by flag (rhbz#972675)
  - migration: Don't propagate VIR_MIGRATE_ABORT_ON_ERROR (rhbz#972675)
  - Paused domain should remain paused after migration (rhbz#972675)
  - qemu: New vnc display sharing policy caps flag (rhbz#803602)
  - conf: Add 'sharePolicy' attribute to graphics element for vnc (rhbz#803602)
  - qemu: Add ', share=<policy>' to qemu commandline (rhbz#803602)
  - virsh: Distinguish errors between missing argument and wrong option (rhbz#924596)
  - virsh: Fix incorrect argument errors for long options (rhbz#924596)
  - virsh: Resolve Coverity 'MISSING_BREAK' (rhbz#924596)
  - virnetdev: Need to initialize 'pciConfigAddr' (rhbz#980339)
  - qemu: Fix double free in qemuMigrationPrepareDirect (rhbz#977961)
  - sec_manager: Refuse to start domain with unsupported seclabel (rhbz#947387)
  - usb: Don't spoil decimal addresses (rhbz#981503)
  - storage: Return -1 when fs pool can't be mounted (rhbz#983539)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-21
changelog:
  - conf: Avoid NULL deref for pmsuspended domain state (rhbz#822306)
  - libvirt: Define domain crash event types (rhbz#822306)
  - qemu: Refactor processWatchdogEvent (rhbz#822306)
  - qemu: Expose qemuProcessShutdownOrReboot() (rhbz#822306)
  - qemu: Implement 'oncrash' events when guest panicked (rhbz#822306)
  - qemu: Implement 'oncrash' coredump events when guest panicked (rhbz#822306)
  - conf: Fix a memory leak when parsing nat port XML nodes (rhbz#851455)
  - security_manager: Fix comparison (rhbz#984793)
  - qemu: Prevent crash of libvirtd without guest agent configuration (rhbz#984821)
  - qemu: Fix double free of returned JSON array in qemuAgentGetVCPUs() (rhbz#984821)
  - qemu_agent: Add support for appending arrays to commands (rhbz#924400)
  - Add support for locking domain's memory pages (rhbz#947118)
  - qemu: Implement support for locking domain's memory pages (rhbz#947118)
  - qemu: Check for -realtime mlock=on|off support (rhbz#947118)
  - qemu: Move memory limit computation to a reusable function (rhbz#947118)
  - util: New virCommandSetMax(MemLock|Processes|Files) (rhbz#947118)
  - qemu: Set RLIMIT_MEMLOCK when memoryBacking/locked is used (rhbz#947118)
  - Add Gluster protocol as supported network disk backend (rhbz#849796)
  - qemu: Add support for gluster protocol based network storage backend. (rhbz#849796)
  - tests: Add tests for gluster protocol based network disks support (rhbz#849796)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-22
changelog:
  - virsh: Fix change-media bug on disk block type (rhbz#923053)
  - Fix patches for multiple graphics and spice migration (rhbz#975751)
  - Revert "qemu: Remove maximum cpu limit when setting processor count using the API" (rhbz#855296)
  - Remove VIR_DOMAIN_SHUTDOWN_CRASHED from public API (rhbz#822306)
  - Rename VIR_DOMAIN_PAUSED_GUEST_PANICKED to VIR_DOMAIN_PAUSED_CRASHED (rhbz#822306)
  - Improve LXC startup error reporting (rhbz#903092)
  - qemu: Take error path if acquiring of job fails in qemuDomainSaveInternal (rhbz#928661)
  - util: Improve user lookup helper (rhbz#964359)
  - util: Add virGetGroupList (rhbz#964359)
  - util: Make virSetUIDGID async-signal-safe (rhbz#964359)
  - Fix potential deadlock across fork() in QEMU driver (rhbz#964359)
  - security: Framework for driver PreFork handler (rhbz#964359)
  - security_dac: Compute supplemental groups before fork (rhbz#964359)
  - security: Fix deadlock with prefork (rhbz#964359)
  - Split TLS test into two separate tests (rhbz#975201)
  - Avoid re-generating certs every time (rhbz#975201)
  - Change data passed into TLS test cases (rhbz#975201)
  - Fix validation of CA certificate chains (rhbz#975201)
  - Fix parallel runs of TLS test suites (rhbz#975201)
  - tests: Fix parallel runs of TLS test suites (rhbz#975201)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-23
changelog:
  - virnettlscontext: Resolve Coverity warnings (UNINIT) (rhbz#975201)
  - Fix qemuProcessReadLog with non-zero offset (rhbz#991334)
  - virSecurityManagerGenLabel: Skip seclabels without model (rhbz#997818)
  - bitmap: Add virBitmapCountBits (rhbz#997367)
  - virbitmap: Refactor virBitmapParse to avoid access beyond bounds of array (rhbz#997367)
  - virbitmaptest: Add test for out of bounds condition (rhbz#997367)
  - network: Allow <vlan> in type='hostdev' networks (rhbz#999107)
  - python: Fix bindings that don't raise an exception (rhbz#912170)
  - storage: Update pool metadata after adding/removing/resizing volume (rhbz#965442)
  - storage: Fix coverity warning (rhbz#965442)
  - storage: Fix the use-after-free memory bug (rhbz#965442)
  - network: Permit upstream forwarding of unqualified DNS names (rhbz#928638)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-24
changelog:
  - security: Provide supplemental groups even when parsing label (rhbz#964359)
  - qemu: Remove hostdev entry when freeing the depending network entry (rhbz#1000973)
  - virsh: Correct DESCRIPTION for virsh help blockcopy (rhbz#1002790)
  - Add '<nat>' element to '<forward>' network schemas (rhbz#1004365)
  - build: More workarounds for if_bridge.h (rhbz#1002735)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-25
changelog:
  - migration: Do not restore labels on failed migration (rhbz#895826)
  - qemu: Use default machine type if missing it in qemu command line (rhbz#995312)
  - qemu: Don't leak vm on failure (rhbz#995312)
  - virDomainDefParseXML: Set the argument of virBitmapFree to NULL after calling virBitmapFree (rhbz#1006710)
  - tests: Files named '.*-invalid.xml' should fail validation (rhbz#1006710)
  - tests: Use portable shell code (rhbz#1006710)
  - Add test for the nodemask double free crash (rhbz#1006710)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-26
changelog:
  - Fix crash in remoteDispatchDomainMemoryStats (CVE-2013-4296)
  - Introduce APIs for splitting/joining strings (rhbz#1006266)
  - Rename virKillProcess to virProcessKill (rhbz#1006266)
  - Rename virPid{Abort, Wait} to virProcess{Abort, Wait} (rhbz#1006266)
  - Rename virCommandTranslateStatus to virProcessTranslateStatus (rhbz#1006266)
  - Move virProcessKill into virprocess.{h, c} (rhbz#1006266)
  - Move virProcess{Kill, Abort, TranslateStatus} into virprocess.{c, h} (rhbz#1006266)
  - Include process start time when doing polkit checks (rhbz#1006266)
  - Add support for using 3-arg pkcheck syntax for process (CVE-2013-4311)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-28
changelog:
  - libvirt-guests: status: Return non-zero when stopped (rhbz#1011981)
  - qemu: Drop qemuDomainMemoryLimit (rhbz#1013758)
  - docs: Discourage users to set hard_limit (rhbz#1013758)
  - docs: Clean 09adfdc62de2b up (rhbz#1013758)
  - qemuSetupMemoryCgroup: Handle hard_limit properly (rhbz#1013758)
  - qemuBuildCommandLine: Fall back to mem balloon if there's no hard_limit (rhbz#1013758)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-29
changelog:
  - virNetDevBandwidthEqual: Make it more robust (rhbz#1014198)
  - qemu_hotplug: Allow QoS update in qemuDomainChangeNet (rhbz#1014198)
  - qemu: Generate correct name for hostdev network devices (rhbz#1001881)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-29.el6_5.2
changelog:
  - qemuDomainDestroyFlags: Don't allow @vm to disappear while executing API (rhbz#1038816)
  - python: Return dictionary without value in case of no blockjob (rhbz#1038815)
  - remote: Fix regression in event deregistration (rhbz#1038814)
  - Add virtio-scsi to fallback models of scsi controller (rhbz#1040141)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-29.el6_5.3
changelog:
  - qemu: Avoid operations on NULL monitor if VM fails early (rhbz#1055578)
  - qemu: Do not access stale data in virDomainBlockStats (CVE-2013-6458)
  - qemu: Avoid using stale data in virDomainGetBlockInfo (CVE-2013-6458)
  - qemu: Fix job usage in qemuDomainBlockJobImpl (CVE-2013-6458)
  - qemu: Fix job usage in qemuDomainBlockCopy (rhbz#1054804)
  - qemu: Fix job usage in virDomainGetBlockIoTune (CVE-2013-6458)
  - Don't crash if a connection closes early (CVE-2014-1447)
  - Really don't crash if a connection closes early (CVE-2014-1447)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-29.el6_5.4
changelog:
  - Block info query: Add check for transient domain (rhbz#1059904)
  - network: Only prevent forwarding of DNS requests for unqualified names (rhbz#1062708)
  - network: Change default of forwardPlainNames to 'yes' (rhbz#1062708)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-29.el6_5.6
changelog:
  - Remove contiguous CPU indexes assumption (rhbz#1080439)
  - qemu: monitor: Fix error message and comment when getting cpu info (rhbz#1080439)
  - qemu: monitor: Filter out thread ids of CPUS that were unplugged (rhbz#1080439)
  - qemu: monitor: Fix invalid parentheses (rhbz#1080471)
  - virNetClientSetTLSSession: Restore original signal mask (rhbz#1080501)


author: Dan Smith <danms@us.ibm.com> - 0.1-2
changelog:
  - Cleaned up Release
  - Removed unnecessary Requires
  - After install, condrestart pegasus
  - Updated to latest source snapshot


author: Dan Smith <danms@us.ibm.com> - 0.3-4
changelog:
  - Fixed loader config for 64-bit systems
  - Added missing root/interop schema install
  - Added RegisteredProfile.registration to install


author: Dan Smith <danms@us.ibm.com> - 0.4-2
changelog:
  - Fixed schema registration to pick up ECTP in root/virt properly
  - Fixed schema registration to include ReferencedProfile in interop
  - Added RASD namespace fix


author: Dan Smith <danms@us.ibm.com> - 0.5.1-3
changelog:
  - Added infostore_trunc patch to fix infostore corruption
  - Added vsss_paramname patch to fix VSSS parameter name
  - Added vsss_logic patch to fix terminal memory snapshot logic
  - Added /etc/libvirt/cim directory for infostore


author: Kaitlin Rupert <kaitlin@us.ibm.com> - 0.5.1-4
changelog:
  - Added nostate patch to consider XenFV no state guests as running guests
  - Added createsnap_override patch to add vendor defined values to CreateSnapshot
  - Added add_shutdown_rsc patch to add support for shutdown operation
  - Added vsmc_add_remove patch to expose Add/Remove resources via VSMC
  - Added override_refconf patch to fix dup devs where ID matches refconf dev ID


author: Kaitlin Rupert <kaitlin@us.ibm.com> - 0.5.1-5
changelog:
  - Added vsmigser_schema patch to remove dup method name from VSMigrationService
  - Added mem_parse patch to set proper mem max_size and mem values
  - Added mig_prof_ver patch to report the proper Migration Profile version
  - Added hyp_conn_fail patch to fix when not connecting to hyp returns a failure
  - Added rm_def_virtdev patch to remove default DiskRADSD virtual device
  - Added rm_eafp_err patch to remove error status when EAFP no pool link exists
  - Added sdc_unsup patch to make SDC not return unsup for RASD to AC case


author: Daniel Veillard <veillard@redhat.com> - 0.5.11-1.el6
changelog:
  - Rebase to 0.5.11 for RHEL-6.1
  - needed to bump libcmpiutil requirement to 0.5.4 due to incompatibilities
  - Resolves: rhbz#633336
  - Resolves: rhbz#633331


author: Daniel Veillard <veillard@redhat.com> - 0.6.0-1.el6
changelog:
  - Rebase to libvirt-cim 0.6.0 rhbz#739154
  - Support libvirt domain events rhbz#739153
  - Network QoS support rhbz#633338
  - cpu cgroup support rhbz#739156


author: Daniel Veillard <veillard@redhat.com> - 0.6.1-2.el6
changelog:
  - do not require specifically tog-pegasus server (rhbz#799037)
  - (de)register the schemas with sblim-sfcb if found


author: Jiri Denemark <jdenemar@redhat.com> - 0.6.1-4.el6
changelog:
  - Fix an incomplete substitution in Makefile (rhbz#805892)
  - Only deregister cim classes on uninstall (rhbz#864096)


author: John Ferlan <jferlan@redhat.com> - 0.6.1-5
changelog:
  - Distinguish running or inactive state (rhbz#913164)
  - Only support script on bridge for xen domains (rhbz#908083)


author: Michal Privoznik <mprivozn@redhat.com> - 0.6.1-7.el6
changelog:
  - libvirt-cim-get_dominfo-Use-VIR_DOMAIN_XML_SECURE-more-wisely.patch (rhbz#826179)
  - Don't install open-pegasus' specific providers (rhbz#859122)


author: John Ferlan <jferlan@redhat.com> - 0.6.1-9.el6
changelog:
  - Add shareable property to disk and dumpCore tag support (rhbz#1000937)
  - Update spec file to more closely match upstream
  - Fixed dates in changelog


author: John Ferlan <jferlan@redhat.com> - 0.6.1-9.el6_5.1
changelog:
  - VSSD: Add properties for arch and machine (rhbz#1055626)
  - libxkutil: Improve domain.os_info cleanup
  - Coverity: Resolve RESOURCE_LEAK - parse_os()


author: Ivana Hutarova Varekova <varekova@redhat.com> 2.0-1
changelog:
  - resolves: #658734
    setacl(1) man page bug (package acl)
  - resolves: #651120
    setfattr(1) man page bug (package attr)
  - resolves: #615905
    ospfclient(8) and watchquagga(8) man pages added (package quagga)
  - resolves: #633701
    expect(1) man page is bad formatted (package expect)
  - resolves: #650162
    useradd(8) man page bug (package shadow-utils)
  - resolves: #657563
    Manual page corrections for find(1) (package findutils)
  - resolves: #632081
    man(1) for Japanese manual page contains duplicated lines in PAGER explanation
    (package man)
  - resolves: #604626
    yum-verify man page uses 'pretty' quotes in examples (package yum-utils)
  - resolves: #622451
    Author info is wrong in man page (package logrotate)
  - resolves: #638625
    Ambiguity in logrotate man page (package logrotate)
  - resolves: #644308
    manpage not in sync with options logrotate actually recognizes (package logrotate)
  - resolves: #613979
    dftest and randpkt does not have a man page (package wireshark)
  - resolves: #619779
    lftp(1) option xfer:auto-rename not documented (package lftp)
  - resolves: #673968
    logrotate(8) manpage typo patch (package logrotate)


author: Ivana Hutarova Varekova <varekova@redhat.com> 2.1-1
changelog:
  - resolves: #615873
    Man w3m is stating incorrect program version (package w3m)
  - resolves: #675213
    userpasswd(1) manpage fix (package usermode)
  - resolves: #675688
    pcretest(1) manpage fixes (package pcre)
  - resolves: #675682
    pcregrep(1) manpage fixes (package pcre)
  - resolves: #636785
    "semanage module" is not mentioned in semanage man page (package policycoreutils)
  - resolves: #540492
    8 options are not described in semanage man page (package policycoreutils)


author: Ivana Hutarova Varekova <varekova@redhat.com> 2.4-1
changelog:
  - related: #604626
    add forgotten patch
  - related: #632081
    fix the encoding
  - related: #644308
    fix the typo
  - related: #650162
    fix the patch text
  - related: #676483


author: Ivana Hutarova Varekova <varekova@redhat.com> 6.2.0-1
changelog:
  - resolves: #712256
    Typo in volume_key manpage
  - resolves: #709274
    ntpq(8) manpage fixes
  - resolves: #709058
    ntp-keygen(8) manpage fixes
  - resolves: #615897
    Added missing man page for/usr/sbin/lsmsr in x86info package
  - resolves: #690187
    New man pages for cciss + hpsa modules


author: Ivana Hutarova Varekova <varekova@redhat.com> 6.2.1-1
changelog:
  - resolves: #698151
    Remove documentation for "order" keyword in /etc/host.conf manpage
  - resolves: #688543
    Several lsvpd tools options not documented in man page
  - resolves: #674423
    man page for recvmmsg added
  - resolves: #656245
    add fattach.2 link to uninplemented
  - resolves: #719902
    Remove bug fixed in original component: #674870
    Remove bug fixed in original component: #674878
    Remove bug fixed in original component: #677541
    Remove bug fixed in original component: #677542
    Remove bug fixed in original component: #690801
    Remove bug fixed in original component: #674883


author: Peter Schiffer <pschiffe@redhat.com> 6.2.2-1
changelog:
  - resolves: #727526
    Typo in man curl manpage
  - resolves: #730042
    Add missing man page for cpufreq-aperf and fixed cpufreq-set man page
  - resolves: #602228
    bridge-utils missing documentation in manpage for RFE 574461
  - resolves: #731690
    Man ecryptfs contains invalid link in SEE ALSO section
  - resolves: #734836
    Document that realtime clock functions need to link with -lrt
  - resolves: #656245
    Fixed incorrect link from previous release
  - resolves: #690187
    Added license file for man pages from man-pages package
    Removed bug fixed in original component: #659740
    Added license file for man page from x86info package


author: Peter Schiffer <pschiffe@redhat.com> 6.2.3-1
changelog:
  - resolves: #740670
    vsftpd: documentation for 'max_per_ip' default setting is wrong
  - resolves: #717770
    Need single-request-reopen option documented for resolv.conf
  - resolves: #742098
    Update description of timeo in nfs(5) manpage
  - resolves: #694860
    No mention of sssd in nsswitch.conf man page
  - resolves: #723791
    Lack of UMOUNT_NOFOLLOW flag description in umount(2)
  - resolves: #728416
    [RFE] net: backport sendmmsg syscall [Manpage request]


author: Peter Schiffer <pschiffe@redhat.com> 6.3.1-1
changelog:
  - resolves: #605521
    added manual page for urlgrabber
  - resolves: #768949
    updated info about trapt in bash manual page
  - resolves: #528879
    added missing pages: mksquashfs.1 and unsquashfs.1
  - Removed bug fixed in original component: #659646
  - Removed bug fixed in original component: #659705
  - Removed bug fixed in original component: #659713
  - Removed bug fixed in original component: #659720
  - Removed bug fixed in original component: #674864
  - Removed bug fixed in original component: #674866
  - Removed bug fixed in original component: #676636
  - Removed bug fixed in original component: #676643
  - Removed bug fixed in original component: #714086
  - Removed bug fixed in original component: #745133


author: Peter Schiffer <pschiffe@redhat.com> 6.3.2-1
changelog:
  - resolves: #745467
    added manual page for pkcs_slot
  - resolves: #801742
    fixed redundant "works" word in request-key.conf man page
  - resolves: #695363
    added description of auditing support to the iptables and ip6tables man pages
  - resolves: #801784
    fixed typo in the yum man page
  - resolves: #747970
    added description of -D option to the lsblk man page
  - resolves: #769566
    fixed description of --group-info option in the wbinfo man page
  - resolves: #766341
    removed -s option from cgcreate man page
  - resolves: #801783
    added description of auditing support to the ebtables man page
  - resolves: #800256
    added description of EIDRM error to the shmop man page
  - resolves: #653908
    added missing options to the replcon man page
  - Removed bug fixed in original component: #737990


author: Peter Schiffer <pschiffe@redhat.com> 6.3.3-1
changelog:
  - related: #528879
    fixed name section in the unsquashfs.1 man page
  - resolves: #529335
    added missing pages: fusermount.1, ulockmgr_server.1 and mount.fuse.8
  - resolves: #810910
    mount(8) man page should include relatime in defaults definition


author: Peter Schiffer <pschiffe@redhat.com> 6.4.0-1
changelog:
  - resolves: #866386
    mpo remove tracker
  - removed bug fixed in original component: #676355
  - removed bug fixed in original component: #714073
  - removed bug fixed in original component: #714074
  - removed bug fixed in original component: #714075
  - removed bug fixed in original component: #714078
  - removed bug fixed in original component: #729984
  - removed bug fixed in original component: #735789
  - removed bug fixed in original component: #745152
  - removed bug fixed in original component: #745501
  - removed bug fixed in original component: #745521
  - removed bug fixed in original component: #745733
  - removed bug fixed in original component: #799958
  - removed bug fixed in original component: #809108
  - removed bug fixed in original component: #809117
  - removed bug fixed in original component: #809139
  - removed bug fixed in original component: #809144
  - removed bug fixed in original component: #809564
  - removed bug fixed in original component: #820183
  - removed bug fixed in original component: #690800
  - renamed all patches to include bug id


author: Peter Schiffer <pschiffe@redhat.com> 6.4.1-1
changelog:
  - resolves: #872526
    mentioned ext4 support in dump(8) man page
  - resolves: #853959
    added missing --no-tpm option in rngd(8) man page
  - resolves: #867332
    mentioned that groupmems command is not setuid in groupmems(8) man page
  - resolves: #849201
    added missing alsaunmute(1) man page
  - resolves: #806845
    updated dmidecode(8) man page
  - resolves: #845657
    updated description of localalloc option on the numactl(8) man page
  - resolves: #814417
    updated vnc documentation for -SecurityTypes option
  - resolves: #846591
    added missing options to the ipmitool(1) man page


author: Peter Schiffer <pschiffe@redhat.com> 6.5.0-1
changelog:
  - resolves: #996478
    mpo remove tracker
  - removed bug fixed in original component: #659661
  - removed bug fixed in original component: #714079
  - removed bug fixed in original component: #714084
  - removed bug fixed in original component: #809550


author: Peter Schiffer <pschiffe@redhat.com> 6.5.1-1
changelog:
  - related: #996478
    mpo remove tracker
  - removed bug fixed in original component: #881779
  - resolves: #896700
    fixed missing text in auditd.conf(5) man page
  - resolves: #1002071
    updated description of extglob behavior in bash(1) man page
  - resolves: #807323
    added description of webm format to byzanz-record(1) man page
  - resolves: #885625
    fixed typo on cupsctl(8) man page
  - resolves: #905066
    fixed documentation regarding CA certificates in curl package
  - resolves: #896544
    fixed typos in curl package man pages
  - resolves: #913088
    fixed typo in security_compute_av(3) man page
  - resolves: #913191
    updated selinux(8) man page
  - resolves: #979460
    added clarification about setting variables on mailx(1) man page
  - resolves: #960281
    documented missing values in clock_getres(2) man page
  - resolves: #974697
    updated description of LD_PRELOAD variable in ld.so(8) man page
  - resolves: #953753
    documented /proc/[pid]/oom_score_adj on proc(5) man page
  - resolves: #953750
    documented /proc/sys/kernel/dmesg_restrict on proc(5) man page
  - resolves: #953539
    documented /proc/sys/kernel/kptr_restrict on proc(5) man page
  - resolves: #908295
    fixed typo on syslog(3) man page
  - resolves: #974685
    removed incorrect example from sched_setaffinity(2) man page
  - resolves: #988125
    documented MADV_DONTDUMP and MADV_DODUMP on madvise(2) man page
  - resolves: #903258
    documented FALLOC_FL_PUNCH_HOLE flag on fallocate(2) man page
  - resolves: #957010
    fixed return type of strtoul(3) and strtoull(3)
  - resolves: #928917
    updated description of O_DIRECT on open(2) man page
  - resolves: #979318
    described ipv6 on netstat(8) man page
  - resolves: #951826
    updated default settings of inet_protocols variable on postconf(5) man page
  - resolves: #872144
    backported fix for top(1) man page
  - resolves: #983066
    removed deprecated example from rhnreg_ks(8) man page
  - resolves: #904970
    fixed typos on rsync(1) man page
  - resolves: #907837
    fixed description of -u option on useradd(8) man page
  - resolves: #884699
    fixed typo in usb-devices(1) man page
  - resolves: #972764
    removed superfluous dots after "via" preposition in yum man pages


author: Peter Schiffer <pschiffe@redhat.com> 6.5.2-1
changelog:
  - related: #807323
    fixed typo on byzanz-record(1) man page
  - related: #896700
    fixed even more missing text in auditd.conf(5) man page
  - related: #913191
    fixed typo on selinux(8) man page
  - resolves: #1020432
    properly documented -Z option for passing principal
    list on ssh-keygen(1) man page
  - resolves: #1020417
    removed incorrect default values of KexAlgorithms on ssh_config(5) man page
  - resolves: #833868
    fixed dig(1) man page
  - resolves: #1018622
    updated description of "new station" message on arpwatch(8) man page


author: Jeff Johnson <jbj@redhat.com> 0.15-3687.0
changelog:
  - first build from adapted spec file, only client and libraries for now.
  - internal apr/apr-utils/neon until incompatibilities sort themselves out.
  - avoid libdir issues on x86_64 for the moment.


author: Joe Orton <jorton@redhat.com> 0.22.2-1
changelog:
  - update to 0.22.2; add mod_dav_svn subpackage
  - include Python bindings
  - neon: force use of expat, enable SSL
  - drop check for specific apr version added in -3


author: Jeff Johnson <jbj@redhat.com> 0.22.2-2
changelog:
  - use external neon-0.23.9-2 (i.e. with neon-config), drop internal neon.
  - use db-4.1.25, not db-4.0.14.
  - do "make check" (but ignore failure for now).
  - s390x knows not of httpd >= 2.0.45.


author: Joe Orton <jorton@redhat.com> 1.0.0-2
changelog:
  - add fix for lack of apr_dir_read ordering guarantee (Philip Martin)
  - enable compression in ra_dav by default (Tobias Ringström)


author: Joe Orton <jorton@redhat.com> 1.0.2-2
changelog:
  - add perl MODULE_COMPAT requirement for -perl subpackage
  - move perl man pages into -perl subpackage
  - clean up -perl installation and dependencies (Ville Skyttä, #123045)


author: Joe Orton <jorton@redhat.com> 1.1.3-7
changelog:
  - restore swig bindings support (from upstream via Max Bowsher, #141343)
  - tweak SELinux commentary in default subversion.conf


author: Joe Orton <jorton@redhat.com> 1.1.3-8
changelog:
  - further swig bindings fix (upstream via Max Bowsher, #151798)
  - fix perl File::Path dependency in filter-requires.sh


author: Joe Orton <jorton@redhat.com> 1.2.0-3
changelog:
  - update to 1.2.1
  - fix BuildRequires for ruby and apr-util (#163126)
  - drop static library archives


author: Joe Orton <jorton@redhat.com> 1.2.3-3
changelog:
  - update to 1.2.3
  - update to psvn.el r16070 from Stefan Reichoer
  - merge subversion.conf changes from RHEL4
  - merge filter-requires.sh changes from FC4 updates


author: Joe Orton <jorton@redhat.com> 1.3.2-2
changelog:
  - update to 1.3.2
  - fix Ruby sitelibdir (Garrick Staples, #191611)
  - own /etc/subversion (#189071)
  - update to psvn.el r19857


author: Joe Orton <jorton@redhat.com> 1.4.3-3
changelog:
  - update to 1.4.3 (#228691)
  - remove trailing dot from Summary
  - use current preferred standard BuildRoot
  - add post/postun ldconfig scriptlets for -ruby and -javahl


author: Joe Orton <jorton@redhat.com> 1.4.4-2
changelog:
  - update to 1.4.4
  - add Provides: svn (#245087)
  - fix without-java build (Lennert Buytenhek, #245467)


author: Joe Orton <jorton@redhat.com> 1.4.4-3
changelog:
  - fix build with new glibc open()-as-macro
  - build all swig code in %build, not %install
  - BuildRequire perl(Test::More), perl(ExtUtils::MakeMaker)


author: Joe Orton <jorton@redhat.com> 1.4.4-4
changelog:
  - trim dependencies from .la files
  - detabify spec file
  - test suite disabled to ease stress on builders


author: Joe Orton <jorton@redhat.com> 1.5.6-3
changelog:
  - update to 1.5.6
  - autoload psvn (#238491, Tom Tromey)
  - regenerate swig bindings (#480503)
  - fix build with libtool 2.2 (#469524)


author: Ville Skyttä <ville.skytta@iki.fi> - 1.6.5-3
changelog:
  - Apply svn2cl upstream patch to fix newline issues with libxml2 2.7.4+,
    see http://bugs.debian.org/546990 for details.


author: Ville Skyttä <ville.skytta@iki.fi> - 1.6.6-5
changelog:
  - Include svn2cl and its man page only in the -svn2cl subpackage (#558598).
  - Do not include bash completion in docs, it's installed.


author: Joe Orton <jorton@redhat.com> - 1.6.11-4
changelog:
  - add security fixes for CVE-2011-1752, CVE-2011-1783, CVE-2011-1921 (#709221)
  - add security fix for CVE-2011-0715 (#681174)
  - add security fixes for CVE-2010-4644, CVE-2010-4539 (#672679)


author: Joe Orton <jorton@redhat.com> - 1.6.11-5
changelog:
  - add init script for svnserve (#720790, #711904)
  - fix segfault with "AuthzForceUsernameCase lower" (#751321)
  - fix parent directory access with merges (#749494)


author: Rob Crittenden <rcritten@redhat.com> 1.0.6-2
changelog:
  - Patch to properly detect the Apache model and set up NSS appropriately
  - Patch to punt if a bad password is encountered
  - Patch to fix crash when password.conf is malformatted
  - Don't enable ECC support as NSS doesn't have it enabled (3.11.4-0.7)


author: Rob Crittenden <rcritten@redhat.com> 1.0.7-1
changelog:
  - Update to 1.0.7
  - Remove Requires for nss and nspr since those are handled automatically
    by versioned libraries
  - Updated URL and Source to reference directory.fedoraproject.org


author: Rob Crittenden <rcritten@redhat.com> - 1.0.7-4
changelog:
  - Apply patch so that mod_nss calls NSS_Init() after Apache forks a child
    and not before. This is in response to a change in the NSS softtokn code
    and should have always been done this way. (444348)
  - The location of libnssckbi moved from /usr/lib[64] to /lib[64]
  - The NSS database needs to be readable by apache since we need to use it
    after the root priviledges are dropped.


author: Rob Crittenden <rcritten@redhat.com> - 1.0.7-6
changelog:
  - Update the patch for FIPS to include fixes for nss_pcache, enforce
    the security policy and properly initialize the FIPS token.


author: Rob Crittenden <rcritten@redhat.com> - 1.0.7-7
changelog:
  - Don't inherit the MP cache in multi-threaded mode (454701)
  - Don't initialize NSS in each child if SSL isn't configured


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-3
changelog:
  - The location of libnssckbi.so moved from /lib[64] to /usr/lib[64] (#558545)
  - Don't generate output when the default NSS database is generated (#538859)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-4
changelog:
  - Remove unused variable and perl substitution for gencert. gencert used to
    have separate variables for NSS & NSPR libraries, that is gone now so this
    variable and substitution aren't needed.
  - Added comments to patch to identify what they do


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-5
changelog:
  - Add (pre) for Requires on httpd so we can be sure the user and group are
    already available
  - Add file Requires on libnssckbi.so so symlink can't fail
  - Use _sysconfdir macro instead of /etc


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-6
changelog:
  - Patch to add configuration options for new NSS negotiation API (#574187)
  - Set minimum version of nss to 3.12.6 to pick up renegotiation fix


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-9
changelog:
  - Add man page for gencert (#605376)
  - Fix hang when handling large POST under some conditions (#634687)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-13
changelog:
  - Fix array overrun when launching nss_pcache (#714154)
  - For FakeBasicAuth retrieve the entire subject, not just CN. Prefix this
    with "/" to be compatible with OpenSSL.
    Always retrieve the client certificate, not just on the first request
    it is needed. (#702437)
  - Don't try to shut down NSS if it wasn't initialized. (#691502)


author: Robert Relyea <rrelyea@redhat.com> - 1.0.8-14
changelog:
  - Fix 'Bugzilla Bug #797358 - mod_nss fails debug assertion' by removing
    'mod_nss-no_shutdown_if_not_init.patch' and applying
    'mod_nss-no_shutdown_if_not_init_2.patch' instead
  - The 'mod_nss-no_shutdown_if_not_init_2.patch' patch also fixes
    Bugzilla Bug #797326 - File descriptor leak after "service httpd reload"
    or httpd doesn't reload


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-15
changelog:
  - Fixes Bugzilla Bug #749408 - PK11_ListCerts called to retrieve all user
    certificates for every server (mod_nss-PK11_ListCerts.patch)
  - Fixes Bugzilla Bug #749409 - Add '--enable-ecc' option to %configure
    line under %build section of RHEL 6 spec file


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-16
changelog:
  - Fixes Bugzilla Bug #769906 - mod_nss insists on Required value
    NSSCipherSuite not set. (mod_nss-proxyvariables.patch)


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-17
changelog:
  - Fixes Bugzilla Bug #816394 - [RFE] Provide Apache 2.2 support for TLS v1.1
    via NSS through mod_nss . . .
  - Bumped version build/runtime requirements for NSPR and NSS


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-18
changelog:
  - Fixes Bugzilla Bug #835071 - [RFE] Support ability to share mod_proxy with
    other SSL providers (w/jorton, nkinder, & rcritten)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-19
changelog:
  - Resolves: CVE-2013-4566
  - Bugzilla Bug #1030265 - mod_nss: incorrect handling of NSSVerifyClient in
    directory context [rhel-6.5.z]


author: Bill Nottingham <notting@redhat.com>
changelog:
  - get correct manual path the Right Way(tm)
  - make it so it uses default colors even if COLORFGBG isn't set


author: Nalin Dahyabhai <nalin@redhat.com> 5:1.4.1-10
changelog:
  - expect the server to prompt for additional auth data if we have some to
    send (#129961, upstream #1845)
  - use "pop" as the service name instead of "pop-3" when using SASL for POP,
    per rfc1734


author: Bill Nottingham <notting@redhat.com> 5:1.4.2.1-1
changelog:
  - update to 1.4.2.1 (#141007, <moritz@barsnick.net>)
  - include a /etc/Muttrc.local for site config (#123109)
  - add <f2> as a additional help key for terminals that use <f1> internally
    (#139277)


author: Miroslav Lichvar <mlichvar@redhat.com> 5:1.4.2.2-1
changelog:
  - update to 1.4.2.2
  - fix directories in manual.txt (#162207)
  - drop bcc patch (#197408)
  - don't package flea


author: Miroslav Lichvar <mlichvar@redhat.com> 5:1.5.14-2
changelog:
  - add check_mbox_size configuration variable; if enabled, file size is used
    instead of access time when checking for new mail
  - bind delete key to delete-char (#232601)


author: Miroslav Lichvar <mlichvar@redhat.com> 5:1.5.14-4
changelog:
  - validate msgid in APOP authentication (CVE-2007-1558)
  - fix overflow in gecos field handling (CVE-2007-2683)


author: Miroslav Lichvar <mlichvar@redhat.com> 5:1.5.17-2
changelog:
  - don't ignore $from in batch send mode (#392861)
  - check Maildir for not being NULL when expanding '='-paths
  - prevent mailto parsing buffer overflow by ignoring too long header
  - use strtok_r() to parse mailto: links, not strtok()
  - update UPDATING


author: Miroslav Lichvar <mlichvar@redhat.com> 5:1.5.17-4
changelog:
  - fix sending long commands when using gnutls (#438275)
  - glob tilde in smime_keys (#424311)
  - fix awk script in mutt_ldap_query
  - force building with libdb
  - make enabling/disabling features in spec easier


author: Miroslav Lichvar <mlichvar@redhat.com> 5:1.5.18-2
changelog:
  - allow interrupts when reading, writing or closing sockets (#447887)
  - fix possible crash when opening IMAP mailbox


author: Miroslav Lichvar <mlichvar@redhat.com> 5:1.5.19-4
changelog:
  - use PATH_MAX for buffers passed to realpath (#492861)
  - unconditionally inode-sort Maildir and MH folders
  - restore connection polling callback when closing SASL connection


author: Miroslav Lichvar <mlichvar@redhat.com> 5:1.5.19-5
changelog:
  - fix certificate verification (CVE-2009-1390)
  - add support for gnutls INSECURE_ALGORITHM error code (#499390)


author: Jos Vos <jos@xos.nl>
changelog:
  - Version 3.22.27 release XOS.1 for LinuX/OS 1.7.0
  - Initial version.
  - Some ideas borrowed from Red Hat Powertools 6.1, although this spec
    file is a full rewrite from scratch.


author: Jos Vos <jos@xos.nl>
changelog:
  - Version 3.22.27 release XOS.2 for LinuX/OS 1.7.1
  - Add post(un)install scripts for updating ld.so.conf (client subpackage).


author: Jos Vos <jos@xos.nl>
changelog:
  - Version 3.22.32 release XOS.1 for LinuX/OS 1.8.0
  - Upgrade from version 3.22.27 to 3.22.32.
  - Do "make install" instead of "make install-strip", because "install -s"
    now appears to fail on various scripts.  Afterwards, strip manually.
  - Reorganize subpackages, according to common Red Hat packages: the client
    program and shared library become the base package and the server and
    some accompanying files are now in a separate server package.  The
    server package implicitly requires the base package (shared library),
    but we have added a manual require tag anyway (because of the shared
    config file, and more).
  - Rename the mysql-benchmark subpackage to mysql-bench.


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - update to 3.23.20
  - use %configure, %makeinstall, %{_tmppath}, %{_mandir},
    %{_infodir}, /etc/init.d
  - remove the bench package
  - change some of the descriptions a little bit
  - fix the init script
  - some compile fixes
  - specify mysql user
  - use mysql uid 27 (postgresql is 26)
  - don't build on ia64


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - 3.23.21
  - remove file from /etc/sysconfig
  - Fix initscript a bit - initialization of databases doesn't
    work yet
  - specify the correct licenses
  - include a /etc/my.conf (empty, FTTB)
  - add conditional restart to spec file


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - try the new compiler again
  - build the SQL daemon statically
  - add compile time support for complex charsets
  - enable assembler
  - more cleanups in initscript


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - don't build the SQL daemon statically (glibc problems)
  - fix the logrotate script - only flush log if mysql
    is running
  - change the reloading procedure 
  - remove icon - glint is obsolete a long time ago


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - don't run ldconfig -n, it doesn't update ld.so.cache
    (#16034)
  - include some missing binaries
  - use safe_mysqld to start the server (request from
    mysql developers)


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - rename config file to /etc/my.cnf, which is what
    mysqld wants... doh. (#17432)
  - include a changed safe_mysqld, so the pid file option
    works. 
  - make mysql dir world readable to they can access the 
    mysql socket. (#17432)
  - 3.23.24


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - 3.23.26, which among other fixes now uses mkstemp()
    instead of tempnam().
  - revert changes made yesterday, the problem is now
    isolated


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - check for negative niceness values, and negate it
    if present (#17899)
  - redefine optflags on IA32 FTTB


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - bzipped source
  - changed from 85 to 78 in startup, so it starts before
    apache (which can use modules requiring mysql)


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - 3.23.30
  - do an explicit chmod on /var/lib/mysql in post, to avoid 
    any problems with broken permissons. There is a report
    of rm not changing this on its own (#22989)


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - add the log file to the rpm database, and make it 0640
    (#24116)
  - as above in logrotate script
  - changes to the init sequence - put most of the data
    in /etc/my.cnf instead of hardcoding in the init script
  - use /var/run/mysqld/mysqld.pid instead of 
    /var/run/mysqld/pid
  - use standard safe_mysqld
  - shut down cleaner


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - gettextize
  - move the items in Requires(post): to Requires: in preparation
    for an errata for 7.0 when 3.23.31 is released
  - 3.23.31


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - Make it obsolete our 6.2 PowerTools packages
  - 3.23.36 bugfix release - fixes some security issues
    which didn't apply to our standard configuration
  - Make "make test" part of the build process, except on IA64
    (it fails there)


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - Reenable test, but don't run them for s390, s390x or ia64
  - Make /etc/my.cnf config(noplace). Same for /etc/logrotate.d/mysqld


author: Trond Eivind Glomsrd <teg@redhat.com> 3.23.41-1
changelog:
  - 3.23.41 bugfix release
  - disable innodb, to avoid the broken updates
  - Use "mysqladmin flush_logs" instead of kill -HUP in logrotate 
    script (#51711)


author: Trond Eivind Glomsrd <teg@redhat.com> 3.23.46-1
changelog:
  - 3.23.46
  - use -fno-rtti and -fno-exceptions, and set CXX to increase stability. 
    Recommended by mysql developers.


author: Trond Eivind Glomsrd <teg@redhat.com> 3.23.47-4
changelog:
  - Use kill, not mysqladmin, to flush logs and shut down. Thus, 
    an admin password can be set with no problems.
  - Remove reload from init script


author: Trond Eivind Glomsrd <teg@redhat.com> 3.23.49-3
changelog:
  - Add the various .cnf examples as doc files to mysql-server (#60349)
  - Don't include manual.ps, it's just 200 bytes with a URL inside (#60349)
  - Don't include random files in /usr/share/mysql (#60349)
  - langify (#60349)


author: Trond Eivind Glomsrd <teg@redhat.com> 3.23.52-2
changelog:
  - Add --enable-local-infile to configure - a new option
    which doesn't default to the old behaviour (#72885)


author: Patrick Macdonald <patrickm@redhat.com> 3.23.57-1
changelog:
  - revert to prior version of MySQL due to license incompatibilities 
    with packages that link against the client.  The MySQL folks are
    looking into the issue.


author: Tom Lane <tgl@redhat.com> 3.23.58-8
changelog:
  - repair logfile attributes in %files, per bug #102190
  - repair quoting problem in mysqlhotcopy, per bug #112693
  - repair missing flush in mysql_setpermission, per bug #113960
  - repair broken error message printf, per bug #115165
  - delete mysql user during uninstall, per bug #117017
  - rebuilt


author: Tom Lane <tgl@redhat.com> 3.23.58-11
changelog:
  - fix low-priority security issues CAN-2004-0388, CAN-2004-0381, CAN-2004-0457
    (bugs #119442, 125991, 130347, 130348)
  - fix bug with dropping databases under recent kernels (bug #124352)


author: Tom Lane <tgl@redhat.com> 3.23.58-12
changelog:
  - fix multilib problem with mysqlbug and mysql_config
  - adjust chkconfig priority per bug #128852
  - remove bogus quoting per bug #129409 (MySQL 4.0 has done likewise)
  - add sleep to mysql.init restart(); may or may not fix bug #133993


author: Tom Lane <tgl@redhat.com> 3.23.58-13
changelog:
  - fix security issues CAN-2004-0835, CAN-2004-0836, CAN-2004-0837
    (bugs #135372, 135375, 135387)
  - fix privilege escalation on GRANT ALL ON `Foo\_Bar` (CAN-2004-0957)


author: Tom Lane <tgl@redhat.com> 4.1.7-4
changelog:
  - Turn off old_passwords in default /etc/my.cnf file, for better compatibility
    with mysql 3.x clients (per suggestion from Joe Orton).


author: Tom Lane <tgl@redhat.com> 4.1.7-6
changelog:
  - Fix init script to not need a valid username for startup check (bz#142328)
  - Fix init script to honor settings appearing in /etc/my.cnf (bz#76051)
  - Enable SSL (bz#142032)


author: Tom Lane <tgl@redhat.com> 4.1.10-2
changelog:
  - Need -fno-strict-aliasing in at least one place, probably more.
  - Work around some C spec violations in mysql.


author: Tom Lane <tgl@redhat.com> 4.1.10a-1
changelog:
  - Update to MySQL 4.1.10a to fix security vulnerabilities (bz#150868,
    for CAN-2005-0711, and bz#150871 for CAN-2005-0709, CAN-2005-0710).


author: Tom Lane <tgl@redhat.com> 4.1.11-1
changelog:
  - Update to MySQL 4.1.11 to fix bz#152911 as well as other issues
  - Move perl-DBI, perl-DBD-MySQL dependencies to server package (bz#154123)
  - Override configure thread library test to suppress HAVE_LINUXTHREADS check
  - Fix BDB failure on s390x (bz#143537)
  - At last we can enable "make test" on all arches


author: Tom Lane <tgl@redhat.com> 4.1.11-2
changelog:
  - Avoid dependency on <asm/atomic.h>, cause it won't build anymore on ia64.
    This is probably a cleaner solution for bz#143537, too.


author: Tom Lane <tgl@redhat.com> 4.1.11-3
changelog:
  - Enable openssl tests during build, per bz#155850
  - Might as well turn on --disable-dependency-tracking


author: Tom Lane <tgl@redhat.com> 4.1.12-1
changelog:
  - Update to MySQL 4.1.12 (includes a fix for bz#158688, bz#158689)
  - Extend mysql-test-ssl.patch to solve rpl_openssl test failure (bz#155850)
  - Update mysql-lock-ssl.patch to match the upstream committed version
  - Add --with-isam to re-enable the old ISAM table type, per bz#159262
  - Add dependency on openssl-devel per bz#159569
  - Remove manual.txt, as upstream decided not to ship it anymore;
    it was redundant with the mysql.info file anyway.


author: Tom Lane <tgl@redhat.com> 4.1.12-2
changelog:
  - Fix buffer overflow newly exposed in isam code; it's the same issue
    previously found in myisam, and not very exciting, but I'm tired of
    seeing build warnings.


author: Tom Lane <tgl@redhat.com> 5.0.16-1
changelog:
  - Update to MySQL 5.0.16
  - Add EXCEPTIONS-CLIENT license info to the shipped documentation
  - Make my_config.h architecture-independent for multilib installs;
    put the original my_config.h into my_config_$ARCH.h
  - Add -fwrapv to CFLAGS so that gcc 4.1 doesn't break it


author: Tom Lane <tgl@redhat.com> 5.0.18-4
changelog:
  - Modify multilib header hack to not break non-RH arches, per bug #181335
  - Remove logrotate script, per bug #180639.
  - Add a new mysql-test RPM to carry the regression test files;
    hack up test scripts as needed to make them run in /usr/share/mysql-test.


author: Tom Lane <tgl@redhat.com> 5.0.22-1
changelog:
  - Update to MySQL 5.0.22 (fixes CVE-2006-2753)
  - Install temporary workaround for gcc bug on s390x (bz #193912)


author: Tom Lane <tgl@redhat.com> 5.0.22-2
changelog:
  - Work around brew's tendency not to clean up failed builds completely,
    by adding code in mysql-testing.patch to kill leftover mysql daemons.


author: Tom Lane <tgl@redhat.com> 5.0.27-1
changelog:
  - Update to MySQL 5.0.27 (see CVE-2006-4031, CVE-2006-4226, CVE-2006-4227)
  Resolves: #202247, #202675, #203427, #203428, #203432, #203434, #208641
  - Fix init script to return status 1 on server start timeout
  Resolves: #203910
  - Move mysqldumpslow from base package to mysql-server
  Resolves: #193559
  - Adjust link options for BDB module
  Resolves: #199368


author: Tom Lane <tgl@redhat.com> 5.0.33-1
changelog:
  - Update to MySQL 5.0.33
  - Install band-aid fix for "view" regression test designed to fail after 2006
  - Don't chmod -R the entire database directory tree on every startup
  Related: #221085
  - Fix unsafe use of install-info
  Resolves: #223713
  - Cope with new automake in F7
  Resolves: #224171


author: Tom Lane <tgl@redhat.com> 5.0.37-1
changelog:
  - Update to MySQL 5.0.37
  Resolves: #231838
  - Put client library into a separate mysql-libs RPM to reduce dependencies
  Resolves: #205630


author: Tom Lane <tgl@redhat.com> 5.0.37-2
changelog:
  - Use a less hacky method of getting default values in initscript
  Related: #233771, #194596
  - Improve packaging of mysql-libs per suggestions from Remi Collet
  Resolves: #233731
  - Update default /etc/my.cnf ([mysql.server] has been bogus for a long time)


author: Tom Lane <tgl@redhat.com> 5.0.45-1
changelog:
  - Update to MySQL 5.0.45
  Resolves: #246535
  - Move mysql_config's man page to base package
  Resolves: #245770
  - move my_print_defaults to base RPM, for consistency with Stacks packaging
  - mysql user is no longer deleted at RPM uninstall
  Resolves: #241912


author: Tom Lane <tgl@redhat.com> 5.0.45-2
changelog:
  - Update License tag to match code.
  - Work around recent Fedora change that makes "open" a macro name.


author: Tom Lane <tgl@redhat.com> 5.0.45-4
changelog:
  - Seems we need explicit BuildRequires on gawk and procps now
  - Rebuild to fix Fedora toolchain issues


author: Tom Lane <tgl@redhat.com> 5.0.45-7
changelog:
  - Unbelievable ... upstream still thinks that it's a good idea to have a
    regression test that is guaranteed to begin failing come January 1.
  - ... and it seems we need to raise STACK_MIN_SIZE again too.


author: Tom Lane <tgl@redhat.com> 5.0.45-9
changelog:
  - Fix the stack overflow problem encountered in January.  It seems the real
  issue is that the buildfarm machines were moved to RHEL5, which uses 64K not
  4K pages on PPC, and because RHEL5 takes the guard area out of the requested
  thread stack size we no longer had enough headroom.
  Related: #435337


author: Dennis Gilmore <dennis@ausil.us> 5.0.45-10
changelog:
  - add sparc64 to 64 bit arches for test suite checking
  - add sparc, sparcv9 and sparc64 to multilib handling


author: Tom Lane <tgl@redhat.com> 5.0.45-11
changelog:
  - Fix mysql-stack-guard patch to work correctly on IA64
  - Fix mysql.init to wait correctly when socket is not in default place
  Related: #435494


author: Tom Lane <tgl@redhat.com> 5.0.51a-2
changelog:
  - Enable ndbcluster support
  Resolves: #163758
  - Suppress odd crash messages during package build, caused by trying to
    build dbug manual (which we don't install anyway) with dbug disabled
  Resolves: #437053
  - Improve mysql.init to pass configured datadir to mysql_install_db,
    and to force user=mysql for both mysql_install_db and mysqld_safe.
  Related: #450178


author: Tom Lane <tgl@redhat.com> 5.0.67-1
changelog:
  - Update to mysql version 5.0.67
  - Move mysql_config's man page to base package, again (apparently I synced
    that change the wrong way while importing specfile changes for ndbcluster)


author: Tom Lane <tgl@redhat.com> 5.0.67-2
changelog:
  - Build the "embedded server" library, and package it in a new sub-RPM
    mysql-embedded, along with mysql-embedded-devel for devel support files.
  Resolves: #149829


author: Tom Lane <tgl@redhat.com> 5.1.30-1
changelog:
  - Update to MySQL 5.1.30.  Note that this includes an ABI break for
    libmysqlclient (it's now got .so major version 16).
  - This also updates mysql for new openssl build


author: Tom Lane <tgl@redhat.com> 5.1.30-2
changelog:
  - hm, apparently --with-innodb and --with-ndbcluster are still needed
    even though no longer documented ...


author: Tom Lane <tgl@redhat.com> 5.1.33-1
changelog:
  - Update to MySQL 5.1.33.
  - Disable use of pthread_setschedparam; doesn't work the way code expects.
  Related: #477624


author: Tom Lane <tgl@redhat.com> 5.1.34-1
changelog:
  - Update to MySQL 5.1.34, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-34.html
  - Increase startup timeout per bug #472222


author: Tom Lane <tgl@redhat.com> 5.1.35-1
changelog:
  - Update to MySQL 5.1.35, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-35.html
  - Ensure that /var/lib/mysql is created with the right SELinux context
  Resolves: #502966


author: Tom Lane <tgl@redhat.com> 5.1.36-1
changelog:
  - Update to MySQL 5.1.36, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-36.html


author: Tom Lane <tgl@redhat.com> 5.1.37-1
changelog:
  - Update to MySQL 5.1.37, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-37.html


author: Tom Lane <tgl@redhat.com> 5.1.37-2
changelog:
  - Add a couple of patches to improve the probability of the regression tests
    completing in koji builds


author: Tom Lane <tgl@redhat.com> 5.1.37-4
changelog:
  - Remove one misguided patch; turns out I was chasing a glibc bug
  - Temporarily disable "main.mysql" test; there's something broken there too,
    but we need to get mysql built in rawhide for dependency reasons


author: Tom Lane <tgl@redhat.com> 5.1.37-5
changelog:
  - Work around unportable assumptions about stpcpy(); re-enable main.mysql test
  - Clean up some obsolete parameters to the configure script


author: Tom Lane <tgl@redhat.com> 5.1.39-1
changelog:
  - Update to MySQL 5.1.39, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-39.html


author: Tom Lane <tgl@redhat.com> 5.1.39-3
changelog:
  - Work around two different compiler bugs on sparc, one by backing off
    optimization from -O2 to -O1, and the other with a klugy patch
  Related: #529298, #529299
  - Clean up bogosity in multilib stub header support: ia64 should not be
    listed (it's not multilib), sparc and sparc64 should be


author: Tom Lane <tgl@redhat.com> 5.1.40-1
changelog:
  - Update to MySQL 5.1.40, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-40.html
  - Do not force the --log-error setting in mysqld init script
  Resolves: #533736


author: Tom Lane <tgl@redhat.com> 5.1.41-1
changelog:
  - Update to MySQL 5.1.41, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html
    including fixes for CVE-2009-4019
  Resolves: #549327
  - Don't set old_passwords=1; we aren't being bug-compatible with 3.23 anymore
  Resolves: #540735


author: Tom Lane <tgl@redhat.com> 5.1.42-4
changelog:
  - Sync with current Fedora build, including:
  - Update to MySQL 5.1.42, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-42.html
  - Disable symbolic links by default in /etc/my.cnf
  Resolves: #553653
  - Remove static libraries (.a files) from package, per packaging guidelines
  - Change %define to %global, per packaging guidelines
  - Disable building the innodb plugin; it tickles assorted gcc bugs and
    doesn't seem entirely ready for prime time anyway.
  Resolves: #553632
  - Start mysqld_safe with --basedir=/usr, to avoid unwanted SELinux messages
    (see 547485)
  - Stop waiting during "service mysqld start" if mysqld_safe exits
  Resolves: #544095


author: Tom Lane <tgl@redhat.com> 5.1.42-7
changelog:
  - Add backported patch for CVE-2008-7247 (upstream bug 39277)
  Resolves: #549329
  - Use non-expired certificates for SSL testing (upstream bug 50702)


author: Tom Lane <tgl@redhat.com> 5.1.43-2
changelog:
  - Update to MySQL 5.1.43, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-43.html
  Resolves: #565554
  - Remove mysql-cluster, which is no longer supported by upstream in this
    source distribution.  If we want it we'll need a separate SRPM for it.
  Resolves: #565210


author: Tom Lane <tgl@redhat.com> 5.1.44-2
changelog:
  - Update to MySQL 5.1.44, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-44.html
  Resolves: #565554
  - Remove mysql.info, which is not freely redistributable
  Related: #560181
  - Revert broken upstream fix for their bug 45058
  Related: #566547
  - Bring init script into some modicum of compliance with Fedora/LSB standards
  Resolves: #557711
  Resolves: #562749


author: Tom Lane <tgl@redhat.com> 5.1.47-1
changelog:
  - Update to MySQL 5.1.47, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-47.html
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-46.html
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-45.html
    including fixes for CVE-2010-1621, CVE-2010-1626,
    CVE-2010-1848, CVE-2010-1849, CVE-2010-1850
  Resolves: #590598
  - Create mysql group explicitly in pre-server script, to ensure correct GID


author: Tom Lane <tgl@redhat.com> 5.1.47-2
changelog:
  - Add back "partition" storage engine
  Resolves: #598585
  - Fix broken "federated" storage engine plugin
  Resolves: #587170
  - Read all certificates in SSL certificate files, to support chained certs
  Resolves: #598656


author: Tom Lane <tgl@redhat.com> 5.1.47-3
changelog:
  - Add -p "$mypidfile" to initscript's status call to improve corner cases.
    (Note: can't be fixed in Fedora until 595597 is fixed there.)
  Resolves: #596008


author: Tom Lane <tgl@redhat.com> 5.1.47-4
changelog:
  - Add backported patch for CVE-2010-2008 (upstream bug 53804)
  Resolves: #614215
  - Add BuildRequires perl(Time::HiRes) ... seems to no longer be installed
    by just pulling in perl.


author: Tom Lane <tgl@redhat.com> 5.1.52-1
changelog:
  - Update to MySQL 5.1.52, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-52.html
    including numerous small security issues
  Resolves: #652554
  - Sync with current Fedora package; this includes:
  - Duplicate COPYING and EXCEPTIONS-CLIENT in -libs and -embedded subpackages,
    to ensure they are available when any subset of mysql RPMs are installed,
    per revised packaging guidelines
  - Allow init script's STARTTIMEOUT/STOPTIMEOUT to be overridden from sysconfig


author: Tom Lane <tgl@redhat.com> 5.1.61-1
changelog:
  - Update to 5.1.61, for assorted upstream bugfixes including
    numerous CVEs announced in January 2012
  Resolves: #787192


author: Tom Lane <tgl@redhat.com> 5.1.66-1
changelog:
  - Update to 5.1.66, for assorted upstream bugfixes including
    CVEs announced in July and October 2012
  Resolves: #871814


author: Tom Lane <tgl@redhat.com> 5.1.67-1
changelog:
  - Update to 5.1.67, for assorted upstream bugfixes including
    CVEs announced in January 2013
  Resolves: #901381


author: Tom Lane <tgl@redhat.com> 5.1.69-1
changelog:
  - Update to 5.1.69, for assorted upstream bugfixes including
    CVEs announced in April 2013
  Resolves: #953085


author: Honza Horak <hhorak@redhat.com> 5.1.70-1
changelog:
  - Update to MySQL 5.1.70, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-70.html
    Resolves: #990796, #842052
  - Fix mysqldump failure against MySQL 5.0.x server due missing tables
    Resolves: #877557
  - Add logrotate script
    Resolves: #904061
  - Fix init script to not show failed on start even when server started
    Resolves: #884651


author: Honza Horak <hhorak@redhat.com> 5.1.71-1
changelog:
  - Update to MySQL 5.1.71, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-71.html
    Resolves: #990796


author: Jakub Dorňák <jdornak@redhat.com> - 5.1.73-1
changelog:
  - Update to MySQL 5.1.73, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-73.html
    (CVE-2014-0412, CVE-2014-0437, CVE-2013-5908, CVE-2014-0393,
    CVE-2014-0386, CVE-2014-0401, CVE-2014-0402)
    Resolves: #1055880


author: Honza Horak <hhorak@redhat.com> 5.1.73-2
changelog:
  - Make mysqld init script more robust and ignore existing but
    non-being-used unix socket file
    Resolves: #1058719


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - tkmib doco had #!/usr/bin/perl55
  - include snmpcheck and tkmib again (still needs some CPAN module, however).


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - don't depend on /etc/init.d so that package will work with 6.2.
  - perl path fiddles no longer needed.
  - rely on brp-compress frpm rpm to compress man pages.
  - patch from ucd-snmp CVS (Wes Hardaker).
  - configure.in needs to check for rpm libraries correctly (#23033).
  - add simple logrotate script (#21399).
  - add options to create pidfile and log with syslog with addresses (#23476).


author: Matt Wilson <msw@redhat.com>
changelog:
  - configure with --enable-reentrant and added "smux" and "agentx" to
    --with-mib-modules= argument (#29626)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Updated to 4.2.1. Removed 2 obsolete patches (fromcvs and #18153)
  - Include /usr/share/snmp/snmpconf in %files


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Enabled IPv6 support (RFE #47764)
  - Hopefully final fix of snmpwalk problem (#42153). Thanks to Douglas Warzecha
    for the patch and Matt Domsch for reporting the problem.


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Removed tkmib from the package once again as we don't ship the Tk.pm CPAN
    perl module required to run it (#49363)
  - Added missing Provides for the .so.0 libraries as rpm doesn't seem to find
    those during the build anymore (it used to) (#46388)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Fixed a couple of security issues:
    o /tmp race and setgroups() privilege problem
    o Various buffer overflow and format string issues.
    o One signedness problem in ASN handling.
  - Fixed an important RFE to support bcm5820 cards. (#51125)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Final bcm5820 fix. Last one was broken.
  - Fixed bugzilla bug (#51960) where the binaries contained rpath references.


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Fixed a server segfault for snmpset operation (#53640). Thanks to Josh Giles
    and Wes Hardaker for the patch.


author: Phil Knirsch <phil@redhat.de> 4.2.3-1
changelog:
  - Update to 4.2.3 final.
  - Fixed libtool/rpath buildroot pollution problem.
  - Fixed library naming problem.


author: Phil Knirsch <pknirsch@redhat.com> 4.2.3-4
changelog:
  - Added the snmptrapd init script as per request (#49205)
  - Fixed the again broken rpm query stuff (#57444)
  - Removed all old and none-used db related stuff (libs and header checks/files)


author: Phil Knirsch <pknirsch@redhat.com> 5.0.1-5
changelog:
  - Added --enable-ucd-snmp-compatibility for compatibility with older version
    and fixed installation thereof.
  - Got rid of the perl(Tk) dependancy by removing snmpcheck.
  - Include /usr/include/ucd-snmp in the filelist.
  - Fixed a problem with the ucd-snmp/version.h file.


author: Phil Knirsch <pknirsch@redhat.com> 5.0.8-2
changelog:
  - Hack to make it build on 64bit platforms with /usr/lib64 correctly.
  - Fixed bug #85071 (leak of open descriptors for ipv6).


author: Phil Knirsch <pknirsch@redhat.com> 5.0.9-1
changelog:
  - Updated to latest upstream version net-snmp-5.0.9
  - Added patch to fix net-snmp-perl problems (#105842).


author: Phil Knirsch <pknirsch@redhat.com> 5.1-1
changelog:
  - Updated to latest net-snmp-5.1 upstream version.
  - Tons of specfile and patch cleanup.
  - Cleaned up perl stuff (mib2c etc, see #107707).
  - Added lm_sensors support patch for x86 archs from Kaj J. Niemi (#107618).
  - Added support for custom mib paths and mibs to snmptrapd initscript (#102762)


author: Phil Knirsch <pknirsch@redhat.com> 5.1-2
changelog:
  - Included BuildPrereq on lm_sensors-devel on x86 archs (#110616).
  - Fixed deprecated initscript options (#110618).


author: Phil Knirsch <pknirsch@redhat.com> 5.1-3
changelog:
  - Removed snmpcheck again, needs perl(Tk) which we don't ship (#111194).
  - Fixed getopt definition in include file (#111209).
  - Included Kaj J. Niemi's patch for broken perl module (#111319).
  - Included Kaj J. Niemi's patch for broken async getnext perl call (#111479).
  - Included Kaj J. Niemi's patch for broken hr_storage (#111502).


author: Phil Knirsch <pknirsch@redhat.com> 5.1-9
changelog:
  - Reverted removal of _includir redefiniton due to php-snmp dependancy.
  - Remove SO_BSDCOMPAT setsockopt() call, deprecated.


author: Phil Knirsch <pknirsch@redhat.com> 5.1-12
changelog:
  - Hacked an ugly perl hack to get rid of perl RPATH problems.
  - Fixed 64bit patch and applied it. ;-)


author: Phil Knirsch <pknirsch@redhat.com> 5.1.1-2
changelog:
  - Added Kaj J. Niemi that fixes ipAdEntIfIndex problem (#119106)
  - Added Kaj J. Niemi to shut up memshared message for 2.6 kernel (#119203)


author: Radek Vokal <rvokal@redhat.com> 5.1.2-4
changelog:
  - New prereq for net-snmp-devel
  - lelf check removed from configure.in (#128748)
  - fixed snmpd coredump when sent SIGHUP (#127314)


author: Phil Knirsch <pknirsch@redhat.com> 5.1.2-9
changelog:
  - Droped obsolete lm-sensors patch and enabled lmSensors module
  - Marked several patches to be removed for 5.1.3


author: Radek Vokal <rvokal@redhat.com> 5.1.2-12
changelog:
  - snmpd crash with 'interfaces' directives in snmpd.conf fixed #139010
  - rather dirty patch fixing conf directory for net-snmp-config


author: Radek Vokal <rvokal@redhat.com> - 5.1.2-3
changelog:
  - patch from CVS - kill extra carriage return (#144917)
  - removed patch for interface indexing - doesn't show virtual interfaces


author: Radek Vokal <rvokal@redhat.com> - 5.2.1-5
changelog:
  - 64bit needed some changes, was causing timeouts on 64bit archs!? 
  - affects bugs #125432 and #132058


author: Radek Vokal <rvokal@redhat.com> - 5.2.1-12
changelog:
  - session free fixed, agentx modules build fine (#157851)
  - fixed dependency for net-snmp libs (#156932)


author: Radek Vokal <rvokal@redhat.com> - 5.2.2-0.rc6.1
changelog:
  - update to rc6, snmpnetstat changes due to license problems
  - persistent files in directory defined by snmp.conf persistentDir are 
    loaded at startup


author: Radek Vokal <rvokal@redhat.com> - 5.2.2-4
changelog:
  - check for header files in configure
  - patch for SNMPv3 traps / session user creation (net-snmp bz#1374087)


author: Radek Vokal <rvokal@redhat.com> 5.3-2
changelog:
  -  Security fix. Bug granting write access to read-only users 
     or communities which were configured  using the "rocommunity" 
     or "rouser" snmpd.conf tokens fixed


author: Radek Vokál <rvokal@redhat.com> 5.3-7
changelog:
  - fix parsing of /proc/diskstats
  - fix disman monitor crash
  - fix perl vendor name
  - fix OID lookup fail


author: Radek Vokal <rvokal@redhat.com> 5.3.1.pre2-1
changelog:
  - update to 5.3.1.pre2
  - fix multilib issues (#192736)
    On system with /usr/lib64 use net-snmp-config64 and net-snmp-config64.h


author: Radek Vokal <rvokal@redhat.com> 5.3.1.0-5
changelog:
  - SMUX support is still needed .. will disappear later!
  - static libs should be in devel not libs (#203571)
  - fix lm_sensors issues


author: Radek Vokál <rvokal@redhat.com> - 1:5.4-13
changelog:
  - fix overly verbose log message (#221911)
  - few minor tweaks for review - still not perfect
  - fix linking with lcrypto (#231805)


author: Jan Safranek <jsafranek@redhat.com> 5.4-14
changelog:
  - fix snmptrapd hostname logging (#238587)
  - fix udpEndpointProcess remote IP address (#236551)
  - fix -M option of net-snmp-utils (#244784)
  - default snmptrapd.conf added (#243536)
  - fix crash when multiple exec statements have the same name
    (#243536)
  - fix ugly error message when more interfaces share
    one IP address (#209861)


author: Jan Safranek <jsafranek@redhat.com> 5.4-16
changelog:
  - supported lm_sensors on ppc64 (#249255)
  - snmpconf generates config files with proper selinux context
    (#247462)
  - fix leak  in udp transport (#247771)
  - add alpha to supported archs in net-snmp-config (#246825)
  - fix hrSWInst (#250237)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-3
changelog:
  - include these tables: ip-mib/ipv4InterfaceTable
    ip-mib/ipv6InterfaceTable, ip-mib/ipAddressPrefixTable
  - fix Requires of net-snmp-devel to include lmsensors-devel on supported
    architectures


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-5
changelog:
  - move mib2c-update from net-snmp-utils to net-snmp-perl, where
    mib2c is located
  - add tkmib to net-snmp-gui package (#167933)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-6
changelog:
  - add support of lm_sensors v3
  - added procps to build dependencies (#380321)
  - removed beecrypt from dependencies
  - fixed crash on reading xen interfaces (#386611)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-9
changelog:
  - introduce /etc/sysconfig/snmpd. Use it to specify snmpd command line options.
    /etc/snmp/snmpd.options is not used anymore (#431391)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-15
changelog:
  - explicitly require lm_sensor > 3 for build (#442718)
  - create multilib net-snmp-config on multilib architectures only


author: Jan Safranek <jsafranek@redhat.com> 5.4.2-2
changelog:
  - redistribute the perl scripts to the net-snmp package,
    net-snmp-utils doesn't depend on perl now (#462484)


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-1
changelog:
  - explicitly require the right version and release of net-snmp and
    net-snmp-libs
  - update to net-snmp-5.4.2.1 to fix CVE-2008-4309


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-12
changelog:
  - make the default configuration less noisy, i.e. do not print "Connection from
    UDP:" and "Received SNMP packet(s) from UDP:" messages on each connection.
    (#509055)


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-13
changelog:
  - package cleanup, remove unnecessary patches
  - move local state file from /var/net-snmp/ to /var/lib/net-snmp


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-2
changelog:
  - introduce /etc/sysconfig/snmptrapd. Use it to specify snmptrapd command
    line options.  /etc/snmp/snmptrapd.options is not used anymore (#540799)
  - build-in ipAddressPrefixTable, ipDefaultRouterTable, ipv6ScopeZoneIndexTable,
    ipIfStatsTable, SCTP-MIB, RMON-MIB and Etherlike-MIBs
  - remove ucd5820stat helper script, it depends on get5820stats, which is not
    available in Fedora
  - move sample services ipf-mod.pl to documentation
  - remove logrotate config, snmpd logs into syslog


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-3
changelog:
  - prepare the .spec file for review
  - run automatic regression suite after the compilation of the package
    to check for obvious regressions
  - remove unnecessary package dependencies


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-4
changelog:
  - fix udpTable indexes on big-endian systems (#543352)
  - fix snmptrapd init script to survive with empty /etc/sysconfig/snmptrapd
  - lower the default log level of snmpd to get rid of the debug messages


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-7
changelog:
  - fix invalid access to memory in tcpListenerTable (#551030)
  - fix crash with interfaces without broadcast addresses (like OpenVPN's tun0)
    (#549390)
  - fix responding to broadcast SNMP requests (#549390)
  - port patches from RHEL-5 to avoid regressions


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-14
changelog:
  - store temporary files in /var/run/net-snmp instead of /tmp (SELinux does
    not allow writing /tmp) (#560081)
  - fix filedescriptor leak in RMON-MIB and Etherlike-MIB (#562108)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-15
changelog:
  - remove net-snmp-gui subpackage, perl-Tk is being removed from
    distro (#568786)
  - fix IF-MIB::ifSpeed of inactive interfaces (#561884)
  - correct the package license


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-19
changelog:
  - fixed exit code of snmp utilities when wrong argument to '-A' option
    is specified (#574061)
  - fixed BER parsing of incoming packets - siletnly discard the invalid ones
    according to RFC (#568651)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-21
changelog:
  - fixed hrFSTable and hrStorageTable to provide persistent table indexes
    according to RFS 2790 (#595325)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-22
changelog:
  - fixed value of ipIfStatsTable.Ip6ReasmReqds (#597265)
  - added missing include files from util_funcs directory (#604636)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-23
changelog:
  - fixed segfault when parsing snmpd.conf with disman entries (#607080)
  - fixed value of IP-MIB::ipv6InterfaceForwarding (#607074)
  - fixed output of snmptranslate tool when displaying ranges of UNSIGNED
    type (#606874)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-27.1
changelog:
  - fixed truncation of sysObjectID (#641113)
  - fixed assertions in calculating of statistics in IF-MIB (#621664)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-28
changelog:
  - fixed recompilation of the package on machine without IPv6 (#657835)
  - fixed SMUX getting stuck on big-endian platforms (#665053)
  - fixed OID comparsion in snmpwalk, now the output does not include
    objects outside requested subtree (#636890)
  - fixed IPv4 address creation in ipAddressTable (#616764)
  - added IPv6 address creation to ipAddressTable (#616336)
  - fixed value of ipAddressPrefixAutonomousFlag OID (#625262)
  - fixed ipv6IfTable - new interfaces were not added there (#627564)
  - extended BRIDGE-MIB implementation to cover RFC 4363 (#630157)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-31
changelog:
  - fixed BRIDGE-MIB implementation in /usr/bin/snmp-bridge-mib,
    now it supports embedded perl and answers GETNEXT requests correctly
    (#630157).


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-32
changelog:
  - fixed varbind parsing in python netsnmp module (#711481)
  - fixed session initialization in python netsnmp module (#710667)
  - fixed crash when getting out-of-memory in inetNetToMediaTable (#708947)
  - added xfs and jfs filesystem support to hrStorageTable (#707912)
  - fixed snmpd to purge zombies resulted from pass_persist process exit
    (#703682)
  - added a log message when snmpd detects two interfaces with the same
    IP address and thus having only one ipTable entry for both (#702171)
  - added new snmpd.conf options 'interface_fadeout' and
    'interface_replace_old' to controll snmpd behavior when more
    interfaces get the same name (#702165)
  - fixed snmptrapd leaking memory when processing traps in embedded perl
    (#678314)
  - fixed hrSystemDate timezone sign (#683680)
  - fixed snmp logging 'truncating integer value > 32 bits' for
    UCD-SNMP-MIB::systemStats (#681949)
  - fixed rare race condition in hrSWRunTable (#683563)
  - recompiled with relro for better security (#725657)
  - snmpd should not change request-id when sending multiple SMUX messages
    (#708370)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-38
changelog:
  - fixed snmpd crashing with many AgentX subagent (#749227)
  - fixed SNMPv2-MIB::sysObjectID value when "sysObjectID" config file
    option with long OID was used (#786931)
  - fixed value of BRIDGE-MIB::dot1dBasePortIfIndex.1 (#740172)
  - fixed parsing of "proxy" snmpd.conf option not to enable
    verbose logging by default (#746903)
  - added new "realStorageUnits" config file option to support
    disks > 16 TB in hrStorageTable (#741789)
  - added vxfs, reiserfs and ocfs2 filesystem support to hrStorageTable
    (#746903)
  - fixed snmpd sigsegv when embedded perl script registers one handler
    twice (#748907)
  - fixed setting of SNMP-TARGET-MIB::snmpTargetAddrRowStatus via
    SNMP-SET request on 64-bit platforms (#754275)
  - fixed crash when /var/lib/net-snmp/mib_indexes/ files have wrong
    SELinux context (#754971)
  - fixed memory leak when agentx subagent disconnects in the middle
    of request processing (#736580)
  - fixed slow (re-)loads of TCP-MIB::tcpConnectionTable (#789909)
  - removed 'error finding row index in _ifXTable_container_row_restore'
    error message (#788954)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-43
changelog:
  - fixed value of UCD-SNMP-MIB::extCommand to contain full command
    line (#842279)
  - fixed rpath to perl.so (#848319)
  - added support for port numbers in 'clientaddr' configuration
    option (#833013)
  - fixed rare snmptrapd crash on SIGHTERM handling when embedded perl
    is used (#824402)
  - fixed engineID of outgoing traps if 'trapsess -e <engineID>' is used in
    snmpd.conf (#800671)
  - updated documentation of '-c' option of snmptrapd (#784502)
  - fixed endless loop when SIGTEM arrives in middle of internal query
    processing (#851637)
  - fixed UCD-DISKIO-MIB::diskIOLA values (#848155)
  - removed various error log messages related to counte64 expansions
    (#846906)
  - removed various error log messages when IPv6 is disabled (#845157)
  - added support of cvfs filesystem in hrStorageTable (#846532)
  - fixed rare race condintion when populating UCD-SNMP-MIB::prTable,
    which could result in some entries missing in the table (#846436)
  - added support of simfs filesystem in hrStorageTable (#861152)
  - fixed responding to requests on a multihost machine (#825889)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-45
changelog:
  - fixed potential memory leak on realloc failure when processing 'extend'
    option (#893119)
  - added precise enumeration of configuration files searched to
    snmp_config(5) man page (#907571)
  - set permissions of snmpd.conf and snmptrapd conf to 0600 (#919239)
  - fixed kernel threads in hrSWRunTable (#919952)
  - fixed various error codes in Python module (#955771)
  - fixed snmpd crashing in the middle of agentx request processing when
    a subagent disconnects (#955511)
  - allow 'includeFile' and 'includeDir' options in configuration files
    (#917816)
  - fixed netlink message size (#927474)
  - fixed IF-MIB::ifSpeedHi on systems with non-standard interface speeds
    (#947973)
  - fixed BRIDGE-MIB::dot1dBasePortTable not to include the bridge itself
    as a port (#960568)
  - fixed snmpd segfault when 'agentaddress' configuration options is used
    and too many SIGHUP signals are received (#968898)
  - updated UCD-SNMP-MIB::dskTable to dynamically add/remove disks
    if 'includeAllDisks' is specified in snmpd.conf (#922691)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-46
changelog:
  - fixed parsing of bulk responses (#983116)
  - added support of vzfs filesystem in hrStorageTable (#989498)
  - fixed endless loop when parsing sendmail configuration file with
    queue groups (#991213)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-49
changelog:
  - fixed snmp daemons and utilities crashing in FIPS mode (#1001830)
  - added support of btrfs filesystem in hrStorageTable (#1006706)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-49.1
changelog:
  - added 'diskio' option to snmpd.conf, it's possible to monitor only selected
    devices in diskIOTable (#990674)
  - fixed CVE-2014-2284: denial of service flaw in Linux implementation of
    ICMP-MIB (#1073222)


author: Laine Stump <laine@redhat.com> - 0.1.6-2
changelog:
  - make miimon/arpmon in bond definitions optional
  - Resolves: rhbz#585108
  - properly deal with initializing a 0 length /etc/sysconfig/iptables file
  - Resolves: rhbz#582905


author: Laine Stump <laine@redhat.com> - 0.1.6-4
changelog:
  - install missing sysconfig.aug file
  - Resolves: rhbz#613886
  - Don't delete the physical interface config when defining a vlan
  - Resolves: rhbz#585112


author: Laine Stump <laine@redhat.com> - 0.1.7-1
changelog:
  - rebase to netcf-0.1.7
    - Resolves: rhbz#651032
    - remove all iptables manipulation
    - Resolves: rhbz#633346
    - Resolves: rhbz#629206


author: Laine Stump <laine@redhat.com> - 0.1.8-1
changelog:
  - rebase to netcf-0.1.8
    - resolves rhbz#616060
    - show ifup output in relevant error message
    - resolves rhbz#662057
    - pkgconfig file should not list augeas, libxml or libxslt
    - resolves rhbz#681078
    - Need to input 'quit' twice to quit ncftool after an erroneous command
    - resolves rhbz#703318
    - %desc field in specfile has a typo
    - resolves rhbz#705061
    - rebase netcf for RHEL6.2
    - resolves rhbz#708476
    - RFE: transaction-oriented API for handling host interfaces


author: Laine Stump <laine@redhat.com> - 0.1.9-1
changelog:
  - rebase to netcf-0.1.9
    - resolves rhbz#616060
    - always add <bridge> element to bridge, even if there is no physdev present
    - resolves rhbz#713180
    - don't log error if interface isn't found in kernel during status report
    - resolves rhbz#713286
    - update gnulib


author: Laine Stump <laine@redhat.com> - 0.1.9-2
changelog:
  - resolves rhbz#728184
    - eliminate potential use of uninitialized index/pointer in add_bridge_info
    - resolves rhbz#736920
    - resolves rhbz#739505
    - fix missing vlan/bond/ethernet info in dumpxml --live


author: Laine Stump <laine@redhat.com> - 0.1.9-3
changelog:
  - resolves rhbz#886862
    - libnl addr and link caches are not thread-safe, leading to
      libvirtd crashes


author: Laine Stump <laine@redhat.com> - 0.1.9-4
changelog:
  - resolves rhbz#844578
    - check IFF_RUNNING before considering and interface "active"
    - resolves rhbz#848722
    - fix ipcalc_netmask


author: Christopher Aillon <caillon@redhat.com> 4.6-4
changelog:
  - Use the NSPR version numbering scheme reported by NSPR,
    which unfortunately is not exactly the same as the real
    version (4.6 != 4.6.0 according to RPM and pkgconfig).


author: Christopher Aillon <caillon@redhat.com>
changelog:
  - Stop shipping static libraries; NSS and dependencies no longer
    require static libraries to build.


author: Kai Engert <kengert@redhat.com> 4.6.1-2
changelog:
  - Do not use -ansi when compiling, because of a compilation
    problem with latest glibc and anonymous unions.
    See also bugzilla.mozilla.org # 322427.


author: Kai Engert <kengert@redhat.com> - 4.6.5-2
changelog:
  - Update to latest ipv6 upstream patch
  - Add upstream patch to fix a thread cleanup issue
  - Now requires pkgconfig


author: Kai Engert <kengert@redhat.com> - 4.6.6-2
changelog:
  - Update thread-cleanup patch to latest upstream version
  - Add upstream patch to support PR_STATIC_ASSERT


author: Elio Maldonado <emaldona@redhat.com> - 4.9.5-3
changelog:
  - Bump the release tag so it's higher than the one for rhel-6.4.z
  - Resolves: rhbz#919180 - Rebase to nspr-4.9.5


author: Elio Maldonado <emaldona@redhat.com> - 4.10.0-1
changelog:
  - Update Version to 4.10.0 to prevent Mozilla apps update problems as
  - reported and fixed on https://bugzilla.redhat.com/show_bug.cgi?id=981166
  - Resolves: rhbz#1002643 - Rebase RHEL 6 to NSPR 4.10 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.0-2
changelog:
  - Rebase to nspr-4.10.2
  - Resolves: rhbz#1032485 - CVE-2013-5607 (MFSA 2013-103) Avoid unsigned integer wrapping in PL_ArenaAllocate (MFSA 2013-103)


author: Christopher Aillon <caillon@redhat.com> 3.11-0.cvs
changelog:
  - Initial import into Fedora Core, based on a CVS snapshot of
    the NSS_3_11_RTM tag
  - Fix up the pkcs11-devel subpackage to contain the proper headers
  - Build with RPM_OPT_FLAGS
  - No need to have rpath of /usr/lib in the pc file


author: Kai Engert <kengert@redhat.com> - 3.11.3-2
changelog:
  - Revert the attempt to require latest NSPR, as it is not yet available
    in the build infrastructure.


author: Kai Engert <kengert@redhat.com> - 3.11.5-1
changelog:
  - Update to 3.11.5
  - This update fixes two security vulnerabilities with SSL 2
  - Do not use -rpath link option
  - Added several unsupported tools to tools package


author: Kai Engert <kengert@redhat.com> - 3.11.5-2
changelog:
  - Fix rhbz#230545, failure to enable FIPS mode
  - Fix rhbz#220542, make NSS more tolerant of resets when in the 
    middle of prompting for a user password.


author: Kai Engert <kengert@redhat.com> - 3.11.7-2
changelog:
  - Update to 3.11.7, but freebl/softokn remain at 3.11.5.
  - Use a workaround to avoid mozilla bug 51429.


author: Kai Engert <kengert@redhat.com> - 3.11.7-10
changelog:
  - Add /etc/prelink.conf.d/nss-prelink.conf in order to blacklist
    our signed libraries and protect them from modification.


author: Kai Engert <kengert@redhat.com> - 3.11.99.3-2
changelog:
  - Build against gcc 4.3.0, use workaround for bug 432146
  - Run the test suite after the build and abort on failures.


author: Kai Engert <kengert@redhat.com> - 3.12.0.3-3
changelog:
  - nss package should own /etc/prelink.conf.d folder, rhbz#452062
  - use upstream patch to fix test suite abort


author: Kai Engert <kaie@redhat.com> - 3.12.3-3
changelog:
  - ship .chk files instead of running shlibsign at install time
  - include .chk file in softokn-freebl subpackage
  - add patch for upstream nss bug 488350


author: Kai Engert <kaie@redhat.com> - 3.12.3-7
changelog:
  - re-enable test suite
  - add patch for upstream bug 488646 and add newer paypal
    certs in order to make the test suite pass


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-5
changelog:
  - updated pem module incorporates various patches
  - fix off-by-one error when computing size to reduce memory leak. (483855)
  - fix data type to work on x86_64 systems. (429175)
  - fix various memory leaks and free internal objects on module unload. (501080)
  - fix to not clone internal objects in collect_objects().  (501118)
  - fix to not bypass initialization if module arguments are omitted. (501058)
  - fix numerous gcc warnings. (500815)
  - fix to support arbitrarily long password while loading a private key. (500180) 
  - fix memory leak in make_key and memory leaks and return values in pem_mdSession_Login (501191)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-10
changelog:
  - must install libnssutil3.since nss-util is untagged at the moment
  - preserve time stamps when installing various files


author: Elio Maldonado+emaldona@redhat.com - 3.12.3.99.3-11
changelog:
  - split off nss-softokn and nss-util as subpackages with their own rpms
  - first phase of splitting nss-softokn and nss-util as their own packages


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-19
changelog:
  - remove patches that are now in nss-softokn and
  - remove spurious exec-permissions for nss.pc per rpmlint
  - single requires line in nss.pc.in


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-22
changelog:
  - Fix nss-config not to include nssutil
  - Add BuildRequires on nss-softokn and nss-util since build also runs the test suite


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-25
changelog:
  - Remove nss-prelink.conf as signed all shared libraries moved to nss-softokn
  - Add a temprary hack to nss.pc.in to unblock builds


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-29
changelog:
  - Restoring patches 2 and 7 as we still compile all sources
  - Applying the nss-nolocalsql.patch solves nss-tools sqlite dependency problems


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-30
changelog:
  - Fix FORTIFY_SOURCE buffer overflows in test suite on ppc and ppc64 - bug 519766
  - Fixed requires and buildrequires as per recommendations in spec file review


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-2
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - No rpath-link in nss-softokn-config


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - PEM module implements memory management for internal objects - 509705
  - PEM module doesn't crash when processing malformed key files - 512019


author: Elio Maldonado<emaldona@redhat.com - 3.12.4-9
changelog:
  - Install blank databases and configuration file for system shared database
  - nsssysinit queries system for fips mode before relying on environment variable


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-14
changelog:
  - Fix bug where user was prompted for a password when listing keys on an empty system database (#527048)
  - Fix setup-nsssysinit to handle more general flags formats (#527051)


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1.8
changelog:
  - Fix nsssysinit to set the default flags on the crypto module (#545779)
  - Fix nsssysinit to enable apps to use the system cert store, patch contributed by David Woodhouse (#546221)
  - Fix segmentation fault when listing keys or certs in the database, patch contributed by Kamil Dudka (#540387)
  - Sysinit requires coreutils for post install scriplet (#547067)
  - Remove redundant header from the pem module


author: Elio Maldonado <emaldona@redhat.com> - 3.12.5-7.1
changelog:
  - Updated to 3.12.5 from CVS import from Fedora 12
  - Moved blank legacy databases to the lookaside cache
  - Reenabled the full test suite
  - Retagging for a RHEL-6-test-build


author: Elio Maldonado <emaldona@redhat.com> - 3.12.5-7.3
changelog:
  - Resolves: #551784 rebuilt after nss-softokn and nss-util builds
  - this will generate the coorect nss.spec


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-5
changelog:
  - Appying the changes in previous log
  - Changing some BuildRequires to >= as well
  - Temporarily disabling all tests for faster builds


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-2
changelog:
  - Add suppport for pkcs8 formatted keys in the pem module
  - Add verify(not md5 size mtime) to configuration files attributes
  - Prevent nss-sysinit disabling on package upgrade
  - Create pkcs11.txt with correct permissions regardless of current umask
  - Add option to setup-nsssysinit.sh to report nss-sysinit status
  - Update test certificate which had expired


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-2
changelog:
  - Prefer user database ca cert trust settings system's ones
  - Swap internal key slot on fips mode switches


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-3
changelog:
  - Add requires for pkcs11-devel on nss-softokn-freebl devel
  - Run the test suites in check section per packaging guidelines


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-7
changelog:
  - Update expired PayPayEE.cert test certificate
  - Conditionalize some database tests on user not being root


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-1
changelog:
  - Resolves: Bug 744070 - Update to 3.13.1
  - Resolves: Bug 784674 - nss should protect against being called before nss_Init
  - Resolves: Bug 784490 - CVE-2011-3389 HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-4
changelog:
  - Add two needed patches
  - Resolves: rhbz#783315 - Need nss workaround for freebl bug that causes openswan to drop connections
  - Resolves: rhbz#747387 - Unable to contact LDAP Server during winsync


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-1
changelog:
  - Update to 3.13.3
  - Resolves: rhbz#798539 - Distrust MITM subCAs issued by TrustWave
  - Remove builtins-nssckbi_1_88_rtm.patch which the rebase obsoletes


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Resolves: rhbz#746632 - pem_CreateObject mem leak on non existing file name
  - Resolves: rhbz#768669 - PEM unregistered callback causes SIGSEGV


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-3
changelog:
  - Resolves: rhbz#746632 - pem_CreateObject mem leak on non existing file name
  - Use completed patch per code review


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-1
changelog:
  - Rebase to nss-3.14.0.0-1
  - Resolves: rhbz#837089
  - Update ssl-cbc-random-iv patch for new sources
  - Remove patches rendered obsoleted by rebase to 3.14
  - Add a patch to enforce no pkcs11 bypass


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-7
changelog:
  - Add dummy sources file to test for and prevent breaking rhpkg commands
  - Enable testing for 'rhpk upload' and 'rhpk new-sources' breakage such as hangs
  - Related: rhbz#837089


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-8
changelog:
  - PEM peminit returns CKR_CANT_LOCK when needed to inform caller module isn't thread safe
  - Resolves: rhbz#555019 - [PEM] invalid writes in multi-threaded libcurl based application


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-9
changelog:
  - Fix locking issue causing curl hangs and authenticate to the correct session
  - Resolves: rhbz#872838


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-12
changelog:
  - Recreate the distrust patch by backporting the upstream one
  - Resolves: rhpbz#890914 - Dis-trust TURKTRUST mis-issued *.google.com certificate


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3.14.3_RTM
  - Resolves: rhbz#918950 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue
  - Update expired test certificates (fixed in upstream bug 852781)
  - Sync up pem module's rsawrapr.c with softoken's upstream changes for nss-3.14.3
  - Reactivate the aia tests


author: Elio Maldonado - 3.14.3-2
changelog:
  - Install sechash.h and secmodt.h which are now provided by nss-devel
  - Resolves: rhbz#918950 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue
  - Remove unsafe -r option from commands that remove headers already shipped by nss-util and nss-softoken


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-3
changelog:
  - Ensure pem uses system freebl as with this update freebl brings in new API's
  - Resolves: rhbz#918950 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-4
changelog:
  - Revert to accepting MD5 on digital signatures by default
  - Resolves: rhbz#918136 - nss 3.14 - MD5 hash algorithm disabled


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-5
changelog:
  - Syncup with uptream changes for aes gcm and ecc suiteb
  - Enable ecc support for suite b
  - Apply several upstream AES GCM fixes
  - Use the pristine nss upstream sources with ecc included
  - Export NSS_ENABLE_ECC=1 in both the build and the check sections
  - Make failed requests for unsupoprted ssl pkcs 11 bypass non fatal
  - Resolves: rhbz#882408 - NSS_NO_PKCS11_BYPASS must preserve ABI
  - Related:  rhbz#918950  - rebase nss to 3.14.3


author: Kai Engert <kaie@redhat.com> - 3.14.3-33
changelog:
  - Configure libnssckbi.so to use the alternatives system
    in order to prepare for a drop in replacement.
    Please ensure that older packages that don't use the alternatives
    system for libnssckbi.so have a smaller n-v-r.


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-34
changelog:
  - Fix race condition in cert code related to smart cards
  - Resolves: rhbz#903017 - Firefox hang when CAC/PIV smart card certificates are viewed in the certificate manager


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-37
changelog:
  - Do not hold issuer certificate handles in the crl cache
  - Resolves: rhbz#961659 - SQL backend does not reload certificates


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-1
changelog:
  - Rebase to NSS_3.15.1_RTM
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x) 
  - Update patches on account of the shallow tree with the rebase to 3.15.1
  - Update the pem module sources  nss-pem-20130405.tar.bz2 with latest patches applied
  - Remove patches rendered obsolete by the nss rebase and the updated nss-pem sources
  - Enable the iquote.patch to access newly introduced types


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-2
changelog:
  - Fix relative path in %check section to prevent undetected test failures
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-4
changelog:
  - Require nss-softokn-fips
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-5
changelog:
  - Disable the cipher suite already run as part of the nss-softokn build
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-6
changelog:
  - Fix all.sh test for which application was last build by updating nss-versus-softoken-test.path
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Kai Engert <kaie@redhat.com> - 3.15.1-7
changelog:
  - Additional syntax fixes in nss-versus-softoken-test.patch
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-8
changelog:
  - Don't require nss-softokn-fips
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-9
changelog:
  - Rebuild for the pem module to link with freel from nss-softokn-3.14.3-6.el6
  - Related: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]
  - Related: rhbz#1010224 - NSS 3.15 breaks SSL in OpenLDAP clients


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-10
changelog:
  - Restore a mistakenly removed patch
  - Resolves: rhbz#961659 - SQL backend does not reload certificates


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-11
changelog:
  - Fix the test for zero failures in the %check section
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-12
changelog:
  - Add a zero default value to the DISABLETEST and TEST_FAILURES checks
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-13
changelog:
  - Add zero default value to DISABLETEST check and fix the TEST_FAILURES check and reporting
  - Resolves: rhbz#990631 - file permissions of pkcs11.txt/secmod.db must be kept when modified by NSS
  - Related: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-14
changelog:
  - Add s390x and ia64 to the %define multilib_arches list used for defining alt_ckbi
  - Resolves: rhbz#1016044 - nss.s390: primary link for libnssckbi.so must be /usr/lib64/libnssckbi.so


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-15
changelog:
  - Using export NSS_DISABLE_HW_GCM=1 to deal with some problemmatic build systems
  - Resolves: rhbz#1016044 - nss.s390: primary link for libnssckbi.so must be /usr/lib64/libnssckbi.so


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Enable patch with fix for deadlock in trust domain lock and object lock
  - Resolves: Bug 1036477 - deadlock in trust domain lock and object lock
  - Disable hw gcm on rhel-5 based build environments where OS lacks support
  - Rollback changes to build nss without softokn until Bug 689919 is approved
  - Cipher suite was run as part of the nss-softokn build


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Revoke trust in one mis-issued anssi certificate
  - Resolves: Bug 1042685 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117) [rhel-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Resolves: Bug 1048713 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-6
changelog:
  - Make pem's derEncodingsMatch function work with encrypted keys
  - Resolves: Bug 1048713 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: Dennis Gilmore <dennis@ausil.us> 3.12.3.99.3-10
changelog:
  - dont include the headers in nss-util only in the -devel package
  - nss-util-devel Requires nss-devel since its only providing a subset of the headers.


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-11
changelog:
  - Remove spurious executable permissions from nss-util-config
  - Shorten some descriptions to keep rpmlint happy


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - Apply nss-nolocalsql patch subset for nss-util
  - No rpath-link in nss-util-config


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Resolves: rhbz#799192 - Update to 3.13.3
  - Update minimum nspr version for Requires and BuildRequires to 4.9
  - Fix version/release in changelog to match the Version and Release tags, now 3.13.3-2


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-1
changelog:
  - Update to NSS_3_13_5_RTM
  - Resolves: rhbz#833480 - Update nss-util on RHEL 6.x to NSS 3.13.5 for Mozilla 10.0.6
  - Add -L${libdir}/nss3 to Libs: line in nspr.pc.in


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-3
changelog:
  - Update to nss-3.14.0.0-1
  - Add temporary patch so utilmod doesn't include any headers from softoken
  - Keep the hasht.h from current nss-softokn-devel
  - Remove the long obsoleted nss-nolocalsql.patch


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3_14_3_RTM
  - Resolves: rhbz#919174 - Rebase to 3.14.3 as part of the fix for the lucky-13 issue


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-4
changelog:
  - Resolves: rhbz#976572 - Pick up various upstream GCM code fixes applied since nss-3.14.3 was released


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-5
changelog:
  - Update to NSS_3_15_1_RTM
  - Resolves: rhbz#1002644 - Rebase RHEL 6 to NSS-UTIL 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-3
changelog:
  - Preserve existing permissions when replacing existing pkcs11.txt file, but keep strict default permissions for new files
  - Resolves: rhbz#990631 - file permissions of pkcs11.txt/secmod.db must be kept when modified by NSS


author: Michal Schmidt <mschmidt@redhat.com> - 2.2.8-4
changelog:
  - Return support for crypto hw on s390.
  - Renamed to opencryptoki.
  - Simplified multilib by putting libs in subpackage as suggested by Dan Horák.


author: Dan Horák <dhorak@redhat.com> 2.3.1-1
changelog:
  - New upstream release 2.3.1. (#559364)
  - opencryptoki-2.3.0-fix-nss-breakage.patch was merged.
  - updated pkcsslotd initscript (#547324)
  - Resolves: #559364
  - Related: #547324


author: Dan Horák <dhorak@redhat.com> 2.4-2
changelog:
  - don't add root to pkcs11 group (#732756)
  - document implications of the pkcs11 group membership (#730903)
  - Resolves: #732756, #730903


author: Rex Dieter <rdieter@fedoraproject.org> - 1.3-5
changelog:
  - libopenjpeg has undefined references (#467661)
  - openjpeg.h is installed in a directory different from upstream's default (#484887)
  - drop -O3 (#504663)
  - add %check section
  - %files: track libopenjpeg somajor (2)


author: Tom Lane <tgl@redhat.com> 1.3-7
changelog:
  - Apply two upstream fixes for crasher bugs
  Resolves: #609389
  - Fix FTBFS: ImplicitDSOLinking (see Fedora bug 564783)


author: Tom Lane <tgl@redhat.com> 1.3-8
changelog:
  - Apply patches for CVE-2009-5030, CVE-2012-3358
  Resolves: #831562
  - Include -DCMAKE_INSTALL_LIBDIR in cmake call; fixes FTBFS with recent
    versions of cmake


author: Petr Hracek <phracek@redhat.com> 1.3-10
changelog:
  - Apply patch for CVE-2013-6054 CVE-2013-1447 CVE-2013-6045 CVE-2013-6052 
  Resolves: #1038985 CVE-2013-6054 CVE-2013-1447 CVE-2013-6045 CVE-2013-6052


author: Bill Nottingham <notting@redhat.com>
changelog:
  - update to 1.2.7
  - fix some bugs from bugzilla (#4885, #4887, #4888, #4967)
  - take include files out of base package


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add -D_REENTRANT to make threaded stuff more stable, even though it looks
    like the sources define it, too
  - mark *.ph files in migration tools as config files


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move the defaults for databases and whatnot to /var/lib/ldap (bug #10714)
  - fix some possible string-handling problems


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 1.2.10
  - add revamped version of patch from kos@bastard.net to allow execution as
    any non-root user
  - remove test suite from %build because of weirdness in the build system


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - more minimalistic fix for bug #11111 after consultation with OpenLDAP team
  - backport replacement for the ldapuser patch


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 1.2.11
  - add condrestart logic to init script
  - munge migration scripts so that you don't have to be 
    /usr/share/openldap/migration to run them
  - add code to create pid files in /var/run


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - tweak init script to return error codes properly
  - change initscripts dependency to one on /etc/init.d


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - switch to gdbm; I'm getting off the db merry-go-round
  - tweak the init script some more
  - add instdir to @INC in migration scripts


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - split off clients and servers to shrink down the package and remove the
    base package's dependency on Perl
  - make certain that the binaries have sane permissions


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - build a semistatic slurpd with threads, everything else without
  - disable reverse lookups, per email on OpenLDAP mailing lists
  - make sure the execute bits are set on the shared libraries


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add the nis.schema and inetorgperson.schema to the default server config
  - make ldapadd a hard link to ldapmodify because they're identical binaries


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.0.6
  - add buildprereq on cyrus-sasl-devel, krb5-devel, openssl-devel
  - take the -s flag off of slapadd invocations in migration tools
  - add the cosine.schema to the default server config, needed by inetorgperson


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - try adding the suffix first when doing online migrations
  - force ldapadd to use simple authentication in migration scripts
  - add indexing of a few attributes to the default configuration
  - add commented-out section on using TLS to default configuration


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add missing required attributes to conversion scripts to comply with schema
  - add schema for mail aliases, autofs, and kerberosSecurityObject rooted in
    our own OID tree to define attributes and classes migration scripts expect
  - tweak automounter migration script


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - reorganize the patch list to separate MigrationTools and OpenLDAP patches
  - switch to Luke Howard's rfc822MailMember schema instead of the aliases.schema
  - configure slapd to run as the non-root user "ldap" (#19370)
  - chdir() before chroot() (we don't use chroot, though) (#19369)
  - disable saving of the pid file because the parent thread which saves it and
    the child thread which listens have different pids


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add Norbert Klasen's patch (via Del) to fix searches using ldaps URLs
    (OpenLDAP ITS #889)
  - add "-h ldaps:///" to server init when TLS is enabled, in order to support
    ldaps in addition to the regular STARTTLS (suggested by Del)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change automount object OID from 1.3.6.1.1.1.2.9 to 1.3.6.1.1.1.2.13,
    per mail from the ldap-nis mailing list


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add support for additional OPTIONS, SLAPD_OPTIONS, and SLURPD_OPTIONS in
    a /etc/sysconfig/ldap file (#23549)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - back out pidfile patches, which interact weirdly with Linux threads
  - mark non-standard schema as such by moving them to a different directory


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - build dummy certificate in %post, use it in default config
  - configure-time shenanigans to help a confused configure script


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move shared libraries to /lib
  - redo init script for better internationalization (#26154)
  - don't use ldaprc files in the current directory (#38402) (patch from
    hps@intermeta.de)
  - add BuildPrereq on tcp wrappers since we configure with
    --enable-wrappers (#43707)
  - don't overflow debug buffer in mail500 (#41751)
  - don't call krb5_free_creds instead of krb5_free_cred_contents any
    more (#43159)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - require cyrus-sasl-md5 (support for DIGEST-MD5 is required for RFC
    compliance) by name (follows from #43079, which split cyrus-sasl's
    cram-md5 and digest-md5 modules out into cyrus-sasl-md5)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add a build-time requirement on pam-devel
  - add a build-time requirement on a sufficiently-new libtool to link
    shared libraries to other shared libraries (which is needed in order
    for prelinking to work)


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.12-1
changelog:
  - update to 2.0.12 to pull in fixes for setting of default TLS options, among
    other things
  - update to migration tools 39
  - drop tls patch, which was fixed better in this release


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - disable kbind support (deprecated, and I suspect unused)
  - configure with --with-kerberos=k5only instead of --with-kerberos=k5
  - build slapd with threads


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.20-2
changelog:
  - temporarily disable optimizations for ia64 arches
  - specify pthreads at configure-time instead of letting configure guess


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.22-2
changelog:
  - switch to an internalized Berkeley DB as the ldbm back-end  (NOTE: this breaks
    access to existing on-disk directory data)
  - add slapcat/slapadd with gdbm for migration purposes
  - remove Kerberos dependency in client libs (the direct Kerberos dependency
    is used by the server for checking {kerberos} passwords)


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.25-1
changelog:
  - update to 2.0.25 "stable", ldbm-over-gdbm (putting off migration of LDBM
    slapd databases until we move to 2.1.x)
  - use %{_smp_mflags} when running make
  - update to MigrationTools 44
  - enable dynamic module support in slapd


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.25-2
changelog:
  - change LD_FLAGS to refer to /usr/kerberos/_libdir instead of
    /usr/kerberos/lib, which might not be right on some arches


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - incorporate fixes from SuSE's security audit, except for fixes to ITS 1963,
    1936, 2007, 2009, which were included in 2.0.26.
  - add two more patches for db 4.1.24 from sleepycat's updates page
  - use openssl pkgconfig data, if any is available


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.27-8
changelog:
  - back down to db 4.0.x, which 2.0.x can compile with in ldbm-over-db setups
  - tweak SuSE patch to fix a few copy-paste errors and a NULL dereference


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.1.17
  - disable the shell backend, not expected to work well with threads
  - drop the kerberosSecurityObject schema, the krbName attribute it
    contains is only used if slapd is built with v2 kbind support


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - install the db utils for the bundled libdb as %{_sbindir}/slapd_db_*
  - install slapcat/slapadd from 2.0.x for migration purposes


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.22-0
changelog:
  - 2.1.22 now badged stable
  - be more aggressive in what we index by default
  - use/require libtool 1.5


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - actually require newer libtool, as was intended back in 2.1.22-0, noted as
    missed by Jim Richardson


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - build bundled libdb for slapd dynamically to make the package smaller,
    among other things
  - on tls-capable arches, build libdb both with and without shared posix
    mutexes, otherwise just without
  - disable posix mutexes unconditionally for db 4.0, which shouldn't need
    them for the migration cases where it's used
  - update to MigrationTools 45


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.22-8
changelog:
  - add another section to the ABI note for the TLS libdb so that it's marked as
    not needing an executable stack (from Arjan Van de Ven)


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.25-1
changelog:
  - change logging facility used from daemon to local4 (#112730, reversing #11047)
    BEHAVIOR CHANGE - SHOULD BE MENTIONED IN THE RELEASE NOTES.


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.25-2
changelog:
  - fix incorrect use of find when attempting to detect a common permissions
    error in the init script (#114866)


author: Thomas Woerner <twoerner@redhat.com> 2.1.29-3
changelog:
  - removed rpath
  - added pie patch: slapd and slurpd are now pie
  - requires libtool >= 1.5.6-2 (PIC libltdl.a)


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.13-1
changelog:
  - add compat-openldap subpackage
  - default to bdb, as upstream does, gambling that we're only going to be
    on systems with nptl now


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.13-2
changelog:
  - build a separate, static set of libraries for openldap-devel with the
    non-standard ntlm bind patch applied, for use by the evolution-connector
    package (#125579), and installing them under
    evolution_connector_prefix)
  - provide openldap-evolution-devel = version-release in openldap-devel
    so that evolution-connector's source package can require a version of
    openldap-devel which provides what it wants


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move slapd startup to earlier in the boot sequence (#103160)
  - update to 2.2.15 (stable-20040822)
  - change version number on compat-openldap to include the non-compat version
    from which it's compiled, otherwise would have to start 2.2.15 at release 3
    so that it upgrades correctly


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.2.17 (stable-20040923) (#135188)
  - move nptl libraries into arch-specific subdirectories on x86 boxes
  - require a newer glibc which can provide nptl libpthread on i486/i586


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.20-1
changelog:
  - update to 2.2.20 (stable-20050103)
  - warn about unreadable krb5 keytab files containing "ldap" keys
  - warn about unreadable TLS-related files
  - own a ref to subdirectories which we create under _libdir/tls


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.23-1
changelog:
  - update to 2.2.23 (stable-20050125)
  - update notes on upgrading from earlier versions
  - drop slapcat variations for 2.0/2.1, which choke on 2.2's config files


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.24-1
changelog:
  - update to 2.2.24 (stable 20050318)
  - export KRB5_KTNAME in the init script, in case it was set in the sysconfig
    file but not exported


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.2.26 (stable 20050429)
  - enable the lmpasswd scheme
  - print a warning if slaptest fails, slaptest -u succeeds, and one of the
    directories listed as the storage location for a given suffix in slapd.conf
    contains a readable file named __db.001 (#118678)


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.26-1
changelog:
  - run slaptest with the -u flag if no id2entry db files are found, because
    you can't check for read-write access to a non-existent database (#156787)
  - add _sysconfdir/openldap/cacerts, which authconfig sets as the
    TLS_CACERTDIR path in /etc/openldap/ldap.conf now
  - use a temporary wrapper script to launch slapd, in case we have arguments
    with embedded whitespace (#158111)


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Add the tls-fix-connection-test patch to close
    bz#161991 openldap password disclosure issue
  - add the hop patches to prevent infinite looping when chasing referrals.
    OpenLDAP ITS #3578


author: Jay Fenlason <fenlason@redhat.com> 2.2.26-2
changelog:
  - Move the slapd.pem file to /etc/pki/tls/certs
    and edit the -config patch to match to close
    bz#143393  Creates certificates + keys at an insecure/bad place
  - also use _sysconfdir instead of hard-coding /etc


author: Jay Fenlason <fenlason@redhat.com> 2.3.11-2
changelog:
  - Upgrade to 2.3.11, which upstream now considers stable.
  - Switch compat-openldap to 2.2.29
  - remove references to nss_ldap_build from the spec file
  - remove references to 2.0 and 2.1 from the spec file.
  - reorganize the build() function slightly in the spec file to limit the
    number of redundant and conflicting options passedto configure.
  - Remove the attempt to hardlink ldapmodify and ldapadd together, since
    the current make install make ldapadd a symlink to ldapmodify.
  - Include the -ads patches to allow SASL binds to an Active Directory
    server to work.  Nalin <nalin@redhat.com> wrote the patch, based on my
    broken first attempt.


author: Jay Fenlason <fenlason@redhat.com> 2.3.11-3
changelog:
  - Remove Requires: cyrus-sasl and cyrus-sasl-md5 from openldap- and
    compat-openldap- to close
    bz#173313 Remove exlicit 'Requires: cyrus-sasl" + 'Requires: cyrus-sasl-md5'


author: Jay Fenlason <fenlason@redhat.com> 2.3.19-2
changelog:
  - Upgrade to 2.3.19, which upstream now considers stable
  - Modify the -config.patch, ldap.init, and this spec file to put the
    pid file and args file in an ldap-owned openldap subdirectory under
    /var/run.
  - Move back_sql* out of _sbindir/openldap , which requires
    hand-moving slapd and slurpd to _sbindir, and recreating symlinks
    by hand.
  - Retire openldap-2.3.11-ads.patch, which went upstream.
  - Update the ldap.init script to run slaptest as the ldap user rather
    than as root.  This solves
    bz#150172 Startup failure after database problem
  - Add to the servers post and preun scriptlets so that on preun, the
    database is slapcatted to /var/lib/ldap/upgrade.ldif and the
    database files are saved to /var/lib/ldap/rpmorig.  On post, if
    /var/lib/ldap/upgrade.ldif exists, it is slapadded.  This means that
    on upgrades from 2.3.16-2 to higher versions, the database files may
    be automatically upgraded.  Unfortunatly, because of the changes to
    the preun scriptlet, users have to do the slapcat, etc by hand when
    upgrading to 2.3.16-2.  Also note that the /var/lib/ldap/rpmorig
    files need to be removed by hand because automatically removing your
    emergency fallback files is a bad idea.
  - Upgrade internal bdb to db-4.4.20.  For a clean upgrade, this will
    require that users slapcat their databases into a temp file, move
    /var/lib/ldap someplace safe, upgrade the openldap rpms, then
    slapadd the temp file.


author: Jay Fenlason <fenlason@redhat.com> 2.3.27-2
changelog:
  - New upstream release
  - Include the gethostbyname_r patch so that nss_ldap won't hang
    on recursive attemts to ldap_initialize.


author: Jay Fenlason <fenlason@redhat.com> 2.3.27-3
changelog:
  - Include --enable-multimaster to close
    bz#185821: adding slapd_multimaster to the configure options
  - Upgade guide.html to the correct one for openladp-2.3.27, closing
    bz#190383: openldap 2.3 packages contain the administrator's guide for 2.2
  - Remove the quotes from around the slaptestflags in ldap.init
    This closes one part of
    bz#204593: service ldap fails after having added entries to ldap
  - include __db.* in the list of files to check ownership of in
    ldap.init, as suggested in
    bz#199322: RFE: perform cleanup in ldap.init


author: Thomas Woerner <twoerner@redhat.com> 2.3.30-1.1
changelog:
  - tcp_wrappers has a new devel and libs sub package, therefore changing build
    requirement for tcp_wrappers to tcp_wrappers-devel


author: Jay Fenlason <fenlason<redhat.com> 2.3.34-1
changelog:
  - New upstream release
  - Upgrade the scripts for migrating the database so that they might
    actually work.
  - change bind-libbind-devel to bind-devel in BuildPreReq


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-2
changelog:
  - slapadd during package update is now quiet (bz#224581)
  - use _localstatedir instead of var/ during build (bz#220970)
  - bind-libbind-devel removed from BuildRequires (bz#216851)
  - slaptest is now quiet during service ldap start, if
    there is no error/warning (bz#143697)
  - libldap_r.so now links with pthread (bz#198226)
  - do not strip binaries to produce correct .debuginfo packages
    (bz#152516)


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-3
changelog:
  - do not create script in /tmp on startup (bz#188298)
  - add compat-slapcat to openldap-compat (bz#179378)
  - do not import ddp services with migrate_services.pl
    (bz#201183)
  - sort the hosts by adders, preventing duplicities
    in migrate*nis*.pl (bz#201540)
  - start slupd for each replicated database (bz#210155)
  - add ldconfig to devel post/postun (bz#240253)
  - include misc.schema in default slapd.conf (bz#147805)


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-4
changelog:
  - Fix initscript return codes (#242667)
  - Provide overlays (as modules; #246036, #245896)
  - Add available modules to config file


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-6
changelog:
  - fix compat-slapcat compilation. Now it can be found in 
    /usr/lib/compat-openldap/slapcat, because the tool checks argv[0]
    (#246581)


author: Jan Safranek <jsafranek@redhat.com> 2.3.37-2
changelog:
  - do not use specific automake and autoconf
  - do not distinguish between NPTL and non-NPTL platforms, we have NPTL
    everywhere
  - db-4.6.18 integrated
  - updated openldap-servers License: field to reference BDB license


author: Jan Safranek <jsafranek@redhat.com> 2.3.38-2
changelog:
  - skeleton /etc/sysconfig/ldap added
  - new SLAPD_LDAP option to turn off listening on ldap:/// (#292591)
  - fixed checking of SSL (#292611)
  - fixed upgrade with empty database


author: Jan Safranek <jsafranek@redhat.com> 2.4.7-4
changelog:
  - fixed rpmlint warnings and errors
    - /etc/openldap/schema/README moved to /usr/share/doc/openldap


author: Jan Safranek <jsafranek@redhat.com> 2.4.8-3
changelog:
  - reworked the upgrade logic, slapcat/slapadd of the whole database
    is needed only if minor version changes (2.3.x -> 2.4.y)
  - do not try to save database in LDIF format, if openldap-servers package 
    is  being removed (it's up to the admin to do so manually)


author: Jan Safranek <jsafranek@redhat.com> 2.4.8-4
changelog:
  - bdb upgraded to 4.6.21
  - reworked upgrade logic again to run db_upgrade when bdb version
    changes


author: Jan Safranek <jsafranek@redhat.com> 2.4.11-3
changelog:
  - add SLAPD_SHUTDOWN_TIMEOUT to /etc/sysconfig/ldap, allowing admins
    to set non-default slapd shutdown timeout
  - add checkpoint to default slapd.conf file (#458679)


author: Jan Zeleny <jzeleny@redhat.com> 2.4.15-3
changelog:
  - extended previous patch (#481310) to remove options cfMP
    from some client tools
  - correction of patch setugid (#494330)


author: Jan Zeleny <jzeleny@redhat.com> 2.4.16-1
changelog:
  - rebase of openldap to 2.4.16
  - fixed minor issue in spec file (output looking interactive
    when installing servers)


author: Jan Zeleny <jzeleny@redhat.com> 2.4.18-2
changelog:
  - changed configuration approach. Instead od slapd.conf slapd
    is using slapd.d directory now
  - fix of some issues caused by renaming of init script
  - fix of buffer overflow issue in ldif.c pointed out by new glibc


author: Jan Zeleny <jzeleny@redhat.com> 2.4.18-4
changelog:
  - buffer overflow patch from upstream
  - added /etc/openldap/slapd.d and /etc/openldap/slapd.conf.bak
    to files owned by openldap-servers


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.19-1
changelog:
  - fixed tls connection accepting when TLSVerifyClient = allow
  - /etc/openldap/ldap.conf removed from files owned by openldap-servers
  - minor changes in spec file to supress warnings
  - some changes in init script, so it would be possible to use it when
    using old configuration style
  - rebased openldap to 2.4.19
  - rebased bdb to 4.8.24


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.19-7
changelog:
  - updated usage line in init script
  - changed return code when calling init script with bad arguments


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.19-9
changelog:
  - fixed broken link /usr/sbin/slapschema (#583568)
  - removed some static libraries from openldap-devel (#583575)


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.19-10
changelog:
  - updated overlay list in config file (#586143)
  - config dir slapd.d added to package payload (#585276)
  - init script now creates only symlink, not harldink, in /var/run (#584870)


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.19-12
changelog:
  - updated man pages - only slaptest can convert configuration schema
    (#584787)
  - openldap compiled with -fno-strict-aliasing (#596193)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-4
changelog:
  - rebase to 2.4.23 (Fedora 14) (#644077)
  - uses Mozilla NSS instead of OpenSSL for TLS/SSL
  - added LDIF (ldif.h) to the public API
  - removed embeded Berkeley DB
  - removed autofs schema (use up-to-date version from autofs package instead)
  - removed compat-openldap subpackage (use separate package instead)
  - fixes: ldapsearch -Z hangs server if starttls fails (#652823)
  - fixes: improve SSL/TLS log messages (#652819)
  - fixes: crash when TLS_CACERTDIR contains a subdirectory (#652817)
  - fixes: TLS_CACERTDIR takes precedence over TLS_CACERT (#652816)
  - fixes: openldap should ignore files not in the openssl c_hash format in cacertdir (#652814)
  - fixes: slapd init script gets stuck in an infinite loop (#644399)
  - fixes: Remove lastmod.la from default slapd.conf.bak (#630637)
  - fixes: Mozilla NSS - delay token auth until needed (#616558)
  - fixes: Mozilla NSS - support use of self signed CA certs as server certs (#616554)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-5
changelog:
  - initscript: slaptest with '-u' to skip database opening (#613966)
  - removed slurpd options from sysconfig/ldap
  - fix: verification of self issued certificates (#667795)
  - fix: move libraries from /usr/lib to /lib (#548475)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-7
changelog:
  - fix: some server certificates refused with inadequate type error (#669846)
  - fix: default encryption strength dropped in switch to using NSS (#669845)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-10
changelog:
  - fix: add symlinks for libraries moved in 2.4.23-5 to allow building
    packages which require these libraries in the old location (#678105)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-11
changelog:
  - fix: CVE-2011-1024 ppolicy forwarded bind failure messages cause success
  - fix: CVE-2011-1025 rootpw is not verified for ndb backend
  - fix: openldap startup script ignores ulimit settings (#679356)
  - fix: add symlinks into /usr/lib*/ (#680139)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-13
changelog:
  - fix update: openldap can't use TLS after a fork() (#671553)
  - fix: possible NULL pointer dereferences in NSS non-blocking patch (#684035)
  - fix: move libldif to /lib for consistency (#548475)
  - fix: openldap-servers upgrade hangs or do not upgrade the database (#685119)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-14
changelog:
  - fix update: openldap startup script ignores ulimit settings (#679356)
  - fix update: openldap-servers upgrade hangs or do not upgrade the database (#685119)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-15
changelog:
  - fix: rpm -V fail when upgrading with openldap-devel installed (#693716)
    (remove devel *.so symlinks from /lib and leave them in /usr/lib)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-16
changelog:
  - fix: memleak in tlsm_auth_cert_handler (#717738)
  - fix: segmentation fault of client tool when LDIF input file is not terminated
    by a new line character (#698921)
  - fix: segmentation fault of client tool when input line in LDIF file
    is splitted but indented incorrectly (#701227)
  - fix: server scriptlets require initscripts package (#712358)
  - enable ldapi:/// interface by default
  - set cn=config management ACLs for root user, SASL external schema (#712494)
  - fix: ldapsearch fails if no CA certificate is available (#713525)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-17
changelog:
  - fix: strict aliasing warnings during package build (#723487)
  - add partial RELRO support for libraries (#723999)
  - fix: incorrect behavior of allow/try options of VerifyCert and TLS_REQCERT (#729095)
  - fix: memleak - free the return of tlsm_find_and_verify_cert_key (#729087)
  - fix: TLS_REQCERT=never ignored when the certificate is expired (#722959)
  - fix: matching wildcard hostnames in certificate Subject field does not work (#726984)
  - fix: OpenLDAP server segfaults when using back-sql (#727533)
  - fix: conversion of constraint overlay settings to cn=config is incorrect (#722923)
  - fix: DDS overlay tolerance parametr doesn't function and breakes default TTL (#723514)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-18
changelog:
  - fix: overlay refint option refint_nothing doesn't function correctly (#725479)
  - fix: Unwanted slash printed when installing openldap-servers (#732001)
  - manpage fix: TLS options in documentation are not valid for MozNSS (#684810)
  - fix: NSS_Init* functions are not thread safe (#731168)
  - manpage fix: errors in manual page slapo-unique (#723521) 
  - new feature: honor priority/weight with ldap_domain2hostlist (#730311)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-20
changelog:
  - new feature update: honor priority/weight with ldap_domain2hostlist (#730311)
  - fix regression: openldap built without tcp_wrappers (#742592)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-21
changelog:
  - fix: ldapsearch crashes with invalid parameters (#743781)
  - fix: replication (syncrepl) with TLS causes segfault (#783445)
  - fix: openldap server in MirrorMode sometimes fails to resync via syncrepl (#784211)
  - use portreserve to reserve LDAPS port (636/tcp+udp) (#790687)
  - fix: missing options in manual pages of client tools (#745470)
  - fix: SASL_NOCANON option missing in ldap.conf manual page (#732916)
  - fix: slapd segfaults when certificate key cannot be loaded (#796808)
  - Jan Synáček <jsynacek@redhat.com>
    + fix: overlay constraint with count option work bad with modify operation (#742163)
    + fix: Default SSL certificate bundle is not found by openldap library (#742023)
    + fix: Duplicate close() calls in OpenLDAP (#784203)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-23
changelog:
  - security fix: CVE-2012-1164: assertion failure by processing search queries
    requesting only attributes for particular entry (#813162)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-24
changelog:
  - fix update: Default SSL certificate bundle is not found by openldap library (#742023)
  - fix: memberof overlay on the frontend database causes server segfault (#730745)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-26
changelog:
  - fix: MozNSS CA cert dir does not work together with PEM CA cert file (#818844)
  - fix: memory leak: def_urlpre is not freed (#816168)
  - fix update: Default SSL certificate bundle is not found by openldap library (#742023)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-28
changelog:
  - CVE-2012-2668 (#825875)
    + cipher suite selection by name can be ignored
    + default cipher suite is always selected


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-29
changelog:
  - fix: invalid order of TLS shutdown operations (#818572)
  - fix: TLS error messages overwriting in tlsm_verify_cert() (#828787)
  - fix: reading pin from file can make all TLS connections hang (#829319)
  - fix: replication with TLS does not work (#707599)
  - fix: some TLS ciphers cannot be enabled (#852339)
  - fix: connection hangs after fallback to second server when certificate hostname verification fails (#843056)
  - fix: not all certificates in OpenSSL compatible CA certificate directory format are loaded (#811468)
  - fix: MozNSS certificate database in SQL format cannot be used (#857390)
  - fix: libldap does not load PEM certificate if certdb is used as TLS_CACERTDIR (#859858)
  - fix: do not send IPv6 DNS queries when IPv6 is disabled on the host (#835012)
  - fix: modification of olcSyncrepl attribute takes server out of MirrorMode (#821848)


author: Bernhard Rosenkrdnzer <bero@redhat.de>
changelog:
  - inital packaging
  - changes from base:
    - Move /usr/local/ssl to /usr/share/ssl for FHS compliance
    - handle RPM_OPT_FLAGS


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.5a, modified for U.S.
  - add perl as a build-time requirement
  - move certificate makefile to another package
  - disable RC5, IDEA, RSA support
  - remove optimizations for now


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - byte-compile python extensions without the build-root
  - adjust the makefile to not remove temporary files (like .key files when
    building .csr files) by marking them as .PRECIOUS


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove -Wa,* and -m* compiler flags from the default Configure file (#20656)
  - add the CA.pl man page to the perl subpackage


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - disable some inline assembly, which on x86 is Pentium-specific
  - re-enable MD2 (see http://www.ietf.org/ietf/IPR/RSA-MD-all)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - re-disable MD2 -- the EVP_MD_CTX structure would grow from 100 to 152
    bytes or so, causing EVP_DigestInit() to zero out stack variables in
    apps built against a version of the library without it


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.6
  - enable MD2
  - use the libcrypto.so and libssl.so targets to build shared libs with
  - bump the soversion to 1 because we're no longer compatible with any of
    the various 0.9.5a packages circulating around, which provide lib*.so.0


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.6a
  - use the build-shared target to build shared libraries
  - bump the soversion to 2 because we're no longer compatible with
    our 0.9.5a packages or our 0.9.6 packages
  - drop the patch for making rsatest a no-op when rsa null support is used
  - put all man pages into <section>ssl instead of <section>
  - break the m2crypto modules into a separate package


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add a script for creating dummy certificates
  - move man pages from %{_mandir}/man?/foo.?ssl to %{_mandir}/man?ssl/foo.?


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-3
changelog:
  - add patches for AEP hardware support
  - add patch to keep trying when we fail to load a cert from a file and
    there are more in the file
  - add missing prototype for ENGINE_ubsec() in engine_int.h


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-4
changelog:
  - move man pages back to %{_mandir}/man?/foo.?ssl from
    %{_mandir}/man?ssl/foo.?
  - add an [ engine ] section to the default configuration file


author: Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-1
changelog:
  - upgrade to 0.9.6c
  - bump BuildArch to i686 and enable assembler on all platforms
  - synchronise with shrimpy and rawhide
  - bump soversion to 3


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-30
changelog:
  - add configuration stanza for x86_64 and use it on x86_64
  - build for linux-ppc on ppc
  - start running the self-tests again


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7-6
changelog:
  - EVP_DecryptInit should call EVP_CipherInit() instead of EVP_CipherInit_ex(),
    to get the right behavior when passed uninitialized context structures
    (#83766)
  - build with -mcpu=ev5 on alpha family (#83828)


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7-8
changelog:
  - add fix to guard against attempts to allocate negative amounts of memory
  - add patch for CAN-2003-0078, fixing a timing attack


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-5
changelog:
  - add patch to harden against Klima-Pokorny-Rosa extension of Bleichenbacher's
    attack (CAN-2003-0131)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - backport fix for engine-used-for-everything from 0.9.7b
  - backport fix for prng not being seeded causing problems, also from 0.9.7b
  - add a check at build-time to ensure that RSA is thread-safe
  - keep perlpath from stomping on the libica configure scripts


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add security fixes for protocol parsing bugs (CAN-2003-0543, CAN-2003-0544)
    and heap corruption (CAN-2003-0545)
  - update RHNS-CA-CERT files
  - ease back on the number of threads used in the threading test


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22
changelog:
  - add -Wa,--noexecstack to RPM_OPT_FLAGS so that assembled modules get tagged
    as not needing executable stacks


author: Phil Knirsch <pknirsch@redhat.com> 0.9.7a-24
changelog:
  - Use /dev/urandom instead of PRNG for libica.
  - Apply libica-1.3.5 fix for /dev/urandom in icalinux.c
  - Use latest ICA engine patch from IBM.


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-25
changelog:
  - add dependency on zlib-devel for the -devel package, which depends on zlib
    symbols because we enable zlib for libssl (#102962)


author: Joe Orton <jorton@redhat.com> 0.9.7a-27
changelog:
  - updated ca-bundle.crt: removed expired GeoTrust roots, added
    freessl.com root, removed trustcenter.de Class 0 root


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-33
changelog:
  - add an intermediate <openssl/opensslconf.h> which points to the right
    arch-specific opensslconf.h on multilib arches


author: Tomas Mraz <tmraz@redhat.com> 0.9.7e-1
changelog:
  - new upstream source, updated patches
  - added patch so we are hopefully ABI compatible with upcoming
    0.9.7f


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-1
changelog:
  - reenable optimizations on ppc64 and assembly code on ia64
  - upgrade to new upstream version (no soname bump needed)
  - disable thread test - it was testing the backport of the
    RSA blinding - no longer needed
  - added support for changing serial number to
    Makefile.certificate (#151188)
  - make ca-bundle.crt a config file (#118903)


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-2
changelog:
  - add back RC4_CHAR on ia64 and x86_64 so the ABI isn't broken
  - disable broken bignum assembly on x86_64


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-3
changelog:
  - uninitialized variable mustn't be used as input in inline
    assembly
  - reenable the x86_64 assembly again


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-4
changelog:
  - move certificates to _sysconfdir/pki/tls (#143392)
  - move CA directories to _sysconfdir/pki/CA
  - patch the CA script and the default config so it points to the
    CA directories


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-6
changelog:
  - use poll instead of select in rand (#128285)
  - fix Makefile.certificate to point to /etc/pki/tls
  - change the default string mask in ASN1 to PrintableString+UTF8String


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-7
changelog:
  - fix CAN-2005-0109 - use constant time/memory access mod_exp
    so bits of private key aren't leaked by cache eviction (#157631)
  - a few more fixes from upstream 0.9.7g


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-9
changelog:
  - add *.so.soversion as symlinks in /lib (#165264)
  - remove unpackaged symlinks (#159595)
  - fixes from upstream (constant time fixes for DSA,
    bn assembler div on ppc arch, initialize memory on realloc)


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-10
changelog:
  - fix CAN-2005-2969 - remove SSL_OP_MSIE_SSLV2_RSA_PADDING which
    disables the countermeasure against man in the middle attack in SSLv2
    (#169863)
  - use sha1 as default for CA and cert requests - CAN-2005-2946 (#169803)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8a-4
changelog:
  - fix build (-lcrypto was erroneusly dropped) of the updated libica
  - updated ICA engine to 1.3.6-rc3


author: Tomas Mraz <tmraz@redhat.com> - 0.9.8a-6
changelog:
  - fix stale open handles in libica (#177155)
  - fix build if 'rand' or 'passwd' in buildroot path (#178782)
  - initialize VIA Padlock engine (#186857)


author: Tomas Mraz <tmraz@redhat.com> - 0.9.8b-1
changelog:
  - upgrade to new version, stays ABI compatible
  - there is no more linux/config.h (it was empty anyway)


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - add ipv6 support to s_client and s_server (by Jan Pazdziora) (#198737)
  - add patches for BN threadsafety, AES cache collision attack hazard fix and
    pkcs7 code memleak fix from upstream CVS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-7
changelog:
  - fix CVE-2006-2937 - mishandled error on ASN.1 parsing (#207276)
  - fix CVE-2006-2940 - parasitic public keys DoS (#207274)
  - fix CVE-2006-3738 - buffer overflow in SSL_get_shared_ciphers (#206940)
  - fix CVE-2006-4343 - sslv2 client DoS (#206940)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-13
changelog:
  - allow building on ARM architectures (#245417)
  - use reference timestamps to prevent multilib conflicts (#218064)
  - -devel package must require pkgconfig (#241031)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-14
changelog:
  - use localhost in testsuite, hopefully fixes slow build in koji
  - CVE-2007-3108 - fix side channel attack on private keys (#250577)
  - make ssl session cache id matching strict (#233599)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-16
changelog:
  - fix CVE-2007-5135 - off-by-one in SSL_get_shared_ciphers (#309801)
  - fix CVE-2007-4995 - out of order DTLS fragments buffer overflow (#321191)
  - add alpha sub-archs (#296031)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-2
changelog:
  - enable some new crypto algorithms and features
  - add some more important bug fixes from openssl CVS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-3
changelog:
  - set default paths when no explicit paths are set (#418771)
  - do not add tls extensions to client hello for SSLv3 (#422081)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-9
changelog:
  - fix CVE-2008-0891 - server name extension crash (#448492)
  - fix CVE-2008-1672 - server key exchange message omit crash (#448495)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-1
changelog:
  - new upstream version with necessary soname bump (#455753)
  - temporarily provide symlink to old soname to make it possible to rebuild
    the dependent packages in rawhide
  - add eap-fast support (#428181)
  - add possibility to disable zlib by setting
  - add fips mode support for testing purposes
  - do not null dereference on some invalid smime files
  - add buildrequires pkgconfig (#479493)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-6
changelog:
  - drop the temporary triggerpostun and symlinking in post
  - fix the pkgconfig files and drop the unnecessary buildrequires
    on pkgconfig as it is a rpmbuild dependency (#481419)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-7
changelog:
  - must also verify checksum of libssl.so in the FIPS mode
  - obtain the seed for FIPS rng directly from the kernel device
  - drop the temporary symlinks


author: Tomas Mraz <tmraz@redhat.com> 0.9.8k-1
changelog:
  - update to new upstream release (minor bug fixes, security
    fixes and machine code optimizations only)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8k-6
changelog:
  - abort if selftests failed and random number generator is polled
  - mention EVP_aes and EVP_sha2xx routines in the manpages
  - add README.FIPS
  - make CA dir absolute path (#445344)
  - change default length for RSA key generation to 2048 (#484101)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.11.beta4
changelog:
  - update to new upstream version, no soname bump needed
  - fix CVE-2009-3555 - note that the fix is bypassed if SSL_OP_ALL is used
    so the compatibility with unfixed clients is not broken. The
    protocol extension is also not final.


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.12.beta4
changelog:
  - keep the beta status in version number at 3 so we do not have to rebuild
    openssh and possibly other dependencies with too strict version check


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.13.beta4
changelog:
  - disable enforcement of the renegotiation extension on the client (#537962)
  - add fixes from the current upstream snapshot


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.17.beta4
changelog:
  - upstream fix compression handling on session resumption
  - various null checks and other small fixes from upstream
  - upstream changes for the renegotiation info according to the latest draft


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.19.beta4
changelog:
  - fix CVE-2009-4355 - leak in applications incorrectly calling
    CRYPTO_free_all_ex_data() before application exit (#546707)
  - upstream fix for future TLS protocol version handling


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.21.beta5
changelog:
  - gracefully handle zero length in assembler implementations of
    OPENSSL_cleanse (#564029)
  - do not fail in s_server if client hostname not resolvable (#561260)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-2
changelog:
  - make CA dir readable - the private keys are in private subdir (#584810)
  - a few fixes from upstream CVS
  - make X509_NAME_hash_old work in FIPS mode (#568395)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-3
changelog:
  - fix wrong ASN.1 definition of OriginatorInfo - CVE-2010-0742 (#598738)
  - fix information leak in rsa_verify_recover - CVE-2010-1633 (#598732)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-7
changelog:
  - listen on ipv6 wildcard in s_server so we accept connections
    from both ipv4 and ipv6 (#601612)
  - fix openssl speed command so it can be used in the FIPS mode
    with FIPS allowed ciphers (#619762)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-8
changelog:
  - add -x931 parameter to openssl genrsa command to use the ANSI X9.31
    key generation method
  - use FIPS-186-3 method for DSA parameter generation
  - add OPENSSL_FIPS_NON_APPROVED_MD5_ALLOW environment variable
    to allow using MD5 when the system is in the maintenance state
    even if the /proc fips flag is on
  - make openssl pkcs12 command work by default in the FIPS mode


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-15
changelog:
  - better documentation of the available digests in apps (#693858)
  - backported CHIL engine fixes (#693863)
  - allow testing build without downstream patches (#708511)
  - enable partial RELRO when linking (#723994)
  - add intelx engine with improved performance on new Intel CPUs
  - add OPENSSL_DISABLE_AES_NI environment variable which disables
    the AES-NI support (does not affect the intelx engine)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-16
changelog:
  - merge the optimizations for AES-NI, SHA1, and RC4 from the intelx
    engine to the internal implementations


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-21
changelog:
  - fix for CVE-2011-4108 & CVE-2012-0050 - DTLS plaintext recovery
    vulnerability and additional DTLS fixes (#771770)
  - fix for CVE-2011-4576 - uninitialized SSL 3.0 padding (#771775)
  - fix for CVE-2011-4577 - possible DoS through malformed RFC 3779 data (#771778)
  - fix for CVE-2011-4619 - SGC restart DoS attack (#771780)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-23
changelog:
  - fix problem with the SGC restart patch that might terminate handshake
    incorrectly
  - fix for CVE-2012-0884 - MMA weakness in CMS and PKCS#7 code (#802725)
  - fix for CVE-2012-1165 - NULL read dereference on bad MIME headers (#802489)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-25
changelog:
  - fix for CVE-2012-2333 - improper checking for record length in DTLS (#820686)
  - properly initialize tkeylen in the CVE-2012-0884 fix


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-26
changelog:
  - use PKCS#8 when writing private keys in FIPS mode as the old
    PEM encryption mode is not FIPS compatible (#812348)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-27
changelog:
  - fix sslrand(1) and sslpasswd(1) reference in openssl(1) manpage (#841645)
  - drop superfluous lib64 fixup in pkgconfig .pc files (#770872)
  - force BIO_accept_new(*:<port-number>) to listen on IPv4


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-28
changelog:
  - fix for CVE-2013-0169 - SSL/TLS CBC timing attack (#907589)
  - fix for CVE-2013-0166 - DoS in OCSP signatures checking (#908052)
  - enable compression only if explicitly asked for or OPENSSL_DEFAULT_ZLIB
    environment variable is set (fixes CVE-2012-4929 #857051)
  - use __secure_getenv() everywhere instead of getenv() (#839735)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-15
changelog:
  - make DTLS1 work in FIPS mode
  - avoid RSA and DSA 512 bits and Whirlpool in 'openssl speed' in FIPS mode


author: Bill Nottingham <notting@redhat.com> - 2.1.4-6
changelog:
  - don't run by default
  - don't create/chmod directories in %post, just include them with the
    right perms
  - fix debuginfo
  - fix docs


author: Harald Hoyer <harald@redhat.com> - 2.1.5-1
changelog:
  - added selinux patch from Daniel Walsh
  - initscript now uses translated strings
  - version 2.1.5 with minor fixes


author: Harald Hoyer <harald@redhat.com> - 2.3.0-1
changelog:
  - version 2.3.0
  - reimported specfile
  - PIEd openswan
  - cleaned up initial config files and added include directives
    for easy config drop in


author: Harald Hoyer <harald@redhat.com> - 2.3.1-3
changelog:
  - added openswan-2.3.1-nat_t_aggr.patch
  - added openswan-2.3.1-iproute2.patch
  - added openswan-2.3.1-cisco.patch
  - NAT-T/XAUTH/AGGR-MODE is now possible with a Cisco VPN 3000


author: Harald Hoyer <harald@redhat.com> - 2.4.4-1.1
changelog:
  - version 2.4.4
  - fixes NISCC Vulnerability Advisory 273756/NISCC/ISAKMP
  - fixes NISCC Advisory 3756/NISCC/ISAKMP


author: Steve Conklin <sconklin@redhat.com> - 2.6.03-3
changelog:
  - Removed _smp_mflags macro from from the spec file build section
  - Added BuildRequires for xmlto
  - Changed License from GPL to GPL+
  - removed klips ifdefs from spec file
  - Added patch to move example configs to doc dir
  - Added a patch to make the link to init script relative, 
    for chroot environments


author: Steve Conklin <sconklin@redhat.com> - 2.6.03-4
changelog:
  - Removed use of xmlto and the BuildRequires
  - moved scripts from /usr/lib to /usr/libexec
  - removed man3 pages for libopenswan functions (we don't deliver)


author: Steve Conklin <sconklin@redhat.com> - 2.6.03-6
changelog:
  - Moved everything else out of /usr/lib
  - Added tmraz's patch to remove extra slashes in makefile
  - Removed macros from changelog entries


author: Steve Conklin <sconklin@redhat.com> - 2.6.03-8
changelog:
  Related: rhbz#235224
  - rpmdiff spotted these:
  - Cleaned out unused man page
  - patch error in barf script


author: Steve Conklin <sconklin@redhat.com> - 2.6.08-1
changelog:
  - Moved to latest upstream
  - Replaced the init script source file with a patch to the upstream one
  -    (no functional changes to the init script)
  - Added protostack=netkey to ipsec.conf
  - New patch to include definition of HOST_NAME_MAX


author: Avesh Agarwal <avagarwa@redhat.com> - 2.6.18-2
changelog:
  - Addressed some issues related to buzilla 447419
  - Added xmlto and bind-devel to BuildRequires 
  - Removed the patch openswan-2.6-noxmlto.patch
  - Removed the command "rm -rf programs/readwriteconf" from the spec file
    as readwriteconf is used with "make check" for debugging purposes.
  - Removed USE_LWRES=false from the spec file as it has been 
    obsolete in upstream (using bind-devel instead)


author: Avesh Agarwal <avagarwa@redhat.com> - 2.6.21-1
changelog:
  - new upstream release
  - Fix for CVE-2009-0790 DPD crasher
  - Fix remaining SADB_EXT_MAX -> K_SADB_EXT_MAX entries
  - Fix ipsec setup --status not showing amount of tunnels with netkey


author: Avesh Agarwal <avagarwa@redhat.com> - 2.6.21-2
changelog:
  - Applied patch to support NSS, currently disabled due to
    dependency on rh bz #491693
  - The patch also supports fips check integrity 
     (requires fipscheck-devel library)


author: Avesh Agarwal <avagarwa@redhat.com> - 2.6.21-3
changelog:
  - Updated the Openswan-NSS porting to enable nss by default
  - The patch includes README.nss for information about NSS usage


author: Avesh Agarwal <avagarwa@redhat.com> - 2.6.21-4
changelog:
  - Updated the Openswan-NSS porting to enable nss and fipscheck by default
  - fipscheck requires fipscheck-devel library


author: Avesh Agarwal <avagarwa@redhat.com> - 2.6.21-5
changelog:
  - Added support for using PSK with NSS
  - Fixed several warnings and undid unnecessary comments
  - Updated README.nss with an example configuration
  - Fixed Openswan ASN.1 parser vulnerability (CVE-2009-2185)


author: Avesh Agarwal <avagarwa@redhat.com> - 2.6.22-1
changelog:
  - New upstream release
  - Added support for using PSK with NSS
  - Fixed several warnings and undid unnecessary debug messages
  - Updated README.nss with an example configuration
  - Moved README.nss to openswan/doc/
  - Improved FIPS integrity check functionality


author: Avesh Agarwal <avagarwa@redhat.com> - 2.6.23-1
changelog:
  - New upstream release
  - Supports smartcards now
  - Supports PSK with NSS
  - Supports libcap-ng for lowering capabilities of pluto process 
  - Updated README.nss


author: Avesh Agarwal <avagarwa@redhat.com> - 2.6.24-1
changelog:
  - New upstream release
  - Cisco interop patches
  - Improved init script
  - Fix to allow ";" in the ike/esp parameters
  - Fix to unset IKEv2 Critical flag for payloads defined in RFC 4306
  - Fix to Zeroize ISAKMP and IPsec SA's when in FIPS mode
  - Fix to the issue where Some programs were installed
    twice causing .old files
  - lwdns.req.log moved from /var/tmp/ to /var/run/pluto/ .
    This is to avoid an SElinux AVC Denial
  - Fix for the issueo where ipsec help shows the list twice
  - Fix for compile time warnings


author: Avesh Agarwal <avagarwa@redhat.com> - 2.6.24-2
changelog:
  - Modified summary in spec file
  - Replaced buildroot with RPM_BUILD_ROOT in spec file
  - Included html files in the doc package
  - Patch for disabling openswan startup at the system
    boot by default


author: Avesh Agarwal <avagarwa@redhat.com> - 2.6.24-3
changelog:
  Resolves: #568355 Implementation of new Diffie-Hellman groups 
                    described in RFC 5114
  Resolves: #568493 Pluto's child process can not add routes
  Resolves: #568648 some subcommand doesn't work
  Resolves: #568652 the transport mode doesn't work
  Resolves: #574833 Openswan client can not interop with 
                    Cisco VPN servers
  Resolves: #574839 ImplicitDSOLinking
  Resolves: #574841 Openswan Implementation issue related to 
                    hardcoded length of hash algorithms


author: Avesh Agarwal <avagarwa@redhat.com> - 2.6.24-4
changelog:
  Resolves: #579629
  Resolves: #584224
  Resolves: #586420
  Resolves: #592630
  Resolves: #594767
  Resolves: #579747
  Resolves: #587669


author: Avesh Agarwal <avagarwa@redhat.com> - 2.6.32-1
changelog:
  Resolves: 642722
  Resolves: 642724
  Resolves: 646718
  Resolves: 628879
  Resolves: 621790
  Resolves: 668785
  Resolves: 658253
  Resolves: 658121


author: Avesh Agarwal <avagarwa@redhat.com> - 2.6.32-7
changelog:
  Resolves: #737973
  Resolves: #737975
  Resolves: #737976
  Resolves: #738385
  Resolves: #742632
  Resolves: #742070


author: Avesh Agarwal <avagarwa@redhat.com> - 2.6.32-11
changelog:
  Resolves: #771464
  Resolves: #771465
  Resolves: #771466
  Resolves: #771467
  Resolves: #771473
  Resolves: #771475


author: Paul Wouters <pwouters@redhat.com> - 2.6.32-21
changelog:
  - Resolves: rhbz#975550 ikev2 md5 hash results in incorrect policy
  - Resolves: rhbz#985596 openswan does not allow SHA2 auth algorithms under FIPS mode 
  - Resolves: rhbz#881914 openswan doesn't support SHA2 certificates
  - Resolves: rhbz#954249 barf and look should not cause loading of kernel modules
  - Resolves: rhbz#954249 barf and look should not cause loading of kernel modules
  - Resolves: rhbz#960235 CVE-2013-2053: remote buffer overflow in atodn()
  - Resolves: rhbz#963833 Abort pluto on crypto failure to prevent plaintext / nonce leak
  - Resolves: rhbz#771612 ipsec barf should not grep sparse file
  - Resolves: rhbz#841325 leftmodecfgclient=no causes rekey failure [Avesh]
  - Resolves: rhbz#848132 dpdaction=restart can cause full phase1 timeout after DPD [Avesh]
  - Resolves: rhbz#880004 Backported libreswan IKE fragmentation support 
  - Resolves: rhbz#908476 Backported libreswan INITIAL-CONTACT Notify support
  - Resolves: rhbz#796683 Backported libreswan USERCOMPILE with -fno-strict-aliasing
  - Resolves: rhbz#959568 Backported libreswan nat_keepalive=yes|no (default yes) option
  - Resolves: rhbz#916743 Backported libreswan control transmission delay timing
  - Resolves: rhbz#959566 Backported libreswan ikeping compile warnings
  - Resolves: rhbz#957400 Openswan did not load aesni_intel kernel module
  - Resolves: rhbz#960171 Initial loading of CRL always fails on pluto startup [Matt Rogers]
  - Resolves: rhbz#958969 Crl signature verification failure in when input signature is stripped of all leading zeros
  - Resolves: rhbz#868986 Fix for RDN values containing a comma [Matt Rogers]
  - Resolves: rhbz#747966 Missing else keyword


author: Paul Wouters <pwouters@redhat.com> - 2.6.32-23
changelog:
  - Resolves: rhbz#998587 underspecific build requires (of nss)
  - Resolves: rhbz#1002312 IKEv2 skeyseed calculation only succeeds because of unspecified compiler behaviour
  - Resolves: rhbz#1002633 openswan needs -fips subpackage that would provide the FIPS hmac files


author: Arnaldo Carvalho de Melo <acme@redhat.com> - 0.9.3-1
changelog:
  - New upstream release
  - Fixes the folowing bugzilla.redhat.com tickets:
  - 563355 error in tuna --help output
  - 574950 cannot use cpu ranges in the tuna GUI
  - 559770 tuna backtrace when moving threads
  - 563352 tuna backtrace when no thread list is given for --priority
  - 563350 tuna backtrace when scheduler is mis-typed.


author: Stef Walter <stefw@redhat.com> - 0.16.1-1
changelog:
  - Update to upstream version 0.16.1
  - Setup source directories as appropriate for Shared System Certificates feature


author: Stef Walter <stefw@redhat.com> - 0.16.3-1
changelog:
  - Update to upstream version 0.16.3
  - Split out system trust module into its own package.
  - p11-kit-trust provides an alternative to an nss module


author: Stef Walter <stefw@redhat.com> - 0.17.5-1
changelog:
  - Make 'p11-kit extract-trust' call update-ca-trust
  - Work around 32-bit oveflow of certificate dates
  - Build fixes


author: Stef Walter <stefw@redhat.com> - 0.18.0-1
changelog:
  - Update to new upstream stable release
  - Various logging tweaks (#928914, #928750)
  - Make the 'p11-kit extract-trust' explicitly reject
    additional arguments


author: Stef Walter <stefw@redhat.com> - 0.18.3-1
changelog:
  - Update to new upstream stable release
  - Fix intermittent firefox cert validation issues (#960230)
  - Include the manual pages in the package


author: Stef Walter <stefw@redhat.com> - 0.18.3-2
changelog:
  - Don't install libnssckbi.so alternatives in the package.
    On RHEL 6 this is done by the update-ca-trust script.


author: Stef Walter <stefw@redhat.com> - 0.18.4-1
changelog:
  - Remove alternative on package removal
  - Update to 0.18.4 with minor p11-kit command fixes
  - Fix arguments to extract-trust p11-kit command


author: Stef Walter <stefw@redhat.com> - 0.18.4-2
changelog:
  - Fix inconsistency issues when multilib packages are installed
  - Add 'p11-kit redhat-setup-trust status' command


author: Stef Walter <stefw@redhat.com> - 0.18.5-1
changelog:
  - Update to new upstream point release
  - Use freebl for hash algorithms (#983384)
  - Don't load configs in home dir when setuid or setgid (#985816)
  - Use $TMPDIR instead of $TEMP while testing (#985017)
  - Use $XDG_DATA_HOME for user pkcs11 module configuration
  - Open files and fds with O_CLOEXEC (#984986)
  - Abort initialization if critical module fails to load (#985023)
  - Don't use thread-unsafe: strerror, getpwuid (#985481)
  - Fix p11_kit_space_strlen() result when empty string (#985416)


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.4-2
changelog:
  - Reference authors from the project AUTHORS file instead of listing in description
  - Change Source0 to reference the project's Mercurial repo
  - Cleaned up the summaries and descriptions
  - Incorporate the results of Fedora package self-review


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.4-3
changelog:
  - Include an AUTHORS and license file in each package
  - Change the library package name to pacemaker-libs to be more
    Fedora compliant
  - Remove execute permissions from xml related files
  - Reference the new cluster-glue devel package name
  - Update the tarball from upstream to version c9120a53a6ae
    + High: PE: Only prevent migration if the clone dependancy is stopping/starting on the target node
    + High: PE: Bug 2160 - Dont shuffle clones due to colocation
    + High: PE: New implementation of the resource migration (not stop/start) logic
    + Medium: Tools: crm_resource - Prevent use-of-NULL by requiring a resource name for the -A and -a options
    + Medium: PE: Prevent use-of-NULL in find_first_action()
    + Low: Build: Include licensing files


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-0.4.c9120a53a6ae.hg
changelog:
  - Incorporate the feedback from the cluster-glue review
  - Realistically, the version is a 1.0.5 pre-release
  - Use the global directive instead of define for variables
  - Use the haclient/hacluster group/user instead of daemon
  - Use the _configure macro
  - Fix install dependancies


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-1
changelog:
  - Add dependancy on resource-agents
  - Use the version of the configure macro that supplies --prefix, --libdir, etc
  - Update the tarball from upstream to version 462f1569a437 (Pacemaker 1.0.5 final)
    + High: Tools: crm_resource - Advertise --move instead of --migrate
    + Medium: Extra: New node connectivity RA that uses system ping and attrd_updater
    + Medium: crmd: Note that dc-deadtime can be used to mask the brokeness of some switches


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-2
changelog:
  - Add versioned perl dependancy as specified by
      https://fedoraproject.org/wiki/Packaging/Perl#Packages_that_link_to_libperl
  - No longer remove RPATH data, it prevents us finding libperl.so and no other
    libraries were being hardcoded
  - Compile in support for heartbeat
  - Conditionally add heartbeat-devel and corosynclib-devel to the -devel requirements
    depending on which stacks are supported


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-3
changelog:
  - Update the tarball from upstream to version 38cd629e5c3c
    + High: Core: Bug lf#2169 - Allow dtd/schema validation to be disabled
    + High: PE: Bug lf#2106 - Not all anonymous clone children are restarted after configuration change
    + High: PE: Bug lf#2170 - stop-all-resources option had no effect
    + High: PE: Bug lf#2171 - Prevent groups from starting if they depend on a complex resource which can't
    + High: PE: Disable resource management if stonith-enabled=true and no stonith resources are defined
    + High: PE: Don't include master score if it would prevent allocation
    + High: ais: Avoid excessive load by checking for dead children every 1s (instead of 100ms)
    + High: ais: Bug rh#525589 - Prevent shutdown deadlocks when running on CoroSync
    + High: ais: Gracefully handle changes to the AIS nodeid
    + High: crmd: Bug bnc#527530 - Wait for the transition to complete before leaving S_TRANSITION_ENGINE
    + High: crmd: Prevent use-after-free with LOG_DEBUG_3
    + Medium: xml: Mask the "symmetrical" attribute on rsc_colocation constraints (bnc#540672)
    + Medium (bnc#520707): Tools: crm: new templates ocfs2 and clvm
    + Medium: Build: Invert the disable ais/heartbeat logic so that --without (ais|heartbeat) is available to rpmbuild
    + Medium: PE: Bug lf#2178 - Indicate unmanaged clones
    + Medium: PE: Bug lf#2180 - Include node information for all failed ops
    + Medium: PE: Bug lf#2189 - Incorrect error message when unpacking simple ordering constraint
    + Medium: PE: Correctly log resources that would like to start but can't
    + Medium: PE: Stop ptest from logging to syslog
    + Medium: ais: Include version details in plugin name
    + Medium: crmd: Requery the resource metadata after every start operation


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-4
changelog:
  - Include the fixes from CoroSync integration testing
  - Move the resource templates - they're not documentation
  - Ensure documentation is placed in a standard location
  - Exclude documentation that is included elsewhere in the package

  - Update the tarball from upstream to version ee19d8e83c2a
    + High: cib: Correctly clean up when both plaintext and tls remote ports are requested
    + High: PE: Bug bnc#515172 - Provide better defaults for lt(e) and gt(e) comparisions
    + High: PE: Bug lf#2197 - Allow master instances placemaker to be influenced by colocation constraints
    + High: PE: Make sure promote/demote pseudo actions are created correctly
    + High: PE: Prevent target-role from promoting more than master-max instances
    + High: ais: Bug lf#2199 - Prevent expected-quorum-votes from being populated with garbage
    + High: ais: Prevent deadlock - dont try to release IPC message if the connection failed
    + High: cib: For validation errors, send back the full CIB so the client can display the errors
    + High: cib: Prevent use-after-free for remote plaintext connections
    + High: crmd: Bug lf#2201 - Prevent use-of-NULL when running heartbeat


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-6
changelog:
  - Let snmp automatically pull in lm_sensors-devel if required
    and available on that arch (its not on s390x)


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.0-0.1-00d9bcac8775.hg
changelog:
  - Related: rhbz#rhbz#543948
  - Update the tarball from upstream to version 00d9bcac8775
    + High: PE: Bug 2213 - Ensure groups process location constraints so that clone-node-max works for cloned groups
    + High: PE: Bug lf#2153 - Update regression tests
    + High: PE: Bug lf#2153 - non-clones shouldn't restart when clones stop/start on other nodes
    + High: PE: Bug lf#2209 - Clone ordering should be able to prevent startup of dependant clones
    + High: PE: Bug lf#2216 - Correctly identify the state of anonymous clones when deciding when to probe
    + High: PE: Bug lf#2225 - Operations that require fencing should wait for 'stonith_complete' not 'all_stopped'.
    + High: PE: Bug lf#2225 - Prevent clone peers from stopping while another is instance is (potentially) being fenced
    + High: PE: Correctly anti-colocate with a group
    + High: PE: Correctly unpack ordering constraints for resource sets to avoid graph loops
    + High: Replace stonithd with the new fencing subsystem
    + High: cib: Ensure the loop searching for a remote login message terminates
    + High: cib: Finally fix reliability of receiving large messages over remote plaintext connections
    + High: cib: Fix remote notifications
    + High: cib: For remote connections, default to CRM_DAEMON_USER since thats the only one that the cib can validate the password for using PAM
    + High: cib: Remote plaintext - Retry sending parts of the message that didn't fit the first time
    + Medium: PE: Bug lf#2206 - rsc_order constraints always use score at the top level
    + Medium: PE: Provide a default action for resource-set ordering
    + Medium: PE: Silently fix requires=fencing for stonith resources so that it can be set in op_defaults
    + Medium: ais: Some clients such as gfs_controld want a cluster name, allow one to be specified in corosync.conf
    + Medium: cib: Create valid notification control messages
    + Medium: cib: Indicate where the remote connection came from
    + Medium: cib: Send password prompt to stderr so that stdout can be redirected
    + Medium: extra: Add the daemon parameter to the controld metadata
    + Medium: fencing: Re-engineer the stonith daemon to support RHCS agents
    + Medium: tools: Make crm_mon functional with remote connections
    + Medium: xml: Bug bnc#552713 - Treat node unames as text fields not IDs
    + Medium: xml: Bug lf#2215 - Create an always-true expression for empty rules when upgrading from 0.6


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.0-1
changelog:
  - Related: rhbz#543948
  - Update the tarball from upstream to version 07ab245be519
    + High: crmd: Always connect to stonith
    + High: crmd: Ensure batch-limit is correctly enforced
    + High: crmd: Ensure we have the latest status after a transition abort
    + High: Fencing: Overhaul the fencing daemon
    + High: PE: Bug lf#2153 - non-clones shouldn't restart when clones stop/start on other nodes - improved
    + Medium: PE: Allow resource sets to be reused between ordering and colocation constraints
    + Medium: PE: Implement serializing order constraints that dont cause restarts or inhibit migration
    + Medium: PE: Include node attributes for the node to be fenced
    + Medium: PE: Make crm_simulate a full replacement for ptest
    + Medium: PE: Only complain about target-role=master for non m/s resources
    + Medium: PE: Prevent non-multistate resources from being promoted through target-role
    + Medium: PE: Simplify the rsc_order syntax - don't make funky inferences based on score
    + Medium: PE: Support serialized sets of resources
    + Medium: Tools: Bug lf#2286 - Allow the shell to accept template parameters on the command line
    + Medium: Tools: Bug lf#2307 - Provide a way to determin the nodeid of past cluster members
    + Medium: Tools: crm: add update method to template apply (LF 2289)
    + Medium: Tools: crm: direct RA interface for stonith class resource agents (LF 2270)
    + Medium: Tools: crm: don't remove sets which contain id-ref attribute (LF 2304)
    + Medium: Tools: crm: exclude locations when testing for pathological constraints (LF 2300)
    + Medium: Tools: crm: fix exit code on single shot commands
    + Medium: Tools: crm: fix node delete (LF 2305)
    + Medium: Tools: crm: implement -F (--force) option
    + Medium: Tools: crm: rename status to cibstatus (LF 2236)
    + Medium: Tools: crm: stay in crm if user specified level only (LF 2286)


