# changelog

author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-568.el6]
changelog:
  - [base] reduce boot delay on large memory systems (Seth Jennings) [1221389]
  - [md] dm: run queue on re-queue (Mike Snitzer) [1225158]
  - [fs] take i_mutex during prepare_binprm for set<u,g>id executables (Mateusz Guzik) [1216269] {CVE-2015-3339}
  - [netdrv] i40e: Make sure to be in VEB mode if SRIOV is enabled at probe (Stefan Assmann) [1206000]
  - [netdrv] i40e: start up in VEPA mode by default (Stefan Assmann) [1206000]
  - [netdrv] e1000e: Bump the version to 3.2.5 (John Greene) [1211531]
  - [netdrv] e1000e: fix unit hang during loopback test (John Greene) [1211531]
  - [netdrv] e1000e: fix systim issues (John Greene) [1211531]
  - [netdrv] e1000e: fix legacy interrupt handling in i219 (John Greene) [1211531]
  - [netdrv] e1000e: fix flush_desc_ring implementation (John Greene) [1211531]
  - [netdrv] e1000e: fix logical error in flush_desc_rings (John Greene) [1211531]
  - [netdrv] e1000e: remove call to do_div and sign mismatch warning (John Greene) [1211531]
  - [netdrv] e1000e: i219 execute unit hang fix on every reset or power state transition (John Greene) [1211531]
  - [netdrv] e1000e: i219 fix unit hang on reset and runtime D3 (John Greene) [1211531]
  - [netdrv] e1000e: fix call to do_div to use u64 arg (John Greene) [1211531]
  - [netdrv] e1000e: Cleanup handling of VLAN_HLEN as a part of max frame size (John Greene) [1211531]
  - [netdrv] e1000e: Correctly include VLAN_HLEN when changing interface MTU (John Greene) [1211531]
  - [netdrv] e1000e: call netif_carrier_off early on down (John Greene) [1211531]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-569.el6]
changelog:
  - [gpu] drm/radeon: fix freeze for laptop with Turks/Thames GPU (Jerome Glisse) [1213297]
  - [md] dm: fix casting bug in dm_merge_bvec (Mike Snitzer) [1226453]
  - [fs] nfs: Send the size attribute on open(O_TRUNC) (Benjamin Coddington) [1208065]
  - [net] inet: fix processing of ICMP frag_needed messages (Sabrina Dubroca) [1210321]
  - [net] tcp: double default TSQ output bytes limit (Hannes Frederic Sowa) [1140590]
  - [hv] hv_balloon: correctly handle num_pages>INT_MAX case (Vitaly Kuznetsov) [1006234]
  - [hv] hv_balloon: correctly handle val.freeram<num_pages case (Vitaly Kuznetsov) [1006234]
  - [hv] hv_balloon: survive ballooning request with num_pages=0 (Vitaly Kuznetsov) [1006234]
  - [hv] hv_balloon: eliminate jumps in piecewiese linear floor function (Vitaly Kuznetsov) [1006234]
  - [hv] hv_balloon: do not online pages in offline blocks (Vitaly Kuznetsov) [1006234]
  - [hv] hv_balloon: don't lose memory when onlining order is not natural (Vitaly Kuznetsov) [1006234]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-570.el6]
changelog:
  - [block] fix ext_dev_lock lockdep report (Jeff Moyer) [1230927]
  - [md] Revert "md dm: run queue on re-queue" (Mike Snitzer) [1232007]
  - [firmware] another cxgb4 firmware load fixup (Sai Vemuri) [1189255]
  - [char] tty: Don't protect atomic operation with mutex (Aristeu Rozanski) [1184182]
  - [edac] i5100 add 6 ranks per channel (Aristeu Rozanski) [1171333]
  - [edac] i5100 clean controller to channel terms (Aristeu Rozanski) [1171333]
  - [crypto] rng - Remove krng (Herbert Xu) [1226418]
  - [crypto] drbg - Add stdrng alias and increase priority (Herbert Xu) [1226418]
  - [crypto] seqiv - Move IV seeding into init function (Herbert Xu) [1226418]
  - [crypto] eseqiv - Move IV seeding into init function (Herbert Xu) [1226418]
  - [crypto] chainiv - Move IV seeding into init function (Herbert Xu) [1226418]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-571.el6]
changelog:
  - [netdrv] bnx2x: Move statistics implementation into semaphores (Michal Schmidt) [1231348]
  - [scsi] storvsc: Set the SRB flags correctly when no data transfer is needed (Vitaly Kuznetsov) [1221404]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-573.el6]
changelog:
  - [security] selinux: don't waste ebitmap space when importing NetLabel categories (Paul Moore) [1130197]
  - [x86] Revert "Add driver auto probing for x86 features v4" (Prarit Bhargava) [1231280]
  - [net] bridge: netfilter: don't call iptables on vlan packets if sysctl is off (Florian Westphal) [1236551]
  - [net] ebtables: Allow filtering of hardware accelerated vlan frames (Florian Westphal) [1236551]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.2.1.el6]
changelog:
  - [net] udp: fix behavior of wrong checksums (Denys Vlasenko) [1240758 1240759] {CVE-2015-5364 CVE-2015-5366}
  - [fs] vfs: Unhash and evict unused children dentries after rmdir (Lukas Czerner) [1243400 1241030]
  - [fs] vfs: Prevent syncing frozen file system (Lukas Czerner) [1243404 1241791]
  - [fs] vfs: Prevent freeing unlinked file to be indefinitely delayed (Lukas Czerner) [1243406 1236736]
  - [fs] vmcore: continue vmcore initialization if PT_NOTE is found empty (Baoquan He) [1245195 1236437]
  - [fs] vmcore: prevent PT_NOTE p_memsz overflow during header update (Baoquan He) [1245195 1236437]
  - [kernel] audit/fix non-modular users of module_init in core code (Baoquan He) [1245195 1236437]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.3.1.el6]
changelog:
  - [md] Revert "dm: don't schedule delayed run of the queue if nothing to do" (Mike Snitzer) [1246095 1240767]
  - [md] Revert "dm: only run the queue on completion if congested or no requests pending" (Mike Snitzer) [1246095 1240767]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.4.1.el6]
changelog:
  - [firmware] add iwlwifi-8000C-13 ucode (Stanislaw Gruszka) [1242969 1134603]
  - [net] Always propagate flag changes to interfaces (Jarod Wilson) [1253734 1222823]
  - [s390] zcrypt: Fixed reset and interrupt handling of AP queues (Hendrik Brueckner) [1253729 1238308]
  - [scsi] zfcp: Use correct length for FCP_RSP_INFO (Hendrik Brueckner) [1253728 1223105]
  - [tools] perf: avoid possible race condition in copyfile (Milos Vyletel) [1253733 1229673]
  - [tools] perf: Introduce copyfile_offset function (Milos Vyletel) [1253733 1229673]
  - [tools] perfs: Add rm_rf utility function (Milos Vyletel) [1253733 1229673]
  - [net] vlan: restore VLAN_GROUP_ARRAY_LEN definition (Michal Schmidt) [1246102 1242145]
  - [md] dm btree remove: fix bug in redistribute3 (Mike Snitzer) [1246105 1242023]
  - [netdrv] vmxnet3: prevent receive getting out of sequence on napi poll (Neil Horman) [1246092 1236564]
  - [kernel] sched, cgroup: replace signal_struct->group_rwsem with a global percpu_rwsem (Oleg Nesterov) [1246081 1198732]
  - [kernel] percpu_rw_semaphore: add lockdep annotations (Oleg Nesterov) [1246081 1198732]
  - [kernel] percpu_rw_semaphore: kill ->writer_mutex, add ->write_ctr (Oleg Nesterov) [1246081 1198732]
  - [kernel] percpu_rw_semaphore: reimplement to not block the readers unnecessarily (Oleg Nesterov) [1246081 1198732]
  - [kernel] percpu-rwsem: use synchronize_sched_expedited (Oleg Nesterov) [1246081 1198732]
  - [kernel] percpu-rw-semaphores: use rcu_read_lock_sched (Oleg Nesterov) [1246081 1198732]
  - [kernel] percpu-rw-semaphores: use light/heavy barriers (Oleg Nesterov) [1246081 1198732]
  - [kernel] blockdev: turn a rw semaphore into a percpu rw semaphore (Oleg Nesterov) [1246081 1198732]
  - [kernel] softirq: Add softirq_2ms_loop and default to existing RHEL6 behaviour (Prarit Bhargava) [1246064 970263]
  - [kernel] softirq: reduce latencies (Prarit Bhargava) [1246064 970263]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.7.1.el6]
changelog:
  - Revert: [kernel] softirq: reduce latencies (Prarit Bhargava) [1246064 970263]
  - Revert: [kernel] softirq: Add softirq_2ms_loop and default to existing RHEL6 behaviour (Prarit Bhargava) [1246064 970263]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.8.1.el6]
changelog:
  - [netdrv] bonding: fix LACP PDU not sent on slave port sometimes (Jarod Wilson) [1266366 1258446]
  - [netdrv] bonding: fix incorrect lacp mux state when agg not active (Jarod Wilson) [1266366 1258446]
  - [netdrv] bonding: fix bond_open don't always set slave active flag (Jarod Wilson) [1266366 1258446]
  - [netdrv] bonding: update bond carrier state when min_links option changes (Jarod Wilson) [1266366 1258446]
  - [netdrv] bonding: change AD_LINK_SPEED_BITMASK to enum to suport more speed (Jarod Wilson) [1266366 1258446]
  - [virt] kvm: ioapic: conditionally delay irq delivery duringeoi broadcast (Fam Zheng) [1266369 1199155]
  - [kernel] ipc, sem: fix use after free on IPC_RMID after a task using same semaphore set exits (Herton R. Krzesinski) [1266373 1233300]
  - [fs] xfs: extent size hints can round up extents past MAXEXTLEN (Leonardo Menezes Vaz) [1266372 1211110]
  - [fs] Remove BUG_ON in nfs_clear_inode (Frank Sorenson) [1266364 1224343]
  - [net] use address assign type "SET" (Jarod Wilson) [1266374 1225359]
  - [net] ethtool: set addr_assign_type to NET_ADDR_SET when addr is passed on create (Jarod Wilson) [1266374 1225359]
  - [net] rtnl: use dev_set_mac_address() instead of plain ndo_ (Jarod Wilson) [1266374 1225359]
  - [net] ipv4: inet_fragmentation: compute work more accurate (Hannes Frederic Sowa) [1246088 1235465]
  - [netdrv] bna: fix interrupts storm caused by erroneous packets (Ivan Vecera) [1260535 1241287]
  - [edac] pci: avoid negative reference count of edac_class (Herton R. Krzesinski) [1255492 1227845]
  - [kernel] percpu_counter: batch size aware __percpu_counter_compare (Hannes Frederic Sowa) [1246088 1235465]
  - [kernel] percpu_counter: make percpu_counters_lock irq-safe (Hannes Frederic Sowa) [1246088 1235465]
  - [kernel] lib/percpu_counter.c: fix bad percpu counter state during suspend (Hannes Frederic Sowa) [1246088 1235465]
  - [kernel] percpu_counter: unbreak __percpu_counter_add (Hannes Frederic Sowa) [1246088 1235465]
  - [kernel] lib/percpu_counter.c: fix __percpu_counter_add (Hannes Frederic Sowa) [1246088 1235465]
  - [kernel] percpu_counter: make APIs irq safe (Hannes Frederic Sowa) [1246088 1235465]
  - [kernel] lib/percpu_counter.c: __this_cpu_write doesn't need to be protected by spinlock (Hannes Frederic Sowa) [1246088 1235465]
  - [kernel] lib/percpu_counter.c: enclose hotplug only variables in hotplug ifdef (Hannes Frederic Sowa) [1246088 1235465]
  - [kernel] percpucounter: Optimize __percpu_counter_add a bit through the use of this_cpu options (Hannes Frederic Sowa) [1246088 1235465]
  - [kernel] percpu_counter: use this_cpu_ptr instead of per_cpu_ptr (Hannes Frederic Sowa) [1246088 1235465]
  - [kernel] percpu: fix list_head init bug in __percpu_counter_init (Hannes Frederic Sowa) [1246088 1235465]


author: Weiping Pan <wpan@redhat.com> 2.0.8.rh1 2
changelog:
  - rebuild oracleasm for RHEL6.5, sync to upstream commit d368091e98dc
  - (oracleasm: Add support for new error return codes from block/SCSI)


author: Weiping Pan <wpan@redhat.com> 2.0.8 4
changelog:
  - add  .clear_inode callback, fix bug 1157408.
  - rebuild oracleasm for RHEL6.6 in brew, update the version to 2.0.8-4


author: Michael A. Peters <mpeters@mac.com> - 2005-0.1
changelog:
  - Initial attempt at something that resembles packaging.
  -- Red Hat / Fedora specific patches from tetex not carried over yet
  -- probably some regression


author: Michael A. Peters <mpeters@mac.com> - 2005-0.2
changelog:
  - apply Fedora/Red Hat patches (except fot japanese)
  - port patches as needed
  -- Some of the scripts not patched have same tmpdir issue as the
  -- badscript patch fixes - so a second badscript patch IS still needed
  - build shared libkpathsea


author: Jindrich Novy <jnovy@redhat.com> - 2007-0.2
changelog:
  - update to TeXLive 2007 final
  - remove texlive-errata dependencies
  - don't use dates in upstream tarball names
  - fix invalid freetype libraries location
  - disable broken parallel build
  - move filelists back to the spec


author: Jindrich Novy <jnovy@redhat.com> - 2007-0.5
changelog:
  - separate kpathsea from texlive-fonts
  - update filelists
  - incorporate fixes from David Walluck (Mandriva, Debian, SuSE patches, etc.)
  - link against system freetype2/t1lib
  - remove kpathsea library building hacks
  - disable ttf2pk, don't link against type1
  - fix perl requires


author: Jindrich Novy <jnovy@redhat.com> - 2007-0.9
changelog:
  - update internal xpdf to 3.02 from upstream to fix CVE-2007-3387
  - don't link statically with libstdc++
  - put xdvi.xaw3d to texlive-xdvi instead of main package


author: Jindrich Novy <jnovy@redhat.com> - 2007-0.10
changelog:
  - update License tag to licenses used in TeXLive sources
  - remove ps2eps, it's a separate package
  - don't remove updmap.cfg in post phase
  - fix provides/obsoletes
  - tetex.cron -> texlive.cron
  - review fixes thanks to Patrice Dumas:
  - remove .gz from installing info in scriptlets
  - remove useless comments, lesstif/lesstif-devel requires
  - remove X-Red-Hat-Extra category from xdvi.desktop
  - update texlive-texdoc.patch
  - require xdg-utils, htmlview, don't require bison, flex, ed


author: MATSUURA Takanori <t.matsuu at gmail.com> - 2007-0.10.1
changelog:
  - add Japanese pTeX
  - Polish platex and pdfplatex are moved to platex-pl and
    pdfplatex respectively


author: Jindrich Novy <jnovy@redhat.com> - 2007-0.11
changelog:
  - BR gawk, ghostscript
  - incorporate path fixes by Patrice Dumas
  - change in the kpathsea default paths
  - don't BR the *-texmf
  - ship kpathsea defaults as documentation
  - disable build of ps2eps at configuration time


author: Jindrich Novy <jnovy@redhat.com> - 2007-0.12
changelog:
  - update description
  - BR ruby, don't obsolete tetex-tex4ht
  - remove license problematic/useless stuff, based on email from Karl Berry
  - move vfont.sample to doc
  - preserve timestamps
  - shuffle binaries between texlive and texlive-fonts, update scriptlets


author: Patrice Dumas <pertusus@free.fr>
changelog:
  - subpackage packages that have a distinct upstream
  - remove non free parts from the archive
  - install xdvi icon in hicolor directory


author: Jindrich Novy <jnovy@redhat.com> - 2007-0.13
changelog:
  - update ls-Rs to deal with the japanese support
  - update ptex to 3.1.10 and mendex to 2.6e
  - fix install-info in scriptlets


author: Jindrich Novy <jnovy@redhat.com> - 2007-0.15
changelog:
  - fix t1lib flaw CVE-2007-4033 (#352271)
  - fix CVE-2007-4352 CVE-2007-5392 CVE-2007-5393, various xpdf flaws (#345121)
  - xdvi won't segfault if DVI file contains character which
    is not present in font (#243630)
  - fix dvips -z buffer overflow with long href (#368591)
  - fix insecure usage of temporary file in dviljk (#368611, #368641)
  - link against poppler, not internal xpdf
  - include arabtex


author: Jindrich Novy <jnovy@redhat.com> - 2007-4
changelog:
  - update japanese, chinese, korean paths to fonts in vfontmap (#418081, #392221)
  - create customized cid-x.map for dvipdfmx (#418091)


author: Jindrich Novy <jnovy@redhat.com> - 2007-6
changelog:
  - unify texlive and texlive-fonts packages and obsolete
    texlive-fonts (related: #426388)
  - move subpackages versions to the top of spec file
  - changes from Patruce Dumas:
    * remove BuildRequires on texmf packages
    * don't create .fmt files during the build
    * ship the ptex.pool file


author: Jindrich Novy <jnovy@redhat.com> - 2007-9
changelog:
  - unify texlive and texlive-fonts filelists
  - package texdoc and texdoctk to a separate subpackage
    texlive-doc, because of the Perl-Tk dependencies and logic


author: Jindrich Novy <jnovy@redhat.com> - 2007-10
changelog:
  - don't build/package xdvik/pxdvik, it's now separated
  - fix texlive-doc requires, description
  - use virtual provides with parentheses to avoid clashes
    with real packages (#410401)


author: Jindrich Novy <jnovy@redhat.com> - 2007-11
changelog:
  - temporary fix to pdflatex to not to warn verbosely because of
    ambiguous entries in pdflatex.map (#425804)
  - update post scriptlets, spec cleanup


author: Jindrich Novy <jnovy@redhat.com> - 2007-12
changelog:
  - remove all references to teTeX from the packaged man pages
    and update links to point correctly to upstream mailing
    list and web page
  - drop xpdf patch, we link against poppler now


author: Jindrich Novy <jnovy@redhat.com> - 2007-13
changelog:
  - don't copy original pdftex map files but regenerate them
    with the correct updmap.cfg file updated in texlive-texmf
    (Related: #425804)
  - install mendex via libtool (#428507)


author: Jindrich Novy <jnovy@redhat.com> - 2007-15
changelog:
  - dependency pruning: (#428489, #429753)
    - package XeTeX separately
    - move ghostscript utilities (a2ping, e2pall, epstopdf, gsftopk,
      pdfcrop, ps4pdf, thumbpdf) and metafont with X support
      to texlive-utils subpackage
    - move allcm, allec, allneeded to texlive-dvips
    - package xdvipdfmx in dvipdfmx subpackage
    - only texlive-doc now requires xdg-utils


author: Jindrich Novy <jnovy@redhat.com> - 2007-16
changelog:
  - package Japanese separately -> texlive-japanese
  - add missing BR: texlive-texmf-fonts (#430338)
  - temporarily disable BR: texlive in kpathsea


author: Jindrich Novy <jnovy@redhat.com> - 2007-18
changelog:
  - package ConTeXt separately to get rid of the ruby dependency
  - fix summary for texlive-japanese
  - remove man pages with no corresponding binaries


author: Jindrich Novy <jnovy@redhat.com> - 2007-20
changelog:
  - move mktexpk to texlive-utils (#435176)
  - rename texlive-japanese to texlive-east-asian
  - move ghostscript Requires to dvipdfmx
  - remove trailing spaces from spec


author: Jindrich Novy <jnovy@redhat.com> - 2007-23
changelog:
  - move MetaPost back to the main package from texlive-context
  - don't package dvipdfmx, it is now packaged separately (#433225)


author: Jindrich Novy <jnovy@redhat.com> - 2007-24
changelog:
  - put back dvipdfmx requires for xelatex (#433225)
  - don't compile unpackaged stuff
  - enable parallel build


author: Jindrich Novy <jnovy@redhat.com> - 2007-25
changelog:
  - fix fmtutil to not to hang in infinite loop, thanks to
    Stepan Kasal (#437008)
  - fix search paths in texmf.cnf, thanks to Patrice Dumas (#436949)


author: Jindrich Novy <jnovy@redhat.com> - 2007-27
changelog:
  - remove dvipdfmx completely, also for F8 (related #437448)
  - kpathsea requires texlive again (#437458)


author: Jindrich Novy <jnovy@redhat.com> - 2007-29
changelog:
  - run restorecon on /var/lib/texmf to avoid access denials
    if SELinux is in enforcing mode (#443286, #442161)


author: Jindrich Novy <jnovy@redhat.com> - 2007-30
changelog:
  - fix SELinux contexts everywhere possible, don't allow restorecon
    to fail (#444922)
  - add missing post/postun scriptlets for subpackages


author: Jindrich Novy <jnovy@redhat.com> - 2007-31
changelog:
  - don't build/package dvipdfm, it's now packaged separately (#445983),
    thanks to Jonathan Underwood
  - remove F8 related chunks from spec


author: Jindrich Novy <jnovy@redhat.com> - 2007-32
changelog:
  - texlive-xetex now provides tex(xetex) (#451774)
  - attempt to fix lacheck segfault (#451513)
  - avoid multiple ownership of texconfig stuff (#442135)


author: Jindrich Novy <jnovy@redhat.com> - 2007-35
changelog:
  - texlive-context requires texlive-texmf-context (#455163)
  - fix lacheck to not to segfault (#451513)
  - rediff some patchesto be applicable with zero fuzz


author: Jindrich Novy <jnovy@redhat.com> - 2007-41
changelog:
  - texlive-east-asian now requires texlive-texmf-east-asian (#487258)
  - do not attempt to remove old fonts via cron in /var/lib/texmf,
    fonts are stored in ~/.texlive2007/texmf-var per-user
    (#477833, #463975, #453468)
  - use correct paths in brp-* post install scriptlets (#468179)
  - fix build with gcc4.4


author: Jindrich Novy <jnovy@redhat.com> 2007-45
changelog:
  - make kpathsea not dependent on texlive
  - fix lacheck again (#451513)
  - fix dvips configuration (#467542)
  - update kpathsea description and summary (#519257)
  - use upstream patch to fix pool overflow CVE-2009-1284 (#492136)
  - don't complain if the pdvipsk hunks touching config.ps don't apply


author: Jindrich Novy <jnovy@redhat.com> 2007-48
changelog:
  - add missing defattr to filelists
  - do not own /var/lib/texmf/web2c/, it is owned by texlive-texmf
  - use official tarball for dvipsk-jpatch


author: Jindrich Novy <jnovy@redhat.com> 2007-57
changelog:
  - fix CVE-2010-2642 CVE-2011-0433 CVE-2011-0764 CVE-2011-1552
    CVE-2011-1553 CVE-2011-1554, texlive various flaws (#773184)


author: Than Ngo <than@redhat.com> - 2007-58
changelog:
  - Resolves: bz#699575, running latex when the .aux file is non-writable can erase the input .tex file


author: Tomas Smetana <tsmetana@redhat.com> 20070328-2
changelog:
  - fix wrong exit status of spawned process after SIGSTOP
  - fix building of debuginfo package, add %{?dist} to release
  - fix handling of SIGTTOU in non-interactive shell
  - remove useless builtins


author: Tomas Smetana <tsmetana@redhat.com> 20071105-2
changelog:
  - fix #405381 - ksh will not handle $(xxx) when typeset -r IFS
  - fix #386501 - bad group in spec file


author: Michal Hlavinka <mhlavink@redhat.com> 20081104-1
changelog:
  - update to 2008-11-04
  - ast-ksh-locales are not useable remove them
  - /usr/bin/ksh symlink was removed


author: Michal Hlavinka <mhlavink@redhat.com> - 20100202-6
changelog:
  - fix infinite loop when whence builtin is used with -q option (#587127)
  - fix stdin for double command substitution (#584704)


author: Michal Hlavinka <mhlavink@redhat.com> - 20100621-3
changelog:
  - fix file io race condition when file was created, but still does not exist (#660319)
  - use 'alternatives' for (m)ksh switching (#659658)
  - do not forget to restore file handles after execution of sourced script (#651888)
  - fix bug when here document got sometimes truncated (#644362)
  - do not forget to close autoloaded file with function definition (#643811)
  - fix wrong typeset handling of arrays that could caused a crash (#637052)
  - fix minor issues in man page (#619692)
  - fix crash when ksh get SIGPIPE while already executing signal handler (#616691)
  - fix wrong output redirection in SIGPIPE trap (#616684)
  - add RLIMIT_RTPRIO and RLIMIT_NICE support to ulimit (#582690)


author: Michal Hlavinka <mhlavink@redhat.com> - 20100621-7
changelog:
  - ksh did not wait for pipeline to complete when pipefail option was used (#702016)
  - completion used after an environment variable reported bad susbstituion error (#702015)
  - ksh child exit code not preserved correctly (#702013)
  - do not change $0 in posix function (#702011)
  - fix man page information about default value for PATH variable (#702008)
  - do not use invalid PID values in ksh kill built-in (#701890)
  - fix crashe when IFS is unset inside a function (#683734)
  - do not count empty array elements (#702014)


author: Michal Hlavinka <mhlavink@redhat.com> - 20100621-14
changelog:
  - fix data corruption in a here-document section of a script at byte 8192 (#786787)
  - restore tty settings after timed out read (#577223)
  - do not create extra process when it's not needed (#781976)
  - fix file descriptor leak (#781498)
  - do not segfault on incorrect oop code (#743840)


author: Michal Hlavinka <mhlavink@redhat.com> - 20100621-19
changelog:
  - assigning a right justified typedef'd variable to a smaller one
    could corrupt the result (#846678)
  - fix exporting of l/r-justified variable (#846678)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-2
changelog:
  - fix overflow in subshell loop (#858263)
  - set default editing mode to emacs (#761551)
  - ksh -m did not turn monitor mode on (#960034)
  - prevent fork bomb trigered by SIGSTP (#922851)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-14
changelog:
  - reading a file via command substitution did not work when any of stdin,
    stdout or stderr were closed (#1066589)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-16
changelog:
  - do not resend signal on termination (#1075635)
  - fix argv rewrite (#1047506)
  - fix brace expansion on/off (#1078698)
  - fix incorrect rounding of numsers 0.5 < |x| <1.0 in printf (#1070350)
  - fix parser errors related to the end of the here-document marker (#1036931)
  - ksh hangs when command substitution fills out the pipe buffer (#1062296)
  - using typeset -l with a restricted variabled caused segmentation fault (#1083713)
  - ksh stopped on read when monitor mode was enabled (#1023109)
  - monitor mode was documented incorrectly (#1019334)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-17
changelog:
  - do not crash when unsetting running function from another one (#1105138)
  - should report an error when trying to cd into directory without execution bit (#1102627)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-18
changelog:
  - job locking mechanism did not survive compiler optimization (#1112306)
  - wrong return code from a pipe in command substitution (#1117316)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-24
changelog:
  - cd to directory without execution permission can't fail silently (#1160923)
  - current directory could differ from PWD (#1168611)
  - declaration of a two dimemsional associatve array could add an extra 0 element (#1173668)
  - exporting fixed with variable corrupted its data (#1188377)
  - fixes memmory leak on unset of associative array (#1189294)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-26
changelog:
  - fix segfault when handling a trap (#1117404)
  - closing a file descriptor in a command substitution caused loss of the output (#1116072)


author: Paul Nasrat <pnasrat@redhat.com> - 3.3.6-1
changelog:
  - Update to 3.3.6
  - Fix typo  (#189647)
  - Enable threading fixes (#181298)
  - Conditionalize static library


author: Panu Matilainen <pmatilai@redhat.com> - 3.5.9-2
changelog:
  - Remove references to temporary registers from cache on release (#463061)
  - Enable loading of external extensions (#457433)


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.6.2-2
changelog:
  - require tcl(abi) in sqlite-tcl subpackage (#474034)
  - move tcl extensions to arch-specific location
  - enable dependency extraction on the tcl dso
  - require pkgconfig in sqlite-devel


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.12-2
changelog:
  - disable strict aliasing to work around brokenness on 3.6.12 (#494266)
  - run test-suite on build but let it fail for now


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.14-1
changelog:
  - update to 3.6.14 (http://www.sqlite.org/releaselog/3_6_14.html)
  - merge-review cosmetics (#226429)
    - drop ancient sqlite3 obsoletes
    - fix tab vs space whitespace issues
    - remove commas from summaries
  - fixup io-test fsync expectations wrt SQLITE_DISABLE_DIRSYNC


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.17-1
changelog:
  - update to 3.6.17 (http://www.sqlite.org/releaselog/3_6_17.html)
  - disable to failing tests until upstream fixes


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.18-1
changelog:
  - update to 3.6.18 (http://www.sqlite.org/releaselog/3_6_18.html)
  - drop no longer needed test-disabler patches


author: Mike A. Harris <mharris@redhat.com> 0.99.0-2
changelog:
  - Renamed package to prepend "xorg-x11" to the name for consistency with
    the rest of the X11R7 packages.
  - Added "Requires: %{name} = %{version}-%{release}" dependency to devel
    subpackage to ensure the devel package matches the installed shared libs.
  - Added virtual "Provides: lib<name>" and "Provides: lib<name>-devel" to
    allow applications to use implementation agnostic dependencies.
  - Added post/postun scripts which call ldconfig.
  - Added Conflicts with XFree86-libs and xorg-x11-libs to runtime package,
    and Conflicts with XFree86-devel and xorg-x11-devel to devel package.


author: Mike A. Harris <mharris@redhat.com> 0.99.0-3
changelog:
  - Changed all virtual BuildRequires to the "xorg-x11-" prefixed non-virtual
    package names, as we want xorg-x11 libs to explicitly build against
    X.Org supplied libs, rather than "any implementation", which is what the
    virtual provides is intended for.
  - Added freetype-devel build dependency


author: Mike A. Harris <mharris@redhat.com> 0.99.0-4
changelog:
  - Added xorg-x11-proto-devel dependency to 'devel' subpackage, because the
    libXfont headers use some of the protocol headers, but the autotooling of
    libXfont doesn't autodetect this yet.  Discovered when bdftopcf failed to
    compile while trying to package xorg-x11-font-utils, even though libXfont
    headers were installed.


author: Mike A. Harris <mharris@redhat.com> 0.99.0-5
changelog:
  - Renamed package to remove xorg-x11 from the name due to unanimous decision
    between developers.
  - Use Fedora Extras style BuildRoot tag.
  - Disable static library creation by default.
  - Add missing defattr to devel subpackage
  - Add missing documentation files to doc macro
  - Fix BuildRequires to use new libX* style package names


author: Mike A. Harris <mharris@redhat.com> 0.99.1-1
changelog:
  - Updated libXfont to version 0.99.1 from X11R7 RC1
  - Remove libfontcache* from file manifests, as it is static linked into Xfont


author: Mike A. Harris <mharris@redhat.com> 0.99.2-1
changelog:
  - Updated libXfont to version 0.99.2 from X11R7 RC2
  - Changed 'Conflicts: XFree86-devel, xorg-x11-devel' to 'Obsoletes'
  - Changed 'Conflicts: XFree86-libs, xorg-x11-libs' to 'Obsoletes'


author: Mike A. Harris <mharris@redhat.com> 0.99.2-3
changelog:
  - Added libXfont-0.99.2-fontdir-attrib-fix-bug-172997.patch to remove
    conditionalization of FONTDIRATTRIB from sources instead of tweaking
    CFLAGS for bug (#172997, fdo#5047).


author: Mike A. Harris <mharris@redhat.com> 0.99.3-1
changelog:
  - Updated libXfont to version 0.99.3 from X11R7 RC3
  - Added "Requires(pre): xorg-x11-filesystem >= 0.99.2-3", to ensure
    that /usr/lib/X11 and /usr/include/X11 pre-exist.
  - Removed 'x' suffix from manpage directories to match RC3 upstream.
  - Removed libXfont-0.99.2-fontdir-attrib-fix-bug-172997.patch, which is now
    integrated upstream.


author: Adam Jackson <ajax@redhat.com> 1.2.3-2.fc7
changelog:
  - libXfont-1.2.3-namespace-pollution.patch: Hide some symbols from the dynamic
    linker to avoid colliding with other libs.


author: Adam Jackson <ajax@redhat.com> 1.3.3-1
changelog:
  - libXfont 1.3.3.
  - libXfont-1.3.1-fast-retry.patch: Retry font server connections faster.
    (#443070)


author: Soren Sandmann <ssp@redhat.com> 1.4.5-3
changelog:
  - cve-2013-6462.patch: sscanf overflow (bug 1049684)
  - sscanf-hardening.patch: Some other sscanf hardening fixes (1049684)


author: Benjamin Tissoires <btissoir@redhat.com> 1.4.5-4
changelog:
  - CVE-2014-0209: integer overflow of allocations in font metadata file parsing (bug 1163602, bug 1163601)
  - CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies (bug 1163602, bug 1163601)
  - CVE-2014-0211: integer overflows calculating memory needs for xfs replies (bug 1163602, bug 1163601)


author: Benjamin Tissoires <benjamin.tissoires@redhat.com> 1.4.5-5
changelog:
  - CVE-2015-1802: missing range check in bdfReadProperties (bug 1258892)
  - CVE-2015-1803: crash on invalid read in bdfReadCharacters (bug 1258892)
  - CVE-2015-1804: out-of-bounds memory access in bdfReadCharacters (bug 1258892)


author: Simo Sorce <ssorce@redhat.com> - 0.3.0-2
changelog:
  - Try to fix build adding automake as an explicit BuildRequire
  - Add also a couple of last minute patches from upstream


author: Jakub Hrozek <jhrozek@redhat.com> - 0.3.2-1
changelog:
  - bugfix release 0.3.2
  - includes previous release patches
  - change permissions of the /etc/sssd/sssd.conf to 0600


author: Simo Sorce <ssorce@redhat.com> - 0.4.1-1
changelog:
  - add missing configure check that broke stopping the daemon
  - also fix default config to add a missing required option


author: Jakub Hrozek <jhrozek@redhat.com> - 0.4.1-4
changelog:
  - Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
    without a password. (Patch by Stephen Gallagher)


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.0-1
changelog:
  - Ensure that the configuration upgrade script always writes the config
    file with 0600 permissions
  - Eliminate an infinite loop in group enumerations


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.1-1
changelog:
  - Add SSSDConfig API
  - Update polish translation for 0.6.0
  - Fix long timeout on ldap operation
  - Make dp requests more robust


author: Stephen Gallagher <sgallagh@redhat.com> - 0.7.1-1
changelog:
  - Fix segfault in sssd_pam when cache_credentials was enabled
  - Update the sample configuration
  - Fix upgrade issues caused by data provider service removal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.2-1
changelog:
  - Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
  - Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
  - Several segfault bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.3-1
changelog:
  - Fixes link error on platforms that do not do implicit linking
  - Fixes double-free segfault in PAM
  - Fixes double-free error in async resolver
  - Fixes support for TCP-based DNS lookups in async resolver
  - Fixes memory alignment issues on ARM processors
  - Manpage fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-1.pre20100317git0ea7f19
changelog:
  - Release candidate for SSSD 1.1
  - Add simple access provider
  - Create subpackages for libcollection, libini_config, libdhash and librefarray
  - Support IPv6
  - Support LDAP referrals
  - Fix cache issues
  - Better feedback from PAM when offline


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-2
changelog:
  - Release SSSD 1.1.0 final
  - Fix two potential segfaults
  - Fix memory leak in monitor
  - Better error message for unusable confdb


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.1-1
changelog:
  - New upstream release 1.1.1
  - Fixed the IPA provider (which was segfaulting at start)
  - Fixed a bug in the SSSDConfig API causing some options to revert to
  - their defaults
  - This impacted the Authconfig UI
  - Ensure that SASL binds to LDAP auto-retry when interrupted by a signal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.91-10
changelog:
  - Release new upstream version 1.1.91
  - Enhancements when using SSSD with FreeIPA v2
  - Support for deferred kinit
  - Support for DNS SRV records for failover


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.92-11
changelog:
  - New LDAP access provider allows for filtering user access by LDAP attribute
  - Reduced default timeout for detecting offline status with LDAP
  - GSSAPI ticket lifetime made configurable
  - Better offline->online transition support in Kerberos


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-12
changelog:
  - New stable upstream version 1.2.0
  - Support ServiceGroups for FreeIPA v2 HBAC rules
  - Fix long-standing issue with auth_provider = proxy
  - Better logging for TLS issues in LDAP
  - Resolves: rhbz#584001 - Rebase sssd to 1.2
  - Resolves: rhbz#584017 - Unconfiguring sssd leaves KDC locator file
  - Resolves: rhbz#587384 - authconfig fails if krb5_kpasswd in sssd.conf
  - Resolves: rhbz#587743 - Need to replicate pam_ldap's pam_filter in sssd.conf
  - Resolves: rhbz#590134 - sssd: auth_provider = proxy regression
  - Resolves: rhbz#591131 - Kerberos provider needs to rewrite kdcinfo file when
  -                         going online
  - Resolves: rhbz#591136 - Change SSSD ipa BE to handle new structure of the
  -                         HBAC rule


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-13
changelog:
  - Resolves: rhbz#598670 - Ccache file of a user is removed too early
  - Resolves: rhbz#599057 - Incomplete comparison of a service name in
  -                         IPA access provider
  - Resolves: rhbz#598496 - Failure with IPA access provider
  - Resolves: rhbz#599027 - Makefile typo causes SSSD not to use the
  -                         kernel keyring


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-14
changelog:
  - Resolves: rhbz#593696 - Empty list of simple_allow_users causes sssd service
  -                         to fail while restart
  - Resolves: rhbz#600352 - Wrapping the value for "ldap_access_filter" in
  -                         parentheses causes ldap_search_ext to fail
  - Resolves: rhbz#600468 - Segfault in krb5_child
  - Related:  rhbz#601770 - SSSD in RHEL 6.0 should ship with zero open Coverity
  -                         bugs.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-15
changelog:
  - New upstream bugfix release 1.2.1
  - Resolves: rhbz#601770 - SSSD in RHEL 6.0 should ship with zero open Coverity
  -                         bugs.
  - Resolves: rhbz#603041 - Remove unnecessary option krb5_changepw_principal
  - Resolves: rhbz#604704 - authconfig should provide error with no trace back
  -                         if disabling sssd when sssd is not enabled
  - Resolves: rhbz#591873 - Connecting to the network after an offline kerberos
  -                         auth logs continuous error messages to sssd_ldap.log
  - Resolves: rhbz#596295 - Authentication fails for user from the second domain
  -                         when the same user name is filtered out from the
  -                         first domain
  - Related:  rhbz#598559 - Update translation files for SSSD before RHEL 6
  -                         final


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-19
changelog:
  - Resolves: rhbz#606836 - libcollection needs an soname bump before RHEL 6
  -                         final
  - Resolves: rhbz#608661 - SASL with OpenLDAP server fails
  - Resolves: rhbz#608688 - SSSD doesn't properly request RootDSE attributes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-20
changelog:
  - Resolves: rhbz#591715 - sssd should emit warnings if there are problems with
  -                         /etc/krb5.keytab file


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-21
changelog:
  - Resolves: rhbz#607233 - SSSD users cannot log in through GDM
  -                       - Real issue was that long-running services
  -                       - do not reconnect if sssd is restarted


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-23
changelog:
  - Resolves: rhbz#617623 - SSSD suffers from serious performance issues on
  -                         initgroups calls


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-32
changelog:
  - Resolves: rhbz#633406 - the krb5 locator plugin isn't packaged for multilib
  - Resolves: rhbz#633487 - SSSD initgroups does not behave as expected


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-28.1
changelog:
  - Resolves: rhbz#637070 - the krb5 locator plugin isn't packaged for multilib
  - Resolves: rhbz#642412 - SSSD initgroups does not behave as expected


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-35
changelog:
  - Resolves: rhbz#645449 - 'getent passwd <username>' returns nothing if its
  -                         uidNumber gt 2147483647


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-28.4
changelog:
  - Resolves: rhbz#660592 - SSSD shutdown sometimes hangs
  - Resolves: rhbz#660585 - getent passwd <username>' returns nothing if its
  -                         uidNumber gt 2147483647


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.0-1
changelog:
  - Related: rhbz#644072 - Rebase SSSD to 1.5
  - New upstream release 1.5.0
  - Fixed issues with LDAP search filters that needed to be escaped
  - Add Kerberos FAST support on platforms that support it
  - Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
  - Added a Kerberos access provider to honor .k5login
  - Addressed several thread-safety issues in the sss_client code
  - Improved support for delayed online Kerberos auth
  - Significantly reduced time between connecting to the network/VPN and
  - acquiring a TGT
  - Added feature for automatic Kerberos ticket renewal
  - Provides the kerberos ticket for long-lived processes or cron jobs
  - even when the user logs out
  - Added several new features to the LDAP access provider
  - Support for 'shadow' access control
  - Support for authorizedService access control
  - Ability to mix-and-match LDAP access control features
  - Added an option for a separate password-change LDAP server for those
  - platforms where LDAP referrals are not supported
  - Added support for manpage translations


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-1
changelog:
  - Resolves: rhbz#670259 - Refresh SSSD in 6.1 to 1.5.1
  - New upstream release 1.5.1
  - Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
  - Vast performance improvements when enumerate = true
  - All PAM actions will now perform a forced initgroups lookup instead of just
  - a user information lookup
  -   This guarantees that all group information is available to other
  -   providers, such as the simple provider.
  - For backwards-compatibility, DNS lookups will also fall back to trying the
  - SSSD domain name as a DNS discovery domain.
  - Support for more password expiration policies in LDAP
  -    389 Directory Server
  -    FreeIPA
  -    ActiveDirectory
  - Support for ldap_tls_{cert,key,cipher_suite} config options
  - Assorted bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-3
changelog:
  - Related:  rhbz#670259 - Refresh SSSD in 6.1 to 1.5.1
  - Also add the updated ding-libs to the BuildRequires


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-4
changelog:
  - Resolves: rhbz#674172 - Group members are not sanitized in nested group
  - processing
  - Put translated tool manpages into the sssd-tools subpackage


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-5
changelog:
  - Resolves: rhbz#674164 - sss_obfuscate fails if there's no domain named
  -                         "default"
  - Resolves: rhbz#674515 - -p option always uses empty string to obfuscate
  -                         password
  - Resolves: rhbz#674141 - Traceback call messages displayed while
  -                         "sss_obfuscate" command is executed as a non-root
  -                         user


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-6
changelog:
  - Resolves: rhbz#670511 - SSSD and sftp-only jailed users with pubkey login
  - Resolves: rhbz#675284 - "no matching rule" message logged on all successful
  -                         requests
  - Resolves: rhbz#676911 - SSSD attempts to use START_TLS over LDAPS for
  -                         authentication


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-7
changelog:
  - Resolves: rhbz#677588 - sssd crashes at the next tgt renewals it tries
  - Resolves: rhbz#678410 - name service caches names, so id command shows
  -                         recently deleted users
  - Resolves: rhbz#678614 - SSSD needs to look at IPA's compat tree for
  -                         netgroups


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-8
changelog:
  - Resolves: rhbz#678593 - User information not updated on login for secondary
  -                         domains
  - Resolves: rhbz#678777 - IPA provider does not update removed group
  -                         memberships on initgroups


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-9
changelog:
  - Resolves: rhbz#679082 - SSSD IPA provider should honor the krb5_realm option
  - Resolves: rhbz#677318 - Does not read renewable ccache at startup


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-10
changelog:
  - Related: rhbz#678614 - SSSD needs to look at IPA's compat tree for netgroups
  - Related: rhbz#679082 - SSSD IPA provider should honor the krb5_realm option


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-11
changelog:
  - Resolves: rhbz#682340 - sssd-be segmentation fault - ipa-client on
  -                         ipa-server
  - Resolves: rhbz#680440 - sssd does not handle kerberos server IP change
  - Resolves: rhbz#680442 - Dynamic DNS update fails if multiple servers are
  -                         given in ipa_server config option
  - Resolves: rhbz#680932 - Do not delete sysdb memberOf if there is no memberOf
  -                         attribute on the server
  - Resolves: rhbz#682807 - sssd_nss core dumps with certain lookups


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-12
changelog:
  - Resolves: rhbz#682850 - IPA provider should use realm instead of ipa_domain
  -                         for base DN


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-13
changelog:
  - Related: rhbz#680440 - sssd does not handle kerberos server IP change
  -   SSSD was staying with the old server if it was still online


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-14
changelog:
  - Resolves: rhbz#683255 - sudo/ldap lookup via sssd gets stuck for 5min
  -                         waiting on netgroup
  - Resolves: rhbz#683431 - sssd consumes 100% CPU
  - Related: rhbz#680440  - sssd does not handle kerberos server IP change


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-15
changelog:
  - Resolves: rhbz#683860 - Skip users and groups that have incomplete contents
  - Resolves: rhbz#688491 - authconfig fails when access_provider is set as krb5
  -                         in sssd.conf


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-16
changelog:
  - Resolves: rhbz#683158 - SSSD breaks on RDNs with a comma in them
  - Resolves: rhbz#689886 - group memberships are not populated correctly during
  -                         IPA provider initgroups
  - Resolves: rhbz#683885 - SSSD should skip over groups with multiple names


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-20
changelog:
  - Resolves: rhbz#690131 - Traceback messages seen while interrupting
  -                         sss_obfuscate using ctrl+d
  - Resolves: rhbz#690421 - [abrt] sssd-1.2.1-28.el6_0.4: _talloc_free: Process
  -                         /usr/libexec/sssd/sssd_be was killed by signal 11
  -                         (SIGSEGV)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-21
changelog:
  - Resolves: rhbz#690866 - Groups with a zero-length memberuid attribute can
  -                         cause SSSD to stop caching and responding to
  -                         requests


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-23
changelog:
  - Resolves: rhbz#691678 - SSSD needs to fall back to 'cn' for GECOS
  -                         information


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-24
changelog:
  - Resolves: rhbz#692472 - Process /usr/libexec/sssd/sssd_be was killed by
  -                         signal 11 (SIGSEGV)
  -                         Fix is to not attempt to resolve nameless servers


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-25
changelog:
  - Resolves: rhbz#694783 - SSSD crashes during getent when anonymous bind is
  -                         disabled


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-26
changelog:
  - Resolves: rhbz#694444 - Unable to resolve SRV record when called with
  -                         _srv_,<fixed ldap uri> in ldap_uri
  - Related:  rhbz#694783 - SSSD crashes during getent when anonymous bind is
  -                         disabled


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-27
changelog:
  - Related:  rhbz#694783 - SSSD crashes during getent when anonymous bind is
  -                         disabled


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-28
changelog:
  - Related:  rhbz#691678 - SSSD needs to fall back to 'cn' for GECOS
  -                         information


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-32
changelog:
  - Related: rhbz#693818 - Automatic TGT renewal overwrites cached password
  - Fix typo causing build breakage


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-33
changelog:
  - Related: rhbz#693818 - Automatic TGT renewal overwrites cached password
  - Fix segfault in TGT renewal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-34
changelog:
  - Resolves: rhbz#701700 - sssd client libraries use select() but should use
  -                         poll() instead


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-35
changelog:
  - Resolves: rhbz#707282 - latest sssd fails if ldap_default_authtok_type is
  -                         not mentioned
  - Resolves: rhbz#692404 - rfc2307bis groups are being enumerated even when the
  -                         gidNumber is out of the range of min_id,max_id.
  - Resolves: rhbz#699530 - Users with a local group as their primary GID are
  -                         denied access by the simple access provider
  - Resolves: rhbz#700172 - RFE: SSSD should support paged LDAP lookups
  - Resolves: rhbz#705434 - IPA provider fails initgroups() if user is not a
  -                         member of any group
  - Resolves: rhbz#703624 - SSSD's async resolver only tries the first
  -                         nameserver in /etc/resolv.conf


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-36
changelog:
  - Resolves: rhbz#698723 - kpasswd fails when using sssd and
  -                         kadmin server != kdc server


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-37
changelog:
  - Resolves: rhbz#707513 - Unable to authenticate users when username
  -                         contains "\0"


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-38
changelog:
  - Resolves: rhbz#707627 - Include valid "ldap_uri" formats in sssd-ldap man
  -                         page


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-39
changelog:
  - Resolves: rhbz#709342 - Typo in negative cache notification for initgroups()
  - Resolves: rhbz#708009 - "renew_all_tgts" and "renew_handlers" messages are
  -                         being logged multiple times when the provider comes
  -                         back online
  - Resolves: rhbz#707997 - The IPA provider does not work with IPv6
  - Resolves: rhbz#677327 - [RFE] Support overriding attribute value
  - Resolves: rhbz#692090 - SSSD is not populating nested groups in
  -                         Active Directory


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-41
changelog:
  - Resolves: rhbz#713961 - libsss_ldap segfault at login against OpenLDAP
  - Resolves: rhbz#713438 - sssd shuts down if inotify crashes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-42
changelog:
  - Resolves: rhbz#711416 - During the change password operation the ccache is
  -                         not replaced by a new one if the old one isn't
  -                         active anymore
  - Resolves: rhbz#715609 - Certificate validation fails with message
  -                         "Connection error: TLS: hostname does not match CN
  -                         in peer certificate"
  - Resolves: rhbz#719089 - IPA dynamic DNS update mangles AAAA records
  - Resolves: rhbz#721052 - sssd does not handle kerberos server IP change
  -                         Honor TTL values when resolving hostnames


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-43
changelog:
  - Related:  rhbz#721052 - sssd does not handle kerberos server IP change
  -                         Use ares_search instead of ares_query to honor
  -                         search entries in /etc/resolv.conf


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-44
changelog:
  - Resolves: rhbz#700828 - Process /usr/libexec/sssd/sssd_be was killed by
                            signal 11 (SIGSEGV) when ldap_uri is misconfigured
  - Resolves: rhbz#726438 - sssd doesn't honor ldap supportedControls 
  - Resolves: rhbz#726466 - HBAC rule evaluation does not support extended
                            UTF-8 languages
  - Resolves: rhbz#718250 - Remove DENY rules from the HBAC access provider
  - Resolves: rhbz#728267 - When non-posix groups are skipped, initgroups
                            returns random GID
  - Resolves: rhbz#726475 - sssd_pam leaks file descriptors
  - Resolves: rhbz#725868 - Explicitly ignore groups with gidNumber = 0


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-45
changelog:
  - Related:  rhbz#726466 - HBAC rule evaluation does not support extended
                            UTF-8 languages
  - Related:  rhbz#718250 - Remove DENY rules from the HBAC access provider
  - Fixes an issue on big endian platforms


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-46
changelog:
  - Related:  rhbz#728267 - When non-posix groups are skipped, initgroups
                            returns random GID


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-47
changelog:
  - Resolves: rhbz#728961 - Provide a mechanism for vetoing the use of certain
                            shells


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-49
changelog:
  - Resolves: rhbz#732010 - LDAP+GSSAPI needs explicit Kerberos realm
  - Resolves: rhbz#733382 - SSSD should pick a user/group name when there are
                            multi-valued names
  - Resolves: rhbz#733409 - Improve password policy error message
  - Resolves: rhbz#733663 - Authentication fails when there exists an empty
                            hbacsvcgroup
  - Resolves: rhbz#732935 - Add LDAP provider option to set
                            LDAP_OPT_X_SASL_NOCANON
  - Resolves: rhbz#734101 - sssd blocks login of ipa-users


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-50
changelog:
  - Resolves: rhbz#736314 - sssd crashes during auth while there exists multiple
                            external hosts along with managed host
  - Resolves: rhbz#732974 - [RFE] Have SSSD cache properly with
    krb5_validate = True and SElinux enabled


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-51
changelog:
  - Resolves: rhbz#737157 - "System error" appears in log during change password
                            operation of a user in openldap server with ppolicy
                            enabled
  - Resolves: rhbz#737172 - "Unknown (private extension) error(21853), (null)"
                            messages are logged during change password operation
                            of a user in openldap server with ppolicy enabled


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-52
changelog:
  - Resolves: rhbz#728343 - SSSD taking 5 minutes to log in
  - Resolves: rhbz#739850 - Coverity defects newly introduced in rhel 6.2


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-53
changelog:
  - Resolves: rhbz#741751 - HBAC rule evaluation does not properly handle host
                            groups
  - Resolves: rhbz#740501 - SSSD not functional after "self" reboot
  - Resolves: rhbz#742539 - HBAC: Hostname comparisons should be
                            case-insensitive


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-55
changelog:
  - Resolves: rhbz#738621 - Lookup fails for non-primary usernames with
                            multi-valued uid
  - Resolves: rhbz#738629 - Group lookups doesn't return it's member for
                            sometime when the member has multi-valued uid
  - Resolves: rhbz#742295 - Use an explicit base 10 when converting uidNumber
                            to integer
  - Resolves: rhbz#733382 - SSSD should pick a user/group name when there are
                            multi-valued names


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-56
changelog:
  - Resolves: rhbz#742278 - Rework the example config
  - Resolves: rhbz#746037 - Only access sssd_nss internal hash table if it was
                            initialized
  - Resolves: rhbz#742526 - SSSD's man pages are missing information
  - Resolves: rhbz#743841 - SSSD can crash due to dbus server removing a UNIX
                            socket


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-57
changelog:
  - Resolves: rhbz#743925 - HBAC processing is very slow when dealing with
                            FreeIPA deployments with large numbers of hosts
  - Resolves: rhbz#745966 - sssd_pam segfaults on sssd restart
  - Related:  rhbz#743841 - SSSD can crash due to dbus server removing a UNIX
                            socket


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-59
changelog:
  - Resolves: rhbz#742288 - RFC2307bis initgroups calls are slow
  - Resolves: rhbz#746654 - SSSD backend gets killed on slow systems
  - Related:  rhbz#743925 - HBAC processing is very slow when dealing with
                            FreeIPA deployments with large numbers of hosts
                            Fixes a crash introduced by the earlier patch.
  - Related:  rhbz#733382 - SSSD should pick a user/group name when there are
                            multi-valued names
                            Fixes for internationalization


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-60
changelog:
  - Related:  rhbz#743841 - SSSD can crash due to dbus server removing a UNIX
                            socket


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-64
changelog:
  - Resolves: rhbz#749822 - SSSD may go into infinite loop during RFC2307bis
                            initgroups when groups appear in multiple nesting
                            levels


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-67
changelog:
  - Resolves: rhbz#753842 - sssd_nss crashes when passed invalid UTF-8 for the
                            username in getpwnam()
  - Resolves: rhbz#758157 - LDAP failover not working if server refuses
                            connections


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-2.beta2
changelog:
  - Related:  rhbz#735422 - Rebase SSSD to 1.8.0 in RHEL 6.3
  - Resolves: rhbz#786553 - sssd on ppc64 doesn't pull cyrus-sasl-gssapi.ppc as
                            a dependancy
  - Resolves: rhbz#785909 - --debug-timestamps=1 is not passed to providers
  - Resolves: rhbz#785908 - ldap_*_search_base doesn't fully limit the group and
                            netgroup search base correctly
  - Resolves: rhbz#785907 - [RFE] Add support to request canonicalization on krb
                            AS requests
  - Resolves: rhbz#785905 - [RFE] DEBUG timestamps should offer higher precision
  - Resolves: rhbz#785904 - [RFE] SSSD should have --version option
  - Resolves: rhbz#785902 - Errors with empty loginShell and proxy provider
  - Resolves: rhbz#785898 - Enable midway cache refresh by default
  - Resolves: rhbz#785888 - sssd returns empty netgroup at a second request for
                            a non-existing netgroup
  - Resolves: rhbz#785884 - Honour TTL when resolving host names
  - Resolves: rhbz#785883 - check DNS records before updates
  - Resolves: rhbz#785881 - List the keytab to pick the princiapl to use instead
                            of guessing
  - Resolves: rhbz#785880 - debug_level in sssd.conf overrides command-line
  - Resolves: rhbz#785879 - sss_obfuscate/python config parser modifies config
                            file too much
  - Resolves: rhbz#785877 - on reconnect we need to detect that a ipa/ds server
                            has been reinitialized
  - Resolves: rhbz#785741 - sssd.api.conf and sssd.api.d should not be in /etc
  - Resolves: rhbz#773660 - Kerberos errors should go to syslog
  - Resolves: rhbz#772163 - Iterator loop reuse cases a tight loop in the native
                            IPA netgroups code
  - Resolves: rhbz#771706 - sssd_be crashes during auth when there exists UTF
                            source host group in an hbacrule
  - Resolves: rhbz#771702 - sssd_pam crashes during change password operation
                            against a IPA server
  - Resolves: rhbz#771361 - case_sensitive function not working as intended for
                            ldap
  - Resolves: rhbz#768935 - Crash when applying settings
  - Resolves: rhbz#766941 - The full dyndns update message should be logged into
                            debug logs
  - Resolves: rhbz#766930 - [RFE] Add a new option to override home directory
                            value
  - Resolves: rhbz#766913 - [RFE] Add option to select validate and FAST keytab
                            principal name
  - Resolves: rhbz#766907 - Use [...] for IPv6 addresses in kdc info files
  - Resolves: rhbz#766904 - [RFE] Create a command line tool to change the debug
                            levels on the fly
  - Resolves: rhbz#766876 - [RFE] Make HBAC srchost processing optional
  - Resolves: rhbz#766141 - [RFE] SSSD should support FreeIPA's internal
                            netgroup representation
  - Resolves: rhbz#761582 - [RFE] Add ldap_sasl_minssf option
  - Resolves: rhbz#759186 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process
                            /usr/sbin/sssd was killed by signal 11 (SIGSEGV)
  - Resolves: rhbz#755506 - [RFE] Add host-based (pam_host_attr) access control
  - Resolves: rhbz#753876 - [RFE] Add support for the services map
  - Resolves: rhbz#746181 - "getgrgid call returned more than one result" after
                            group name change in MSAD
  - Resolves: rhbz#744197 - [RFE] close LDAP connection to the server when idle
                            for some (configurable) time
  - Resolves: rhbz#742510 - [RFE] Separate Cache Timeouts for SSSD
  - Related:  rhbz#742509 - [RFE] Add SSSD Tool to purge cache
  - Resolves: rhbz#742052 - id -G group resolution takes extremely long
  - Resolves: rhbz#739312 - [RFE] sssd does not set shadowLastChange
  - Resolves: rhbz#736150 - [RFE] SSSD should support multiple search bases
  - Resolves: rhbz#735827 - [RFE] Ability to set a domain as case sensitive or
                            insensitive
  - Resolves: rhbz#735405 - [RFE] Option to disable warnings for unknown users
  - Resolves: rhbz#728212 - [RFE] sssd does not handle when paging control
                            disabled for openldap
  - Resolves: rhbz#726467 - SSSD takes 30+ seconds to login
  - Resolves: rhbz#721289 - Process /usr/libexec/sssd/sssd_be was killed by
                            signal 11 during auth when password for the user is
                            not set


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-3.beta2
changelog:
  - Handle filtering python Provides in a safer way
  - Related:  rhbz#735422 - Rebase SSSD to 1.8.0 in RHEL 6.3


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-4.beta3
changelog:
  - Resolves: rhbz#761570 - [RFE] support looking up autofs maps via SSSD
  - Resolves: rhbz#788979 - sssd crashes during initgroups against a user
                            belonging to nested rfc2307bis group


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-5
changelog:
  - Resolves: rhbz#753763 - Provide logging configuration compatibility on
                            SSSD 1.5/1.6 upgrade
  - Resolves: rhbz#785871 - wrong build dependency on nscd
  - Resolves: rhbz#785873 - IPA host search base cannot be set
  - Resolves: rhbz#791208 - Entries lacking a POSIX username value break group
                            lookups
  - Resolves: rhbz#796307 - Simple Paged Search control needs to be used more
                            sparingly
  - Resolves: rhbz#797282 - sssd-1.5.1-66.el6.x86_64 needs
                            openldap >= openldap-2.4.23-20.el6.x86_64
  - Resolves: rhbz#787035 - ipa - sssd slow response with thousands of user
                            entries
  - Resolves: rhbz#742509 - [RFE] Add SSSD Tool to purge cache
  - Resolves: rhbz#772297 - Fails to update if all nisNetgroupTriple or
                            memberNisNetgroup entries are deleted from a
                            netgroup
  - Resolves: rhbz#783138 - Backend occasionally goes offline under heavy load
  - Resolves: rhbz#797975 - sssd_be: The requested target is not configured is
                            logged at each login
  - Resolves: rhbz#735422 - Rebase SSSD to 1.8.0 in RHEL 6.3


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-6
changelog:
  - Fix multilib-clean issue due to upgrade script
  - Related:  rhbz#753763 - Provide logging configuration compatibility on
                            SSSD 1.5/1.6 upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-7
changelog:
  - Fix multilib-clean issue due to upgrade script
  - Use a patch and install the script to python_sitelib
  - Related:  rhbz#753763 - Provide logging configuration compatibility on
                            SSSD 1.5/1.6 upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-8
changelog:
  - Fix multilib-clean issue due to upgrade script
  - Fix typo in the patch
  - Related:  rhbz#753763 - Provide logging configuration compatibility on
                            SSSD 1.5/1.6 upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-9
changelog:
  - Fix multilib-clean issue due to upgrade script
  - Remove old copy from the spec file
  - Related:  rhbz#753763 - Provide logging configuration compatibility on
                            SSSD 1.5/1.6 upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-10
changelog:
  - Fix explicit requires to use openldap instead of openldap-libs
  - Related:  rhbz#797282 - sssd-1.5.1-66.el6.x86_64 needs
                            openldap >= openldap-2.4.23-20.el6.x86_64


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-11
changelog:
  - Do not auto-upgrade debug levels
  - Tool still available for manual use
  - Reverts:  rhbz#753763 - Provide logging configuration compatibility on
                            SSSD 1.5/1.6 upgrade
  - Resolves: rhbz#798881 - Install-time warnings
  - Resolves: rhbz#798774 - IPA provider should assume that ipa_domain is also
                            the dns_discovery_domain
  - Resolves: rhbz#798655 - Password logins failing due to a process with high
                            UID


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-12
changelog:
  - Resolves: rhbz#801407 - sssd_nss gets hung processing identical search
                            requests
  - Resolves: rhbz#801451 - Logging in with ssh pub key should consult
                            authentication authority policies
  - Resolves: rhbz#795562 - Infinite loop checking Kerberos credentials
  - Resolves: rhbz#798317 - sssd crashes when ipa_hbac_support_srchost is set to
                            true
  - Resolves: rhbz#799039 - --debug option for sss_debuglevel doesn't work
  - Resolves: rhbz#799915 - Unable to lookup netgroups with case_sensitive=false
  - Resolves: rhbz#799929 - Raise limits for max num of files sssd_nss/sssd_pam
                            can use
  - Resolves: rhbz#799971 - sssd_be crashes on shutdown
  - Resolves: rhbz#801533 - sssd_be crashes when resolving non-trivial nested
                            group structure
  - Resolves: rhbz#801368 - Group lookups doesn't return members with proxy
                            provider configured
  - Resolves: rhbz#801377 - getent returns non-existing netgroup name, when sssd
                            is configured as proxy provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-15
changelog:
  - Update translations
  - Resolves: rhbz#802372 - Pick up latest translation files for SSSD
  - Resolves: rhbz#802207 - getent netgroup hangs when
                            "use_fully_qualified_names = TRUE" in sssd
  - Related:  rhbz#801451 - Logging in with ssh pub key should consult
                            authentication authority policies


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-17
changelog:
  - Related:  rhbz#802207 - getent netgroup hangs when
                            "use_fully_qualified_names = TRUE" in sssd
  - Resolves: rhbz#801719 - "Error looking up public keys" while ssh to replica
                            using IP address
  - Resolves: rhbz#803659 - Service lookup shows case sensitive names twice with
                            case_sensitive=false
  - Resolves: rhbz#803842 - Unable to bind to LDAP server when minssf set
  - Resolves: rhbz#805034 - accessing an undefined variable might cause crash
  - Resolves: rhbz#805108 - sss_ssh_knownhostproxy infinite loop hangs SSH login


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-18
changelog:
  - Resolves: rhbz#804057 - Initial service lookups having name with uppercase
                            alphabets doesn't work
  - Resolves: rhbz#804065 - Service lookup using case-sensitive protocol names
                            doesn't work when case_sensitive=false
  - Resolves: rhbz#805281 - sssd: Uses the wrong key when there a multiple
                            realms in a single keytab
  - Resolves: rhbz#805452 - Unable to lookup user, group, netgroup aliases with
                            case_sensitive=false
  - Resolves: rhbz#805918 - Wrong resolv_status might cause crash when name
                            resolution times out
  - Resolves: rhbz#805431 - NFS files/folders are mapped to nobody user if NFS
                            top level directory is chowned by a SSSD user


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-20
changelog:
  - Related: rhbz#805452  - Unable to lookup user, group, netgroup aliases with
                            case_sensitive=false


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-21
changelog:
  - Resolves: rhbz#808458 - Authconfig crashes when sets krb realm
  - Resolves: rhbz#808597 - sssd_nss crashes on request when no back end is
                            running
  - Resolves: rhbz#808107 - Coverity revealed memory management defects


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-22
changelog:
  - Fix typo in patch for SSH umask
  - Related:  rhbz#808107 - Coverity revealed memory management defects


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-23
changelog:
  - Resolves: rhbz#805924 - SSSD should attempt to get the RootDSE after binding
  - Resolves: rhbz#814237 - sdap_check_aliases must not error when detects the
                            same user
  - Resolves: rhbz#812281 - autofs client: map name length used as key length
  - Related:  rhbz#784870 - SSSD fails during autodetection of search bases for
                            new LDAP features
  - Related:  rhbz#814269 - sssd-1.5.1-66.el6_2.3.x86_64 freezes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-24
changelog:
  - Resolves: rhbz#805431 - NFS files/folders are mapped to nobody user if NFS
                            top level directory is chowned by a SSSD user


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-25
changelog:
  - Resolves: rhbz#816616 - group members are now lowercased in case insensitive
                            domains


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-26
changelog:
  - Resolves: rhbz#818642 - Auth fails for user with non-default attribute names
  - Resolves: rhbz#819063 - sssd fails to provide partial data till paged search
                            returns "Size Limit Exceeded"
  - Resolves: rhbz#820585 - Group enumeration fails in proxy provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-27
changelog:
  - Resolves: rhbz#820759 - AVC denial seen on sssd upgrade during ipa-client
                            upgrade
  - Resolves: rhbz#821044 - sss_groupadd no longer detects duplicate GID numbers


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-28
changelog:
  - Resolves: rhbz#822236 - SSSD netgroups do not honor
                            entry_cache_nowait_percentage


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-29
changelog:
  - Resolves: rhbz#824062 - sssd_be crashed with SIGSEGV in
                            _tevent_schedule_immediate()


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-30
changelog:
  - Resolves: rhbz#824616 - sssd_nss crashes when configured with
                            use_fully_qualified_names = true


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-31
changelog:
  - Resolves: rhbz#825028 - Service lookups by port number doesn't work on
                            s390x/ppc64 arches


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-32
changelog:
  - Fix protocol break for services map
  - Related:  rhbz#825028 - Service lookups by port number doesn't work on
                            s390x/ppc64 arches


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.0-33
changelog:
  - Resolves: rhbz#840089 - Update the shadowLastChange attribute
                            with days since the Epoch, not seconds


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-1.rc1
changelog:
  - Rebase to 1.9.0 RC1
  - Resolves: rhbz#827606 - Rebase SSSD to 1.9 in 6.4
  - Bump the selinux-policy version number to pull in required fixes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-2
changelog:
  - Fix the "ca" translation of the sssd-simple manual page
  - Related: rhbz#827606 - Rebase SSSD to 1.9 in 6.4


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-5
changelog:
  - Do not send SIGKILL to service right after sending SIGTERM
  - Resolves: #771975
  - Fix the initial sudo smart refresh
  - Resolves: #869013
  - Implement password authentication for users from trusted domains
  - Resolves: #869071
  - LDAP child crashed with a wrong keytab
  - Resolves: #869150
  - The sssd_nss process grows the memory consumption over time
  - Resolves: #869443


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-6
changelog:
  - Resolves: rhbz#871576 - sssd does not resolve group names from AD
  - Resolves: rhbz#872324 - pam: fd leak when writing the selinux login file
                            in the pam responder
  - Resolves: rhbz#871424 - authconfig chokes on sssd.conf with chpass_provider
                            directive


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-7
changelog:
  - Resolves: rhbz#873032 - Move sss_cache to the main subpackage
  - Resolves: rhbz#829740 - Init script reports complete before sssd is actually
                            working
  - Resolves: rhbz#869466 - SSSD starts multiple processes due to syntax error in
                            ldap_uri
  - Resolves: rhbz#870505 - sss_cache: Multiple domains not handled properly
  - Resolves: rhbz#867933 - invalidating the memcache with sss_cache doesn't work
                            if the sssd is not running
  - Resolves: rhbz#872110 - User appears twice on looking up a nested group


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-9
changelog:
  - Resolves: rhbz#873988 - Man page issue to list 'force_timeout' as an
                            option for the [sssd] section


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-10
changelog:
  - Resolves: rhbz#872180 - subdomains: Invalid sub-domain request type
  - Related: rhbz#867933 - invalidating the memcache with sss_cache doesn't work
                           if the sssd is not running


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-12
changelog:
  - Resolves: rhbz#870278 -  ipa client setup should configure host properly
                             in a trust is in place


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-16
changelog:
  - Resolves: rhbz#875738 - offline authentication failure always returns
                            System Error


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-19
changelog:
  - Resolves: rhbz#877130 - LDAP provider fails to save empty groups
  - Related: rhbz#869466 - check the return value of waitpid()


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-20
changelog:
  - Resolves: rhbz#877126 - subdomains code does not save the proper
                            user/group name


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-21
changelog:
  - Resolves: rhbz#877354 - ldap_connection_expire_timeout doesn't expire
                            ldap connections


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-22
changelog:
  - Resolves: rhbz#861075 - SSSD_NSS failure to gracefully restart
                            after sbus failure


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-25
changelog:
  - Resolves: rhbz#878262 - ipa password auth failing for user principal
                            name when shorter than IPA Realm name
  - Resolves: rhbz#871843 - Nested groups are not retrieved appropriately
                            from cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-26
changelog:
  - Resolves: rhbz#874673 - user id lookup fails using proxy provider
  - Fix a possibly uninitialized variable in the LDAP provider
  - Related: rhbz#877130


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-27
changelog:
  - Resolves: rhbz#824244 - sssd does not warn into sssd.log for broken
                            configurations


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-28
changelog:
  - Resolves: rhbz#874616 - Silence the DEBUG messages when ID mapping code
                            skips a built-in group


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-31
changelog:
  - Resolves: rhbz#882076 - SSSD crashes when c-ares returns success but an
                            empty hostent during the DNS update
  - Do not version libsss_sudo, it's not supposed to be linked against, but
    dlopened (Related: rhbz#761573)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-32
changelog:
  - Resolves: rhbz#875677 - password expiry warning message doesn't appear
                            during auth
  - Fix potential NULL dereference when skipping built-in AD groups
    (Related: rhbz#874616)
  - Add missing parameter to DEBUG message (Related: rhbz#829742)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-34
changelog:
  - Resolves: rhbz#877974 - updating top-level group does not reflect ghost
                            members correctly
  - Resolves: rhbz#880159 - delete operation is not implemented for ghost users


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-35
changelog:
  - Resolves: rhbz#882290 - arithmetic bug in the SSSD causes netgroup
                            midpoint refresh to be always set to 10 seconds


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-36
changelog:
  - Resolves: rhbz#883336 - sssd crashes during start if id_provider is
                            not mentioned


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-37
changelog:
  - Resolves: rhbz#884480 - user is not removed from group membership during
                            initgroups
  - Fix incorrect synchronization in mmap cache (Related: #789507)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-38
changelog:
  - Resolves: rhbz#882923 - Negative cache timeout is not working for proxy
                            provider
  - Link sss_ssh_authorizedkeys and sss_ssh_knowhostsproxy with the client
    libraries (Related: #870060)
  - Move sss_ssh_knownhosts documentation to the correct section
    (Related: #870060)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-39
changelog:
  - Resolves: rhbz#882221 - Offline sudo denies access with expired
                            entry_cache_timeout
  - Fix several bugs found by Coverity and clang:
  - Check the return value of diff_gid_lists (Related: #869071)
  - Move misplaced sysdb assignment (Related: #827606)
  - Remove dead assignment (Related: #827606)
  - Fix copy-n-paste error in the memberof plugin (Related: #877974)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-40
changelog:
  - Resolves: rhbz#880546 - krb5_kpasswd failover doesn't work
  - Fix the error handler in sss_mc_create_file (Related: #789507)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-42
changelog:
  - Resolves: rhbz#885105 - sudo denies access with disabled
                            ldap_sudo_use_host_filter


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-43
changelog:
  - Resolves: rhbz#880176 - memberUid required for primary groups to match
                            sudo rule


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-44
changelog:
  - Resolves: rhbz#878419 - sss_userdel doesn't remove entries from in-memory
                            cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-45
changelog:
  - Resolves: rhbz#858345 - pam_sss(crond:account): Request to sssd
                            failed. Timer expired


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-46
changelog:
  - Resolves: rhbz#884600 - ldap_chpass_uri failover fails on using same
                            hostname


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-47
changelog:
  - Resolves: rhbz#882923 - Negative cache timeout is not working for proxy
                            provider


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-48
changelog:
  - Resolves: rhbz#880956 - Primary server status is not always reset after
                            failover to backup server happened
  - Silence a compilation warning in the memberof plugin (Related: rhbz#877974)
  - Do not steal resolv result on error (Related: rhbz#882076)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-49
changelog:
  - Resolves: rhbz#884666 - sudo: if first full refresh fails, schedule
                            another first full refresh


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-50
changelog:
  - Resolves: rhbz#870045 - always reread the master map from LDAP
  - Resolves: rhbz#876531 - sss_cache does not work for automount maps


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-52
changelog:
  - Related: rhbz#875851 - sysdb upgrade failed converting db to 0.11
  - Include more debugging during the sysdb upgrade


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-53
changelog:
  - Resolves: rhbz#885078 - sssd_nss crashes during enumeration if the
                            enumeration is taking too long


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-54
changelog:
  - Resolves: rhbz#888614 - Failure in memberof can lead to failed database
                            update


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-57
changelog:
  - Resolves: rhbz#886091 - Disallow root SSH public key authentication
  - Add default section to switch statement (Related: rhbz#884666)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-58
changelog:
  - Resolves: rhbz#889168 - krb5 ticket renewal does not read the renewable
                            tickets from cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-62
changelog:
  - Resolves: rhbz#886848 - user id lookup fails for case sensitive users
                            using proxy provider


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-64
changelog:
  - Resolves: rhbz#891356 - Smart refresh doesn't notice "defaults" addition
                            with OpenLDAP


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-66
changelog:
  - Resolves: rhbz#874579 - sssd caching not working as expected for selinux
                            usermap contexts


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-67
changelog:
  - Resolves: rhbz#878583 - IPA Trust does not show secondary groups for AD
                            Users for commands like id and getent


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-68
changelog:
  - Resolves: rhbz#887961 - AD provider: getgrgid removes nested group
                            memberships


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-71
changelog:
  - Resolves: rhbz#895132 - Modifications using sss_usermod tool are not
                            reflected in memory cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-72
changelog:
  - Resolves: rhbz#894997 - sssd_be crashes looking up members with groups
                            outside the nesting limit


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-73
changelog:
  - Resolves: rhbz895615 - ipa-client-automount: autofs failed in s390x and
                           ppc64 platform


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-74
changelog:
  - Resolves: rhbz894381 - memory cache is not updated after user is deleted
                           from ldb cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-78
changelog:
  - Resolves: rhbz#896476 - SSSD should warn when pam_pwd_expiration_warning
                            value is higher than passwordWarning LDAP attribute.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-79
changelog:
  - Resolves: rhbz#902716 - Rule mismatch isn't noticed before smart refresh
                            on ppc64 and s390x


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-80
changelog:
  - Resolves: rhbz#903078 - Out-of-bounds read flaws in
                            autofs and ssh services responders


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-81
changelog:
  - Resolves: rhbz#903078 - TOCTOU race conditions by copying
                            and removing directory trees


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-82
changelog:
  - Resolves: rhbz#888614 - Failure in memberof can lead to failed
                            database update


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-84
changelog:
  - Resolves: rhbz#911329 - pwd_expiration_warning has wrong default for
                            Kerberos


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-85
changelog:
  - Fix pwd_expiration_warning=0
  - Resolves: rhbz#911329 - pwd_expiration_warning has wrong default for
                            Kerberos


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-86
changelog:
  - Resolves: rhbz#911299 - sssd: simple access provider flaw prevents intended
                            ACL use when client to an AD provider


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-88
changelog:
  - Resolves: #950874: Simple access control always denies uppercased users
                       in case insensitive domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-90
changelog:
  - Resolves: #953165 - Enabling enumeration causes sssd_be process to
                        utilize 100% of the CPU


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-91
changelog:
  - Resolves: #967636 - SSSD frequently fails to return automount maps
                        from LDAP


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-93
changelog:
  - Resolves: #987479 - libsss_sudo should depend on sudo package with
                        sssd support


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-94
changelog:
  - Call restorecon on memcache files to force the right context on upgrades
  - Resolves: #987456 - RHEL6 sssd upgrade restorecon workaround for
                        /var/lib/sss/mc context


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-95
changelog:
  - Mention that enumeration should be discouraged
  - Resolves: #988381 - clarify the disadvantages of enumeration in sssd.conf


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-96
changelog:
  - Resolves: #988525 - sssd fails instead of skipping when a sudo ldap
                        filter returns entries with multiple CNs


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-97
changelog:
  - Resolves: #986379 - sss_cache -N/-n should invalidate the hash table
                        in sssd_nss


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-98
changelog:
  - Resolves: #979046 - sssd_be goes to 99% CPU and causes significant login
                        delays when client is under load


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-99
changelog:
  - Clarify the min_id/max_id limits further
  - Resolves: #978994 - SSSD filter out ldap user/group if uid/gid is zero


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-101
changelog:
  - Resolves: #976273 - [RFE] Add a new override_homedir expansion for the
                        "original value"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-104
changelog:
  - Resolves: #971435 - Enhance sssd init script so that it would source
                        a configuration


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-106
changelog:
  - Format patch to configure sysv script differently
  - RHEL-6 patch(1) apparently doesn't like the output of git format-patch
   -M -C and doesn't properly copy files on renames
  - Resolves: #971435 - Enhance sssd init script so that it would source a
    configuration.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-108
changelog:
  - Set correct state of SRV servers on resolving error
  - Resolves: #954275 - sssd fails connect to IPA server during boot when
                        spanning tree is enabled in network router.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-109
changelog:
  - Use permissive control when adding ghost users
  - Resolves: #928797 - cyclic group memberships may not work depending on
                        order of operations


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-112
changelog:
  - Resolves: #918394 - sssd etas 99% CPU and runs out of file descriptors
                        when clearing cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-113
changelog:
  - Resolves: #916997 - getgrnam / getgrgid for large user groups
                        is too slow due to range retrieval functionality


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-114
changelog:
  - Resolves: #914433 - sssd pam write_selinux_login_file creating the temp
                        file for SELinux data failed


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-115
changelog:
  - Apply a forgotten dependency for patch #254
  - Related: #916997 - getgrnam / getgrgid for large user groups
                       is too slow due to range retrieval functionality
  - Add two fixes for better handling of faulty SRV processing
  - Related: #954275 - sssd fails connect to IPA server during boot when
                       spanning tree is enabled in network router.
  - Remove enumerate=true from example in man page
  - Related: #988381 - clarify the disadvantages of enumeration in sssd.conf


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-117
changelog:
  - Resolves: #966757 - SSSD failover doesn't work if the first DNS server
                       in resolv.conf is unavailable


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-119
changelog:
  - Resolves: #948830 - sssd do too many disk writes causing delay in
                        "getent netgroup allmachines-netgroup" nested netgroups.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-120
changelog:
  - Resolves: #983028 - passwd returns "Authentication token manipulation
                        error" when entering wrong current password


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-121
changelog:
  - Print password complexity hint when password change fails with
    constraint violation
  - Related: #983028 - passwd returns "Authentication token manipulation
                       error" when entering wrong current password


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-122
changelog:
  - Make IPA SELinux provider aware of subdomain users
  - Resolves: #954342 - In IPA AD trust setup, the sssd logs throws
                        'sysdb_search_user_by_name failed' error when
                        AD user tries to login via ipa client.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-123
changelog:
  - Silence restorecon on clean install
  - Resolves: #987456 - RHEL6 sssd upgrade restorecon workaround for
                        /var/lib/sss/mc context


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-124
changelog:
  - Resolves: #1002161 - large number of sudo rules results in error -
                         Unable to create response: Invalid argument


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-125
changelog:
  - Resolves: #997406 - sssd_nss core dumps under load
  - Resolves: #984814 - sssd_nss terminated with segmentation fault


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-126
changelog:
  - Make IPA SELinux provider aware of subdomain users
  - A better version of already committed patch
  - Resolves: #954342 - In IPA AD trust setup, the sssd logs throws
                        'sysdb_search_user_by_name failed' error when
                        AD user tries to login via ipa client.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-128
changelog:
  - More upstream fixes to prevent memcache crashes
  - Related: #997406 - sssd_nss core dumps under load


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-129
changelog:
  - Do not crash when LDAP disconnects while a search is still in progress
  - Resolves: #1019979 - sssd_be segfault when authenticating against active
                         directory


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-130
changelog:
  - Inherit UID limits for subdomains
  - Resolves: #1020905 - Creating system accounts on a IdM client takes up
                         to 10 minutes when AD trust is configured in the IdM.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-131
changelog:
  - Allow combination of proxy id backend and LDAP auth backend
  - Resolves: #1025813 - SSSD: Allow for custom attributes in RDN when using
                         id_provider = proxy


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-132
changelog:
  - Resolves: #1038098 - sssd_nss grows memory footprint when netgroups
                         are requested


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-134
changelog:
  Resolves: #1036168 - sssd can't retrieve auto.master when using the
                       "default_domain_suffix"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.5.1-3
changelog:
  - Backport the InfoPipe patches needed for Sat6 integration
  - Related: #1051164 - Rebase SSSD to 1.11+ in RHEL6


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-2
changelog:
  - Resolves: rhbz#1104145 - public key validator is too strict and does not
                             allow newlines anywhere in the public key string,
                             not even at the end


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-3
changelog:
  - Resolves: rhbz#1110369 - sssd is started before messagebus, making
                             sssd-ifp fail


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-5
changelog:
  - Fix potential NULL dereference in IFP code
  - Related: rhbz#1110369 - sssd is started before messagebus, making
                            sssd-ifp fail


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-7
changelog:
  - Resolves: rhbz#1042922 - [RFE] Add fallback to sudoRunAs when sudoRunAsUser
                             is not defined and no ldap_sudorule_runasuser mapping
                             has been defined in SSSD


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-9
changelog:
  - Resolves: rhbz#1122158 - ad: group membership is empty when id mapping
                             is off and tokengroups are enabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-11
changelog:
  - Resolves: rhbz#1109188 - dereferencing control failure against openldap
                             server


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-12
changelog:
  - Resolves: rhbz#1111317 - [RFE] Add option for sssd to replace space with
                             specified character in LDAP group


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-13
changelog:
  - Resolves: rhbz#1122873 -  Failover does not always happen from SRV
                              to hostname resolution(via /etc/hosts)
  - Remove spurious systemctl call on %postun


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-14
changelog:
  - Resolves: rhbz#1110226 - Requests queued during transition from offline
                             to online mode


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-19
changelog:
  - Resolves: rhbz#1127757 - sssd can't retrieve sudo rules when using the
                             "default_domain_suffix" option


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-20
changelog:
  - Resolves: rhbz#1127278 -  Auth fails when space in username is
                              replaced with character set by
                              override_default_whitespace


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-21
changelog:
  - Add notes about offline mode to sssd.conf
  - Related: rhbz#1110226 - Requests queued during transition from offline
                             to online mode


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-22
changelog:
  - Use the correct sudo iterator
  - Related: rhbz#1118336 - sudo: invalid sudoHost filter with asterisk


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-23
changelog:
  - Resolves: rhbz#1099290: RFE: Be able to configure sssd to honor openldap
                            account lock to restrict access via ssh key


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-25
changelog:
  - Resolves: rhbz#1111528 - Expired shadow policy user(shadowLastChange=0)
                             is not prompted for password change


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-26
changelog:
  - Resolves: rhbz#1130017 - Saving group membership fails if provider is AD,
                             POSIX attributes are used and primary group contains
                             the user as a member


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-28
changelog:
  - Resolves: rhbz#1125187 - simple_allow_groups does not lookup groups from
                             other AD domains


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-29
changelog:
  - Resolves: rhbz#1103487 - CVE-2014-0249 - sssd: incorrect expansion of group
                             membership when encountering a non-POSIX group


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-31
changelog:
  - Resolves: rhbz#1141814 - Password expiration policies are not being
                             enforced by SSSD


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-32
changelog:
  - Resolves: rhbz#1160713 - TokenGroups for LDAP provider breaks in corner
                             cases


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-33
changelog:
  - Resolves: rhbz#1154042 - RHEL6.6 sssd (1.11) doesn't return all group
                             memberships against an IPA server


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-1
changelog:
  - Resolves: rhbz#1168347 - Rebase sssd to 1.12.x
  - The rebase resolves the following RHEL bugzillas
  - Resolves: rhbz#1172865 - sssd.conf(5) man page gives bad advice about
                             domains parameter
  - Resolves: rhbz#1172494 - PAC: krb5_pac_verify failures should not
                             be fatal (backport fix from upstream)
  - Resolves: rhbz#1171782 - [RFE]: SSSD should preserve case for user
                             uid field
  - Resolves: rhbz#1170910 - SSSD should not fail authentication when only
                             allow rules are used
  - Resolves: rhbz#1168377 - [RFE] User's home directories and shells are
                             not taken from AD when there is an IPA trust with AD
  - Resolves: rhbz#1168363 - [RFE] Add domains= option to pam_sss
  - Resolves: rhbz#1168344 - [RFE] ID Views: Support migration from the sync
                             solution to the trust solution
  - Resolves: rhbz#1161564 - [RFE]ad provider dns_discovery_domain option:
                             kerberos discovery is not using this option
  - Resolves: rhbz#1148582 - inconsistent group information when multiple
                             ad domain sections are configured in sssd
  - Resolves: rhbz#1140909 - sssd.conf man page missing subdomains_provider
                             ad support
  - Resolves: rhbz#1139878 - SSSD connection terminated after failing
                             anonymous bind to IBM Tivoli Directory Server
  - Resolves: rhbz#1135838 - Man sssd-ldap shows parameter
                             ldap_purge_cache_timeout with "Default: 10800
                             (12 hours)"
  - Resolves: rhbz#1135432 - Dereference code errors out when dereferencing
                             entries protected by ACIs
  - Resolves: rhbz#1134942 - sssd does not recognize Windows server 2012
                             R2's LDAP as AD
  - Resolves: rhbz#1123291 - automount segfaults in sss_nss_check_header
  - Resolves: rhbz#1088402 - [RFE] Allow login through SSSD using multiple
                             attributes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-2
changelog:
  - Do not mark the selinux_child helper as setuid, we don't support rootless
    SSSD in 6.7
  - Related: rhbz#1168347 - Rebase sssd to 1.12.x


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-3
changelog:
  -  Related: rhbz#1036745 - [RFE] Allow SSSD to issue shadow expiration
                             warning even if alternate authentication method
                             is used


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-4
changelog:
  - Resolves: rhbz#1171378 - Read and use the TTL value when resolving a
                             SRV query
  - Rebuild against latest krb5, add a versioned BuildRequires
  - Resolves: rhbz#1168357 - [RFE] Implement localauth plugin for MIT krb5 1.12


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-5
changelog:
  - Resolves: rhbz#1171378 - Read and use the TTL value when resolving a
                             SRV query


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-7
changelog:
  - Resolves: rhbz#1194302 - With empty ipaselinuxusermapdefault security
                             context on client is staff_u


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-9
changelog:
  - Initialize a pointer in ldap_child to NULL
  - Resolves: rhbz#1198478 - ccname_file_dummy is not unlinked on error


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-10
changelog:
  - Resolves: rhbz#1173198 - [RFE] Have OpenLDAP lock out ssh keys when
                             account naturally expires


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-11
changelog:
  - Resolves: rhbz#1098147 - [RFE] Implement background refresh for users,
                             groups or other cache objects


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-12
changelog:
  - Fix Coverity warning in ldap_child
  - Add better debugging
  - Related: rhbz#1198478 - ccname_file_dummy is not unlinked on error


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-13
changelog:
  - Resolves: rhbz#1200093 - sssd_nss segfaults if initgroups request is by
                             UPN and doesn't find anything


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-14
changelog:
  - Fix internal error codes broken when fixing rhbz#1036745
  - Related: rhbz#1036745 - [RFE] Allow SSSD to issue shadow expiration
                            warning even if alternate authentication method
                            is used


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-15
changelog:
  - Fix PAM responder initgroups cache for subdomain users
  - Log extop failures better
  - Related: rhbz#1168344 - [RFE] ID Views: Support migration from the sync
                            solution to the trust solution


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-16
changelog:
  - Fix warning in SELinux code
  - Handle setups with empty default and no SELinux maps
  - Related: rhbz#1194302 - With empty ipaselinuxusermapdefault security
                            context on client is staff_u
  - Resolves: rhbz#1202305 - sssd_be segfault on IPA(when auth with AD
                             trusted domain) client at
                             src/providers/ipa/ipa_s2n_exop.c:1605
  - Resolves: rhbz#1201847 - SSSD downloads too much information when fetching
                             information about groups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-18
changelog:
  - Resolves: rhbz#1202728 - sssd-ad requires samba3, but ipa-server-trust-ad
                             requires samba4


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-20
changelog:
  - Cherry-pick unit test changes from upstream to allow cherry-picking
    sssd-1-12 patches
  - Remove unused LDAP provider code to avoid static analyser warnings
  - Related: rhbz#1168347 - Rebase sssd to 1.12.x


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-21
changelog:
  - Handle TTL=0 in SRV queries correctly
  - Resolves: rhbz#1171378 - Read and use the TTL value when resolving a
                             SRV query


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-22
changelog:
  - Fix a typo in DEBUG message
  - Related: rhbz#1173198 - [RFE] Have OpenLDAP lock out ssh keys when
                            account naturally expires


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-23
changelog:
  - Resolves: rhbz#1205716 - Installing sssd-common-1.12.4-18.el6 might
                             install with wrong user account (root)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-25
changelog:
  - Resolves: rhbz#1206121 - ldap_access_order=ppolicy: Explicitly mention in
                             manpage that unsupported time specification will
                             lead to sssd denying access


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-27
changelog:
  - BuildRequire the proper libkrb5 version for correct localauth plugin build
  - Related: rhbz#1168357 - [RFE] Implement localauth plugin for MIT krb5 1.12


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-28
changelog:
  - Resolves: rhbz#1207720 - id lookup resolves "Domain Local" group and
                             errors appear in domain log


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-29
changelog:
  - Package the localauth plugin
  - Related: rhbz#1168357 - [RFE] Implement localauth plugin for MIT krb5 1.12


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-30
changelog:
  - Related: rhbz#1211728 - Only set the selinux context if the context
                            differs from the local one


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-31
changelog:
  - Resolves: rhbz#1203642 - GPO access control looks for computer object
                             in user's domain only


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-32
changelog:
  - Resolves: rhbz#1212017 - Sudo responder does not respect filter_users
                             and filter_groups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-33
changelog:
  - Resolves: rhbz#1213716 - idoverridegroup for ipa group with --group-name
                             does not work
  - Resolves: rhbz#1213822 - Overrides with --login work in second attempt


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-34
changelog:
  - Resolves: rhbz#1170910 - SSSD should not fail authentication when only
                             allow rules are used


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-35
changelog:
  - Resolves: rhbz#1213940 - Overridde with --login fails trusted adusers
                             group membership resolution


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-36
changelog:
  - Resolves: rhbz#1212387 - sssd_be segfault id_provider = ad
                             src/providers/ad/ad_gpo.c:843


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-37
changelog:
  - Resolves: rhbz#1217328 - autofs provider fails when default_domain_suffix
                             and use_fully_qualified_names set


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-38
changelog:
  - Include several upstream fixes related to ID views
  - Resolves: rhbz#1215195 - Override for IPA users with login does not list
                             user all groups
  - Resolves: rhbz#1213947 - Group resolution is inconsistent with group
                             overrides
  - Resolves: rhbz#1213822 - Overrides with --login work in second attempt


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-39
changelog:
  - Resolves: rhbz#1216094 - /usr/libexec/sssd/selinux_child crashes and
                             gets avc denial when ssh


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-40
changelog:
  - Resolves: rhbz#1219844 - Unable to resolve group memberships for AD
                             users when using sssd-1.12.2-58.el7_1.6.x86_64
                             client in combination with
                             ipa-server-3.0.0-42.el6.x86_64 with AD Trust


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-41
changelog:
  - Resolves: rhbz#1221358 - SSSD doesn't work with ID mapping and disabled
                             subdomains


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-42
changelog:
  - Resolves: rhbz#1215765 - sssd nss responder gets wrong number of
                             secondary groups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-45
changelog:
  - Resolves: rhbz#1226834 - id lookup for non-root domain users doesn't
                             return all groups on first attempt


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-46
changelog:
  - Resolves: rhbz#1227860 - Provide a way to disable the cleanup task
  - Resolves: rhbz#1227863 - ignore_group_members doesn't work for subdomains


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-47
changelog:
  - Resolves: rhbz#1232738 - Cache is not updated after user is deleted from
                             ldap server


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-47.1
changelog:
  - Resolves: rhbz#1258398 - sysdb sudo search doesn't escape special
                             characters


author: Nalin Dahyabhai <nalin@redhat.com> 0.7
changelog:
  - add openldap-devel as a buildprereq
  - krb5: use a continuous connection
  - krb5: add "realm" config directive
  - ldap: use a continuous connection
  - ldap: add "server", "basedn", "binddn", "user", "authuser" config directives
  - ldap: actually finish the account deletion function
  - ldap: don't send cleartext passwords to the directory
  - fix naming attribute for users (should be uid, not gid)
  - refine the search-by-id,convert-to-name,search-by-name logic
  - fix handling of defaults when the config file is read in but contains no value
  - implement an LDAP information store
  - try to clean up module naming with libtool
  - luseradd: pass plaintext passwords along
  - luseradd: use symbolic attribute names instead of hard-coded
  - lusermod: pass plaintext passwords along
  - lgroupadd: pass plaintext passwords along
  - lgroupmod: pass plaintext passwords along
  - add libuser as a dependency of libuser-devel


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - the great adding-of-the-copyright-statements
  - take more care when creating backup files in the files module


author: Nalin Dahyabhai <nalin@redhat.com> 0.8
changelog:
  - add a "quiet" prompter
  - add --interactive flag to sample apps and default to using quiet prompter
  - ldap: attempt a "self" bind if other attempts fail
  - krb5: connect to the password-changing service if the user principal has
    the NULL instance


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add functions for enumerating users and groups, optionally per-module
  - lusermod.c: -s should specify the shell, not the home directory


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - get bindings for prompts to work correctly
  - clean up some of the add/remove semantics (set source on add)
  - ldap: implement enumeration
  - samples/enum: fix the argument order


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - clean up quota bindings some more
  - finish most of the ldap bindings
  - fix a subtle bug in the files module that would show up when renaming accounts
  - fix mapping methods for entity structures in python


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - finish implementing is_locked methods in files/shadow module
  - finish cleanup of the python bindings
  - allow conditional builds of modules so that we can build without
    all of the prereqs for all of the modules


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - don't bail when writing empty fields to colon-delimited files
  - use permissions of the original file when making backup files instead of 0600


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix errors due to uninitialized fields in the python bindings
  - add kwargs support to all python wrappers
  - add a mechanism for passing arguments to python callbacks


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix group password setting in the files module
  - setpass affects both auth and info, so run both stacks


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - lib/user.c: catch and ignore errors when running stacks
  - lusermod: fix slightly bogus help messages
  - luseradd: when adding a user and group, use the gid of the group
    instead of the user's uid as the primary group
  - properly set the password field in user accounts created using
    auth-only auth modules (shadow needs "x" instead of "!!")
  - implement home directory removal, start on population


author: Nalin Dahyabhai <nalin@redhat.com> 0.16.1-1
changelog:
  - finish home directory population
  - implement home directory moving
  - change entity get semantics in the python bindings to allow default values for .get()
  - add lu_ent_has(), and a python has_key() method to Entity types
  - don't include tools in the binary package
  - add translated strings


author: Nalin Dahyabhai <nalin@redhat.com> 0.18-1
changelog:
  - actually make the new optional arguments optional
  - fix lu_error_new() to actually report errors right
  - fix part of the python bindings
  - include tools in the binary package again
  - fixup modules so that password-changing works right again
  - add a "key" field to prompt structures for use by apps which like to
    cache these things
  - add an optional "mvhomedir" argument to userModify (python)


author: Nalin Dahyabhai <nalin@redhat.com> 0.20-1
changelog:
  - only call the auth module when setting passwords (oops)
  - use GTrees instead of GHashTables for most internal tables
  - files: complain properly about unset attributes
  - files: group passwords are single-valued, not multiple-valued
  - add lpasswd app, make sure all apps start up popt with the right names


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - luserdel: remove the user's primary group if it has the same name as
    the user and has no members configured (-G disables)
  - fixup some configure stuff to make libuser.conf get generated correctly
    even when execprefix isn't specified


author: Nalin Dahyabhai <nalin@redhat.com> 0.21-1
changelog:
  - finish adding a sasldb module which manipulates a sasldb file
  - add users_enumerate_by_group and groups_enumerate_by_users


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - print uids and gids of users and names in lid app
  - fix tree traversal in users_enumerate_by_group and groups_enumerate_by_users
  - implement enumerate_by_group and enumerate_by_user in ldap module
  - fix id-based lookups in the ldap module
  - implement islocked() method in ldap module
  - implement setpass() method in ldap module
  - add lchfn and lchsh apps
  - add %d substitution to libuser.conf


author: Nalin Dahyabhai <nalin@redhat.com> 0.23-1
changelog:
  - install sv translation
  - make lpasswd prompt for passwords when none are given on the command line
  - make sure all user-visible strings are marked for translation
  - clean up some user-visible strings
  - require PAM authentication in lchsh, lchfn, and lpasswd for non-networked modules


author: Nalin Dahyabhai <nalin@redhat.com> 0.24-3
changelog:
  - stop leaking descriptors in the files module
  - speed up user creation by reordering some checks for IDs being in use
  - update the shadowLastChanged attribute when we set a password
  - adjust usage of getXXXXX_r where needed
  - fix assorted bugs in python binding which break prompting


author: Nalin Dahyabhai <nalin@redhat.com> 0.25-1
changelog:
  - close up some memory leaks
  - add the ability to include resident versions of modules in the library


author: Nalin Dahyabhai <nalin@redhat.com> 0.25.1-1
changelog:
  - rename the quota source files to match the library, which clears up a
    file conflict with older quota packages
  - add ja translation files


author: Nalin Dahyabhai <nalin@redhat.com> 0.26-1
changelog:
  - lusermod: change user name in groups the user is a member of during renames
  - lgroupmod: change primary GID for users who are in the group during renumbers
  - ldap.c: handle new attributes more gracefully if possible
  - add ru translation files


author: Nalin Dahyabhai <nalin@redhat.com> 0.27-1
changelog:
  - add ko translation files
  - files.c: fix a heap corruption bug in lock/unlock (#51750)
  - files.c: close a memory leak in reading of files


author: Nalin Dahyabhai <nalin@redhat.com> 0.28-1
changelog:
  - apps: print usage on errors
  - lnewusers.c: initialize groups as groups, not users
  - lnewusers.c: set passwords for new accounts
  - luseradd.c: accept group names in addition to IDs for the -g flag
  - luseradd.c: allow the primary GID to be a preexisting group


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - HUP nscd on modifications
  - userutil.c: mmap files we're reading for probable speed gain
  - userutil.c: be conservative with the amount of random data we read
  - docs fixes


author: Nalin Dahyabhai <nalin@redhat.com> 0.30-1
changelog:
  - quotaq: fix argument order when reading quota information
  - user_quota: set quota grace periods correctly
  - luseradd: never create home directories for system accounts


author: Nalin Dahyabhai <nalin@redhat.com> 0.32-1
changelog:
  - link the python module against libpam
  - attempt to import the python modules at build-time to verify dependencies


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - renamed the python module
  - revamped internals to use gobject's gvalues and gvaluearrays instead of
    glists of cached strings
  - add enumeration-with-data functions to the C library


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.91-1
changelog:
  - ldap: finish port to new API
  - sasl: finish port to new API (needs test)
  - libuser: don't commit object changes before passing data to service
    functions which might need differing data sets to figure out what to
    change (for example, ldap)


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.93-1
changelog:
  - move shadow initialization for groups to the proper callback
  - rework locking in the files module to not require that files be writable


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.97-1
changelog:
  - files: fix bug in removals
  - ldap: revert attempts at being smart at startup time, because it makes UIs
    very messy (up the three whole dialogs just to start the ldap stuff!)


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.98-1
changelog:
  - automatically refresh entities after add, modify, setpass, removepass,
    lock, and unlock operations
  - remove debug spewage when creating and removing mail spools
  - files: fix saving of multi-valued attributes
  - rename MEMBERUID attribute for groups to MEMBERNAME


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.100-1
changelog:
  - be more careful about printing error messages
  - fix refreshing after adding of accounts
  - ldap: try to use a search to convert names to DNs, and only fall back to
    guessing if it turns up nothing
  - files: fix an off-by-one in removal of entries


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.101-1
changelog:
  - fix python bindings of enumerateFull functions
  - adjust prompter wrapping to not error out on successful returns


author: Nalin Dahyabhai <nalin@redhat.com> 0.51-1
changelog:
  - files: ignore blank lines in files
  - libuser: disallow creation of accounts with names containing whitespace,
    control characters, or non-ASCII characters


author: Nalin Dahyabhai <nalin@redhat.com> 0.51.5-1
changelog:
  - expose lu_get_first_unused_id() as a package-private function
  - provide libuser.ADMIN.getFirstUnusedUid and libuser.ADMIN.getFirstUnusedGid
    in python


author: Nalin Dahyabhai <nalin@redhat.com> 0.51.6-1
changelog:
  - use a crypt salt consistent with the defaults/crypt_style setting when
    setting new passwords (#79337)


author: Nalin Dahyabhai <nalin@redhat.com> 0.51.7-1
changelog:
  - ldap: set error codes correctly when we encounter failures initializing
  - don't double-close modules which fail initialization
  - ldap: don't set an error in cases where one is already set


author: Miloslav Trmac <mitr@redhat.com> - 0.51.8-1
changelog:
  - Update to build with latest autotools and gtk-doc
  - Update ALL_LINGUAS and POTFILES.in
  - Rebuild to depend on newer openldap


author: Miloslav Trmac <mitr@redhat.com> - 0.51.10-1
changelog:
  - Don't attempt to lookup using original entity name after entity
    modification (rename in particular) (#78376, #121252)
  - Fix copying of symlinks from /etc/skel (#87572, original patch from gLaNDix)
  - Make --enable-quota work, and fix the quota code to at least compile (#89114)
  - Fix several bugs (#120168, original patch from Steve Grubb)
  - Don't hardcode python version in spec file (#130952, from Robert Scheck)
  - Properly integrate the SELinux patch, it should actually be used now, even
    though it was "enabled" since 0.51.7-6


author: Miloslav Trmac <mitr@redhat.com> - 0.51.11-1
changelog:
  - Allow documented optional arguments in Python
    ADMIN.{addUser,modifyUser,deleteUser} (#119812)
  - Add man pages for lchfn and lchsh
  - LDAP fixes, first round
  - Avoid file conflict on multilib systems
  - Call ldconfig correctly


author: Miloslav Trmac <mitr@redhat.com> - 0.51.12-1
changelog:
  - Don't claim success and exception at the same time (#133479)
  - LDAP fixes, second round
  - Various other bugfixes


author: Miloslav Trmac <mitr@redhat.com> - 0.52.2-1
changelog:
  - Allow LDAP connection using ldaps, custom ports or without TLS (original
    patch from Pawel Salek).


author: Miloslav Trmac <mitr@redhat.com> - 0.52.5-1
changelog:
  - Fix home directory renaming in ADMIN.modifyUser (#135280)
  - Further Python reference counting fixes


author: Miloslav Trmac <mitr@redhat.com> - 0.52.6-1
changelog:
  - Make error reporting more consistent, more verbose and always on stderr
    (partly #133861, original patch by Pawel Salek)
  - Mark strings previously blocked by string freeze for translation


author: Miloslav Trmac <mitr@redhat.com> - 0.53-1
changelog:
  - Support UID and GID values larger than LONG_MAX (#124967)
  - Fix updating of groups after user renaming in lusermod
  - Allow setting a shadow password even if the current shadow password is
    invalid (#131180)
  - Add lu_{user,group}_unlock_nonempty (#86414); module interface ABI has 
    changed
  - Miscellaneous bug and memory leak fixes


author: Miloslav Trmac <mitr@redhat.com> - 0.53.2-1
changelog:
  - Important bug fixes in lchage, lgroupmod, lnewusers and lusermod
  - Minor bug fixes in lpasswd and luseradd
  - Add man pages for the utilities (#61673)


author: Miloslav Trmac <mitr@redhat.com> - 0.53.3-1
changelog:
  - Don't silently ignore some I/O errors
  - Don't include a Cyrus SASL v1 header file when libldap links to v2 (#150046)
  - Rebuild with gcc 4


author: Miloslav Trmac <mitr@redhat.com> - 0.53.3-2
changelog:
  - Add Requires: glib2-devel to libuser-devel (#152501)
  - Run ldconfig using %post{,un} -p to let RPM play tricks


author: Miloslav Trmac <mitr@redhat.com> - 0.53.5-1
changelog:
  - Ignore nss_compat lines in the "files" module (#154651)
  - Autodetect Python version (#154096)
  - Add BuildRequires: libselinux-devel, s/BuildPrereq/BuildRequires/


author: Miloslav Trmac <mitr@redhat.com> - 0.53.8-1
changelog:
  - Permit "portable" user and group names as defined by SUSv3, plus trailing $
    (#159452)
  - Don't build static libraries


author: Miloslav Trmac <mitr@redhat.com> - 0.54-1
changelog:
  - Make sure attributes with no values can never appear
  - Fix crash in the "files" module when an attribute is missing
  - Use hidden visibility for internal functions, remove them from
    libuser/user_private.h; this changes module interface ABI


author: Miloslav Trmac <mitr@redhat.com> - 0.54.1-1
changelog:
  - Support importing of configuration from shadow-utils (/etc/login.defs and
    /etc/default/useradd)
  - Add libuser.conf(5) man page


author: Miloslav Trmac <mitr@redhat.com> - 0.54.6-1
changelog:
  - Fix bugs in handling of invalid lines in the files and shadow modules
  - Fix pattern matching in lu_*_enumerate_full in the files and shadow modules
  - Add more error reporting, return non-zero exit status on error from utils
  - Use the skeleton directory specified in libuser.conf by Python
    admin.createHome and admin.addUser, add parameter skeleton= to admin.addUser
    (#189984)


author: Miloslav Trmac <mitr@redhat.com> - 0.56-1
changelog:
  - Tighten the API and implementation to avoid corrupting number-like strings;
    the module interface ABI has changed
    Resolves: #226976


author: Miloslav Trmac <mitr@redhat.com> - 0.56.1-1
changelog:
  - When changing passwords, only silently ignore know shadow markers, not all
    invalid hashes
    Resolves: #225495


author: Miloslav Trmač <mitr@redhat.com> - 0.56.4-2
changelog:
  - Split the Python module to a separate subpackage (original patch by Yanko
    Kaneti)
  - Update the License: tag


author: Miloslav Trmač <mitr@redhat.com> - 0.56.5-1
changelog:
  - Work around spurious error messages when run against the Fedora Directory
    server
  - Fix error reporting when creating home directories and creating/removing mail
    spool files
    Resolves: #318121


author: Miloslav Trmač <mitr@redhat.com> - 0.56.6-1
changelog:
  - Set SELinux file contexts when creating home directories, preserve them when
    moving home directories
    Resolves: #351201


author: Miloslav Trmač <mitr@redhat.com> - 0.56.7-1
changelog:
  - Add support for SHA256 and SHA512 in password hashes
    Related: #173583
  - Fix file locking on some architectures
  - Rename sr@Latn.po to sr@latin.po
    Resolves: #426584
  - Address issues from a review by Jason Tibbitts:
    - Remove default.-c, moving the provided functions to libuser proper
    - Remove the WITH_SELINUX build option
    - Move Python library test to %check
    Resolves: #226054


author: Miloslav Trmač <mitr@redhat.com> - 0.56.11-1
changelog:
  - Update to libuser-0.56.11.
    Resolves: #454091
    Resolves: #456267
    Resolves: #456270
    Resolves: #487129


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-1
changelog:
  - Update to libuser-0.56.13.
    Resolves: #251951
    Resolves: #454079
    Resolves: #456373
    Resolves: #456382
    Resolves: #530513


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-2
changelog:
  - Allow supplying passwords from scripts
  - Allow specifying a LDAP simple bind password in libuser.conf
    Resolves: #562832


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-5
changelog:
  - Correctly mark the LDAP default password value as encrypted (CVE-2011-0002)
    Resolves: #668021
  - Default LDAP cn to username if gecos is empty
    Resolves: #670151
  - Preserve setuid and setgid bits when copying files from /etc/skel
    Resolves: #724987
  - Fix segfault when reading database files with certain sizes
    Resolves: #788521


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-7
changelog:
  - Don’t use 512-bit RSA private keys in tests
    Related: #1235518
  - Fix testsuite failures if more than one architecture is building concurrently
    Related: #1235518


author: Daniel Veillard <veillard@redhat.com> 0.0.6-1
changelog:
  - added error handling APIs
  - small bug fixes
  - improve python bindings
  - augment documentation and regression tests


author: Daniel Veillard <veillard@redhat.com> 0.1.0-1
changelog:
  - various fixes
  - new APIs: for Node information and Reboot
  - virsh improvements and extensions
  - documentation updates and man page
  - enhancement and fixes of the XML description format


author: Daniel Veillard <veillard@redhat.com> 0.1.1-1
changelog:
  - extend and cleanup the driver infrastructure and code
  - python examples
  - extend uuid support
  - bug fixes, buffer handling cleanups
  - support for new Xen hypervisor API
  - test driver for unit testing
  - virsh --conect argument


author: Daniel Veillard <veillard@redhat.com> 0.1.4-1
changelog:
  - vCPUs and affinity support
  - more complete XML, console and boot options
  - specific features support
  - enforced read-only connections
  - various improvements, bug fixes


author: Daniel Veillard <veillard@redhat.com> 0.1.5-1
changelog:
  - new release
  - bug fixes
  - support for new hypervisor calls
  - early code for config files and defined domains


author: Daniel Veillard <veillard@redhat.com> 0.1.6-1
changelog:
  - Support for localization
  - Support for new Xen-3.0.3 cdrom and disk configuration
  - Support for setting VNC port
  - Fix bug when running against xen-3.0.2 hypercalls
  - Fix reconnection problem when talking directly to http xend


author: Daniel Veillard <veillard@redhat.com> 0.1.7-1
changelog:
  - Fix bug when running against xen-3.0.3 hypercalls
  - Fix memory bug when getting vcpus info from xend


author: Daniel Veillard <veillard@redhat.com> 0.1.8-1
changelog:
  - fix missing page size detection code for ia64
  - fix mlock size when getting domain info list from hypervisor
  - vcpu number initialization
  - don't label crashed domains as shut off
  - fix virsh man page
  - blktapdd support for alternate drivers like blktap
  - memory leak fixes (xend interface and XML parsing)
  - compile fix
  - mlock/munlock size fixes


author: Daniel Veillard <veillard@redhat.com> 0.1.9-1
changelog:
  - better error reporting
  - python bindings fixes and extensions
  - add support for shareable drives
  - add support for non-bridge style networking
  - hot plug device support
  - added support for inactive domains
  - API to dump core of domains
  - various bug fixes, cleanups and improvements
  - updated the localization


author: Daniel Veillard <veillard@redhat.com> 0.1.10-1.fc7
changelog:
  - support for inactive Xen domains
  - improved support for Xen display and vnc
  - a few bug fixes
  - localization updates


author: Daniel P. Berrange <berrange@redhat.com> - 0.2.0-2.fc7
changelog:
  - Fixed path to qemu daemon for autostart
  - Fixed generation of <features> block in XML
  - Pre-create config directory at startup


author: Daniel P. Berrange <berrange@redhat.com> - 0.2.0-3.fc7
changelog:
  - Disable kqemu support since its not in Fedora qemu binary
  - Fix for -vnc arg syntax change in 0.9.0  QEMU


author: Daniel Veillard <veillard@redhat.com> - 0.2.1-1
changelog:
  - Release of 0.2.1
  - lot of bug and portability fixes
  - Add support for network autostart and init scripts
  - New API to detect the virtualization capabilities of a host
  - Documentation updates


author: Jeremy Katz <katzj@redhat.com> - 0.2.1-2.fc7
changelog:
  - don't require xen; we don't need the daemon and can control non-xen now
  - fix scriptlet error (need to own more directories)
  - update description text


author: Daniel Veillard <veillard@redhat.com> - 0.2.3-1
changelog:
  - Release of 0.2.3
  - lot of assorted bugfixes and cleanups
  - support for Xen-3.1
  - new scheduler API


author: Daniel Veillard <veillard@redhat.com> - 0.3.0-1
changelog:
  - Release of 0.3.0
  - Secure remote access support
  - unification of daemons
  - lots of assorted bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.3.1-1
changelog:
  - Release of 0.3.1
  - localtime clock support
  - PS/2 and USB input devices
  - lots of assorted bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.3.2-1
changelog:
  - Release of 0.3.2
  - API for domains migration
  - APIs for collecting statistics on disks and interfaces
  - lots of assorted bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.3.3-1
changelog:
  - Release of 0.3.3
  - Avahi support
  - NUMA support
  - lots of assorted improvements, bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.4.0-1
changelog:
  - Release of 0.4.0
  - SASL based authentication
  - PolicyKit authentication
  - improved NUMA and statistics support
  - lots of assorted improvements, bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.4.1-1
changelog:
  - Release of 0.4.1
  - Storage APIs
  - xenner support
  - lots of assorted improvements, bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.7.0-1
changelog:
  - ESX, VBox3, Power Hypervisor drivers
  - new net filesystem glusterfs
  - Storage cloning for LVM and Disk backends
  - interface implementation based on netcf
  - Support cgroups in QEMU driver
  - QEmu hotplug NIC support
  - a lot of fixes


author: Mark McLoughlin <markmc@redhat.com> - 0.7.0-2
changelog:
  - Make sure qemu can access kernel/initrd (bug #516034)
  - Set perms on /var/lib/libvirt/boot to 0711 (bug #516034)


author: Mark McLoughlin <markmc@redhat.com> - 0.7.0-5
changelog:
  - Add PCI host device hotplug support
  - Allow PCI bus reset to reset other devices (#499678)
  - Fix stupid PCI reset error message (bug #499678)
  - Allow PM reset on multi-function PCI devices (bug #515689)
  - Re-attach PCI host devices after guest shuts down (bug #499561)
  - Fix list corruption after disk hot-unplug
  - Fix minor 'virsh nodedev-list --tree' annoyance


author: Mark McLoughlin <markmc@redhat.com> - 0.7.1-0.2.gitfac3f4c
changelog:
  - Update to newer snapshot of 0.7.1
  - Stop libvirt using untrusted 'info vcpus' PID data (#520864)
  - Support relabelling of USB and PCI devices
  - Enable multipath storage support
  - Restart libvirtd upon RPM upgrade


author: Daniel Veillard <veillard@redhat.com> - 0.7.1-1
changelog:
  - Upstream release of 0.7.1
  - ESX, VBox driver updates
  - mutipath support
  - support for encrypted (qcow) volume
  - compressed save image format for Qemu/KVM
  - QEmu host PCI device hotplug support
  - configuration of huge pages in guests
  - a lot of fixes


author: Mark McLoughlin <markmc@redhat.com> - 0.7.1-8
changelog:
  - Disable sound backend, even when selinux is disabled (#524499)
  - Re-label qcow2 backing files (#497131)


author: Mark McLoughlin <markmc@redhat.com> - 0.7.1-10
changelog:
  - Create /var/log/libvirt/{lxc,uml} dirs for logrotate
  - Make libvirt-python dependon on libvirt-client
  - Sync misc minor changes from upstream spec


author: Mark McLoughlin <markmc@redhat.com> - 0.7.1-11
changelog:
  - Fix libvirtd memory leak during error reply sending (#528162)
  - Add several PCI hot-unplug typo fixes from upstream


author: Daniel Veillard <veillard@redhat.com> - 0.7.2-1
changelog:
  - Upstream release of 0.7.2
  - Allow to define ESX domains
  - Allows suspend and resulme of LXC domains
  - API for data streams
  - many bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.7.4-1
changelog:
  - upstream release of 0.7.4
  - udev node device backend
  - API to check object properties
  - better QEmu monitor processing
  - MAC address based port filtering for qemu
  - support IPv6 and multiple addresses per interfaces
  - a lot of fixes


author: Daniel Veillard <veillard@redhat.com> - 0.7.5-1
changelog:
  - Add new API virDomainMemoryStats
  - Public API and domain extension for CPU flags
  - vbox: Add support for version 3.1
  - Support QEMU's virtual FAT block device driver
  - a lot of fixes


author: Daniel Veillard <veillard@redhat.com> - 0.7.6-0.pre20100121
changelog:
  - Push a prerelease version of 0.7.6 for testing in Beta1
  - Allow specifying -cpu model/flags for qemu
  - Resolves: rhbz#515213
  - Add async qemu machine protocol to libvirt based on JSON QEmu API
  - Resolves: rhbz#518701
  - Allow for static PCI address assignment to all devices
  - Resolves: rhbz#481924
  - expose qemu's -fda fat:floppy feature (525074)
  - configuration of virtual CPU topology (sockets, threads, cores) (538015)
  - rewrite file chown'ing code to use security driver framework (547545 )
  - cannot create a headless KVM virtual machine (548127)
  - Improve virsh schedular parameters documentation (548485)
  - Fail to delete a inactive pool using command "virsh pool-delete" (530985)
  - virsh man page updation for using container (lxc:///) (528709)
  - Command 'virsh vcpuinfo' returns libvirt error in RHEL6 with KVM (522829)
  - Expose information about host CPU flags in capabilities (518062)


author: Daniel Veillard <veillard@redhat.com> - 0.7.6-1
changelog:
  - upstream release of 0.7.6
  - Use QEmu new device adressing when possible
  - Implement CPU topology support for QEMU driver
  - Implement SCSI controller hotplug/unplug for QEMU
  - Implement support for multi IQN
  - a lot of fixes and improvements
  - Resolves: rhbz#558761


author: Daniel Veillard <veillard@redhat.com> - 0.7.6-2
changelog:
  - enable JSON interface, desactivated by default in 0.7.6
  - Resolves: rhbz#563189
  - make sure cgroups are installed and that cgconfig service is on
  - Resolves: rhbz#531263


author: Daniel P. Berrange <berrange@redhat.com> - 0.7.6-3
changelog:
  - Fix balloon units handling in JSON mode (rhbz #566261)
  - Invoke qmp_capabilities at monitor startup (rhbz #563189)


author: Daniel Veillard <veillard@redhat.com> - 0.7.7-1
changelog:
  - macvtap support (rhbz#553348)
  - async job handling (rhbz #515278)
  - virtio channel (rhbz#515281)
  - computing baseline CPU
  - virDomain{Attach,Detach}DeviceFlags
  - Improve libvirt error reporting for failed migrations (rhbz#528793)
  - qemu driver support CPU hotplug (rhbz#533138)
  - wrong (octal) device number for attaching USB devices (rhbz#549840)
  - cannot save domain into root_squashing nfs export (rhbz#558763)
  - assorted bug fixes and lots of cleanups


author: Daniel Veillard <veillard@redhat.com> - 0.7.8-0.pre20100312
changelog:
  - preview for 0.7.8 rebase
  - Extra non upstream basic patch for spice and XQL
  - Resolves: rhbz#515264
  - Resolves: rhbz#515265
  - connected virsh dies with a SIGPIPE after libvirtd restart
  - Resolves: rhbz#526656
  - error when running logrotate on s/390x arch
  - Resolves: rhbz#547514


author: Daniel Veillard <veillard@redhat.com> - 0.7.8-0.pre20100322
changelog:
  - preview #2 for 0.7.8 rebase
  - migration max downtime API
  - Resolves: rhbz#561935
  - allow suspend during migration
  - Resolves: rhbz#561934
  - support vhost net mode at qemu startup for net devices
  - Resolves: rhbz#540391
  - read-only device access support for qemu
  - Resolves: rhbz#556769
  - LSB compliance of libvirtd init script
  - Resolves: rhbz#538701
  - No domain vcpu information output when using JSON monitor
  - Resolves: rhbz#572051
  - "qemudDomainSetMaxMemory" does not work and should be removed
  - Resolves: rhbz#572146
  - after setvcpus, any virsh command will be hung
  - Resolves: rhbz#572193
  - virsh interactive terminal crash or hung
  - Resolves: rhbz#572376
  - virsh hangs after core dump
  - Resolves: rhbz#572544
  - Fix very slow file allocation on ext3


author: Daniel Veillard <veillard@redhat.com> - 0.7.8-0.pre20100330
changelog:
  - preview #3 for 0.7.8 rebase
  - kvm hpet support
  - Resolves: rhbz#576973
  - hook scripts support
  - Resolves: rhbz#569965
  - Need to add time keeping abstraction
  - Resolves: rhbz#557285
  - notification of guest reboot
  - Resolves: rhbz#527572
  - Ability to preserve RTC clock adjustments across guest reboots
  - Resolves: rhbz#515273
  - Notifications of guest stopping due to disk I/O errors
  - Resolves: rhbz#515270
  - VNC ticketing support (524623) spice still needed
  - VNC client disconnect/connect events (515268) spice still needed


author: Daniel Veillard <veillard@redhat.com> - 0.8.0-0.pre20100407
changelog:
  - preview #4 for 0.8.0 rebase
  - snapshot API
  - domain with disk on root-squashing nfs and security driver mismatch
  - Resolves: rhbz#578630
  - Fail to read xml when restore domain
  - Resolves: rhbz#577719
  - loop "virsh cd" in virsh interactive terminal generate unknown error
  - Resolves: rhbz#572380
  - support setting qemu's -drive werror=stop/enospc with configuration
  - Resolves: rhbz#526231


author: Daniel Veillard <veillard@redhat.com> - 0.8.0-1
changelog:
  - official 0.8.0 upstream release
  - Resolves: rhbz#558761
  - new patch set of patches for RHEL-6 SPICE and addons
  - Enable QMP/ JSON mode in the QEMU monitor
  - Resolves: rhbz#563189
  - Support configuration of SPICE as a graphics protocol
  - Resolves: rhbz#515265
  - vnc (and spice) ticketing
  - Resolves: rhbz#524623
  - enable spice tls encryption in domainXML, and which channels are encrypted
  - Resolves: rhbz#573382
  - notification of VNC/SPICE client disconnect/connect events
  - Resolves: rhbz#515268


author: Daniel P. Berrange <berrange@redhat.com> - 0.8.0-2
changelog:
  - Refresh SPICE patches to fix test failures
  - Related: rhbz#515265, rhbz#524623, rhbz#573382
  - Enable test suite during build, disabling tests that don't work in mock
  - Related: rhbz#558761


author: Daniel Veillard <veillard@redhat.com> - 0.8.0-3
changelog:
  - Build ESX support in
  - Resolves: rhbz#581966
  - a batch of network filter fixes, IBM request and upstream fixes
  - Resolves: rhbz#579993
  - couple of patchs to fix device handling with QMP
  - Related: rhbz#563189
  - fix python binding for snapshotting
  - spec file fixes for nwfiler build and RHEL-5 virt-v2v specific rebuild


author: Daniel Veillard <veillard@redhat.com> - 0.8.0-4
changelog:
  - Fix libvirtd startup when avahi failed to look up local host name
  - CPU selection fixes
  - Resolves: rhbz#581627
  - fix migration poll value
  - Resolves: rhbz#584928
  - crash dump job caused libvirt hang
  - Resolves: rhbz#580853
  - Fix initial VCPU pinning in qemu driver
  - Resolves: rhbz#578434
  - fix cpu hotplug command names


author: Daniel Veillard <veillard@redhat.com> - 0.8.1-2
changelog:
  - Don't wipe generated iface target in active domains (588046)
  - Fix LXC domain lookup and error handling (586361)
  - Fix a protocol breakage introduced in libvirt-0.8.0
  - Add support for nic hotplug in QEMU/KVM (589978)
  - Seemless migration of spice graphics clients (589989)
  - fix build with ESX support
  - Resolves: rhbz#581966
  - fix multilib problem (587231)


author: Daniel Veillard <veillard@redhat.com> - 0.8.1-3
changelog:
  - missing python bindings due to older XML api
  - Resolves: rhbz#589453
  - Fix two possible crashes in JSON event dispatch
  - Resolves: rhbz#586353
  - Fix handling of disk backing stores with cgroups
  - Resolves: rhbz#581476
  - virsh schedinfo --set error handling on unknow parameters
  - Resolves: rhbz#586632
  - Apply extra patches for nwfilter
  - Resolves: rhbz#588554
  - Fix hang during concurrent guest migrations
  - Resolves: rhbz#582278


author: Dave Allan <dallan@redhat.com> - 0.8.1-5
changelog:
  - Don't reset user/group/security label for any files on shared filesystems
  - Resolves: rhbz#578889
  - Make saved state labelling ignore the dynamic_ownership parameter
  - Resolves: rhbz#588562
  - Fix & protect against NULL pointer dereference in monitor code
  - Resolves: rhbz#591076
  - Fix virFileResolveLink return value
  - Resolves: rhbz#591363
  - Add support for SSE4.1 and SSE4.2 CPU features
  - Resolves: rhbz#592977


author: Dave Allan <dallan@redhat.com> - 0.8.1-6
changelog:
  - Support seamless migration of SPICE graphics clients (refresh)
  - Resolves: rhbz#591551
  - Fix swapping of PCI vendor & product names in udev backend
  - Resolves: rhbz#578419
  - Fix cgroup setup code to cope with root squashing NFS
  - Resolves: rhbz#593193
  - Fix startup error reporting race
  - Resolves: rhbz#591272


author: Dave Allan <dallan@redhat.com> - 0.8.1-7
changelog:
  - Fix sign extension error in libvirt's parsing of qemu options
  - Resolves: rhbz#592070
  - Graceful shutdown/suspend of libvirt guests on host shutdown
  - Resolves: rhbz#566647
  - Fix pci device hotplug
  - Resolves: rhbz#572867
  - Support 802.1Qbg and bh
  - Resolves: rhbz#532760, rhbz#570949, rhbz#590110, rhbz#570923


author: Dave Allan <dallan@redhat.com> - 0.8.1-8
changelog:
  - Ensure virtio serial has stable addressing
  - Resolves: rhbz#586665
  - SELinux socket labelling on QEMU monitor socket for MLS
  - Resolves: rhbz#593739
  - Fix enumeration of partitions in disks with a trailing digit in path
  - Resolves: rhbz#593785
  - Enable probing of VPC disk format type
  - Resolves: rhbz#597981
  - Delete UNIX domain sockets upon daemon shutdown
  - Resolves: rhbz#598163
  - Fix Migration failure 'canonical hostname pointed to localhost'
  - Resolves: rhbz#589864
  - Fix up the python bindings for snapshotting
  - Resolves: rhbz#591839
  - Sanitize pool target paths
  - Resolves: rhbz#593565
  - Prevent host network conflicts
  - Resolves: rhbz#594494
  - Support 802.1Qbg and bh (vnlink/VEPA) (refresh)
  - Resolves: rhbz#590110


author: Dave Allan <dallan@redhat.com> - 0.8.1-9
changelog:
  - Touch libvirt-guests lockfile
  - Resolves: rhbz#566647
  - Add qemu.conf option for clearing capabilities
  - Resolves: rhbz#593903
  - Add support for launching guest in paused state
  - Resolves: rhbz#589465
  - Add virsh vol-pool command
  - Resolves: rhbz#602217
  - Add vol commands to virsh man page
  - Resolves: rhbz#600640
  - Remove bogus migrate error messages
  - Resolves: rhbz#601575


author: Dave Allan <dallan@redhat.com> - 0.8.1-10
changelog:
  - Add multiIQN XML output
  - Resolves: rhbz#587700
  - Fix udev node device parent-child device relationships
  - Resolves: rhbz#593995
  - Fix leaks in udev device add/remove
  - Resolves: rhbz#595490
  - Fix device destroy return value
  - Resolves: rhbz#597998
  - Update nodedev scsi_host data before use
  - Resolves: rhbz#600048
  - Display wireless devices in nodedev list
  - Resolves: rhbz#604811
  - Show pool and domain persistence
  - Resolves: rhbz#603696
  - Fix cleanup after failing to hotplug a PCI device
  - Resolves: rhbz#605168
  - Add '-nodefconfig' command line arg to QEMU
  - Resolves: rhbz#602778
  - Switch to private redhat namespace for QMP I/O error reason
  - Resolves: rhbz#586353
  - Improve error messages for missing drivers & unsupported functions
  - Resolves: rhbz#595609
  - macvtap: get interface index if not provided
  - Resolves: rhbz#605187
  - Fix leaks in remote code
  - Resolves: rhbz#603442
  - Add an optional switch --uuid to the virsh vol-pool command
  - Resolves: rhbz#604929
  - Change per-connection hashes to be indexed by UUIDs
  - Resolves: rhbz#603494
  - Run virsh from libvirt-guests script with /dev/null on stdin
  - Resolves: rhbz#606314
  - Increase dd block size to speed up domain save
  - Resolves: rhbz#601775
  - Fix reference counting bugs on qemu monitor
  - Resolves: rhbz#602660
  - Add missing action parameter in IO error callback
  - Resolves: rhbz#607157


author: Dave Allan <dallan@redhat.com> - 0.8.1-11
changelog:
  - Do not block during incoming migration
  - Resolves: rhbz#579440
  - Label serial devices
  - Resolves: rhbz#585249
  - parthelper: fix compilation without optimization
  - Related: rhbz#593785
  - Fix name/UUID uniqueness checking in storage/network
  - Resolves: rhbz#593951
  - Don't squash file permissions when migration fails
  - Resolves: rhbz#607922
  - Properly handle 'usbX' sysfs files
  - Resolves: rhbz#603867
  - add pool support to vol-key command & improve vol commands help
  - Resolves: rhbz#598365
  - document attach-disk better
  - Resolves: rhbz#601143
  - Config iptables to allow tftp port if network <tftp> element exists
  - Resolves: rhbz#607294
  - Fix failure to generate python bindings when libvirt.h.in is updated
  - Related: rhbz#589465
  - Allow all interface names
  - Resolves: rhbz#593907
  - Fix nodedevice refcounting
  - Resolves: rhbz#608753
  - Move nwfilter functions inside extern C and fix a locking bug
  - Resolves: rhbz#597391
  - Fix failure to restore qemu domains with selinux enforcing
  - Resolves: rhbz#590975
  - Check for presence of qemu -nodefconfig option before using it
  - Resolves: rhbz#608859


author: Dave Allan <dallan@redhat.com> - 0.8.1-12
changelog:
  - Don't invoke destroy callback from qemuMonitorOpen() failure paths
  - Resolves: rhbz#609060
  - virFileResolveLink: guarantee an absolute path
  - Resolves: rhbz#608092
  - SPICE patches have translatable strings without format args
  - Resolves: rhbz#608917
  - No way to pass disk format type to pool-define-as nor pool-create-as
  - Resolves: rhbz#597790
  - Fix enforcement of direction of traffic for rules describing incoming traffic
  - Resolves: rhbz#606889
  - Clarify virsh help pool-create-as text
  - Resolves: rhbz#609044


author: Dave Allan <dallan@redhat.com> - 0.8.1-14
changelog:
  - Support virtio disk hotplug in JSON mode
  - Resolves: rhbz#573946
  - Fix QEMU monitor JSON crash
  - Resolves: rhbz#604585
  - CVE-2010-2237 CVE-2010-2238 CVE-2010-2239
  - Resolves: rhbz#607817
  - CVE-2010-2242 Apply a source port mapping to virtual network masquerading
  - Resolves: rhbz#608049
  - Fix hang if QEMU exits (almost) immediately
  - Resolves: rhbz#610056
  - Support new CPU models provided by qemu-kvm
  - Resolves: rhbz#605830
  - Fix comparison of two host CPUs
  - Resolves: rhbz#611401
  - Don't mess with the CPU returned by arch driver
  - Resolves: rhbz#613014
  - Fail when CPU type cannot be detected from XML
  - Resolves: rhbz#613760
  - Use -nodefconfig when probing for CPU models
  - Resolves: rhbz#613764
  - cpuCompare: Fix crash on unexpected CPU XML
  - Resolves: rhbz#613765
  - Properly report failure to create raw storage volume files
  - Related: rhbz#547543
  - Fix IOErrorReasonCallback python bindings
  - Related: rhbz#586353
  - Parthelper: canonicalize block device paths
  - Related: rhbz#593785


author: Dave Allan <dallan@redhat.com> - 0.8.1-16
changelog:
  - Make PCI device ordering consistent with older releases
  - Resolves: rhbz#592026
  - Fix libvirtd hang during concurrent bi-directional migration
  - Resolves: rhbz#599590


author: Dave Allan <dallan@redhat.com> - 0.8.1-17
changelog:
  - Set a stable & high MAC addr for guest TAP devices
  - Resolves: rhbz#616517
  - Fix bogus commit of -16 patches
  - Related: rhbz#592026
  - Related: rhbz#599590


author: Dave Allan <dallan@redhat.com> - 0.8.1-19
changelog:
  - Add character device backend activating QEMU internal spice agent
  - Resolves: rhbz#615757
  - Make libvirt-guests initscript Fedora compliant
  - Resolves: rhbz#617300


author: Dave Allan <dallan@redhat.com> - 0.8.1-21
changelog:
  - Fix multiple PCI device assignment bugs
  - Resolves: rhbz#617116
  - Fix the ACS checking in the PCI code
  - Resolves: rhbz#615218
  - Disable boot=on when not using KVM
  - Resolves: rhbz#594068
  - Don't leak delay string when freeing virInterfaceBridgeDefs
  - Resolves: rhbz#620837


author: Dave Allan <dallan@redhat.com> - 0.8.1-22
changelog:
  - Mitigate asynchronous device_del
  - Resolves: rhbz#609437
  - Fix PCI address allocation
  - Resolves: rhbz#618484
  - Make nodeinfo skip offline CPUs
  - Resolves: rhbz#622515


author: Daniel Veillard <veillard@redhat.com> - 0.8.1-25
changelog:
  - fix PXE booting on the virtual network
  - Resolves: rhbz#623951
  - fix tunelled migration
  - Resolves: rhbz#624062


author: Dave Allan <dallan@redhat.com> - 0.8.1-26
changelog:
  - Fix problem with capabilities XML generation
  - Resolves: rhbz#620847
  - Correctly reserve and release PCI slots
  - Resolves: rhbz#623877


author: Daniel Veillard <veillard@redhat.com> - 0.8.1-27
changelog:
  - build -26 hit a miscompilation error c.f. 624895 drop -j2
  - Resolves: rhbz#620847
  - Resolves: rhbz#623877


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.1-28.el6
changelog:
  - Fix JSON migrate_set_downtime command (rhbz#561935)
  - Make SASL work over UNIX domain sockets (rhbz#641687)
  - Let qemu group look below /var/lib/libvirt/qemu/ (rhbz#643407)
  - Fix save/restore on root_squashed NFS (rhbz#643884)
  - Fix race on multiple migration (rhbz#638285)
  - Export host information through SMBIOS to guests (rhbz#526224)
  - Support forcing a CDROM eject (rhbz#626305)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.1-29.el6
changelog:
  - spec file cleanups (rhbz#649523)
  - Fix deadlock on concurrent multiple bidirectional migration (rhbz#659310)
  - Fix funny error in clock-variable (rhbz#660194)
  - Export host information through SMBIOS to guests (rhbz#526224)
  - Ensure device is deleted from guest after unplug (rhbz#644015)
  - Distinguish between QEMU domain shutdown and crash (rhbz#656845)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-1.el6
changelog:
  - Rebased to upstream 0.8.7 (rhbz#653985)
  - The following bugs got fixed by the rebase:
      rhbz#586124, rhbz#595350, rhbz#611793, rhbz#611822, rhbz#617439,
      rhbz#620363, rhbz#626873, rhbz#627143, rhbz#628772, rhbz#639595,
      rhbz#639603, rhbz#656795, rhbz#658657, rhbz#659855, rhbz#660706,
      rhbz#664406, rhbz#665446


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-2.el6
changelog:
  - Fix spec file which was not fully rebased to 0.8.7 (rhbz#653985, rhbz#660706)
  - Skip IB700 watchdog device when assigning PCI slots (rhbz#667091)
  - Improve error reporting when parsing dhcp info (rhbz#653300)
  - Don't chown saved image back to root if dynamic_ownership=0 (rhbz#661720)
  - Fix core dumps if unix_sock_group is set (rhbz#623166)
  - Add support for Westmere CPU model (rhbz#656248)
  - Add XML config switch to enable/disable vhost-net support (rhbz#643050)
  - Enable tuning of qemu network tap device "sndbuf" size (rhbz#665293)
  - Support for explicit boot device ordering (rhbz#646895)
  - Avoid qemu holding migration fd indefinitely (rhbz#620363)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-3.el6
changelog:
  - Report error if invalid type specified for character device (rhbz#638968)
  - Improve log for domain related APIs (rhbz#640202)
  - Reject SDL graphic if it's not supported by qemu (rhbz#633326)
  - Don't lose track of events when callbacks are slow (rhbz#624252)
  - Fail if per-device boot is used but deviceboot is not supported (rhbz#670399)
  - Avoid sending STOPPED event twice (rhbz#666158)
  - Fix issues introduced by dependency patches for rhbz#646895


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-4.el6
changelog:
  - Fix event-handling data race (rhbz#671567)
  - Add support for VNC over a unix domain socket (rhbz#651415)
  - Support intel 'ich6' model (rhbz#648486)
  - Do not use virtio-serial port 0 for generic ports (rhbz#670394)
  - Set SELinux context label of pipes used for qemu migration (rhbz#667756)
  - Support customizable x509 certificate paths for client (rhbz#629510)
  - Round up capacity for LVM volume creation (rhbz#670529)
  - Show error prompt when trying to managed save a shutoff domain (rhbz#672449)
  - Report more proper error for unsupported graphics (rhbz#671319)
  - Expand the man page text for virsh setmaxmem (rhbz#622534)
  - Fix event-handling allocation crash (rhbz#671564)
  - Require --mac to avoid detach-interface ambiguity (rhbz#671050)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-5.el6
changelog:
  - Docs for customizable x509 certificate paths for client (rhbz#629510)
  - Fix tests for VNC over a unix domain socket (rhbz#651415)
  - Fix problems with peer-to-peer migration (rhbz#673434)
  - Fix tunneled migration broken since 0.8.7-2 (rhbz#672199)
  - Update docs for cpu_shares setting (rhbz#641187)
  - Fix possible hang if SASL is used (rhbz#672226)
  - Cancel migration in progress when virsh gets Ctrl-C (rhbz#635353)
  - Enhance virsh migrate command (rhbz#619039)
  - Support for specifying AIO mode for qemu disks (rhbz#591703)
  - Don't leave domain paused after restore (rhbz#670278)
  - Fix possible deadlock/crash in qemu driver (rhbz#673588)
  - Add shortcut for qemu HMP pass through (rhbz#628940)
  - Fix error message when attach device fails (rhbz#675030)
  - Support for booting from assigned PCI devices (rhbz#646895)
  - Improve handling of unlimited value for memory tunables (rhbz#669069)
  - Add smartcard support (rhbz#641834)
  - Remove some RHEL-specific patches which are no longer required (rhbz#653985)
  - Support for disabling/enabling KSM per domain (rhbz#635419)
  - Add --all flag to virsh freecell command (rhbz#653530)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-6.el6
changelog:
  - Fix typo in parsing of spice 'auth' data (rhbz#676374)
  - Fix attach-interface regression (rhbz#676686)
  - Block I/O tunables via blkio cgroups controller (rhbz#632492)
  - Support SCSI RAID type & lower log level for unknown types (rhbz#675771)
  - Only initialize/cleanup libpciaccess once (rhbz#675698)
  - Imprint all logs with version + package build information (rhbz#673226)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-7.el6
changelog:
  - Properly escape special characters in domain names (rhbz#676908)
  - Fix enum type declaration (rhbz#628940)
  - Fix cleanup on VM state after failed QEMU startup (rhbz#673588)
  - Fix XML generation for smartcards (rhbz#677308)
  - Ignore failure of "qemu -M ?" on older qemu (rhbz#676563)
  - Fix typo in setting up SPICE passwords (rhbz#677709)
  - Avoid NULL dereference in virDomainMemoryStats (rhbz#677484)
  - Avoid NULL dereference on error in qemu driver (rhbz#677493)
  - Fix error message when saving a shutoff domain (rhbz#677547)
  - Create enough volumes for mpath pool (rhbz#677231)
  - Allow to delete device mapper disk partition (rhbz#611443)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-8.el6
changelog:
  - Fix --all flag of virsh freecell to really show all cells (rhbz#653530)
  - Add txmode attribute to interface XML for virtio backend (rhbz#629662)
  - Give each virtual network bridge its own fixed MAC address (rhbz#609463)
  - Fix virsh snapshot-list with --quiet option (rhbz#678833)
  - Delay IFF_UP'ing 802.1Qbh interface until migration final stage (rhbz#678826)
  - Fix several memory bugs (rhbz#679164)
  - Fix virt-pki-validate when CERTTOOL is missing (rhbz#679153)
  - Fix memory corruption in virFileAbsPath (rhbz#680281)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-9.el6
changelog:
  - Reorder nwfilter match extensions relative to state match (rhbz#678139)
  - Avoid overwriting error message in qemu driver (rhbz#678870)
  - Allow removing hash entries in virHashForEach (rhbz#681459)
  - Avoid double close on qemu domain restore (rhbz#672725)
  - Fix DomainObj refcounting/hashtable races in qemu driver (rhbz#670848)
  - Fix several memory leaks (rhbz#682249)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-11.el6
changelog:
  - Support vram specification for qxl graphics (rhbz#673578)
  - Fix parsing int options in virsh (rhbz#639587)
  - Use -o encryption=on instead of -e for qemu-img (rhbz#676984)
  - Support domain snapshots with current QMP (rhbz#589076)
  - Update auditing support (rhbz#642785)
  - Only request sound cgroup ACL when required (rhbz#680398)
  - Allow fine-tuning of device ACL permissions (rhbz#683163)
  - Support vhost in attach-interface (rhbz#683276)
  - Don't request cgroup ACL access for /dev/net/tun (rhbz#683305)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-12.el6
changelog:
  - Fix vram settings for qxl graphics (rhbz#673578)
  - Free stream when domain shuts down while its console is open (rhbz#682741)
  - Use hardcoded python path in libvirt.py (rhbz#684204)
  - Add missing checks for read only connections (CVE-2011-1146)
  - Eliminate potential null pointer deref when auditing macvtap devices (rhbz#642785)
  - Insert error messages to avoid a quiet abortion of commands (rhbz#605660)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-13.el6
changelog:
  - Properly report error in virConnectDomainXMLToNative (CVE-2011-1146)
  - Handle DNS over IPv6 (rhbz#687896)
  - Start dnsmasq even if no dhcp ranges/hosts are specified (rhbz#687291)
  - Use a separate dhcp leases file for each network (rhbz#687551)
  - Fix a possible crash in storage driver (rhbz#684712)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-14.el6
changelog:
  - Fix delayed events when SASL is active (rhbz#624252)
  - Fix ref-counting bugs (rhbz#688774)
  - Log an error if on failure to connect to netlink socket (rhbz#689001)
  - Log error and abort network startup when radvd isn't found (rhbz#688957)
  - Add PCI sysfs reset access rights to qemu (rhbz#689002)
  - Fix regression with qemu:///session URI (rhbz#684655)
  - Avoid leaking PCI config fd into qemu (rhbz#687993)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-15.el6
changelog:
  - Fix return value for virJSONValueFromString if it fails (rhbz#688723)
  - Fix positioning to end of qemu log file (rhbz#689986)
  - Initialization error of qemuCgroupData in Qemu host usb hotplug (rhbz#690183)
  - 8021Qbh: Use preassociate-rr during the migration prepare stage (rhbz#684870)
  - Make error reporting in libvirtd thread safe (rhbz#689374)
  - Add missing dependencies (rhbz#690022)
  - Fix restoring a compressed save image (rhbz#691034)
  - Fix label restore bugs in qemu driver (rhbz#690737)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-16.el6
changelog:
  - nwfilter: Enable rejection of packets (rhbz#681948)
  - Revert all previous error log priority hacks (rhbz#587603)
  - Filter out certain expected error messages from libvirtd (rhbz#587603)
  - qemu: Unlock qemu driver before return from domain save (rhbz#688774)
  - Do not send monitor command after monitor meet error (rhbz#688774)
  - qemu: Ignore libvirt debug messages in qemu log (rhbz#681492)
  - virsh: Fix memtune's help message for swap_hard_limit (rhbz#680190)
  - virsh: Fix documentation for memtune command (rhbz#680190)
  - docs: Fix typo (rhbz#680190)
  - Fix typo in systemtap tapset directory name (rhbz#693701)
  - qemu: Ignore unusable binaries (rhbz#676563)
  - qemu: Support for overriding NPROC limit (rhbz#674602)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-17.el6
changelog:
  - Don't return an error on failure to create blkio controller (rhbz#689030)
  - Fix possible infinite loop in remote driver (rhbz#691514)
  - qemu: Remove the managed state file only if restoring succeeded (rhbz#692998)
  - docs: Tweak virsh restore warning (rhbz#692998)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-18.el6
changelog:
  - network: Fix NULL dereference during error recovery (rhbz#696660)
  - virsh: Fix regression in parsing optional integer (rhbz#693963)
  - util: Fix crash when removing entries during hash iteration (rhbz#693385)
  - Experimental libvirtd upstart job (rhbz#678084)


author: Jiri Denemark <jdenemar@redhat.com> - libvirt-0.9.1-1.el6
changelog:
  - Rebased to upstream 0.9.1 (rhbz#705814)
  - The rebase also fixes the following bugs:
      rhbz#587276, rhbz#591058, rhbz#592170, rhbz#598792, rhbz#673814,
      rhbz#677228, rhbz#681458, rhbz#682237, rhbz#692745, rhbz#693932,
      rhbz#694382, rhbz#695653, rhbz#698071, rhbz#698197, rhbz#698208,
      rhbz#698490, rhbz#701305


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.2-1.el6
changelog:
  - Rebased to upstream 0.9.2 (rhbz#705814)
  - The rebase also fixes the following bugs:
      rhbz#569567, rhbz#691830, rhbz#607526, rhbz#609650, rhbz#632495,
      rhbz#640603, rhbz#658713, rhbz#669549, rhbz#677229, rhbz#678548,
      rhbz#640603, rhbz#682237, rhbz#683005, rhbz#684848, rhbz#688859,
      rhbz#690695, rhbz#692355, rhbz#693203, rhbz#694516, rhbz#697650,
      rhbz#698133, rhbz#702044, rhbz#704124, rhbz#704144, rhbz#705405,
      rhbz#706869, rhbz#706883, rhbz#706966, rhbz#707173, rhbz#707257,
      rhbz#707298, rhbz#709576, rhbz#709776, rhbz#710150, rhbz#711151


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.3-1.el6
changelog:
  - Rebased to upstream 0.9.3 (rhbz#705814)
  - The rebase also fixes the following bugs:
      rhbz#591974, rhbz#632499, rhbz#641087, rhbz#664629, rhbz#679668,
      rhbz#682121, rhbz#693648, rhbz#693650, rhbz#693661, rhbz#698340,
      rhbz#698825, rhbz#698861, rhbz#701394, rhbz#707439, rhbz#707530,
      rhbz#715355, rhbz#716826, rhbz#717203, rhbz#718143, rhbz#712050,
      rhbz#715184


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.3-2.el6
changelog:
  - Fix mistaken order of server cert/key parameters in constructor (rhbz#719838)
  - qemu: Don't chown files on NFS share if dynamic_ownership is off (rhbz#716478)
  - util: Don't try to fchown files opened as non-root (rhbz#707257)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.3-4.el6
changelog:
  - storage: Avoid memory leak on metadata fetching (rhbz#707155)
  - graphics: Add support for action_if_connected in qemu (rhbz#707212)
  - qemu: Save domain status ASAP after creating qemu process (rhbz#707894)
  - bios: Add support for SGA (rhbz#711598)
  - pci: Initialize state values on reattach (rhbz#713697)
  - Keep consistence between code and doc on log level and usage (rhbz#716888)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.3-8.el6
changelog:
  - libvirt crash when running domains and vdsm is restarted (rhbz#723811)
  - connect to hypervisor with unconfigured tls/tcp connection pbm (rhbz#723442)
  - virsh list produced segmentation fault when libvirtd is not up (rhbz#723843)
  - clientcert.pem validation failure cause libvirtd crash (rhbz#723881)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-0rc1.el6
changelog:
  - rebased to upstream 0.9.4 release candidate 1 (rhbz#705814)
  - the rebase also fixes the following bugs:
      rhbz#603039, rhbz#632499, rhbz#632760, rhbz#643947, rhbz#678027,
      rhbz#697742, rhbz#697841, rhbz#704836, rhbz#707530, rhbz#720350,
      rhbz#720889, rhbz#721335, rhbz#722862


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-0rc2.el6
changelog:
  - rebased to upstream 0.9.4 release candidate 2 (rhbz#705814)
  - the rebase also fixes the following bugs:
      rhbz#667624, rhbz#669586, rhbz#682084, rhbz#707155, rhbz#707212,
      rhbz#725322, rhbz#725935, rhbz#725950


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-1.el6
changelog:
  - Rebased to upstream 0.9.4 (rhbz#705814)
  - The rebase also fixes the following bugs:
      rhbz#634653, rhbz#707212, rhbz#722806, rhbz#723862, rhbz#726304,
      rhbz#726398, rhbz#727047, rhbz#727094


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-2.el6
changelog:
  - daemon: Unlink unix socket paths on shutdown (rhbz#725702)
  - rpc:Fix sasl session relocking intead of unlocking it (rhbz#729198)
  - network: Eliminate lag in updating dnsmasq hosts files (rhbz#727982)
  - Don't mount /dev for application containers (rhbz#728835)
  - support connected parameter in set_password (rhbz#707212)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-3.el6
changelog:
  - Fix large files support (rhbz#728992)
  - qemu: Avoid overwriting errors from virGetHostname (rhbz#729567)
  - qemu: Fix -chardev udp if parameters are omitted (rhbz#689761)
  - managedsave: Prohibit use on transient domains (rhbz#729714)
  - nwfilter: Tolerate disappearing interfaces while instantiating filter (rhbz#729945)
  - docs: Describe new virtual switch configuration in network XML docs (rhbz#643947)
  - storage: Directory shouldn't be listed as type 'file' (rhbz#727088)
  - virsh: Add dir type for listing volumes with vol-list (rhbz#727088)
  - qemu: Avoid crash on process attach (rhbz#730615)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-4.el6
changelog:
  - Bugfix: Check stdoutWatch before removing the handler. (rhbz#730600)
  - daemon: Fix regression of libvirtd reloading support (rhbz#730428)
  - libvirtd.init.in: Stop/restart() - wrong return value in case of failure (rhbz#730510)
  - Add API for duplicating a socket/client file descriptor (rhbz#720269)
  - Add backlog parameter to virNetSocketListen (rhbz#720269)
  - Support changing UNIX socket owner in virNetSocketNewListenUNIX (rhbz#720269)
  - qemu: Refactor do{Tunnel, Native}Migrate functions (rhbz#720269)
  - qemu: Use virNetSocket for tunneled migration (rhbz#720269)
  - qemu: Use fd: protocol for migration (rhbz#720269)
  - qemu: Support event_idx parameter for virtio disk and net devices (rhbz#725448)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-5.el6
changelog:
  - patch problem for seamless SPICE migration (rhbz#730753)
  - macvtap: Fix getPhysfn to get the PF of a direct attach network interface (rhbz#732082)
  - SSL spice session can't be kept during migration (rhbz#729874)
  - Storage driver should flush host cache after cloning volumes (rhbz#689416)
  - Documentation for CFS bandwidth limiting cgroup (rhbz#692769)
  - libvirt error message should show the uri content but not (null) (rhbz#730244)
  - libvirtd.conf error causes libvirtd to exit silently (rhbz#728654)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-6.el6
changelog:
  - daemon: Move TLS initialization to virInitialize (rhbz#732893)
  - Fix command test wrt gnutls initialize & fix debugging (rhbz#732893)
  - qemu: Init reattaching related members pciDevice before reattach (rhbz#728203)
  - qemu: error if qemu monitor command not found for BlockJob (rhbz#727502)
  - virsh: error if specified bandwidth is invalid for blockjob (rhbz#727502)
  - util: Only fchown newly created files in virFileOpenAs (rhbz#534010)
  - screenshot: Implement multiple screen support (rhbz#710489)
  - security: Rename SetSocketLabel APIs to SetDaemonSocketLabel (rhbz#731243)
  - security: Introduce SetSocketLabel (rhbz#731243)
  - qemu: Correctly label migration TCP socket (rhbz#731243)
  - snapshot: Don't leak resources on qemu snapshot failure (rhbz#733499)
  - Fix memory leak while scanning snapshots (rhbz#674537)
  - qemu: Minor formatting cleanup (rhbz#674537)
  - Swap virDomain and virDomainSnapshot declaration (rhbz#674537)
  - snapshot: Only pass snapshot to qemu command line when reverting (rhbz#674537)
  - snapshot: Track current snapshot across restarts (rhbz#674537)
  - send-key: Fix scan keycode map (rhbz#733597)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-7.el6
changelog:
  - qemu: Properly label outgoing pipe for tunneled migration (rhbz#733998)
  - snapshot: Forbid snapshot on autodestroy domain (rhbz#733806)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-8.el6
changelog:
  - qemu: Fix a regression of domain save (rhbz#735011)
  - virsh: Improve send-key documentation (rhbz#699847)
  - start: Allow discarding managed save (rhbz#730750)
  - virsh: Support 'virsh start --force-boot' on older servers (rhbz#730750)
  - maint: Fix comment typos (rhbz#730750)
  - qemu: Refactor file opening (rhbz#730750)
  - qemu: Detect incomplete save files (rhbz#730750)
  - virsh: Avoid memory leak on cmdVolCreateAs (rhbz#735008)
  - snapshot: Fix corner case on OOM during creation (rhbz#674537)
  - Ensure stream is aborted when exiting console (rhbz#731673)
  - following for (rhbz#731583, rhbz#731579, rhbz#731584, rhbz#731673):
  - Ensure client streams are closed when marking a client for close
  - Fix race condition in abort of stream
  - Tweak debugging message in RPC client code
  - Don't attempt to read from a stream if it is closed
  - Ensure async packets never get marked for sync replies
  - Ignore unused streams in virStreamAbort
  - rpc: Don't close connection if program is unknown
  - rpc: Fix a typo in debugging log in virNetServerProgramSendStreamData
  - stream: Remove redundant reference to client while sending stream data
  - Fix memory leak dispatching domain events
  - Avoid use-after-free on streams, due to message callbacks
  - Fix tracking of RPC messages wrt streams
  - Fix parted sector size assumption (rhbz#735441)
  - Fix incorrect path length check in sanlock lockspace setup (rhbz#735443)
  - Fix sanlock socket security labelling (rhbz#735442)
  - Remove bogus virSecurityManagerSetProcessFDLabel method (rhbz#735442)
  - security: Fix build (rhbz#735442)
  - Fix keymap used to talk with QEMU (rhbz#632499)
  - virsh: Fix snapshot-create-as to handle arbitrary names (rhbz#735495)
  - virsh: Add virsh snapshot-current --name (rhbz#735495)
  - virsh: Add snapshot-parent (rhbz#735495)
  - virsh: Don't reject undefine on active domain (rhbz#735495)
  - virsh: Fix logic bug (rhbz#735495)
  - virsh: Fix dead store (rhbz#735495)
  - virsh: Tweak misleading wording (rhbz#735495)
  - virsh: Concatenate qemu-monitor-command arguments (rhbz#735495)
  - maint: Treat more libxml2 functions as free-like (rhbz#735495)
  - xml: Add another convenience function (rhbz#735495)
  - maint: Simplify lots of libxml2 clients (rhbz#735495)
  - virsh: Add list --managed-save (rhbz#735495)
  - virsh: Prefer unsigned flags (rhbz#735495)
  - snapshot: Add snapshot-list --parent to virsh (rhbz#735495)
  - qemu: Allow to undefine a running domain (rhbz#735498)
  - test: Allow to undefine a running domain (rhbz#735498)
  - build: Fix typo in recent test patch (rhbz#735498)
  - test: Rewrite test to match change in behavior (rhbz#735498)
  - virsh: Properly interleave shared stdout and stderr (rhbz#735498)
  - snapshot: Better events when starting paused (rhbz#733762)
  - snapshot: Fine-tune ability to start paused (rhbz#733762)
  - snapshot: Expose --running and --paused in virsh (rhbz#733762)
  - snapshot: Fine-tune qemu saved images starting paused (rhbz#733762)
  - snapshot: Improve reverting to qemu paused snapshots (rhbz#733762)
  - snapshot: Properly revert qemu to offline snapshots (rhbz#733762)
  - snapshot: Fine-tune qemu snapshot revert states (rhbz#733762)
  - snapshot: Properly revert qemu to offline snapshots (rhbz#733762)
  - snapshot: Fine-tune qemu snapshot revert states (rhbz#733762)
  - snapshot: Speed up snapshot location (rhbz#733529)
  - snapshot: Avoid crash when deleting qemu snapshots (rhbz#733529)
  - snapshot: Track current domain across deletion of children (rhbz#733529)
  - snapshot: Simplify acting on just children (rhbz#733529)
  - snapshot: Allow deletion of just snapshot metadata (rhbz#735457)
  - snapshot: Let qemu discard only snapshot metadata (rhbz#735457)
  - snapshot: Identify which snapshots have metadata (rhbz#735457)
  - snapshot: Reflect new dumpxml and list options in virsh (rhbz#735457)
  - snapshot: Identify qemu snapshot roots (rhbz#735457)
  - snapshot: Allow recreation of metadata (rhbz#735457)
  - snapshot: Refactor virsh snapshot creation (rhbz#735457)
  - snapshot: Improve virsh snapshot-create, add snapshot-edit (rhbz#735457)
  - snapshot: Add qemu snapshot creation without metadata (rhbz#735457)
  - snapshot: Add qemu snapshot redefine support (rhbz#735457)
  - vbox, xenapi: Add virDomainUndefineFlags (rhbz#735457)
  - snapshot: Prevent stranding snapshot data on domain destruction (rhbz#735457)
  - snapshot: Teach virsh about new undefine flags (rhbz#735457)
  - snapshot: Refactor some qemu code (rhbz#735457)
  - snapshot: Cache qemu-img location (rhbz#735457)
  - snapshot: Support new undefine flags in qemu (rhbz#735457)
  - snapshot: Prevent migration from stranding snapshot data (rhbz#735457)
  - snapshot: Refactor domain xml output (rhbz#735553)
  - snapshot: Allow full domain xml in snapshot (rhbz#735553)
  - snapshot: Correctly escape generated xml (rhbz#735553)
  - snapshot: Update rng to support full domain in xml (rhbz#735553)
  - snapshot: Store qemu domain details in xml (rhbz#735553)
  - schedinfo: Update man page about virsh schedinfo command (unknown)
  - snapshot: Additions to domain xml for disks (rhbz#638510)
  - snapshot: Reject transient disks where code is not ready (rhbz#638510)
  - snapshot: Introduce new deletion flag (rhbz#638510)
  - snapshot: Expose new delete flag in virsh (rhbz#638510)
  - snapshot: Allow halting after snapshot (rhbz#638510)
  - snapshot: Expose halt-after-creation in virsh (rhbz#638510)
  - snapshot: Support extra state in snapshots (unknown)
  - snapshot: Add <disks> to snapshot xml (rhbz#638510)
  - snapshot: Also support disks by path (rhbz#638510)
  - snapshot: Add virsh domblklist command (rhbz#638510)
  - snapshot: Add flag for requesting disk snapshot (rhbz#638510)
  - snapshot: Wire up disk-only flag to snapshot-create (rhbz#638510)
  - snapshot: Reject unimplemented disk snapshot features (rhbz#638510)
  - snapshot: Make it possible to audit external snapshot (rhbz#638510)
  - snapshot: Wire up new qemu monitor command (rhbz#638510)
  - snapshot: Wire up live qemu disk snapshots (rhbz#638510)
  - snapshot: Use SELinux and lock manager with external snapshots (rhbz#638510)
  - daemon: Create priority workers pool (rhbz#692663)
  - qemu: Introduce job queue size limit (rhbz#692663)
  - qemu: Deal with stucked qemu on daemon startup (rhbz#692663)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-10.el6
changelog:
  - virterror: Fix error message for VIR_ERR_INVALID_ARG (rhbz#689388)
  - remote: Refuse connecting to remote socket (rhbz#689388)
  - Threadpool: Initialize new dynamic workers (rhbz#692663)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-11.el6
changelog:
  - blockinfo: Fix qemu regression in handling disk name (rhbz#736603)
  - doc: Fix incorrect option in send-key (rhbz#736297)
  - virsh: Fix typo in opts_send_key (rhbz#736297)
  - rpc: Avoid memory leak on virNetTLSContextValidCertificate (rhbz#735650)
  - tests: Avoid memory leak on testTLSSessionInit (rhbz#735650)
  - qemu: Fix seamless SPICE migration with older qemu (rhbz#730753)
  - snapshot: Fix regression with system checkpoints (rhbz#736682)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-12.el6
changelog:
  - selinux: Detect virt_use_nfs boolean set (rhbz#589922)
  - virnetsocket: Pass KRB5CCNAME env variable (rhbz#737176)
  - snapshot: Fix double free of qemuImgBinary (rhbz#737010)
  - qemu_api: Modify apibuild.py to generate docs for QEMU APIs (rhbz#736040)
  - qemu_api: Update Makefile for subdir docs (rhbz#736040)
  - qemu_api: Add comments for API virDomainQemuMonitorCommand (rhbz#736040)
  - qemu_api: Add override XML and C files for QEMU APIs (rhbz#736040)
  - qemu_api: Update Py binding generator to generate files for QEMU APIs (rhbz#736040)
  - qemu_api: Update Makefile to generate libvirtmod_qemu lib (rhbz#736040)
  - qemu_api: Update libvirt spec file (rhbz#736040)
  - Remove two references to files not generated (rhbz#736040)
  - qemu_api: Doc improvements (rhbz#736040)
  - python: Fix libvirt.py generation to include virterror info (rhbz#736040)
  - snapshot: New APIs for inspecting snapshot object (rhbz#735457)
  - snapshot: Use new API for less work (rhbz#735457)
  - snapshot: ABI stability must include memory sizing (rhbz#735553)
  - spec: Require augeas for sanlock (rhbz#738314)
  - sanlock: Add missing test command in virt-sanlock-cleanup.in (rhbz#738534)
  - snapshot: Tweak snapshot-create-as diskspec docs (rhbz#738411)
  - qemu: Hold conn open for all threads started by qemuProcessReconnectAll (rhbz#738778)
  - rpc: Convert unknown procedures to VIR_ERR_NO_SUPPORT (rhbz#738439)
  - Prevent crash from dlclose() of libvirt.so (rhbz#739167)
  - doc: Add statment about permissions needed to do a core dump (rhbz#738146)
  - snapshot: Affect persistent xml after disk snapshot (rhbz#738676)
  - snapshot: Allow disk snapshots of qcow2 disks (rhbz#738676)
  - qemu: Prevent disk corruption on domain shutdown (rhbz#734773)
  - qemu: Introduce shutdown reason for paused state (rhbz#734773)
  - qemu: Fix shutoff reason when domain crashes (rhbz#739641)
  - qemu: Properly detect crash of a rebooted domain (rhbz#739641)
  - qemu: Avoid memory leak (rhbz#739704)
  - remote: Avoid memory leak (rhbz#739704)
  - util: Avoid memory leak (rhbz#739704)
  - Fix memory leak parsing 'relabel' attribute in domain security XML (rhbz#739704)
  - Don't leak memory if a cgroup is mounted multiple times (rhbz#739704)
  - network: Eliminate potential memory leak on parse failure (rhbz#739704)
  - virsh: doc: Fix supported driver types for attach-disk command (rhbz#738970)
  - Do not log invalid operations in libvirtd logs (rhbz#590807)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-13.el6
changelog:
  - Fix crash on events due to allocation errors (rhbz#737881)
  - remote: Fix crash on OOM (rhbz#737881)
  - Fix persistent migration config save (rhbz#738148)
  - qemu: Transfer inactive XML among cookie (rhbz#738148)
  - storage: Ensure the device path exists before refreshing disk pool (rhbz#611442)
  - Store max migration bandwidth in qemuDomainObjPrivate struct (rhbz#740099)
  - Save migration speed in qemuDomainMigrateSetMaxSpeed (rhbz#740099)
  - Set qemu migration speed unlimited when migrating to file (rhbz#740099)
  - Use max bandwidth from qemuDomainObjPrivate struct when migrating (rhbz#740099)
  - build: Silence warning on 32-bit build (rhbz#740099)
  - conf: Assign newDef of active domain as persistent conf if it is NULL (rhbz#728428)
  - qemu: Avoid dereferencing a NULL pointer (rhbz#739704)
  - sanlock: Fix memory leak (rhbz#739704)
  - virsh: Fix regression in argv parsing (rhbz#740168)
  - snapshot: Fix logic bug in qemu undefine (rhbz#735457)
  - snapshot: Prepare to remove transient snapshot metadata (rhbz#735457)
  - snapshot: Remove snapshot metadata on transient exit (rhbz#735457)
  - snapshot: Also delete empty directory (rhbz#735457)
  - virsh: Do not ignore the specified flags for cmdSaveImageDefine (rhbz#740508)
  - selinux: Correctly report warning if virt_use_nfs not set (rhbz#589922)
  - qemu: Properly hot-unplug drives (rhbz#696596)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-14.el6
changelog:
  - Fix synchronous reading of stream data (rhbz#741337)
  - qemu: Add ability to set PCI device "rombar" on or off (rhbz#738095)
  - virsh: Better document --copy-storage migrate options (rhbz#677220)
  - virsh: Enhance documentation of commands starting jobs (rhbz#705237)
  - qemu: Always remove domain object if MigratePrepare fails (rhbz#741251)
  - security: Properly chown/label bidirectional and unidirectional fifos (rhbz#740478)
  - qemu: Check domain status details when reconnecting monitor (rhbz#617890)
  - qemu: Finish domain shutdown on reconnect (rhbz#617890)
  - qemu: Avoid loop of fake reboots (rhbz#617890)
  - qemu: Preserve fakeReboot flag in domain status (rhbz#617890)
  - snapshot: Fix man page typos (rhbz#740686)
  - docs: Document virsh nodedev-* commands (rhbz#740686)
  - docs: Document node device XML (rhbz#740686)
  - qemu: Add return value check (rhbz#739704)
  - qemu: Check for ejected media during startup and migration (rhbz#725673)
  - virsh: Update man page for cpu_shares parameter (rhbz#639591)
  - virsh: Describe attach-interface parameter target (rhbz#698899)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-15.el6
changelog:
  - Add virFileLock and virFileUnlock APIs (rhbz#728153)
  - Move pidfile functions into util/virpidfile.{c, h} (rhbz#728153)
  - Introduce functions for checking whether a pidfile is valid (rhbz#728153)
  - Add some APIs which use locking for crashsafe pidfile handling (rhbz#728153)
  - Convert libvirtd to use crash-safe pidfile APIs (rhbz#728153)
  - build: Fix recent build failures (rhbz#728153)
  - daemon: Don't remove pidfiles in init scripts (rhbz#728153)
  - daemon: Modify init script to detect upstart managed libvirtd (rhbz#728153)
  - qemu: Check for outstanding async job too (rhbz#742277)
  - qemu: Make PCI multifunction support more manual (rhbz#727530)
  - network: Fill in bandwidth from portgroup for all forward modes (rhbz#743176)
  - snapshot: Refactor virsh snapshot parent computation (rhbz#742410)
  - snapshot: Better virsh handling of missing current, parent (rhbz#742410)
  - qemu: Fix migration with dname (rhbz#740533)
  - qemu: Correct misspelled 'enospc' option, and only use for werror (rhbz#730909)
  - snapshot: Add REVERT_FORCE to API (rhbz#742615)
  - snapshot: Use qemu-img on disks in use at time of snapshot (rhbz#742615)
  - snapshot: Enforce REVERT_FORCE on qemu (rhbz#742615)
  - init: Raise default system aio limits (rhbz#740899)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-16.el6
changelog:
  - qemu: Enable multifunction for older qemu (rhbz#738388)
  - qemu: Don't fail virDomainGetInfo if we can't update balloon info (rhbz#741217)
  - qemu: Leave rerror policy at default when enospace is requested (rhbz#730909)
  - snapshot: Fix virsh error message typo (rhbz#735457)
  - snapshot: Let virsh edit disk snapshots (rhbz#744071)
  - snapshot: Simplify redefinition of disk snapshot (rhbz#744071)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-17.el6
changelog:
  - Fix deadlock when the RPC program is unknown (rhbz#743843)
  - qemuDomainAttach: Initialize pidfile variable (rhbz#744548)
  - storage: Do not use comma as seperator for lvs output (rhbz#727474)
  - snapshot: Avoid accidental renames with snapshot-edit (rhbz#744724)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-18.el6
changelog:
  - virDomainCoreDump: Introduce VIR_DUMP_RESET flag (rhbz#632498)
  - qemu: Implement VIR_DUMP_RESET (rhbz#632498)
  - qemu: Check for domain being active on successful job acquire (rhbz#745734)
  - Set to NULL members that have been freed to prevent crashes (rhbz#746075)
  - virFDStream: Close also given errfd (fd leak) (rhbz#746075)
  - qemu: Silence Coverity false positive (rhbz#739704)
  - command: Avoid fd leak on failure (rhbz#739704)
  - build: Add compiler attributes to virUUIDParse (rhbz#739704)
  - qemu: Check for json allocation failure (rhbz#739704)
  - qemu: Fix text block info parsing (rhbz#739704)
  - storage: Plug memory leak on error (rhbz#739704)
  - conf: Plug memory leak on error (rhbz#739704)
  - qemu: Plug memory leak on migration (rhbz#739704)
  - macvtap: Plug memory leak for 802.1Qbh (rhbz#739704)
  - macvtap: Avoid invalid free (rhbz#739704)
  - Update to require sanlock 1.8 for license compliance (rhbz#739518)
  - events: Propose a separate lock for event queue (rhbz#743817)
  - util: Make getaddrinfo failure nonfatal in virGetHostname (rhbz#738915)
  - qemu: Make sure BeginJob is always followed by EndJob (rhbz#746268)
  - pci: Fix pciDeviceListSteal on multiple devices (rhbz#733587)
  - qemu: Do not reattach PCI device used by other domain when shutdown (rhbz#733587)
  - qemu: Honor the orginal PCI dev properties when reattaching (rhbz#736214)
  - daemon: Always advertise libvirtd service (rhbz#726616)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-20.el6
changelog:
  - qemu: Avoid leaking uninit data from hotplug to dumpxml (rhbz#747516)
  - storage: Plug iscsi memory leak (rhbz#747516)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-21.el6
changelog:
  - docs: Document managed=yes of hostdev passthrough (rhbz#740686)
  - ServerClient: Flush cached data (rhbz#748025)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-1.el6
changelog:
  - Rebase to upstream 0.9.10 (rhbz#752433)
  - Add support for sVirt in the LXC driver
  - block rebase: add new API virDomainBlockRebase
  - API: Add api to set and get domain metadata
  - virDomainGetDiskErrors public API
  - conf: add rawio attribute to disk element of domain XML
  - Add new public API virDomainGetCPUStats()
  - Introduce virDomainPMSuspendForDuration API
  - resize: add virStorageVolResize() API
  - Add a virt-host-validate command to sanity check HV config
  - Add new virDomainShutdownFlags API
  - QEMU guest agent support
  - many improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-2.el6
changelog:
  - qemu: Set capabilities based on supported monitor commands (rhbz#766958)
  - qemu: Implement DomainPMSuspendForDuration (rhbz#766958)
  - snapshot: Fix snapshot deletion use-after-free (rhbz#790744)
  - storage: Allow runtime detection of scrub (rhbz#725013)
  - qemu: Unlock monitor when connecting to dest qemu fails (rhbz#783968)
  - qemu: Prevent crash of libvirtd without guest agent (rhbz#790745)
  - python: Expose virDomain{G,S}etInterfaceParameters APIs in python binding (rhbz#770971)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-3.el6
changelog:
  - storage: Allow runtime detection of scrub missing build dep (rhbz#725013)
  - daemon: Plug memory leak (rhbz#795978)
  - daemon: Fix logic bug with virAsprintf (rhbz#795978)
  - util: Fix virFileAccessibleAs return path from parent (rhbz#795093)
  - Add support for unsafe migration (rhbz#751631)
  - virsh: Add --unsafe option to migrate command (rhbz#751631)
  - Introduce virStorageFileIsClusterFS (rhbz#751631)
  - qemu: Forbid migration with cache != none (rhbz#751631)
  - qemu: Nicer error message on failed graceful destroy (rhbz#795656)
  - Error out when using SPICE TLS with spice_tls=0 (rhbz#790436)
  - Revert "spec: Mark directories in /var/run as ghosts" (rhbz#788985)
  - Fixed URI parsing (rhbz#785164)
  - virsh: Fix informational message in iface-bridge command (rhbz#797066)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-4.el6
changelog:
  - Improve error reporting when virsh console is run without a TTY (rhbz#729940)
  - pidfile: Make checking binary path in virPidFileRead optional (rhbz#729940)
  - Add flags for virDomainOpenConsole (rhbz#729940)
  - virsh: Add support for VIR_DOMAIN_CONSOLE_* flags (rhbz#729940)
  - fdstream: Emit stream abort callback even if poll() doesnt. (rhbz#729940)
  - fdstream: Add internal callback on stream close (rhbz#729940)
  - util: Add helpers for safe domain console operations (rhbz#729940)
  - qemu: Add ability to abort existing console while creating new one (rhbz#729940)
  - Fixed service handling in specfile (rhbz#786770)
  - qemu: Don't emit tls-port spice option if port is -1 (rhbz#798220)
  - docs: Comments wiping supported algorithms (rhbz#725013)
  - libvirt-guests: Add documentation and clean up to use virsh's improved list (rhbz#693758)
  - libvirt-guests: Don't try to do a managed-save of transient guests (rhbz#693758)
  - virsh: Enhance list command to ease creation of shell scripts (rhbz#693758)
  - libvirt-guests: Check if URI is reachable before launching commands (rhbz#720691)
  - hooks: Add support for capturing hook output (rhbz#795127)
  - qemu: Add pre-migration hook (rhbz#795127)
  - Support for cpu64-rhel* qemu cpu models (rhbz#768450)
  - util: Add netlink event handling to virnetlink.c (rhbz#693842)
  - Add de-association handling to macvlan code (rhbz#693842)
  - qemu: Add ibmvscsi controller model (rhbz#782034)
  - qemu: Add virtio-scsi controller model (rhbz#782034)
  - conf: Add helper function to look up disk controller model (rhbz#782034)
  - conf: Introduce new attribute for device address format (rhbz#782034)
  - qemu: New cap flag to indicate if channel is supported by scsi-disk (rhbz#782034)
  - qemu: Build command line for the new address format (rhbz#782034)
  - tests: Add tests for virtio-scsi and ibmvscsi controllers (rhbz#782034)
  - virsh: Two new helper functions for disk device changes (rhbz#713932)
  - virsh: Use vshFindDisk and vshPrepareDiskXML in cmdDetachDisk (rhbz#713932)
  - virsh: New command cmdChangeMedia (rhbz#713932)
  - qemu: Require json for block jobs (rhbz#799055)
  - qemu: Pass block pull backing file to monitor (rhbz#799055)
  - virsh: Expose partial pull (rhbz#799055)
  - libvirt-guests: Add parallel startup and shutdown of guests (rhbz#625362)
  - qemu: Shared or readonly disks are always safe wrt migration (rhbz#751631)
  - util: Eliminate crash in virNetDevMacVLanCreateWithVPortProfile (rhbz#693842)
  - rpc: Fix client crash on connection close (rhbz#800185)
  - conf: Add missing device types to virDomainDevice(Type|Def) (rhbz#691539)
  - conf: Relocate virDomainDeviceDef and virDomainHostdevDef (rhbz#691539)
  - conf: Reorder static functions in domain_conf.c (rhbz#691539)
  - qemu: Rename virDomainDeviceInfoPtr variables to avoid confusion (rhbz#691539)
  - conf: Add device pointer to args of virDomainDeviceInfoIterate callback (rhbz#691539)
  - conf: Make hostdev info a separate object (rhbz#691539)
  - conf: HostdevDef parse/format helper functions (rhbz#691539)
  - conf: Give each hostdevdef a parent pointer (rhbz#691539)
  - conf: Put subsys part of virDomainHostdevDef into its own struct (rhbz#691539)
  - conf: Hostdev utility functions (rhbz#691539)
  - qemu: Re-order functions in qemu_hotplug.c (rhbz#691539)
  - qemu: Refactor hotplug detach of hostdevs (rhbz#691539)
  - conf: Parse/format type='hostdev' network interfaces (rhbz#691539)
  - qemu: Support type='hostdev' network devices at domain start (rhbz#691539)
  - conf: Change virDomainNetRemove from static to global (rhbz#691539)
  - qemu: Use virDomainNetRemove instead of inline code (rhbz#691539)
  - qemu: Support type=hostdev network device live hotplug attach/detach (rhbz#691539)
  - util: Two new pci util functions (rhbz#691539)
  - util: Support functions for mac/portprofile associations on hostdev (rhbz#691539)
  - util: Changes to support portprofiles for hostdevs (rhbz#691539)
  - qemu: Install port profile and mac address on netdev hostdevs (rhbz#691539)
  - Fix build after commit e3ba4025 (rhbz#693842)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-5.el6
changelog:
  - Avoid global variable shadowed (rhbz#737726)
  - Add nodeGetCPUmap() for getting available CPU IDs in a cpumap. (rhbz#737726)
  - Qemu driver for virDomainGetCPUstats using cpuacct cgroup. (rhbz#737726)
  - Cpu-stats command shows cpu statistics information of a domain. (rhbz#737726)
  - Ensure max_id is initialized in linuxParseCPUmap() (rhbz#737726)
  - rpc: Allow truncated return for virDomainGetCPUStats (rhbz#737726)
  - qemu: Don't parse device twice in attach/detach (rhbz#770031)
  - sanlock: Fix condition left crippled while debugging (rhbz#785736)
  - sanlock: Use STREQ_NULLABLE instead of STREQ on strings that may be null (rhbz#785736)
  - qemu: Fix startupPolicy for snapshot-revert (rhbz#798938)
  - util: Don't overflow on errno in virFileAccessibleAs (rhbz#798938)
  - blockResize: Add flag for bytes (rhbz#796526)
  - docs: Use correct terminology for 1024 bytes (rhbz#796526)
  - api: Add overflow error (rhbz#796526)
  - util: New function for scaling numbers (rhbz#796526)
  - xml: Share 'unit' in RNG (rhbz#796526)
  - xml: Output memory unit for clarity (rhbz#796526)
  - storage: Support more scaling suffixes (rhbz#796526)
  - xml: Drop unenforced minimum memory limit from RNG (rhbz#796526)
  - xml: Use long long internally, to centralize overflow checks (rhbz#796526)
  - xml: Use better types for memory values (rhbz#796526)
  - xml: Allow scaled memory on input (rhbz#796526)
  - virsh: Add option aliases (rhbz#796526)
  - virsh: Use option aliases (rhbz#796526)
  - virsh: Add command aliases, and rename nodedev-detach (rhbz#796526)
  - virsh: Improve storage unit parsing (rhbz#796526)
  - virsh: Improve memory unit parsing (rhbz#796526)
  - qemuBuildCommandLine: Don't add tlsPort if none set (rhbz#801443)
  - Removed more AMD-specific features from cpu64-rhel* models (rhbz#768450)
  - qemu: Support disk filenames with comma (rhbz#801970)
  - cpustats: Collect VM user and sys times (miss python bindings) (rhbz#800366)
  - cpustats: Report user and sys times (rhbz#800366)
  - qemu: Fix (managed)save and snapshots with host mode CPU (rhbz#801160)
  - qemu: Make block io tuning smarter (rhbz#770683)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-6.el6
changelog:
  - cpu: Add new flag supported by qemu to the cpu definition (rhbz#767364)
  - Added support for AMD Bulldozer CPU (rhbz#767364)
  - graphics: Cleanup port policy (rhbz#801443)
  - qemu: Reverse condition in qemuDomainCheckDiskPresence (rhbz#798938)
  - cpu: Add cpu definition for Intel Sandy Bridge cpu type (rhbz#761005)
  - cpu: Disable tsc-deadline feature not supported in qemu on RHEL 6.3 (rhbz#761005)
  - qemu: Support numad (rhbz#769930)
  - numad: Fix typo and warning (rhbz#769930)
  - qemu: Use scsi-block for lun passthrough instead of scsi-disk (rhbz#782034)
  - util: Make virDomainLeaseDefFree global (rhbz#802851)
  - qemu: Don't 'remove' hostdev objects from domain if operation fails (rhbz#802851)
  - util: Eliminate device object leaks related to virDomain*Remove*() (rhbz#802851)
  - virsh: Fix invalid free (rhbz#803591)
  - qemu: Eliminate memory leak in qemuDomainUpdateDeviceConfig (rhbz#802854)
  - qemu: Support persistent hotplug of <hostdev> devices (rhbz#802856)
  - qemu: Fix segfault when detaching non-existent network device (rhbz#802644)
  - remote: Fix migration leaks (rhbz#798497)
  - virsh: Trim aliases from -h output (rhbz#796526)
  - Fix handling of blkio deviceWeight empty string (rhbz#804028)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-7.el6
changelog:
  - snapshot: Make quiesce a bit safer (rhbz#804210)
  - python: Avoid memory leaks on libvirt_virNodeGetMemoryStats (rhbz#770944)
  - qemu: Use unlimited speed when migrating to file (rhbz#740099)
  - qemu: Add support for domain cleanup callbacks (rhbz#795305)
  - qemu: Avoid dangling migration-in job on shutoff domains (rhbz#795305)
  - qemu: Add connection close callbacks (rhbz#795305)
  - qemu: Make autodestroy utilize connection close callbacks (rhbz#795305)
  - qemu: Avoid dangling migration-out job when client dies (rhbz#795305)
  - python: Avoid memory leaks on libvirt_virNodeGetCPUStats (rhbz#770943)
  - util: Consolidate duplicated error messages in virnetlink.c (rhbz#693842)
  - python: Add virDomainGetCPUStats python binding API (rhbz#800366)
  - snapshot: Add qemu capability for 'transaction' command (rhbz#782457)
  - snapshot: Add atomic create flag (rhbz#782457)
  - snapshot: Make offline qemu snapshots atomic (rhbz#782457)
  - snapshot: Rudimentary qemu support for atomic disk snapshot (rhbz#782457)
  - snapshot: Add support for qemu transaction command (rhbz#782457)
  - snapshot: Wire up qemu transaction command (rhbz#782457)
  - snapshot: Improve qemu handling of reused snapshot targets (rhbz#782457)
  - Clarify virsh freecell manpage entry (rhbz#698521)
  - Add support for event tray moved of removable disks (rhbz#575160)
  - docs: Add documentation for new attribute tray of disk target (rhbz#575160)
  - conf: Parse and for the tray attribute (rhbz#575160)
  - qemu: Do not start with source for removable disks if tray is open (rhbz#575160)
  - qemu: Prohibit setting tray status as open for block type disk (rhbz#575160)
  - qemu: Update tray status while tray moved event is emitted (rhbz#575160)
  - build: Fix incorrect enum declaration (rhbz#575160)
  - spec: Add missed dependancy for numad (rhbz#769930)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-9.el6
changelog:
  - qemu: Avoid entering monitor with locked driver (rhbz#803186)
  - snapshot: Don't pass NULL to QMP command creation (rhbz#807147)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-10.el6
changelog:
  - python: Add new helper functions for python to C conversion (rhbz#807751)
  - python: Make python APIs use these helper functions (rhbz#807751)
  - python: Improve conversion validation (rhbz#807751)
  - qemu_agent: Issue guest-sync prior to every command (rhbz#808527)
  - qemu: Fix memory leak in virDomainGetVcpus (rhbz#808979)
  - qemu: Reflect any memory rounding back to xml (rhbz#808522)
  - conf: Allow fuzz in XML with cur balloon > max (rhbz#808522)
  - qemu: Start nested job in qemuDomainCheckEjectableMedia (rhbz#803186)
  - virsh: Clarify escape sequence (rhbz#808652)
  - virsh: Plug memory leaks on failure path (rhbz#807555)
  - conf: Prevent crash of libvirtd without channel target name (rhbz#808371)
  - qemu: Don't leak temporary list of USB devices (rhbz#808459)
  - qemu: Delete USB devices used by domain on stop (rhbz#808459)
  - qemu: Build activeUsbHostdevs list on process reconnect (rhbz#808459)
  - qemu: Fix virtio+macvtap migration from 6.3 to older hosts (rhbz#806633)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-11.el6
changelog:
  - test: Fix segfault in networkxml2argvtest (rhbz#810100)
  - conf: Plug memory leaks on virDomainDiskDefParseXML (rhbz#575160)
  - qemu_ga: Don't overwrite errors on FSThaw (rhbz#808527)
  - Fix parallel build in docs/ directory (rhbz#810559)
  - qemu: Make migration fail when port profile association fails on the dst host (rhbz#811026)
  - Wire up <loader> to set the QEMU BIOS path (rhbz#811227)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-12.el6
changelog:
  - blockjob: Add qemu capabilities related to block pull jobs (rhbz#811683)
  - blockjob: Add API for async virDomainBlockJobAbort (rhbz#811683)
  - blockjob: Optimize JSON event handler lookup (rhbz#811683)
  - blockjob: Wire up qemu async virDomainBlockJobAbort (rhbz#811683)
  - blockjob: Allow for fast-finishing job (rhbz#811683)
  - virsh: Minor syntactic cleanups (rhbz#811683)
  - qemu: Use consistent error when qemu binary is too old (rhbz#811683)
  - blockjob: Add virsh blockpull --wait (rhbz#811683)
  - qemu: Fix deadlock when qemuDomainOpenConsole cleans up a connection (rhbz#811497)
  - qemu: Fix deadlock when qemuDomainOpenConsole cleans up a connection (rhbz#811497)
  - qemu: Fix mem leak in qemuProcessInitCpuAffinity (rhbz#810157)
  - numad: Convert node list to cpumap before setting affinity (rhbz#810157)
  - numad: Ignore cpuset if placement is auto (rhbz#810157)
  - conf: Do not parse cpuset only if the placement is auto (rhbz#810157)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-13.el6
changelog:
  - Fix a problem in the patchset, rhbz#811497 one was applied twice in -12
  - qemu, util: On restart of libvirt restart vepa callbacks (rhbz#812430)
  - qemu, util: Fix netlink callback registration for migration (rhbz#812430)
  - util: Only register callbacks for CREATE operations in virnetdevmacvlan.c (rhbz#812430)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-14.el6
changelog:
  - blockjob: Add new API flags (rhbz#638506)
  - blockjob: Add 'blockcopy' to virsh (rhbz#638506)
  - blockjob: Enhance xml to track mirrors across libvirtd restart (rhbz#638506)
  - blockjob: React to active block copy (rhbz#638506)
  - blockjob: Add qemu capabilities related to block jobs (rhbz#638506)
  - blockjob: Return appropriate event and info (rhbz#638506)
  - blockjob: Support pivot operation on cancel (rhbz#638506)
  - blockjob: Make drive-reopen safer (rhbz#638506)
  - blockjob: Implement block copy for qemu (rhbz#638506)
  - blockjob: Allow for existing files (rhbz#638506)
  - blockjob: Allow mirroring under SELinux (rhbz#638506)
  - blockjob: Accommodate RHEL backport names (rhbz#638506)
  - virsh: Avoid strtol (rhbz#813972)
  - conf: Tighten up XML integer parsing (rhbz#813972)
  - snapshot: Fix memory leak on error (rhbz#782457)
  - virsh: Avoid uninitialized memory usage (rhbz#814080)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-15.el6
changelog:
  - qemu: Improve errors related to offline domains (rhbz#816662)
  - blockjob: Check for active vm before checking blockcopy bits (rhbz#816662)
  - qemu: Preserve original error during migration (rhbz#807907)
  - rpc: Discard non-blocking calls only when necessary (rhbz#807907)
  - qemu: Fix detection of failed migration (rhbz#807907)
  - qemu: Avoid bogus error at the end of tunnelled migration (rhbz#807907)
  - qemu: Make sure qemu can access its directory in hugetlbfs (rhbz#815206)
  - virsh: Fix docs for list command (rhbz#814021)
  - virsh: Fix and clarify the --title flag for the list command in man page (rhbz#814021)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-16.el6
changelog:
  - qemuOpenFile: Don't force chown on NFS (rhbz#810241)
  - util: Fix crash when starting macvtap interfaces (rhbz#815270)
  - qemu: Fix segfault when host CPU is empty (rhbz#817078)
  - blockjob: Allow speed setting in block copy (rhbz#815791)
  - blockjob: Fix block-stream bandwidth race (rhbz#815791)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-17.el6
changelog:
  - qemu: Don't modify domain on failed blockiotune (rhbz#819014)
  - qemu: Reject blockiotune if qemu too old (rhbz#819014)
  - qemu: Don't use virDomainDefFormat* directly (rhbz#815503)
  - qemu: Emit compatible XML when migrating a domain (rhbz#815503)
  - usb: Create functions to search usb device accurately (rhbz#815755)
  - qemu: Call usb search function for hostdev initialization and hotplug (rhbz#815755)
  - virsh: Avoid heap corruption leading to virsh abort (rhbz#819636)
  - util: Fix libvirtd startup failure due to netlink error (rhbz#816465)
  - util: Allow specifying both src and dst pid in virNetlinkCommand (rhbz#816465)
  - util: Function to get local nl_pid used by netlink event socket (rhbz#816465)
  - util: Set src_pid for virNetlinkCommand when appropriate (rhbz#816465)
  - domain_conf: Add "usbredir" to list of valid spice channels (rhbz#819498)
  - domain_conf: Add "default" to list of valid spice channels (rhbz#819499)
  - snapshot: Allow block devices past cgroup (rhbz#810200)
  - blockjob: Allow block devices past cgroup (rhbz#810200)
  - util: Avoid libvirtd crash in virNetDevTapCreate (rhbz#817234)
  - python: Fix the forward_null error in Python binding codes (rhbz#771021)
  - xen: Fix resource leak in xen driver (rhbz#771021)
  - test: Fix resource leak in test driver (rhbz#771021)
  - node: Fix resource leak in nodeinfo.c (rhbz#771021)
  - virnet: Fix resource leak in virnetlink.c (rhbz#771021)
  - vmx: Fix resource leak (rhbz#771021)
  - qemu: Fix resource leak (rhbz#771021)
  - uuid: Fix possible non-terminated string (rhbz#771021)
  - node_device: Fix possible non-terminated string (rhbz#771021)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-18.el6
changelog:
  - numad: Set memory policy from numad advisory nodeset (rhbz#810157)
  - numad: Copy 'placement' of <numatune> to <vcpu> by default (rhbz#810157)
  - numad: Always output 'placement' of <vcpu> (rhbz#810157)
  - qemu: Avoid the memory allocation and freeing (rhbz#810157)
  - numad: Divide cur_balloon by 1024 before passing it to numad (rhbz#810157)
  - numad: Check numactl-devel if compiled with numad support (rhbz#810157)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-19.el6
changelog:
  - build: Fix the typo in configure.ac (rhbz#820461)
  - qemu: Fix build when !HAVE_NUMACTL (rhbz#820461)
  - usb: Fix crash when failing to attach a second usb device (rhbz#815755)
  - qemu: Use the CPU index in capabilities to map NUMA node to cpu list. (rhbz#820461)
  - qemu: Set memory policy using cgroup if placement is auto (rhbz#820461)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-20.el6
changelog:
  - Fix virDomainDeviceInfoIsSet() to check all struct fields (rhbz#820869)
  - Fix logic for assigning PCI addresses to USB2 companion controllers (rhbz#820869)
  - Set a sensible default master start port for ehci companion controllers (rhbz#820869)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-21.el6
changelog:
  - qemu: Rollback on used USB devices (rhbz#743671)
  - qemu: Don't delete USB device on failed qemuPrepareHostdevUSBDevices (rhbz#743671)
  - Revert "rpc: Discard non-blocking calls only when necessary" (rhbz#821468)


author: Eric Blake <eblake@redhat.com> - libvirt-0.9.10-21.el6_3.1
changelog:
  - avoid closing uninitialized fd (rhbz#827050)
  - avoid fd leak (rhbz#827050)
  - command: avoid double close bugs (rhbz#827050)
  - fdstream: avoid double close bug (rhbz#827050)
  - command: check for fork error before closing fd (rhbz#827050)
  - qemu: avoid closing fd more than once (rhbz#827050)
  - Disable keepalives by default (rhbz#832184)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.13-1.el6
changelog:
  - first rebase for 6.4 more to come
  - kvm-guest failed to start; double-close bug in libvirt (rhbz#823716)
  - potential to deadlock libvirt on EPIPE (rhbz#827234)
  - fix keepalive issues (rhbz#832081)
  - CPU topology parsing bug on special NUMA platform (rhbz#828729)
  - libvirtd will crash when tight loop of hotplug/unplug PCI device (rhbz#822373)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.10.0-0rc0.el6
changelog:
  - New build based on upstream snapshot 0.10.0-0rc0 (rhbz#836934)
  - Cleanup and rebase of the few RHEL-only patches


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.10.0-1.el6
changelog:
  - New build based on upstream release 0.10.0 (rhbz#836934)
  - agent: add qemuAgentArbitraryCommand() for general qemu agent command
  - Introduce virDomainPinEmulator and virDomainGetEmulatorPinInfo functions
  - network: use firewalld instead of iptables, when available
  - network: make network driver vlan-aware
  - esx: Implement network driver
  - Various LXC improvements
  - Add virDomainGetHostname
  - a lot of bug fixes, improvements and portability work


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.10.2-1.el6
changelog:
  - New build based on upstream release 0.10.2 (rhbz#836934)
  - network: define new API virNetworkUpdate
  - add support for QEmu sandbox support
  - blockjob: add virDomainBlockCommit
  - New APIs to get/set Node memory parameters
  - new API virConnectListAllSecrets
  - new API virConnectListAllNWFilters
  - new API virConnectListAllNodeDevices
  - new API virConnectListAllInterfaces
  - new API virConnectListAllNetworks
  - new API virStoragePoolListAllVolumes
  - Add PMSUSPENDED life cycle event
  - new API virStorageListAllStoragePools
  - Add per-guest S3/S4 state configuration
  - qemu: Support for Block Device IO Limits
  - a lot of bug fixes, improvements and portability work


author: Jiri Denemark <jdenemar@redhat.com> - libvirt-0.10.2-2.el6
changelog:
  - qemu: Wait for SPICE to migrate (rhbz#836135)
  - lxc: Correctly report active cgroups (rhbz#860907)
  - network: Backend for virNetworkUpdate of interface list (rhbz#844404)
  - Fix start of containers with custom root filesystem (rhbz#861564)
  - Correct checking of virStrcpyStatic() return value (rhbz#864122)


author: Jiri Denemark <jdenemar@redhat.com> - libvirt-0.10.2-3.el6
changelog:
  - conf: Rename life cycle actions to event actions (rhbz#832156)
  - conf: Add on_lockfailure event configuration (rhbz#832156)
  - locking: Add const char * parameter to avoid ugly typecasts (rhbz#832156)
  - locking: Pass hypervisor driver name when acquiring locks (rhbz#832156)
  - locking: Add support for lock failure action (rhbz#832156)
  - locking: Implement lock failure action in sanlock driver (rhbz#832156)
  - conf: Add support for startupPolicy for USB devices (rhbz#843560)
  - qemu: Introduce qemuFindHostdevUSBDevice (rhbz#843560)
  - qemu: Add option to treat missing USB devices as success (rhbz#843560)
  - qemu: Implement startupPolicy for USB passed through devices (rhbz#843560)
  - Add MIGRATABLE flag for virDomainGetXMLDesc (rhbz#843560)
  - qemu: Make save/restore with USB devices usable (rhbz#843560)
  - conf: Mark missing optional USB devices in domain XML (rhbz#843560)
  - security: Also parse user/group names instead of just IDs for DAC labels (rhbz#860519)
  - doc: Update description about security labels on formatdomain.html (rhbz#860519)
  - util: Extend virGetUserID and virGetGroupID to support names and IDs (rhbz#860519)
  - security: Update user and group parsing in security_dac.c (rhbz#860519)
  - doc: Update description about user/group in qemu.conf (rhbz#860519)
  - Fix kvm_pv_eoi with kvmclock (rhbz#860971)
  - Change qemuSetSchedularParameters to use AFFECT_CURRENT (rhbz#852260)
  - Fix handling of itanium arch name in QEMU driver (rhbz#863115)
  - Add a qemu capabilities cache manager (rhbz#863115)
  - Switch over to use cache for building QEMU capabilities (rhbz#863115)
  - Remove probing of flags when launching QEMU guests (rhbz#863115)
  - Remove probing of machine types when canonicalizing XML (rhbz#863115)
  - Remove probing of CPU models when launching QEMU guests (rhbz#863115)
  - Make qemuCapsProbeMachineTypes & qemuCapsProbeCPUModels static (rhbz#863115)
  - Remove xenner support (rhbz#863115)
  - Refactor guest init to support qemu-system-i386 binary too (rhbz#863115)
  - Add a qemuMonitorGetVersion() method for QMP query-version command (rhbz#863115)
  - Add a qemuMonitorGetMachines() method for QMP query-machines command (rhbz#863115)
  - Add a qemuMonitorGetCPUDefinitions method for QMP query-cpu-definitions command (rhbz#863115)
  - Add a qemuMonitorGetCommands() method for QMP query-commands command (rhbz#863115)
  - Add a qemuMonitorGetEvents() method for QMP query-events command (rhbz#863115)
  - Add a qemuMonitorGetObjectTypes() method for QMP qom-list-types command (rhbz#863115)
  - Add a qemuMonitorGetObjectProps() method for QMP device-list-properties command (rhbz#863115)
  - Add a qemuMonitorGetTargetArch() method for QMP query-target command (rhbz#863115)
  - Remove some unused includes in QEMU code (rhbz#863115)
  - Move command/event capabilities detection out of QEMU monitor code (rhbz#863115)
  - Fix regression starting QEMU instances without query-events (rhbz#863115)
  - Refactor qemuCapsParseDeviceStr to work from data tables (rhbz#863115)
  - Fix QEMU test with 1.2.0 help output (rhbz#863115)
  - Ignore error from query-cpu-definitions (rhbz#863115)
  - Fix potential deadlock when agent is closed (rhbz#859712)
  - Fix (rare) deadlock in QEMU monitor callbacks (rhbz#859712)
  - Convert virLXCMonitor to use virObject (rhbz#864336)
  - Remove pointless virLXCProcessMonitorDestroy method (rhbz#864336)
  - Simplify some redundant locking while unref'ing objects (rhbz#859712)
  - Fix deadlock in handling EOF in LXC monitor (rhbz#864336)
  - Avoid bogus I/O event errors when closing the QEMU monitor (rhbz#859712)
  - qemu: Fix parsing of x86 CPU models (rhbz#864097)
  - python: Keep consistent handling of Python integer conversion (rhbz#816609)
  - esx: Fix and improve esxListAllDomains function (rhbz#864384)
  - virsh: Block SIGINT while getting BlockJobInfo (rhbz#845448)
  - spec: Add support for libssh2 transport (rhbz#513363)
  - Revert "Use XDG Base Directories instead of storing in home directory" (rhbz#859331)
  - doc: Sort out the relationship between <vcpu>, <vcpupin>, and <emulatorpin> (rhbz#855218)
  - conf: Ignore vcpupin for not onlined vcpus when parsing (rhbz#855218)
  - conf: Initialize the pinning policy for vcpus (rhbz#855218)
  - qemu: Create or remove cgroup when doing vcpu hotpluging (rhbz#857013)
  - qemu: Initialize cpuset for hotplugged vcpu as def->cpuset (rhbz#855218)
  - conf: Ignore emulatorpin if vcpu placement is auto (rhbz#855218)
  - qemu: Ignore def->cpumask if emulatorpin is specified (rhbz#855218)
  - Avoid straying </cpuset> (rhbz#855218)
  - conf: Fix virDevicePCIAddressEqual args (rhbz#805071)
  - conf: VirDomainDeviceInfoCopy utility function (rhbz#805071)
  - qemu: Reorganize qemuDomainChangeNet and qemuDomainChangeNetBridge (rhbz#805071)
  - Add support for SUSPEND_DISK event (rhbz#839661)


author: Jiri Denemark <jdenemar@redhat.com> - libvirt-0.10.2-4.el6
changelog:
  - node_memory: Add new parameter field to tune the new sysfs knob (rhbz#840113)
  - daemon: Fix removing abstract namespaces (rhbz#859331)
  - tests: Fix domain-events python test (rhbz#839661)
  - conf: Fix crash with cleanup (rhbz#866288)
  - spec: Add runtime requirement for libssh2 (rhbz#866508)
  - spec: Require newer sanlock on recent distros (rhbz#832156)
  - spec: Require newer sanlock on recent distros 2 (rhbz#832156)


author: Jiri Denemark <jdenemar@redhat.com> - libvirt-0.10.2-5.el6
changelog:
  - qemu: Clear async job when p2p migration fails early (rhbz#867412)
  - qemu: Pin the emulator when only cpuset is specified (rhbz#867372)
  - qemu: Correctly wait for spice to migrate (rhbz#867724)
  - qemu: Fixed default machine detection in qemuCapsParseMachineTypesStr (rhbz#867764)
  - conf: Make tri-state feature options more universal (rhbz#864606)
  - conf: Add support for HyperV Enlightenment features (rhbz#864606)
  - qemu: Add support for HyperV Enlightenment feature "relaxed" (rhbz#864606)
  - network: Set to NULL after virNetworkDefFree() (rhbz#866364)
  - qemu: Always format CPU topology (rhbz#866999)
  - qemu: Don't fail without emulatorpin or cpumask (rhbz#867372)
  - qemu: Allow migration with host USB devices (rhbz#843560)
  - qemu: Do not require hostuuid in migration cookie (rhbz#863059)
  - network: Free/null newDef if network fails to start (rhbz#866364)
  - migrate: v2: Use VIR_DOMAIN_XML_MIGRATABLE when available (rhbz#856864)
  - qemu: Avoid holding the driver lock in trivial snapshot API's (rhbz#772088)
  - storage: List more file types (rhbz#772088)
  - storage: Treat 'aio' like 'raw' at parse time (rhbz#772088)
  - storage: Match RNG to supported driver types (rhbz#772088)
  - storage: Use enum for default driver type (rhbz#772088)
  - storage: Use enum for disk driver type (rhbz#772088)
  - storage: Use enum for snapshot driver type (rhbz#772088)
  - storage: Don't probe non-files (rhbz#772088)
  - storage: Get entire metadata chain in one call (rhbz#772088)
  - storage: Don't require caller to pre-allocate metadata struct (rhbz#772088)
  - storage: Remember relative names in backing chain (rhbz#772088)
  - storage: Make it easier to find file within chain (rhbz#772088)
  - storage: Cache backing chain while qemu domain is live (rhbz#772088)
  - storage: Use cache to walk backing chain (rhbz#772088)
  - blockjob: Remove unused parameters after previous patch (rhbz#772088)
  - blockjob: Manage qemu block-commit monitor command (rhbz#772088)
  - blockjob: Wire up online qemu block-commit (rhbz#772088)
  - blockjob: Implement shallow commit flag in qemu (rhbz#772088)
  - blockjob: Refactor qemu disk chain permission grants (rhbz#772088)
  - blockjob: Properly label disks for qemu block-commit (rhbz#772088)
  - blockjob: Avoid segv on early error (rhbz#772088)
  - blockjob: Accommodate early RHEL backport naming (rhbz#772088)
  - virsh: Fix segfault of snapshot-list (rhbz#837544)
  - network: Always create dnsmasq hosts and addnhosts files, even if empty (rhbz#868389)
  - network: Don't allow multiple default portgroups (rhbz#868483)
  - selinux: Use raw contexts (rhbz#851981)
  - selinux: Add security selinux function to label tapfd (rhbz#851981)
  - selinux: Use raw contexts 2 (rhbz#851981)
  - selinux: Fix wrong tapfd relablling (rhbz#851981)
  - selinux: Remove unused variables in socket labelling (rhbz#851981)
  - selinux: Relabel tapfd in qemuPhysIfaceConnect (rhbz#851981)
  - storage: Let format probing work on root-squash NFS (rhbz#856247)
  - snapshot: Sanity check when reusing file for snapshot (rhbz#856247)
  - blockjob: Add qemu capabilities related to block jobs (rhbz#856247)
  - blockjob: React to active block copy (rhbz#856247)
  - blockjob: Return appropriate event and info (rhbz#856247)
  - blockjob: Support pivot operation on cancel (rhbz#856247)
  - blockjob: Make drive-reopen safer (rhbz#856247)
  - blockjob: Implement block copy for qemu (rhbz#856247)
  - blockjob: Allow for existing files in block-copy (rhbz#856247)
  - blockjob: Allow mirroring under SELinux and cgroup (rhbz#856247)
  - blockjob: Relabel entire existing chain (rhbz#856247)


author: Jiri Denemark <jdenemar@redhat.com> - libvirt-0.10.2-6.el6
changelog:
  - xml: Omit domain name from comment if it contains double hyphen (rhbz#868692)
  - cpu: Add recently added cpu feature flags. (rhbz#797283)
  - esx: Update version checks for vSphere 5.1 (rhbz#865670)
  - qemu: Add helper to prepare cpumap for affinity setting (rhbz#869096)
  - qemu: Keep the affinity when creating cgroup for emulator thread (rhbz#869096)
  - qemu: Prohibit chaning affinity of domain process if placement is 'auto' (rhbz#870099)
  - network: Fix networkValidate check for default portgroup and vlan (rhbz#868483)
  - qemu: Fix attach/detach of netdevs with matching mac addrs (rhbz#862515)
  - snapshot: Improve snapshot-list error message (rhbz#869100)
  - virsh: Remove --flags from nodesuspend (rhbz#869508)
  - virsh: Fix POD syntax (rhbz#870273)
  - xml: Print uuids in the warning (rhbz#868692)
  - blockjob: Support both RHEL and upstream qemu drive-mirror (rhbz#871055)


author: Jiri Denemark <jdenemar@redhat.com> - libvirt-0.10.2-7.el6
changelog:
  - sanlock: Introduce 'user' and 'group' conf variables (rhbz#820173)
  - esx: Fix connection to ESX 5.1 (rhbz#865670)
  - cpu: Fix definition of flag smap (rhbz#797283)
  - util: Do a better job of matching up pids with their binaries (rhbz#871201)
  - qemu: Fix EmulatorPinInfo without emulatorpin (rhbz#871312)
  - build: Fix RPM build for non-x86 platforms (rhbz#820173)
  - qemu: Report errors from iohelper (rhbz#866369)
  - build: Fix linking with systemtap probes (rhbz#866369)
  - iohelper: Fdatasync() at the end (rhbz#866369)
  - net-update docs: S/domain/network/ (rhbz#872104)
  - cpu: Add newly added cpu flags (rhbz#838127)
  - cpu: Add AMD Opteron G5 cpu model (rhbz#838127)
  - cpu: Add Intel Haswell cpu model (rhbz#843087)
  - snapshot: New XML for external system checkpoint (rhbz#638512)
  - snapshot: Improve disk align checking (rhbz#638512)
  - snapshot: Populate new XML info for qemu snapshots (rhbz#638512)
  - snapshot: Merge pre-snapshot checks (rhbz#638512)
  - qemu: Fix possible race when pausing guest (rhbz#638512)
  - qemu: Clean up snapshot retrieval to use the new helper (rhbz#638512)
  - qemu: Split out domain memory saving code to allow reuse (rhbz#638512)
  - snapshot: Add flag to enable creating checkpoints in live state (rhbz#638512)
  - snapshot: qemu: Add async job type for snapshots (rhbz#638512)
  - snapshot: qemu: Rename qemuDomainSnapshotCreateActive (rhbz#638512)
  - snapshot: qemu: Add support for external checkpoints (rhbz#638512)
  - snapshot: qemu: Remove restrictions preventing external checkpoints (rhbz#638512)


author: Jiri Denemark <jdenemar@redhat.com> - libvirt-0.10.2-8.el6
changelog:
  - iohelper: Don't report errors on special FDs (rhbz#866369)
  - esx: Yet another connection fix for 5.1 (rhbz#873538)
  - qemu: Don't corrupt pointer in qemuDomainSaveMemory() (rhbz#873537)
  - build: Place attributes in correct location (rhbz#873934)
  - Introduce new VIR_DOMAIN_EVENT_SUSPENDED_API_ERROR event (rhbz#866388)
  - qemu: Emit event if 'cont' fails (rhbz#866388)
  - virsh: Make ,, escape parsing common (rhbz#874171)
  - virsh: Add snapshot-create-as memspec support (rhbz#874171)
  - qemu: Fix domain ID numbering race condition (rhbz#874330)
  - qemu: Allow migration to be cancelled at prepare phase (rhbz#873792)
  - AbortJob: Fix documentation (rhbz#873792)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-9
changelog:
  - util: Improve error reporting from absolutePathFromBaseFile helper (rhbz#874860)
  - storage: Fix broken backing chain (rhbz#874860)
  - nodeinfo: Add check and workaround to guarantee valid cpu topologies (rhbz#874050)
  - nodeinfotest: Add test data for 2 processor host with broken NUMA (rhbz#874050)
  - nodeinfotest: Add test data from a AMD bulldozer machine. (rhbz#874050)
  - virsh: save: Report an error if XML file can't be read (rhbz#876868)
  - virsh: Fix uninitialized variable in cmdSnapshotEdit (rhbz#877303)
  - qemu: Allow larger discrepency between memory & currentMemory in domain xml (rhbz#873134)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-10
changelog:
  - Add note about numeric domain names to manpage (rhbz#824253)
  - Use virNetServerRun instead of custom main loop (rhbz#867246)
  - qemu: Fix RBD attach regression (rhbz#878862)
  - qemu: Stop recursive detection of image chains when an image is missing (rhbz#878862)
  - Fix exiting of libvirt_lxc program on container quit (rhbz#879360)
  - snapshot: qemu: Add support for external inactive snapshots (rhbz#876816)
  - conf: Fix private symbols exported by files in conf (rhbz#876816)
  - snapshot: qemu: Fix detection of external snapshots when deleting (rhbz#876816)
  - snapshot: Require user to supply external memory file name (rhbz#876816)
  - snapshot: Add two more filter sets to API (rhbz#876817)
  - snapshot: Add virsh back-compat support for new filters (rhbz#876817)
  - snapshot: Implement new filter sets (rhbz#876817)
  - snapshot: Expose location through virsh snapshot-info (rhbz#876817)
  - sanlock: Retry after EINPROGRESS (rhbz#820173)
  - storage: Fix logical volume cloning (rhbz#879780)
  - cpu: Add Intel Haswell cpu model (fix previous downstream definition) (rhbz#879282)
  - virsh: Report error when taking a snapshot with empty --memspec argument (rhbz#879130)
  - lxc: Don't crash if no security driver is specified in libvirt_lxc (rhbz#880064)
  - lxc: Avoid segfault of libvirt_lxc helper on early cleanup paths (rhbz#880064)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-11
changelog:
  - Fix uninitialized variable in virLXCControllerSetupDevPTS (rhbz#880064)
  - storage: Fix device detach regression with cgroup ACLs (rhbz#876828)
  - storage: Fix bug of fs pool destroying (rhbz#878400)
  - qemu: Fix a crash when save file can't be opened (rhbz#880919)
  - bitmap: Fix typo to use UL type of integer constant in virBitmapIsAllSet (rhbz#876415)
  - virsh: Rewrite cmdDomDisplay (rhbz#878779)
  - network: Fix crash when portgroup has no name (rhbz#879473)
  - util: Capabilities detection for dnsmasq (rhbz#882265)
  - util: New virSocketAddrIsPrivate function (rhbz#882265)
  - network: Use dnsmasq --bind-dynamic when available (rhbz#882265)
  - storage: Fix scsi detach regression with cgroup ACLs (rhbz#876828)
  - libssh2_session: Support DSS keys as well (rhbz#878376)
  - virsh: Fix error messages in iface-bridge (rhbz#878376)
  - virsh: Check the return value of virStoragePoolGetAutostart (rhbz#878376)
  - conf: Check the return value of virXPathNodeSet (rhbz#878376)
  - conf: snapshot: Check return value of virDomainSnapshotObjListNum (rhbz#878376)
  - util: Fix virBitmap allocation in virProcessInfoGetAffinity (rhbz#878376)
  - virsh: Use correct sizeof when allocating cpumap (rhbz#878376)
  - rpc: Don't destroy xdr before creating it in virNetMessageEncodeHeader (rhbz#878376)
  - virsh: Do timing even for unusable connections (rhbz#878376)
  - conf: Fix uninitialized variable in virDomainListSnapshots (rhbz#878376)
  - Fix error handling in virSecurityManagerGetMountOptions (rhbz#878376)
  - conf: Prevent crash with no uuid in cephx auth secret (rhbz#878376)
  - conf: Fix virDomainNetGetActualDirect*() and BridgeName() (rhbz#881480)
  - virsh: Report errors if arguments of the schedinfo command are incorrect (rhbz#882915)
  - systemd: Require dbus service (rhbz#830201)
  - spec: Require dbus-daemon when using libvirtd in Fedora (rhbz#830201)
  - qemu: Don't free PCI device if adding it to activePciHostdevs fails (rhbz#877095)
  - util: Slightly refactor PCI list functions (rhbz#877095)
  - qemu: Fix memory (and FD) leak on PCI device detach (rhbz#877095)
  - util: Do not keep PCI device config file open (rhbz#877095)
  - node_memory: Improve the docs (rhbz#872656)
  - node_memory: Do not fail if there is parameter unsupported (rhbz#872656)
  - node_memory: Fix bug of node_memory_tune (rhbz#872656)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-12
changelog:
  - qemu: Eliminate bogus error log when changing netdev's bridge (rhbz#885838)
  - remote: Avoid the thread race condition (rhbz#866524)
  - storage: Error out earlier if the volume target path already exists (rhbz#832302)
  - dnsmasq: Fix parsing of the version number (rhbz#885727)
  - qemu: Restart CPUs with valid async job type when doing external snapshots (rhbz#885081)
  - examples: Fix balloon event callback (rhbz#884650)
  - util: Don't fail virGetGroupIDByName when group not found (rhbz#883832)
  - util: Don't fail virGetUserIDByName when user not found (rhbz#883832)
  - util: Rework error reporting in virGet(User|Group)IDByName (rhbz#883832)
  - util: Fix warning message in previous patch (rhbz#883832)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-13
changelog:
  - network: Prevent dnsmasq from listening on localhost (rhbz#886821)
  - sanlock: Re-add lockspace unconditionally (rhbz#820173)
  - Fix "virsh create" example (rhbz#887187)
  - docs: Fix some typos in examples (rhbz#887187)
  - network: Don't require private addresses if dnsmasq uses SO_BINDTODEVICE (rhbz#882265)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-14
changelog:
  - util: Add missing error log messages when failing to get netlink VFINFO (rhbz#889319)
  - util: Fix functions that retrieve SRIOV VF info (rhbz#889319)
  - util: Fix botched check for new netlink request filters (rhbz#889319)
  - blockjob: Fix memleak that prevented block pivot (rhbz#888426)
  - sanlock: Chown lease files as well (rhbz#820173)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-15
changelog:
  - snapshot: conf: Make virDomainSnapshotIsExternal more reusable (rhbz#889407)
  - snapshot: qemu: Separate logic blocks with newlines (rhbz#889407)
  - snapshot: qemu: Fix segfault and vanishing snapshots when redefining (rhbz#889407)
  - snapshot: qemu: Allow redefinition of external snapshots (rhbz#889407)
  - util: Prepare helpers for unpriv_sgio setting (rhbz#878578)
  - qemu: Add a hash table for the shared disks (rhbz#878578)
  - docs: Add docs and rng schema for new XML tag sgio (rhbz#878578)
  - conf: Parse and format the new XML (rhbz#878578)
  - qemu: Set unpriv_sgio when starting domain and attaching disk (rhbz#878578)
  - qemu: Check if the shared disk's cdbfilter conflicts with others (rhbz#878578)
  - qemu: Relax hard RSS limit (rhbz#891653)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-16
changelog:
  - qemu_agent: Remove agent reference only when disposing it (rhbz#892079)
  - Add RESUME event listener to qemu monitor. (rhbz#894085)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-17
changelog:
  - storage: Fix lvcreate parameter for backingStore. (rhbz#896398)
  - qemu: Don't return success if creation of snapshot save file fails (rhbz#896403)
  - qemu: Reject attempts to create snapshots with names containig '/' (rhbz#896403)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-18
changelog:
  - rpc: Fix crash on error paths of message dispatching (CVE-2013-0170)
  - spec: Disable libssh2 support (rhbz#513363)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-19
changelog:
  - xen: Resolve resource leak with 'cpuset' (rhbz#888503)
  - schema: Make the cpuset type reusable across schema files (rhbz#888503)
  - schemas: Add schemas for more CPU topology information in the caps XML (rhbz#888503)
  - conf: Split out NUMA topology formatting to simplify access to data (rhbz#888503)
  - capabilities: Switch CPU data in NUMA topology to a struct (rhbz#888503)
  - capabilities: Add additional data to the NUMA topology info (rhbz#888503)
  - test: Add support for thread and core information for the test driver (rhbz#888503)
  - xen: Initialize variable before using (rhbz#888503)
  - xen: Actually fix the uninitialized variable (rhbz#888503)
  - spice: Properly reserve tlsPort when no port specified (rhbz#913244)
  - qemu_agent: Ignore expected EOFs (rhbz#892079)
  - qemu: Nicer error message if live disk snapshot unsupported (rhbz#882077)
  - qemu: Destroy domain on decompression binary error (rhbz#894723)
  - qemu: Run lzop with '--ignore-warn' (rhbz#894723)
  - Don't ignore return value of qemuProcessKill (rhbz#903238)
  - Fix race condition when destroying guests (rhbz#903238)
  - Log warning if storage magic matches, but version does not (rhbz#903248)
  - Add lots of debugging to storage file probing code (rhbz#903248)
  - Fix probing of QED file format (rhbz#903248)
  - util: Add virendian.h macros (rhbz#903248)
  - util: Use new virendian.h macros (rhbz#903248)
  - storage: Rearrange functions (rhbz#903248)
  - storage: Prepare for refactoring (rhbz#903248)
  - storage: Refactor metadata lookup (rhbz#903248)
  - storage: Don't follow backing chain symlinks too eagerly (rhbz#903248)
  - storage: Test backing chain traversal (rhbz#903248)
  - qemu: Check backing chains even when cgroup is omitted (rhbz#896013)
  - python: Fix bindings for virDomainSnapshotGet{Domain,Connect} (rhbz#895882)
  - qemu: Add checking in helpers for sgio setting (rhbz#908073)
  - qemu: Merge qemuCheckSharedDisk into qemuAddSharedDisk (rhbz#908073)
  - qemu: Record names of domain which uses the shared disk in hash table (rhbz#908073)
  - qemu: Update shared disk table when reconnecting qemu process (rhbz#908073)
  - qemu: Move the shared disk adding and sgio setting prior to attaching (rhbz#908073)
  - qemu: Remove the shared disk entry if the operation is ejecting or updating (rhbz#908073)
  - qemu: Fix the memory leak (rhbz#908073)
  - Fix crash changing CDROM media (rhbz#908073)
  - qemu: Avoid NULL dereference in qemuSharedDiskEntryFree (rhbz#908073)
  - qemu: Do not set unpriv_sgio if neither supported nor requested (rhbz#914677)
  - Use size_t instead of int for virDomainDefPtr struct (rhbz#896604)
  - util: Add VIR_(APPEND|INSERT|DELETE)_ELEMENT (rhbz#896604)
  - qemu: Fix QMP detection of QXL graphics (rhbz#896604)
  - qemu: Add qemu vga devices caps and one cap to mark them usable (rhbz#896604)
  - conf: Add optional attribte primary to video <model> element (rhbz#896604)
  - qemu: Use newer -device video device in qemu commandline (rhbz#896604)
  - tests: Add one -device video device testcase (rhbz#896604)
  - qemu: Detect VGA_QXL capability correctly (rhbz#896604)
  - qemu: Support ram bar size for qxl devices (rhbz#896604)
  - conf: Don't leak 'primary' video property on error (rhbz#896604)
  - storage: lvm: Don't overwrite lvcreate errors (rhbz#912179)
  - storage: lvm: Lvcreate fails with allocation=0, don't do that (rhbz#912179)
  - storage: Cleanup logical volume creation code (rhbz#912179)
  - docs: Clarify semantics of sparse storage volumes (rhbz#912179)
  - storage: Fix memory leak with regfree(reg) call. (rhbz#906299)
  - storage: Resource resource leak using 'tmp_vols' (rhbz#906299)
  - interface: Resolve resource leak wth 'tmp_iface_objs' (rhbz#906299)
  - locking: Resolve resource leaks on non error path (rhbz#906299)
  - selinux: Resolve resource leak using the default disk label (rhbz#906299)
  - storage: Resolve resource leaks with cmd processing (rhbz#906299)
  - domain_conf: Resolve resource leaks found by Valgrind (rhbz#906299)
  - qemu_command: Resolve resource leaks found by Valgrind (rhbz#906299)
  - storage: Need to add virCommandFree() (rhbz#906299)
  - qemu: Fix startupPolicy regression (rhbz#896013)
  - util: Retry NLM_F_REQUEST with different values of IFLA_EXT_MASK (rhbz#923963)
  - security_manager: Don't manipulate domain XML in virDomainDefGetSecurityLabelDef (rhbz#923946)
  - security: Don't add seclabel of type none if there's already a seclabel (rhbz#923946)
  - libvirt_private.syms: Correctly export seclabel APIs (rhbz#923946)
  - security_manager.c: Append seclabel iff generated (rhbz#923946)
  - rpc: Fix client crash when server drops connection (rhbz#921538)
  - storage: Fix volume cloning for logical volume. (rhbz#948678)
  - qemu: Allow migration over IPv6 (rhbz#846013)
  - qemu: Set IPv6 migration capability when dump-guest-core is present (rhbz#846013)
  - remote: Don't call NULL closeFreeCallback (rhbz#911609)
  - libvirt: Increase connection reference count for callbacks (rhbz#911609)
  - virsh: Unregister the connection close notifier upon termination (rhbz#911609)
  - virsh: Move cmdConnect from virsh-host.c to virsh.c (rhbz#911609)
  - virsh: Register and unregister the close callback also in cmdConnect (rhbz#911609)
  - rpc: Fix connection close callback race condition and memory corruption/crash (rhbz#911609)
  - tests: Fix qemumonitorjsontest deadlock when the machine is under load (rhbz#951227)
  - Avoid use of free'd memory in auto destroy callback (rhbz#950286)
  - Fix crash in QEMU auto-destroy with transient guests (rhbz#950286)
  - daemon: Fix leak after listing volumes (CVE-2013-1962)
  - Don't try to add non-existant devices to ACL (rhbz#922153)
  - Avoid spamming logs with cgroups warnings (rhbz#922153)
  - audit: Properly encode device path in cgroup audit (rhbz#922203)
  - qemu: Set correct migrate host in client_migrate_info (rhbz#920441)
  - qemu: Fix crash in migration of graphics-less guests. (rhbz#920441)
  - Fix F_DUPFD_CLOEXEC operation args (rhbz#961034)
  - cgroup: Be robust against cgroup movement races (rhbz#903433)
  - virsocket: Introduce virSocketAddrIsWildcard (rhbz#920441)
  - qemuDomainMigrateGraphicsRelocate: Use then new virSocketAddrIsWildcard (rhbz#920441)
  - virSocketAddrIsWildcard: Use IN6_IS_ADDR_UNSPECIFIED correctly (rhbz#920441)
  - libvirt: lxc: Don't mkdir when selinux is disabled (rhbz#915485)
  - Don't mount selinux fs in LXC if selinux is disabled (rhbz#915485)
  - virsh: Don't print --(null) in vol-name and vol-pool (rhbz#924571)
  - virsh: Fix docs for "virsh setmaxmem" (rhbz#924648)
  - qemu: Remove managed save flag from VM when starting with --force-boot (rhbz#917510)
  - qemu: Don't update count of vCPUs if hot-unplug has failed (rhbz#895424)
  - conf: net: Fix deadlock if assignment of network def fails (rhbz#921777)
  - RPC: Support up to 16384 cpus on the host and 4096 in the guest (rhbz#960683)
  - conf: Don't fail to parse <boot> when parsing a single device (rhbz#895294)
  - conf: Allow for non-contiguous device boot orders (rhbz#889961)
  - qemuDomainChangeGraphics: Check listen address change by listen type (rhbz#976401)
  - build: Fix build with -Werror (rhbz#976401)
  - qemuDomainBlockStatsFlags: Guard disk lookup with a domain job (rhbz#916315)
  - qemu: Don't fail to shutdown domains with unresponsive agent (rhbz#889635)
  - qemu: Wrap controllers code into dummy loop (rhbz#870003)
  - qemu: Add controllers in specified order (rhbz#870003)
  - tests: Add test for controller order (rhbz#870003)
  - bandwidth: Attach sfq to leaf node (rhbz#895340)
  - bandwidth: Create hierarchical shaping classes (rhbz#895340)
  - remote: Forbid default "/session" connections when using ssh transport (rhbz#847822)
  - remote: Fix client crash when URI path is empty when using ssh (rhbz#847822)
  - udev: Fix crash in libudev logging (rhbz#971904)
  - iscsi: Don't leak portal string when starting a pool (rhbz#975392)
  - storage: Avoid double virCommandFree in virStorageBackendLogicalDeletePool (rhbz#921387)
  - manual: Fix copy-paste errors (rhbz#923613)
  - esx: Support virtualHW version 9 (rhbz#955575)
  - manual: Add info about migrateuri in virsh manual (rhbz#878765)
  - conf: Fix cpumask leak in virDomainDefFree (rhbz#977430)
  - qemu: Avoid leaking uri in qemuMigrationPrepareDirect (rhbz#977961)
  - Document that runtime changes may be lost after S4 suspend (rhbz#872419)
  - virsh iface-bridge: Ignore delay if stp is turned off (rhbz#892403)
  - virsh: Obey pool-or-uuid spec when creating volumes (rhbz#970495)
  - Add method for checking if a string is (probably) a log message (rhbz#954248)
  - Convert QEMU driver to use virLogProbablyLogMessage (rhbz#954248)
  - util: Escapes special characters in VIR_LOG_REGEX (rhbz#954248)
  - qemu: Move QEMU log reading into a separate function (rhbz#954248)
  - qemu: Ignore libvirt logs when reading QEMU error output (rhbz#954248)
  - logging: Make log regexp more compact (and readable) (rhbz#954248)
  - qemu: Do not report unsafe migration for local files (rhbz#913363)
  - Plug leak in virCgroupMoveTask (rhbz#978352)
  - Fix invalid read in virCgroupGetValueStr (rhbz#978356)
  - pci: Initialize virtual_functions array pointer to avoid segfault (rhbz#980339)
  - Node device driver: update driver name during dumpxml (rhbz#979330)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-20
changelog:
  - qemu: Don't force port=0 for SPICE (rhbz#975751)
  - qemu: Refactor graphics code to not hardcode a single display (rhbz#975751)
  - qemu: Graphics support for simultaneous one of each sdl, vnc, spice (rhbz#975751)
  - qemu: Don't miss errors when changing graphics passwords (rhbz#975751)
  - qemu: Allow seamless migration for domains with multiple graphics (rhbz#975751)
  - qemu_migration: Move waiting for SPICE migration (rhbz#920205)
  - util: Refactor iptables command construction into multiple steps (rhbz#851455)
  - net: Support set public ip range for forward mode nat (rhbz#851455)
  - net: Add support for specifying port range for forward mode nat (rhbz#851455)
  - qemu_migrate: Dispose listen address if set from config (rhbz#971485)
  - qemu: Remove maximum cpu limit when setting processor count using the API (rhbz#855296)
  - qemu_agent: Introduce helpers for agent based CPU hot(un)plug (rhbz#924400)
  - virsh-domain: Refactor cmdVcpucount and fix output on inactive domains (rhbz#924400)
  - API: Introduce VIR_DOMAIN_VCPU_AGENT, for agent based CPU hot(un)plug (rhbz#924400)
  - qemu: Implement request of vCPU state using the guest agent (rhbz#924400)
  - qemu: Implement support for VIR_DOMAIN_VCPU_AGENT in qemuDomainSetVcpusFlags (rhbz#924400)
  - qemuDomainGetVcpusFlags: Initialize ncpuinfo (rhbz#924400)
  - Fix commit 29c1e913e459058c12d02b3f4b767b3dd428a498 (rhbz#924400)
  - qemu: Make qemuMigrationIsAllowed more reusable (rhbz#972675)
  - qemu: Cancel migration if guest encoutners I/O error while migrating (rhbz#972675)
  - qemu: Forbid migration of machines with I/O errors (rhbz#972675)
  - migration: Make erroring out on I/O error controllable by flag (rhbz#972675)
  - migration: Don't propagate VIR_MIGRATE_ABORT_ON_ERROR (rhbz#972675)
  - Paused domain should remain paused after migration (rhbz#972675)
  - qemu: New vnc display sharing policy caps flag (rhbz#803602)
  - conf: Add 'sharePolicy' attribute to graphics element for vnc (rhbz#803602)
  - qemu: Add ', share=<policy>' to qemu commandline (rhbz#803602)
  - virsh: Distinguish errors between missing argument and wrong option (rhbz#924596)
  - virsh: Fix incorrect argument errors for long options (rhbz#924596)
  - virsh: Resolve Coverity 'MISSING_BREAK' (rhbz#924596)
  - virnetdev: Need to initialize 'pciConfigAddr' (rhbz#980339)
  - qemu: Fix double free in qemuMigrationPrepareDirect (rhbz#977961)
  - sec_manager: Refuse to start domain with unsupported seclabel (rhbz#947387)
  - usb: Don't spoil decimal addresses (rhbz#981503)
  - storage: Return -1 when fs pool can't be mounted (rhbz#983539)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-21
changelog:
  - conf: Avoid NULL deref for pmsuspended domain state (rhbz#822306)
  - libvirt: Define domain crash event types (rhbz#822306)
  - qemu: Refactor processWatchdogEvent (rhbz#822306)
  - qemu: Expose qemuProcessShutdownOrReboot() (rhbz#822306)
  - qemu: Implement 'oncrash' events when guest panicked (rhbz#822306)
  - qemu: Implement 'oncrash' coredump events when guest panicked (rhbz#822306)
  - conf: Fix a memory leak when parsing nat port XML nodes (rhbz#851455)
  - security_manager: Fix comparison (rhbz#984793)
  - qemu: Prevent crash of libvirtd without guest agent configuration (rhbz#984821)
  - qemu: Fix double free of returned JSON array in qemuAgentGetVCPUs() (rhbz#984821)
  - qemu_agent: Add support for appending arrays to commands (rhbz#924400)
  - Add support for locking domain's memory pages (rhbz#947118)
  - qemu: Implement support for locking domain's memory pages (rhbz#947118)
  - qemu: Check for -realtime mlock=on|off support (rhbz#947118)
  - qemu: Move memory limit computation to a reusable function (rhbz#947118)
  - util: New virCommandSetMax(MemLock|Processes|Files) (rhbz#947118)
  - qemu: Set RLIMIT_MEMLOCK when memoryBacking/locked is used (rhbz#947118)
  - Add Gluster protocol as supported network disk backend (rhbz#849796)
  - qemu: Add support for gluster protocol based network storage backend. (rhbz#849796)
  - tests: Add tests for gluster protocol based network disks support (rhbz#849796)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-22
changelog:
  - virsh: Fix change-media bug on disk block type (rhbz#923053)
  - Fix patches for multiple graphics and spice migration (rhbz#975751)
  - Revert "qemu: Remove maximum cpu limit when setting processor count using the API" (rhbz#855296)
  - Remove VIR_DOMAIN_SHUTDOWN_CRASHED from public API (rhbz#822306)
  - Rename VIR_DOMAIN_PAUSED_GUEST_PANICKED to VIR_DOMAIN_PAUSED_CRASHED (rhbz#822306)
  - Improve LXC startup error reporting (rhbz#903092)
  - qemu: Take error path if acquiring of job fails in qemuDomainSaveInternal (rhbz#928661)
  - util: Improve user lookup helper (rhbz#964359)
  - util: Add virGetGroupList (rhbz#964359)
  - util: Make virSetUIDGID async-signal-safe (rhbz#964359)
  - Fix potential deadlock across fork() in QEMU driver (rhbz#964359)
  - security: Framework for driver PreFork handler (rhbz#964359)
  - security_dac: Compute supplemental groups before fork (rhbz#964359)
  - security: Fix deadlock with prefork (rhbz#964359)
  - Split TLS test into two separate tests (rhbz#975201)
  - Avoid re-generating certs every time (rhbz#975201)
  - Change data passed into TLS test cases (rhbz#975201)
  - Fix validation of CA certificate chains (rhbz#975201)
  - Fix parallel runs of TLS test suites (rhbz#975201)
  - tests: Fix parallel runs of TLS test suites (rhbz#975201)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-23
changelog:
  - virnettlscontext: Resolve Coverity warnings (UNINIT) (rhbz#975201)
  - Fix qemuProcessReadLog with non-zero offset (rhbz#991334)
  - virSecurityManagerGenLabel: Skip seclabels without model (rhbz#997818)
  - bitmap: Add virBitmapCountBits (rhbz#997367)
  - virbitmap: Refactor virBitmapParse to avoid access beyond bounds of array (rhbz#997367)
  - virbitmaptest: Add test for out of bounds condition (rhbz#997367)
  - network: Allow <vlan> in type='hostdev' networks (rhbz#999107)
  - python: Fix bindings that don't raise an exception (rhbz#912170)
  - storage: Update pool metadata after adding/removing/resizing volume (rhbz#965442)
  - storage: Fix coverity warning (rhbz#965442)
  - storage: Fix the use-after-free memory bug (rhbz#965442)
  - network: Permit upstream forwarding of unqualified DNS names (rhbz#928638)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-24
changelog:
  - security: Provide supplemental groups even when parsing label (rhbz#964359)
  - qemu: Remove hostdev entry when freeing the depending network entry (rhbz#1000973)
  - virsh: Correct DESCRIPTION for virsh help blockcopy (rhbz#1002790)
  - Add '<nat>' element to '<forward>' network schemas (rhbz#1004365)
  - build: More workarounds for if_bridge.h (rhbz#1002735)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-25
changelog:
  - migration: Do not restore labels on failed migration (rhbz#895826)
  - qemu: Use default machine type if missing it in qemu command line (rhbz#995312)
  - qemu: Don't leak vm on failure (rhbz#995312)
  - virDomainDefParseXML: Set the argument of virBitmapFree to NULL after calling virBitmapFree (rhbz#1006710)
  - tests: Files named '.*-invalid.xml' should fail validation (rhbz#1006710)
  - tests: Use portable shell code (rhbz#1006710)
  - Add test for the nodemask double free crash (rhbz#1006710)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-26
changelog:
  - Fix crash in remoteDispatchDomainMemoryStats (CVE-2013-4296)
  - Introduce APIs for splitting/joining strings (rhbz#1006266)
  - Rename virKillProcess to virProcessKill (rhbz#1006266)
  - Rename virPid{Abort, Wait} to virProcess{Abort, Wait} (rhbz#1006266)
  - Rename virCommandTranslateStatus to virProcessTranslateStatus (rhbz#1006266)
  - Move virProcessKill into virprocess.{h, c} (rhbz#1006266)
  - Move virProcess{Kill, Abort, TranslateStatus} into virprocess.{c, h} (rhbz#1006266)
  - Include process start time when doing polkit checks (rhbz#1006266)
  - Add support for using 3-arg pkcheck syntax for process (CVE-2013-4311)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-28
changelog:
  - libvirt-guests: status: Return non-zero when stopped (rhbz#1011981)
  - qemu: Drop qemuDomainMemoryLimit (rhbz#1013758)
  - docs: Discourage users to set hard_limit (rhbz#1013758)
  - docs: Clean 09adfdc62de2b up (rhbz#1013758)
  - qemuSetupMemoryCgroup: Handle hard_limit properly (rhbz#1013758)
  - qemuBuildCommandLine: Fall back to mem balloon if there's no hard_limit (rhbz#1013758)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-29
changelog:
  - virNetDevBandwidthEqual: Make it more robust (rhbz#1014198)
  - qemu_hotplug: Allow QoS update in qemuDomainChangeNet (rhbz#1014198)
  - qemu: Generate correct name for hostdev network devices (rhbz#1001881)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-30
changelog:
  - Fix race in starting transient VMs (rhbz#1022924)
  - qemuDomainDestroyFlags: Don't allow @vm to disappear while executing API (rhbz#1030736)
  - python: return dictionary without value in case of no blockjob (rhbz#999454)
  - remote: fix regression in event deregistration (rhbz#1020372)
  - Add virtio-scsi to fallback models of scsi controller (rhbz#1014943)
  - qemu: Avoid operations on NULL monitor if VM fails early (rhbz#1047659)
  - qemu: Do not access stale data in virDomainBlockStats (CVE-2013-6458)
  - qemu: Avoid using stale data in virDomainGetBlockInfo (CVE-2013-6458)
  - qemu: Fix job usage in qemuDomainBlockJobImpl (CVE-2013-6458)
  - qemu: Fix job usage in qemuDomainBlockCopy (rhbz#1043069)
  - qemu: Fix job usage in virDomainGetBlockIoTune (CVE-2013-6458)
  - Don't crash if a connection closes early (CVE-2014-1447)
  - Really don't crash if a connection closes early (CVE-2014-1447)
  - Block info query: Add check for transient domain (rhbz#1040507)
  - network: only prevent forwarding of DNS requests for unqualified names (rhbz#1037741)
  - network: change default of forwardPlainNames to 'yes' (rhbz#1037741)
  - sanlock: Truncate domain names longer than SANLK_NAME_LEN (rhbz#1060557)
  - Remove contiguous CPU indexes assumption (rhbz#1066473)
  - qemu: monitor: Fix error message and comment when getting cpu info (rhbz#1066473)
  - qemu: monitor: Filter out thread ids of CPUS that were unplugged (rhbz#1066473)
  - qemu: monitor: Fix invalid parentheses (rhbz#1076719)
  - virNetClientSetTLSSession: Restore original signal mask (rhbz#1078589)
  - spec: Switch to "git am" for applying patches (rhbz#1076719)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-31
changelog:
  - doc: schema: Add basic documentation for the virtual RNG device support (rhbz#786408)
  - conf: Add support for RNG device configuration in XML (rhbz#786408)
  - conf: Add RNG device ABI compatibility check (rhbz#786408)
  - qemu: Implement support for default 'random' backend for virtio-rng (rhbz#786408)
  - qemu: Implement support for EGD backend for virtio-rng (rhbz#786408)
  - docs: domain: /dev/urandom isn't a valid rng patch (rhbz#786408)
  - tests: Add tests for virtio-rng device handling (rhbz#786408)
  - docs: Fix attribute name for virtio-rng backend (rhbz#786408)
  - rng: restrict passthrough names to known-good files (rhbz#786408)
  - Resolve valgrind error (rhbz#786408)
  - Fix crash parsing RNG device specification (rhbz#786408)
  - rng: allow default device in RNG grammar (rhbz#786408)
  - virtio-rng: Add rate limiting options for virtio-RNG (rhbz#786408)
  - qemu_caps: Enable virtio-rng for RHEL-6.6 qemu-kvm downstream (rhbz#786408)
  - audit: Audit resources used by VirtIO RNG (rhbz#786408)
  - virtio-rng: Remove double space in error message (rhbz#786408)
  - doc: fix XML for the RNG device example (rhbz#786408)
  - conf: Don't crash on invalid chardev source definition of RNGs and other (rhbz#786408)
  - conf: Fix XML formatting of RNG device info (rhbz#786408)
  - libvirt: fix error message when connection can't be opened (rhbz#851413)
  - conf: fix error for parallel port mismatch (rhbz#950830)
  - virsh: clarify vol-{down, up}load description (rhbz#955539)
  - virsh: fix doc typos (rhbz#1022872)
  - util: use string libvirt to prefix error message instead of libvir (rhbz#911996)
  - docs: use MiB/s instead of Mbps for migration speed (rhbz#948821)
  - schema: require target path in storage pool xml (rhbz#893273)
  - schema: make source optional in volume XML (rhbz#893273)
  - Add qxl ram size to ABI stability check (rhbz#1035134)
  - qemu: fix default spice password setting (rhbz#953721)
  - Expose ownership ID parsing (rhbz#963881)
  - Make qemuOpenFile aware of per-VM DAC seclabel. (rhbz#869053)
  - Use qemuOpenFile in qemu_driver.c (rhbz#963881)
  - virsh: Fix heading in manpage (rhbz#996840)
  - qemu: Change the default unix monitor timeout (rhbz#1051364)
  - qemu: fix live pinning to memory node on NUMA system (rhbz#857312)
  - qemu: Clean up qemuDomainSetNumaParameters (rhbz#857312)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-32
changelog:
  - virsh-snapshot: Reject --no-metadata together with --print-xml (rhbz#892508)
  - snapshot: Mention disk-only snapshots in error message (rhbz#880521)
  - qemu: snapshot: Report better error message if migration isn't allowed (rhbz#884926)
  - qemu: snapshot: Remove memory image if external checkpoint fails (rhbz#885963)
  - virsh-snapshot: Fix XPath query to determine snapshot state (rhbz#890457)
  - conf: Check if number of vCPUs fits in the storage variable (rhbz#902652)
  - conf: Improve error messages if parsing of vCPU count fails (rhbz#902652)
  - qemu: snapshot: Don't kill access to disk if snapshot creation fails (rhbz#906639)
  - qemu: Un-mark volume as mirrored/copied if blockjob copy fails (rhbz#923125)
  - qemu-blockjob: Fix limit of bandwidth for block jobs to supported value (rhbz#927160)
  - virsh: Fix typo in docs (rhbz#949776)
  - virsh-domain: Report errors on invalid --holdtime value for cmdSendKey (rhbz#952938)
  - qemu: Don't update count of vCPUs if hot-plug fails silently (rhbz#1000357)
  - virsh: man: Mention that volumes need to be in storage pool for undefine (rhbz#1044790)
  - Disable nwfilter driver when running unprivileged (rhbz#1029299)
  - storage: reduce number of stat calls (rhbz#977706)
  - Ignore missing files on pool refresh (rhbz#977706)
  - sanlock: add missing test command in virt-sanlock-cleanup.in (rhbz#1000890)
  - virt-sanlock-cleanup; Fix augtool usage (rhbz#1000890)
  - conf: Fix typo in error message in ABI stability check (rhbz#961655)
  - qemu: Improve error when setting invalid count of vcpus via agent (rhbz#1035109)
  - doc: Clarify usage of SELinux baselabel (rhbz#954245)
  - selinux: Don't mask errors of virSecuritySELinuxGenNewContext (rhbz#954245)
  - qemu: Return meaningful error when qemu dies early (rhbz#844378)
  - sanlock: Forbid VIR_DOMAIN_LOCK_FAILURE_IGNORE (rhbz#905280)
  - Remove the redundant parentheses in migrate help (rhbz#927497)
  - virt-xml-validate: add missing schemas (rhbz#1006699)
  - tools: add missing 'interface' type and update man page (rhbz#1006699)
  - qemu: Don't require a block or file when looking for an alias (rhbz#1078328)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-33
changelog:
  - conf: fix error for parallel port mismatch (rhbz#950830)
  - virDomainReboot: Document that migration might be unsafe (rhbz#744967)
  - interface: list all interfaces with flags == 0 (rhbz#884382)
  - Fix the syntax-check failure (rhbz#884382)
  - Crash of libvirtd by unprivileged user in virConnectListAllInterfaces (rhbz#884382)
  - qemuDomainObjStart: Warn on corrupted image (rhbz#1022008)
  - QoS: make tc filters match all traffic (rhbz#1084477)
  - conf: add support for booting from redirected USB devices (rhbz#1035190)
  - Add redirdevs to ABI stability check (rhbz#1035529)
  - Fix incorrect values in redirdev ABI check error (rhbz#1035529)
  - virSecurityLabelDefParseXML: Don't parse label on model='none' (rhbz#1027096)
  - storage: Skip inactive lv volumes (rhbz#748282)
  - Check for existence of interface prior to setting terminate flag (rhbz#903480)
  - storage: Avoid forward declaration of virStorageVolDelete (rhbz#1024159)
  - storage: Don't update pool available/allocation if buildVol fails (rhbz#1024159)
  - conf: Report errors on cputune parameter parsing (rhbz#1040784)
  - Treat zero cpu shares as a valid value (rhbz#1040784)
  - Show the real cpu shares value in live XML (rhbz#1040784)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-34
changelog:
  - nwfilter: Remove error report in virNWFilterDHCPSnoopEnd (rhbz#903480)
  - conf: introduce generic ISA address (rhbz#1033984)
  - conf: add support for panic device (rhbz#1033984)
  - qemu: add support for -device pvpanic (rhbz#1033984)
  - PanicCheckABIStability: Need to check for existence (rhbz#1033984)
  - use virBitmapFree instead of VIR_FREE for cpumask (rhbz#1088165)
  - Properly free vcpupin info for unplugged CPUs (rhbz#1088165)
  - Save domain status after cpu hotplug (rhbz#1088703)
  - Document behavior of setvcpus during guest boot (rhbz#1088748)
  - qemu: Use maximum guest memory size when getting NUMA placement advice (rhbz#1011906)
  - qemu: Properly format the uuid string in error messages (rhbz#947974)
  - qemu: Split out code to generate SPICE command line (rhbz#953126)
  - qemu: Improve handling of channels when generating SPICE command line (rhbz#953126)
  - qemu: Split out SPICE port allocation into a separate function (rhbz#953126)
  - qemu: Do sensible auto allocation of SPICE port numbers (rhbz#953126)
  - qemu: fix failure to start with spice graphics and no tls (rhbz#953126)
  - qemu: Do not ignore address for USB disks (rhbz#985166)
  - qemu: pass -usb and usb hubs earlier, so USB disks with static address are handled properly (rhbz#985166)
  - qemu: refactor qemuDomainCheckDiskPresence for only disk presence check (rhbz#1014730)
  - qemu: add helper functions for diskchain checking (rhbz#1014730)
  - qemu: check presence of each disk and its backing file as well (rhbz#1014730)
  - conf: add startupPolicy attribute for harddisk (rhbz#1014730)
  - qemu: support to drop disk with 'optional' startupPolicy (rhbz#1014730)
  - qemu: Avoid overflow when setting migration speed (rhbz#1083483)
  - qemu: Avoid overflow when setting migration speed on inactive domains (rhbz#1083483)
  - caps: Add helpers to convert NUMA nodes to corresponding CPUs (rhbz#1012846)
  - qemu: Set cpuset.cpus for domain process (rhbz#1012846)
  - qemu: Unbreak p2p migration with complete migration URI (rhbz#1073227)
  - maint: don't lose error on canceled migration (rhbz#1073227)
  - virsh: suppress aliases in group help (rhbz#956968)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-35
changelog:
  - qemu: export disk snapshot support in capabilities (rhbz#1081032)
  - qemu: extract guest capabilities initialization (rhbz#1081032)
  - qemu: add unit tests for the capabilities xml (rhbz#1081032)
  - qemu: properly quit migration with abort_on_error (rhbz#1045833)
  - conf: restrict external snapshots to backing store formats (rhbz#1019926)
  - qemu: don't check for backing chains for formats w/o snapshot support (rhbz#1019926)
  - qemu: don't call virFileExists() for network type disks (rhbz#1019926)
  - net: Change argument type of virNetworkObjIsDuplicate() (rhbz#1057321)
  - net: Move creation of dnsmasq hosts file to function starting dnsmasq (rhbz#1057321)
  - net: Re-use checks when creating transient networks (rhbz#1057321)
  - network: prevent a few invalid configuration combinations (rhbz#1057321)
  - network: disallow <bandwidth>/<mac> for bridged/macvtap/hostdev networks (rhbz#1057321)
  - virsh-domain: Fix cmdSetvcpus error message (rhbz#1092412)
  - spice: detect if qemu can disable file transfer (rhbz#983018)
  - spice: expose the QEMU disable file transfer option (rhbz#983018)
  - qemu_caps: detect if qemu can disable file transfer for spice (rhbz#983018)
  - Device{Attach, Detach}: Document S4 limitations (rhbz#808463)
  - storageVolCreateXMLFrom: Allow multiple accesses to origvol (rhbz#1058700)
  - LSN-2014-0003: Don't expand entities when parsing XML (CVE-2014-0179)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-36
changelog:
  - virSecuritySELinuxSetFileconHelper: Don't fail on read-only NFS (rhbz#1095135)
  - storage: Resolve issues in failure path (rhbz#1092882)
  - interface: Introduce netcfInterfaceObjIsActive (rhbz#1095774)
  - interface: dump inactive xml when interface isn't active (rhbz#1095774)
  - qemu: add host-pci-multidomain capability (rhbz#1092390)
  - qemu: specify domain in host-side PCI addresses when needed/supported (rhbz#1092390)
  - util: fix virFileOpenAs return value and resulting error logs (rhbz#851411)
  - qemu: check actual netdev type rather than config netdev type during init (rhbz#1012834)
  - Fix parsing of bond interface XML (rhbz#1067062)
  - qemuSetupCgroup: Fix reference to cgroup (rhbz#1012846)
  - apibuild: Disallow 'returns' return decription (rhbz#808463)
  - ESX: Add support for virtualHW version 10 (rhbz#1089389)
  - storage: Ensure 'qemu-img resize' size arg is a 512 multiple (rhbz#1002813)
  - qemu: Adjust size for qcow2/qed if not on sector boundary (rhbz#1002813)
  - sanlock: code movement in virLockManagerSanlockAcquire (rhbz#1088034)
  - sanlock: don't fail with unregistered domains (rhbz#1088034)
  - sanlock: avoid leak in acquire() (rhbz#1088034)
  - networkStartNetwork: Be more verbose (rhbz#1064831)
  - network_conf: Expose virNetworkDefFormatInternal (rhbz#1064831)
  - Avoid crash when LXC start fails with no interface target (rhbz#1064831)
  - lxc_process: Avoid passing NULL iface->iname (rhbz#1064831)
  - network: Introduce network hooks (rhbz#1064831)
  - bridge_driver.h: Fix build --without-network (rhbz#1064831)
  - networkRunHook: Run hook only if possible (rhbz#1064831)
  - conf: clarify what is returned for actual bandwidth and vlan (rhbz#1064831)
  - conf: handle null pointer in virNetDevVlanFormat (rhbz#1064831)
  - conf: make virDomainNetDefFormat a public function (rhbz#1064831)
  - conf: re-situate <bandwidth> element in <interface> (rhbz#1064831)
  - conf: new function virDomainActualNetDefContentsFormat (rhbz#1064831)
  - Slightly refactor hostdev parsing / formating (rhbz#1064831)
  - conf: output actual netdev status in <interface> XML (rhbz#1064831)
  - network: include plugged interface XML in "plugged" network hook (rhbz#1064831)
  - network: don't even call networkRunHook if there is no network (rhbz#1064831)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-37
changelog:
  - udev: consider the device a CDROM when ID_CDROM=1 (rhbz#1016878)
  - Add support for timestamping QEMU logs (rhbz#997010)
  - Detect -msg-timestamp capability from QEMU help output (rhbz#997010)
  - qemu: Avoid leak in qemuDomainCheckRemoveOptionalDisk (rhbz#1014730)
  - Return right error code for baselineCPU (rhbz#1097969)
  - Add a port allocator class (rhbz#1018695)
  - Avoid integer wrap on remotePortMax in QEMU driver (rhbz#1018695)
  - Followup fix for integer wraparound in port allocator (rhbz#1018695)
  - Don't spam logs with "port 0 must be in range" errors (rhbz#1018695)
  - qemu: Avoid assigning unavailable migration ports (rhbz#1018695)
  - qemu: Make migration port range configurable (rhbz#1018695)
  - qemu: Fix augeas support for migration ports (rhbz#1018695)
  - qemu: clean up migration ports when migration cancelled (rhbz#1018695)
  - qemuDomainObjBeginJobInternal: Return -2 for temporary failures (rhbz#1083238)
  - qemu: Make qemuProcess{Start, Stop}CPUs easier to follow (rhbz#1083238)
  - qemu: Ignore temporary job errors when checking migration status (rhbz#1083238)
  - qemu: Send migrate_cancel when aborting migration (rhbz#1098833)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-38
changelog:
  - remote: Don't leak priv->tls object on connection failure (rhbz#1099075)
  - Fix invalid read in virNetSASLSessionClientStep debug log (rhbz#1100173)
  - Tie SASL callbacks lifecycle to virNetSessionSASLContext (rhbz#1100173)
  - fix leak in memoryStats with older python (rhbz#1099860)
  - hooks: let virCommand do the error reporting (rhbz#1105397)
  - SELinux: don't fail silently when no label is present (rhbz#1105954)
  - qemu: Add qemuDomainReleaseDeviceAddress to remove any address (rhbz#807023)
  - qemu: Separate disk device removal into a standalone function (rhbz#807023)
  - qemu: Separate controller removal into a standalone function (rhbz#807023)
  - qemu: Separate net device removal into a standalone function (rhbz#807023)
  - qemu: Separate host device removal into a standalone function (rhbz#807023)
  - Add VIR_DOMAIN_EVENT_ID_DEVICE_REMOVED event (rhbz#807023)
  - examples: Handle VIR_DOMAIN_EVENT_ID_DEVICE_REMOVED event (rhbz#807023)
  - Clarify virDomainDetachDeviceFlags documentation (rhbz#807023)
  - Add virDomainDefFindDevice for looking up a device by its alias (rhbz#807023)
  - qemu: Add support for DEVICE_DELETED event (rhbz#807023)
  - qemu: Remove devices only after DEVICE_DELETED event (rhbz#807023)
  - qemu: Emit VIR_DOMAIN_EVENT_ID_DEVICE_REMOVED events (rhbz#807023)
  - Add function to find a needle in a string array (rhbz#807023)
  - util: Non-existent string array does not contain any string (rhbz#807023)
  - conf: Make error reporting in virDomainDefFindDevice optional (rhbz#807023)
  - qemu: Introduce qemuMonitorGetDeviceAliases (rhbz#807023)
  - qemu: Unplug devices that disappeared when libvirtd was down (rhbz#807023)
  - qemu: Finish device removal in the original thread (rhbz#807023)
  - qemu: Process DEVICE_DELETED event in a separate thread (rhbz#807023)
  - qemu: Remove interface backend only after frontend is gone (rhbz#807023)
  - qemu: Remove disk backend only after frontend is gone (rhbz#807023)
  - qemu: Return in from qemuDomainRemove*Device (rhbz#807023)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-39
changelog:
  - Fix crash when saving a domain with type none dac label (rhbz#1108590)
  - Initialize threading & error layer in LXC controller (rhbz#1109120)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-40
changelog:
  - formatdomain.html.in: Document implementation limitation of QoS (rhbz#980350)
  - Fix error in qemuDomainSetNumaParamsLive (rhbz#857312)
  - cpu: Add new Broadwell CPU model (rhbz#1100381)
  - docs: publish correct enum values (rhbz#1113316)
  - qemu: blockcopy: Don't remove existing disk mirror info (rhbz#1113828)
  - qemu: fix guestfwd chardev option back how it was (rhbz#1112066)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-41
changelog:
  - Add invariant TSC cpu flag (rhbz#996772)
  - Fix segfault when starting a domain with no cpu definition (rhbz#996772)
  - qemu: copy: Accept 'format' parameter when copying to a non-existing img (rhbz#1113828)
  - Bind connection close callback APIs to python binding (rhbz#1114619)
  - qemu: Factor out body of qemuDomainGetMetadata for universal use (rhbz#1115039)
  - qemu: Factor out body of qemuDomainSetMetadata for universal use (rhbz#1115039)
  - conf: Factor out setting of metadata to simplify code (rhbz#1115039)
  - util: Add helper to convert libxml2 nodes to a string (rhbz#1115039)
  - conf: Add support for requesting of XML metadata via the API (rhbz#1115039)
  - conf: allow to add XML metadata using the virDomainSetMetadata api (rhbz#1115039)
  - conf: Avoid false positive of uninitialized variable use (rhbz#1115039)
  - lib: Don't force the key argument when deleting metadata (rhbz#1115039)
  - test: Add <metadata> support into the test drivera (rhbz#1115039)
  - tests: Add metadata tests (rhbz#1115039)
  - conf: Don't corrupt metadata on OOM (rhbz#1115039)
  - Ignore additional fields in iscsiadm output (rhbz#1116741)
  - conf: net: Fix helper for applying new network definition (rhbz#1116754)
  - blockjob: wait for pivot to complete (rhbz#1119385)
  - virsh: Introduce macros to reject mutually exclusive arguments (rhbz#1117177)
  - virsh-domain: Add --live, --config, --current logic to cmdAttachDisk (rhbz#1117177)
  - virsh-domain: Add --live, --config, --current logic to cmdDetachDevice (rhbz#1117177)
  - virsh-domain: Add --live, --config, --current logic to cmdDetachDisk (rhbz#1117177)
  - virsh: Use inactive definition when removing disk from config (rhbz#1117177)
  - virsh-domain: Add --live, --config, --current logic to cmdAttachDevice (rhbz#1117177)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-42
changelog:
  - conf: Fix backport of metadata API code (rhbz#1115039)
  - conf: Always format seclabel's model (rhbz#1113860)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-43
changelog:
  - Fix blkdeviotune for shutoff domain (rhbz#1122819)
  - rpc: message related sizes enlarged (rhbz#1126393)
  - Increase the size of REMOTE_MIGRATE_COOKIE_MAX to REMOTE_STRING_MAX (rhbz#1126393)
  - Fix max stream packet size for old clients (rhbz#1126393)
  - Adjust legacy max payload size to account for header information (rhbz#1126393)
  - rpc: Correct the wrong payload size checking (rhbz#1126393)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-46
changelog:
  - cpu: separate host-model and host-passthrough (rhbz#1138222)
  - Don't include non-migratable features in host-model (rhbz#1138222)
  - Don't add dhcp hosts to hostsfile twice (rhbz#1137011)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-47
changelog:
  - Revert "qemu: export disk snapshot support in capabilities" (rhbz#1149667)
  - qemu: allow restore with non-migratable XML input (rhbz#1141838)
  - qemu: Introduce qemuDomainDefCheckABIStability (rhbz#1141838)
  - Make ABI stability issue easier to debug (rhbz#1141838)
  - domain_conf: fix domain deadlock (CVE-2014-3657)
  - CVE-2014-3633: qemu: blkiotune: Use correct definition when looking up disk (CVE-2014-3633)
  - CVE-2014-7823: dumpxml: security hole with migratable flag (CVE-2014-7823)
  - sanlock: Avoid freeing uninitialized value (rhbz#1136788)
  - virsh: Print cephx and iscsi usage (rhbz#1156327)
  - Fix bug with loading bridge name for active domain during libvirtd start (rhbz#1146310)
  - conf: Fix even implicit labels (rhbz#1138500)
  - tests: Add test cases for previous commit (rhbz#1138500)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-48
changelog:
  - networkValidate: Disallow bandwidth in portgroups too (rhbz#1115292)
  - qemu: Fix checking of ABI stability when restoring external checkpoints (rhbz#834196)
  - qemu: Use "migratable" XML definition when doing external checkpoints (rhbz#834196)
  - qemu: Fix memleak after commit 59898a88ce8431bd3ea249b8789edc2ef9985827 (rhbz#834196)
  - qemu: blkiotune: Avoid accessing non-existing disk configuration (rhbz#1131821)
  - qemu: Fix build error introduced in 653137eb957a278b556c6226424aad5395a (rhbz#1131821)
  - qemu: snapshot: Use better check when reverting external snapshots (rhbz#1124854)
  - virsh: domain: Use global constant for XML file size limit (rhbz#1134671)
  - selinux: Avoid label reservations for type = none (rhbz#1138488)
  - Clean up chardev sockets on QEMU shutdown (rhbz#1122367)
  - Don't include @LIBS@ in libvirt.pc.in file (rhbz#1134455)
  - qemu: save domain state to XML after reboot (rhbz#1169405)
  - virsh: Honour -q in domblklist, vcpupin and emulatorpin (rhbz#1135171)
  - virsh-domain: Flip logic in cmdSetvcpus (rhbz#1139114)
  - Fix possible memory leak in util/virxml.c (rhbz#1136729)
  - esx_vi: fix possible segfault (rhbz#1136729)
  - sasl: Fix authentication when using PLAIN mechanism (rhbz#1171521)
  - Fix leak in x86UpdateHostModel (rhbz#1144304)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-49
changelog:
  - nwfilter: utility function virNWFilterVarValueEqual (rhbz#1126487)
  - qemu: support live update of an interface's filter (rhbz#1126487)
  - qemu: Update fsfreeze status on domain state transitions (rhbz#1136251)
  - virsh: Fix semantics of --config for "update-device" command (rhbz#1129112)
  - virsh: Don't use legacy API if --current is used on device hot(un)plug (rhbz#1125194)
  - qemu: Avoid double serial output with RHEL 6 qemu (rhbz#1162759)
  - storage: Check the partition name against provided name (rhbz#1138523)
  - qemu: Don't unconditionally delete file in qemuOpenFileAs (rhbz#1158036)
  - conf: Don't mangle vcpu placement randomly (rhbz#1170495)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-50
changelog:
  - conf: Don't format actual network definition in migratable XML (rhbz#1186142)
  - network: don't allow multiple portgroups with the same name in a network (rhbz#1115858)
  - build: fix build with latest rawhide kernel headers (rhbz#1198698)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-51
changelog:
  - sanlock: Don't spam logs with "target pid not found" (rhbz#1189414)
  - nwfilter: fix crash when adding non-existing nwfilter (rhbz#1202703)
  - util: more verbose error when failing to create macvtap device (rhbz#1186142)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-52
changelog:
  - qemu: Keep QEMU host drive prefix in BlkIoTune (rhbz#1203633)
  - qemu: Fix name comparison in qemuMonitorJSONBlockIoThrottleInfo() (rhbz#1203633)
  - virsh: fix typos in virsh man page (rhbz#1130835)
  - schemas: Allow all generic elements and attributes for all interfaces (rhbz#1206066)
  - RNG: Allow multiple parameters to be passed to an interface filter (rhbz#1206066)
  - qemu_domain: fix startup policy for disks (rhbz#1203542)
  - Create directory for lease files if it's missing (rhbz#1200991)
  - qemu: cgroup: Properly set up vcpu pinning (rhbz#1198096)
  - cgroup: Add accessors for cpuset.memory_migrate (rhbz#1198497)
  - qemu: Fix possible crash (rhbz#1198497)
  - qemu: Migrate memory on numatune change (rhbz#1198497)
  - qemu: fix crash when removing <filterref> from interface with update-device (rhbz#1205042)
  - nwfilter: Fix rule priority problem (rhbz#1210183)
  - qemuProcessHook: Call qemuProcessInitNumaMemoryPolicy only when needed (rhbz#1198645)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-53
changelog:
  - RHEL: Avoid memory leak when virCgroupSetCpusetMemoryMigrate fails (rhbz#1198497)
  - qemu: cgroup: Fix memory leak when there's no vCPU pinning (rhbz#1198096)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-54
changelog:
  - util: set MAC address for VF via netlink message to PF+VF# when possible (rhbz#1113474)
  - util: set macvtap physdev online when macvtap is set online (rhbz#1113474)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-54.el6_7.1
changelog:
  - qemu: split out cpuset.mems setting (rhbz#1265970)
  - qemu: leave restricting cpuset.mems after initialization (rhbz#1265970)
  - virNetDev{Replace, Restore}MacAddress: Fix memory leak (rhbz#1266039)
  - util: make virNetDev(Replace|Restore)MacAddress public functions (rhbz#1266039)
  - util: don't use netlink to save/set mac for macvtap+passthrough+802.1Qbh (rhbz#1266039)


author: Caolan McNamara <caolanm@redhat.com> 0.2.8.4-1
changelog:
  - get patches merged upstream
  - drop integrated libwmf-0.2.8.3-warnings.patch
  - drop integrated libwmf-0.2.8.3-noextras.patch
  - drop integrated libwmf-0.2.8.3-rh154813.patch


author: Caolan McNamara <caolanm@redhat.com> 0.2.8.4-16
changelog:
  - I wrote it and still had to check the headers to see if I had
    cut and pasted "and later" into then


author: Ville Skyttä <ville.skytta at iki.fi> - 0.2.8.4-18
changelog:
  - Split libwmflite (WMF parser) into -lite subpackage (#432651).
  - Build with dependency tracking disabled.
  - Convert docs to UTF-8.


author: Preston Brown <pbrown@redhat.com> 3.5.6-1
changelog:
  - enable LFS support (debian bug #100810)
  - quote filenames for running compress commands or pre/postrotate cmds (#21348)
  - deprecate "errors" directive (see bug #16544 for explanation)
  - update man page
  - configurable compression command by Colm Buckley <colm@tuatha.org>


author: Preston Brown <pbrown@redhat.com> 3.6-1
changelog:
  - patch from Alexander Kourakos <awk@awks.org> to stop the shared
    postrotate/prerotate scripts from running if none of the log(s) need
    rotating.  All log files are now checked for rotation in one batch,
    rather than sequentially.
  - more fixes from Paul Martin <pm@debian.org>


author: Elliot Lee <sopwith@redhat.com> 3.6.2-1
changelog:
  - Fix bug #55809 (include logrotate.status in "files")
  - Fix bug #58328 (incorrect error detection when reading state file)
  - Allow 'G' size specifier from bug #57242


author: Erik Troan <ewt@redhat.com>
changelog:
  - always use compressext for the extension for compressed
    files; before compresscmd and compressext had to agree
  - moved all compression to one code block
  - compression, scripts don't use system() anymore
  - compress and maillast didn't work together properly
  - delaycompress and mailfirst didn't work properly
  - don't use system() for mailing (or uncompressing) logs anymore
  - use "-s" for speciying the subjected of mailed logs


author: Miloslav Trmac <mitr@redhat.com> - 3.7.1-2
changelog:
  - Fix sending mails (#131583)
  - Preserve file attributes when compressing files (#121523, original patch by
    Daniel Himler)


author: Peter Vrabec <pvrabec@redhat.com> 3.7.4-11
changelog:
  - logrotate won't stop if there are some errors in configuration
    or glob failures (#166510, #182062)


author: Peter Vrabec <pvrabec@redhat.com> 3.7.4-12
changelog:
  - fix problem with compress_options_list (#227706)
  - fix spec file to meet Fedora standards (#226104)


author: Peter Vrabec <pvrabec@redhat.com> 3.7.5-2
changelog:
  - fix error hadnling after prerotate, postrotate, firstaction 
    script failure. (http://qa.mandriva.com/show_bug.cgi?id=29979)


author: Tomas Smetana <tsmetana@redhat.com> 3.7.5-4
changelog:
  - use dateext in the default config file (#240292)
  - add options to use shred for deleting files -- adapt patch sent by
    Peter Eckersley <pde@eff.org> (#239934)
  - ignore .cfsaved files by default (#223476)


author: Tomas Smetana <tsmetana@redhat.com> 3.7.6-1
changelog:
  - new upstream version
  - fix #248565 logrotate never rotates /var/log/btmp
  - fix compile warnings
  - tabooext accepts wildcards (related #247816)
  - fix minor errors and update man page (related #250059)
  - fix handling of size directive (related #247410)


author: Tomas Smetana <tsmetana@redhat.com> 3.7.6-2
changelog:
  - fix #427274 - logrotate fails to preserve SELinux file contexts
  - fix #427661 - SELinux stops vsftpd from working correctly


author: Jan Kaluza <jkaluza@redhat.com> 3.7.8-10
changelog:
  - fix #604686 - pass currently rotated file as argument to
    postrotate/prerotate script in nosharedscripts mode


author: Jan Kaluza <jkaluza@redhat.com> 3.7.8-14
changelog:
  - fix #683622 - add support for ACLs
  - fix #736053 - check for brackets order in config file
  - fix #659705, #659713, #659720 - fixed mistakes in man-page


author: Jan Kaluza <jkaluza@redhat.com> 3.7.8-17
changelog:
  - fix #841520 - do not try to change owner of log if it is not needed
  - fix #848131 - fix bad umask value while creating temp file
  - fix #920030 - set SELinux context before compress files creation
  - fix #922169 - remove temp files on error
  - fix #847338 - do not overwrite create directive value by ACL setting
  - fix #847339 - fix race condition between fchmod and acl_set_fd


author: Jan Kaluza <jkaluza@redhat.com> 3.7.8-18
changelog:
  - fix #722209 - do not redirect output of logrotate to /dev/null, mark
    logrotate.conf as config
  - fix #1117189 - sort logs according to dateformat when removing the old one
  - fix #625034 - update logrotate.status atomically
  - fix #984965 - fix possible overflow in "create" directive parsing
  - fix #1012485 - use permissions 0700 for cron.daily script


author: Jan Kaluza <jkaluza@redhat.com> 3.7.8-19
changelog:
  - fix #1047899 - add support for "maxsize" directive
  - fix #1125769 - add support for "createolddir" directive


author: Jeff Johnson <jbj@redhat.com> 0.15-3687.0
changelog:
  - first build from adapted spec file, only client and libraries for now.
  - internal apr/apr-utils/neon until incompatibilities sort themselves out.
  - avoid libdir issues on x86_64 for the moment.


author: Joe Orton <jorton@redhat.com> 0.22.2-1
changelog:
  - update to 0.22.2; add mod_dav_svn subpackage
  - include Python bindings
  - neon: force use of expat, enable SSL
  - drop check for specific apr version added in -3


author: Jeff Johnson <jbj@redhat.com> 0.22.2-2
changelog:
  - use external neon-0.23.9-2 (i.e. with neon-config), drop internal neon.
  - use db-4.1.25, not db-4.0.14.
  - do "make check" (but ignore failure for now).
  - s390x knows not of httpd >= 2.0.45.


author: Joe Orton <jorton@redhat.com> 1.0.0-2
changelog:
  - add fix for lack of apr_dir_read ordering guarantee (Philip Martin)
  - enable compression in ra_dav by default (Tobias Ringström)


author: Joe Orton <jorton@redhat.com> 1.0.2-2
changelog:
  - add perl MODULE_COMPAT requirement for -perl subpackage
  - move perl man pages into -perl subpackage
  - clean up -perl installation and dependencies (Ville Skyttä, #123045)


author: Joe Orton <jorton@redhat.com> 1.1.3-7
changelog:
  - restore swig bindings support (from upstream via Max Bowsher, #141343)
  - tweak SELinux commentary in default subversion.conf


author: Joe Orton <jorton@redhat.com> 1.1.3-8
changelog:
  - further swig bindings fix (upstream via Max Bowsher, #151798)
  - fix perl File::Path dependency in filter-requires.sh


author: Joe Orton <jorton@redhat.com> 1.2.0-3
changelog:
  - update to 1.2.1
  - fix BuildRequires for ruby and apr-util (#163126)
  - drop static library archives


author: Joe Orton <jorton@redhat.com> 1.2.3-3
changelog:
  - update to 1.2.3
  - update to psvn.el r16070 from Stefan Reichoer
  - merge subversion.conf changes from RHEL4
  - merge filter-requires.sh changes from FC4 updates


author: Joe Orton <jorton@redhat.com> 1.3.2-2
changelog:
  - update to 1.3.2
  - fix Ruby sitelibdir (Garrick Staples, #191611)
  - own /etc/subversion (#189071)
  - update to psvn.el r19857


author: Joe Orton <jorton@redhat.com> 1.4.3-3
changelog:
  - update to 1.4.3 (#228691)
  - remove trailing dot from Summary
  - use current preferred standard BuildRoot
  - add post/postun ldconfig scriptlets for -ruby and -javahl


author: Joe Orton <jorton@redhat.com> 1.4.4-2
changelog:
  - update to 1.4.4
  - add Provides: svn (#245087)
  - fix without-java build (Lennert Buytenhek, #245467)


author: Joe Orton <jorton@redhat.com> 1.4.4-3
changelog:
  - fix build with new glibc open()-as-macro
  - build all swig code in %build, not %install
  - BuildRequire perl(Test::More), perl(ExtUtils::MakeMaker)


author: Joe Orton <jorton@redhat.com> 1.4.4-4
changelog:
  - trim dependencies from .la files
  - detabify spec file
  - test suite disabled to ease stress on builders


author: Joe Orton <jorton@redhat.com> 1.5.6-3
changelog:
  - update to 1.5.6
  - autoload psvn (#238491, Tom Tromey)
  - regenerate swig bindings (#480503)
  - fix build with libtool 2.2 (#469524)


author: Ville Skyttä <ville.skytta@iki.fi> - 1.6.5-3
changelog:
  - Apply svn2cl upstream patch to fix newline issues with libxml2 2.7.4+,
    see http://bugs.debian.org/546990 for details.


author: Ville Skyttä <ville.skytta@iki.fi> - 1.6.6-5
changelog:
  - Include svn2cl and its man page only in the -svn2cl subpackage (#558598).
  - Do not include bash completion in docs, it's installed.


author: Joe Orton <jorton@redhat.com> - 1.6.11-4
changelog:
  - add security fixes for CVE-2011-1752, CVE-2011-1783, CVE-2011-1921 (#709221)
  - add security fix for CVE-2011-0715 (#681174)
  - add security fixes for CVE-2010-4644, CVE-2010-4539 (#672679)


author: Joe Orton <jorton@redhat.com> - 1.6.11-5
changelog:
  - add init script for svnserve (#720790, #711904)
  - fix segfault with "AuthzForceUsernameCase lower" (#751321)
  - fix parent directory access with merges (#749494)


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - tkmib doco had #!/usr/bin/perl55
  - include snmpcheck and tkmib again (still needs some CPAN module, however).


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - don't depend on /etc/init.d so that package will work with 6.2.
  - perl path fiddles no longer needed.
  - rely on brp-compress frpm rpm to compress man pages.
  - patch from ucd-snmp CVS (Wes Hardaker).
  - configure.in needs to check for rpm libraries correctly (#23033).
  - add simple logrotate script (#21399).
  - add options to create pidfile and log with syslog with addresses (#23476).


author: Matt Wilson <msw@redhat.com>
changelog:
  - configure with --enable-reentrant and added "smux" and "agentx" to
    --with-mib-modules= argument (#29626)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Updated to 4.2.1. Removed 2 obsolete patches (fromcvs and #18153)
  - Include /usr/share/snmp/snmpconf in %files


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Enabled IPv6 support (RFE #47764)
  - Hopefully final fix of snmpwalk problem (#42153). Thanks to Douglas Warzecha
    for the patch and Matt Domsch for reporting the problem.


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Removed tkmib from the package once again as we don't ship the Tk.pm CPAN
    perl module required to run it (#49363)
  - Added missing Provides for the .so.0 libraries as rpm doesn't seem to find
    those during the build anymore (it used to) (#46388)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Fixed a couple of security issues:
    o /tmp race and setgroups() privilege problem
    o Various buffer overflow and format string issues.
    o One signedness problem in ASN handling.
  - Fixed an important RFE to support bcm5820 cards. (#51125)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Final bcm5820 fix. Last one was broken.
  - Fixed bugzilla bug (#51960) where the binaries contained rpath references.


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Fixed a server segfault for snmpset operation (#53640). Thanks to Josh Giles
    and Wes Hardaker for the patch.


author: Phil Knirsch <phil@redhat.de> 4.2.3-1
changelog:
  - Update to 4.2.3 final.
  - Fixed libtool/rpath buildroot pollution problem.
  - Fixed library naming problem.


author: Phil Knirsch <pknirsch@redhat.com> 4.2.3-4
changelog:
  - Added the snmptrapd init script as per request (#49205)
  - Fixed the again broken rpm query stuff (#57444)
  - Removed all old and none-used db related stuff (libs and header checks/files)


author: Phil Knirsch <pknirsch@redhat.com> 5.0.1-5
changelog:
  - Added --enable-ucd-snmp-compatibility for compatibility with older version
    and fixed installation thereof.
  - Got rid of the perl(Tk) dependancy by removing snmpcheck.
  - Include /usr/include/ucd-snmp in the filelist.
  - Fixed a problem with the ucd-snmp/version.h file.


author: Phil Knirsch <pknirsch@redhat.com> 5.0.8-2
changelog:
  - Hack to make it build on 64bit platforms with /usr/lib64 correctly.
  - Fixed bug #85071 (leak of open descriptors for ipv6).


author: Phil Knirsch <pknirsch@redhat.com> 5.0.9-1
changelog:
  - Updated to latest upstream version net-snmp-5.0.9
  - Added patch to fix net-snmp-perl problems (#105842).


author: Phil Knirsch <pknirsch@redhat.com> 5.1-1
changelog:
  - Updated to latest net-snmp-5.1 upstream version.
  - Tons of specfile and patch cleanup.
  - Cleaned up perl stuff (mib2c etc, see #107707).
  - Added lm_sensors support patch for x86 archs from Kaj J. Niemi (#107618).
  - Added support for custom mib paths and mibs to snmptrapd initscript (#102762)


author: Phil Knirsch <pknirsch@redhat.com> 5.1-2
changelog:
  - Included BuildPrereq on lm_sensors-devel on x86 archs (#110616).
  - Fixed deprecated initscript options (#110618).


author: Phil Knirsch <pknirsch@redhat.com> 5.1-3
changelog:
  - Removed snmpcheck again, needs perl(Tk) which we don't ship (#111194).
  - Fixed getopt definition in include file (#111209).
  - Included Kaj J. Niemi's patch for broken perl module (#111319).
  - Included Kaj J. Niemi's patch for broken async getnext perl call (#111479).
  - Included Kaj J. Niemi's patch for broken hr_storage (#111502).


author: Phil Knirsch <pknirsch@redhat.com> 5.1-9
changelog:
  - Reverted removal of _includir redefiniton due to php-snmp dependancy.
  - Remove SO_BSDCOMPAT setsockopt() call, deprecated.


author: Phil Knirsch <pknirsch@redhat.com> 5.1-12
changelog:
  - Hacked an ugly perl hack to get rid of perl RPATH problems.
  - Fixed 64bit patch and applied it. ;-)


author: Phil Knirsch <pknirsch@redhat.com> 5.1.1-2
changelog:
  - Added Kaj J. Niemi that fixes ipAdEntIfIndex problem (#119106)
  - Added Kaj J. Niemi to shut up memshared message for 2.6 kernel (#119203)


author: Radek Vokal <rvokal@redhat.com> 5.1.2-4
changelog:
  - New prereq for net-snmp-devel
  - lelf check removed from configure.in (#128748)
  - fixed snmpd coredump when sent SIGHUP (#127314)


author: Phil Knirsch <pknirsch@redhat.com> 5.1.2-9
changelog:
  - Droped obsolete lm-sensors patch and enabled lmSensors module
  - Marked several patches to be removed for 5.1.3


author: Radek Vokal <rvokal@redhat.com> 5.1.2-12
changelog:
  - snmpd crash with 'interfaces' directives in snmpd.conf fixed #139010
  - rather dirty patch fixing conf directory for net-snmp-config


author: Radek Vokal <rvokal@redhat.com> - 5.1.2-3
changelog:
  - patch from CVS - kill extra carriage return (#144917)
  - removed patch for interface indexing - doesn't show virtual interfaces


author: Radek Vokal <rvokal@redhat.com> - 5.2.1-5
changelog:
  - 64bit needed some changes, was causing timeouts on 64bit archs!? 
  - affects bugs #125432 and #132058


author: Radek Vokal <rvokal@redhat.com> - 5.2.1-12
changelog:
  - session free fixed, agentx modules build fine (#157851)
  - fixed dependency for net-snmp libs (#156932)


author: Radek Vokal <rvokal@redhat.com> - 5.2.2-0.rc6.1
changelog:
  - update to rc6, snmpnetstat changes due to license problems
  - persistent files in directory defined by snmp.conf persistentDir are 
    loaded at startup


author: Radek Vokal <rvokal@redhat.com> - 5.2.2-4
changelog:
  - check for header files in configure
  - patch for SNMPv3 traps / session user creation (net-snmp bz#1374087)


author: Radek Vokal <rvokal@redhat.com> 5.3-2
changelog:
  -  Security fix. Bug granting write access to read-only users 
     or communities which were configured  using the "rocommunity" 
     or "rouser" snmpd.conf tokens fixed


author: Radek Vokál <rvokal@redhat.com> 5.3-7
changelog:
  - fix parsing of /proc/diskstats
  - fix disman monitor crash
  - fix perl vendor name
  - fix OID lookup fail


author: Radek Vokal <rvokal@redhat.com> 5.3.1.pre2-1
changelog:
  - update to 5.3.1.pre2
  - fix multilib issues (#192736)
    On system with /usr/lib64 use net-snmp-config64 and net-snmp-config64.h


author: Radek Vokal <rvokal@redhat.com> 5.3.1.0-5
changelog:
  - SMUX support is still needed .. will disappear later!
  - static libs should be in devel not libs (#203571)
  - fix lm_sensors issues


author: Radek Vokál <rvokal@redhat.com> - 1:5.4-13
changelog:
  - fix overly verbose log message (#221911)
  - few minor tweaks for review - still not perfect
  - fix linking with lcrypto (#231805)


author: Jan Safranek <jsafranek@redhat.com> 5.4-14
changelog:
  - fix snmptrapd hostname logging (#238587)
  - fix udpEndpointProcess remote IP address (#236551)
  - fix -M option of net-snmp-utils (#244784)
  - default snmptrapd.conf added (#243536)
  - fix crash when multiple exec statements have the same name
    (#243536)
  - fix ugly error message when more interfaces share
    one IP address (#209861)


author: Jan Safranek <jsafranek@redhat.com> 5.4-16
changelog:
  - supported lm_sensors on ppc64 (#249255)
  - snmpconf generates config files with proper selinux context
    (#247462)
  - fix leak  in udp transport (#247771)
  - add alpha to supported archs in net-snmp-config (#246825)
  - fix hrSWInst (#250237)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-3
changelog:
  - include these tables: ip-mib/ipv4InterfaceTable
    ip-mib/ipv6InterfaceTable, ip-mib/ipAddressPrefixTable
  - fix Requires of net-snmp-devel to include lmsensors-devel on supported
    architectures


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-5
changelog:
  - move mib2c-update from net-snmp-utils to net-snmp-perl, where
    mib2c is located
  - add tkmib to net-snmp-gui package (#167933)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-6
changelog:
  - add support of lm_sensors v3
  - added procps to build dependencies (#380321)
  - removed beecrypt from dependencies
  - fixed crash on reading xen interfaces (#386611)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-9
changelog:
  - introduce /etc/sysconfig/snmpd. Use it to specify snmpd command line options.
    /etc/snmp/snmpd.options is not used anymore (#431391)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-15
changelog:
  - explicitly require lm_sensor > 3 for build (#442718)
  - create multilib net-snmp-config on multilib architectures only


author: Jan Safranek <jsafranek@redhat.com> 5.4.2-2
changelog:
  - redistribute the perl scripts to the net-snmp package,
    net-snmp-utils doesn't depend on perl now (#462484)


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-1
changelog:
  - explicitly require the right version and release of net-snmp and
    net-snmp-libs
  - update to net-snmp-5.4.2.1 to fix CVE-2008-4309


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-12
changelog:
  - make the default configuration less noisy, i.e. do not print "Connection from
    UDP:" and "Received SNMP packet(s) from UDP:" messages on each connection.
    (#509055)


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-13
changelog:
  - package cleanup, remove unnecessary patches
  - move local state file from /var/net-snmp/ to /var/lib/net-snmp


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-2
changelog:
  - introduce /etc/sysconfig/snmptrapd. Use it to specify snmptrapd command
    line options.  /etc/snmp/snmptrapd.options is not used anymore (#540799)
  - build-in ipAddressPrefixTable, ipDefaultRouterTable, ipv6ScopeZoneIndexTable,
    ipIfStatsTable, SCTP-MIB, RMON-MIB and Etherlike-MIBs
  - remove ucd5820stat helper script, it depends on get5820stats, which is not
    available in Fedora
  - move sample services ipf-mod.pl to documentation
  - remove logrotate config, snmpd logs into syslog


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-3
changelog:
  - prepare the .spec file for review
  - run automatic regression suite after the compilation of the package
    to check for obvious regressions
  - remove unnecessary package dependencies


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-4
changelog:
  - fix udpTable indexes on big-endian systems (#543352)
  - fix snmptrapd init script to survive with empty /etc/sysconfig/snmptrapd
  - lower the default log level of snmpd to get rid of the debug messages


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-7
changelog:
  - fix invalid access to memory in tcpListenerTable (#551030)
  - fix crash with interfaces without broadcast addresses (like OpenVPN's tun0)
    (#549390)
  - fix responding to broadcast SNMP requests (#549390)
  - port patches from RHEL-5 to avoid regressions


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-14
changelog:
  - store temporary files in /var/run/net-snmp instead of /tmp (SELinux does
    not allow writing /tmp) (#560081)
  - fix filedescriptor leak in RMON-MIB and Etherlike-MIB (#562108)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-15
changelog:
  - remove net-snmp-gui subpackage, perl-Tk is being removed from
    distro (#568786)
  - fix IF-MIB::ifSpeed of inactive interfaces (#561884)
  - correct the package license


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-19
changelog:
  - fixed exit code of snmp utilities when wrong argument to '-A' option
    is specified (#574061)
  - fixed BER parsing of incoming packets - siletnly discard the invalid ones
    according to RFC (#568651)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-21
changelog:
  - fixed hrFSTable and hrStorageTable to provide persistent table indexes
    according to RFS 2790 (#595325)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-22
changelog:
  - fixed value of ipIfStatsTable.Ip6ReasmReqds (#597265)
  - added missing include files from util_funcs directory (#604636)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-23
changelog:
  - fixed segfault when parsing snmpd.conf with disman entries (#607080)
  - fixed value of IP-MIB::ipv6InterfaceForwarding (#607074)
  - fixed output of snmptranslate tool when displaying ranges of UNSIGNED
    type (#606874)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-27.1
changelog:
  - fixed truncation of sysObjectID (#641113)
  - fixed assertions in calculating of statistics in IF-MIB (#621664)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-28
changelog:
  - fixed recompilation of the package on machine without IPv6 (#657835)
  - fixed SMUX getting stuck on big-endian platforms (#665053)
  - fixed OID comparsion in snmpwalk, now the output does not include
    objects outside requested subtree (#636890)
  - fixed IPv4 address creation in ipAddressTable (#616764)
  - added IPv6 address creation to ipAddressTable (#616336)
  - fixed value of ipAddressPrefixAutonomousFlag OID (#625262)
  - fixed ipv6IfTable - new interfaces were not added there (#627564)
  - extended BRIDGE-MIB implementation to cover RFC 4363 (#630157)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-31
changelog:
  - fixed BRIDGE-MIB implementation in /usr/bin/snmp-bridge-mib,
    now it supports embedded perl and answers GETNEXT requests correctly
    (#630157).


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-32
changelog:
  - fixed varbind parsing in python netsnmp module (#711481)
  - fixed session initialization in python netsnmp module (#710667)
  - fixed crash when getting out-of-memory in inetNetToMediaTable (#708947)
  - added xfs and jfs filesystem support to hrStorageTable (#707912)
  - fixed snmpd to purge zombies resulted from pass_persist process exit
    (#703682)
  - added a log message when snmpd detects two interfaces with the same
    IP address and thus having only one ipTable entry for both (#702171)
  - added new snmpd.conf options 'interface_fadeout' and
    'interface_replace_old' to controll snmpd behavior when more
    interfaces get the same name (#702165)
  - fixed snmptrapd leaking memory when processing traps in embedded perl
    (#678314)
  - fixed hrSystemDate timezone sign (#683680)
  - fixed snmp logging 'truncating integer value > 32 bits' for
    UCD-SNMP-MIB::systemStats (#681949)
  - fixed rare race condition in hrSWRunTable (#683563)
  - recompiled with relro for better security (#725657)
  - snmpd should not change request-id when sending multiple SMUX messages
    (#708370)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-38
changelog:
  - fixed snmpd crashing with many AgentX subagent (#749227)
  - fixed SNMPv2-MIB::sysObjectID value when "sysObjectID" config file
    option with long OID was used (#786931)
  - fixed value of BRIDGE-MIB::dot1dBasePortIfIndex.1 (#740172)
  - fixed parsing of "proxy" snmpd.conf option not to enable
    verbose logging by default (#746903)
  - added new "realStorageUnits" config file option to support
    disks > 16 TB in hrStorageTable (#741789)
  - added vxfs, reiserfs and ocfs2 filesystem support to hrStorageTable
    (#746903)
  - fixed snmpd sigsegv when embedded perl script registers one handler
    twice (#748907)
  - fixed setting of SNMP-TARGET-MIB::snmpTargetAddrRowStatus via
    SNMP-SET request on 64-bit platforms (#754275)
  - fixed crash when /var/lib/net-snmp/mib_indexes/ files have wrong
    SELinux context (#754971)
  - fixed memory leak when agentx subagent disconnects in the middle
    of request processing (#736580)
  - fixed slow (re-)loads of TCP-MIB::tcpConnectionTable (#789909)
  - removed 'error finding row index in _ifXTable_container_row_restore'
    error message (#788954)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-43
changelog:
  - fixed value of UCD-SNMP-MIB::extCommand to contain full command
    line (#842279)
  - fixed rpath to perl.so (#848319)
  - added support for port numbers in 'clientaddr' configuration
    option (#833013)
  - fixed rare snmptrapd crash on SIGHTERM handling when embedded perl
    is used (#824402)
  - fixed engineID of outgoing traps if 'trapsess -e <engineID>' is used in
    snmpd.conf (#800671)
  - updated documentation of '-c' option of snmptrapd (#784502)
  - fixed endless loop when SIGTEM arrives in middle of internal query
    processing (#851637)
  - fixed UCD-DISKIO-MIB::diskIOLA values (#848155)
  - removed various error log messages related to counte64 expansions
    (#846906)
  - removed various error log messages when IPv6 is disabled (#845157)
  - added support of cvfs filesystem in hrStorageTable (#846532)
  - fixed rare race condintion when populating UCD-SNMP-MIB::prTable,
    which could result in some entries missing in the table (#846436)
  - added support of simfs filesystem in hrStorageTable (#861152)
  - fixed responding to requests on a multihost machine (#825889)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-45
changelog:
  - fixed potential memory leak on realloc failure when processing 'extend'
    option (#893119)
  - added precise enumeration of configuration files searched to
    snmp_config(5) man page (#907571)
  - set permissions of snmpd.conf and snmptrapd conf to 0600 (#919239)
  - fixed kernel threads in hrSWRunTable (#919952)
  - fixed various error codes in Python module (#955771)
  - fixed snmpd crashing in the middle of agentx request processing when
    a subagent disconnects (#955511)
  - allow 'includeFile' and 'includeDir' options in configuration files
    (#917816)
  - fixed netlink message size (#927474)
  - fixed IF-MIB::ifSpeedHi on systems with non-standard interface speeds
    (#947973)
  - fixed BRIDGE-MIB::dot1dBasePortTable not to include the bridge itself
    as a port (#960568)
  - fixed snmpd segfault when 'agentaddress' configuration options is used
    and too many SIGHUP signals are received (#968898)
  - updated UCD-SNMP-MIB::dskTable to dynamically add/remove disks
    if 'includeAllDisks' is specified in snmpd.conf (#922691)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-46
changelog:
  - fixed parsing of bulk responses (#983116)
  - added support of vzfs filesystem in hrStorageTable (#989498)
  - fixed endless loop when parsing sendmail configuration file with
    queue groups (#991213)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-49
changelog:
  - fixed snmp daemons and utilities crashing in FIPS mode (#1001830)
  - added support of btrfs filesystem in hrStorageTable (#1006706)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-50
changelog:
  - added 'diskio' option to snmpd.conf, it's possible to monitor only selected
    devices in diskIOTable (#990674)
  - fixed CVE-2014-2284: denial of service flaw in Linux implementation of
    ICMP-MIB (#1073223)
  - added cache to hrSWRunTable to provide consistent results (#1007634)
  - skip 'mvfs' (ClearCase) when skipNFSInHostResources is enabled (#1073237)
  - fixed snmptrapd crashing on forwarding SNMPv3 traps (#1131844)
  - fixed HOST-RESOURCES-MIB::hrSystemProcesses (#1134335)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-51
changelog:
  - added faster caching into IP-MIB::ipNetToMediaTable (#789500)
  - fixed compilation with "-Werror=format-security" (#1181994)
  - added clear error message when port specified in 'clientaddrr' config
    option cannot be bound (#886468)
  - fixed error check in IP-MIB::ipAddressTable (#1012430)
  - fixed agentx client crash on failed response (#1023570)
  - fixed dashes in net-snmp-config.h (#1034441)
  - fixed crash on monitor trigger (#1050970)
  - fixed 'netsnmp_assert 1 == new_val->high failed' message in system log
    (#1065210)
  - fixed parsing of 64bit counters from SMUX subagents (#1069046)
  - Fixed HOST-RESOURCES-MIB::hrProcessorTable on machines with >100 CPUs
    (#1070075)
  - fixed net-snmp-create-v3-user to have the same content on 32 and 64bit
    installations (#1073544)
  - fixed IPADDRESS value length in Python bindings (#1100099)
  - fixed hrStorageTable to contain 31 bits integers (#1104293)
  - fixed links to developer man pages (#1119567)
  - fixed storageUseNFS functionality in hrStorageTable (#1125793)
  - fixed netsnmp_set Python bindings call truncating at the first '\000'
    character (#1126914)
  - fixed log level of SMUX messages (#1140234)
  - use python/README to net-snmp-python subpackage (#1157373)
  - fixed forwarding of traps with RequestID=0 in snmptrapd (#1146948)
  - fixed typos in NET-SNMP-PASS-MIB and SMUX-MIB (#1162040)
  - fixed close() overhead of extend commands (#1188295)
  - fixed lmSensorsTable not reporting sensors with duplicate names (#967871)
  - fixed hrDeviceTable with interfaces with large ifIndex (#1195547)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-52
changelog:
  - Fixed snmptrapd crash when '-OQ' parameter is used and invalid trap is
    received (#CVE-2014-3565)


author: Christopher Aillon <caillon@redhat.com> 4.6-4
changelog:
  - Use the NSPR version numbering scheme reported by NSPR,
    which unfortunately is not exactly the same as the real
    version (4.6 != 4.6.0 according to RPM and pkgconfig).


author: Christopher Aillon <caillon@redhat.com>
changelog:
  - Stop shipping static libraries; NSS and dependencies no longer
    require static libraries to build.


author: Kai Engert <kengert@redhat.com> 4.6.1-2
changelog:
  - Do not use -ansi when compiling, because of a compilation
    problem with latest glibc and anonymous unions.
    See also bugzilla.mozilla.org # 322427.


author: Kai Engert <kengert@redhat.com> - 4.6.5-2
changelog:
  - Update to latest ipv6 upstream patch
  - Add upstream patch to fix a thread cleanup issue
  - Now requires pkgconfig


author: Kai Engert <kengert@redhat.com> - 4.6.6-2
changelog:
  - Update thread-cleanup patch to latest upstream version
  - Add upstream patch to support PR_STATIC_ASSERT


author: Elio Maldonado <emaldona@redhat.com> - 4.9.5-3
changelog:
  - Bump the release tag so it's higher than the one for rhel-6.4.z
  - Resolves: rhbz#919180 - Rebase to nspr-4.9.5


author: Elio Maldonado <emaldona@redhat.com> - 4.10.0-1
changelog:
  - Update Version to 4.10.0 to prevent Mozilla apps update problems as
  - reported and fixed on https://bugzilla.redhat.com/show_bug.cgi?id=981166
  - Resolves: rhbz#1002643 - Rebase RHEL 6 to NSPR 4.10 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.0-2
changelog:
  - Rebase to nspr-4.10.2
  - Resolves: rhbz#1032488 - CVE-2013-5607 (MFSA 2013-103) Avoid unsigned integer wrapping in PL_ArenaAllocate (MFSA 2013-103)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-1
changelog:
  - Rebase to nspr-4.10.8
  - Resolves: Bug 1200920 - Rebase nspr to 4.10.8 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269360 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Christopher Aillon <caillon@redhat.com> 3.11-0.cvs
changelog:
  - Initial import into Fedora Core, based on a CVS snapshot of
    the NSS_3_11_RTM tag
  - Fix up the pkcs11-devel subpackage to contain the proper headers
  - Build with RPM_OPT_FLAGS
  - No need to have rpath of /usr/lib in the pc file


author: Kai Engert <kengert@redhat.com> - 3.11.3-2
changelog:
  - Revert the attempt to require latest NSPR, as it is not yet available
    in the build infrastructure.


author: Kai Engert <kengert@redhat.com> - 3.11.5-1
changelog:
  - Update to 3.11.5
  - This update fixes two security vulnerabilities with SSL 2
  - Do not use -rpath link option
  - Added several unsupported tools to tools package


author: Kai Engert <kengert@redhat.com> - 3.11.5-2
changelog:
  - Fix rhbz#230545, failure to enable FIPS mode
  - Fix rhbz#220542, make NSS more tolerant of resets when in the 
    middle of prompting for a user password.


author: Kai Engert <kengert@redhat.com> - 3.11.7-2
changelog:
  - Update to 3.11.7, but freebl/softokn remain at 3.11.5.
  - Use a workaround to avoid mozilla bug 51429.


author: Kai Engert <kengert@redhat.com> - 3.11.7-10
changelog:
  - Add /etc/prelink.conf.d/nss-prelink.conf in order to blacklist
    our signed libraries and protect them from modification.


author: Kai Engert <kengert@redhat.com> - 3.11.99.3-2
changelog:
  - Build against gcc 4.3.0, use workaround for bug 432146
  - Run the test suite after the build and abort on failures.


author: Kai Engert <kengert@redhat.com> - 3.12.0.3-3
changelog:
  - nss package should own /etc/prelink.conf.d folder, rhbz#452062
  - use upstream patch to fix test suite abort


author: Kai Engert <kaie@redhat.com> - 3.12.3-3
changelog:
  - ship .chk files instead of running shlibsign at install time
  - include .chk file in softokn-freebl subpackage
  - add patch for upstream nss bug 488350


author: Kai Engert <kaie@redhat.com> - 3.12.3-7
changelog:
  - re-enable test suite
  - add patch for upstream bug 488646 and add newer paypal
    certs in order to make the test suite pass


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-5
changelog:
  - updated pem module incorporates various patches
  - fix off-by-one error when computing size to reduce memory leak. (483855)
  - fix data type to work on x86_64 systems. (429175)
  - fix various memory leaks and free internal objects on module unload. (501080)
  - fix to not clone internal objects in collect_objects().  (501118)
  - fix to not bypass initialization if module arguments are omitted. (501058)
  - fix numerous gcc warnings. (500815)
  - fix to support arbitrarily long password while loading a private key. (500180) 
  - fix memory leak in make_key and memory leaks and return values in pem_mdSession_Login (501191)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-10
changelog:
  - must install libnssutil3.since nss-util is untagged at the moment
  - preserve time stamps when installing various files


author: Elio Maldonado+emaldona@redhat.com - 3.12.3.99.3-11
changelog:
  - split off nss-softokn and nss-util as subpackages with their own rpms
  - first phase of splitting nss-softokn and nss-util as their own packages


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-19
changelog:
  - remove patches that are now in nss-softokn and
  - remove spurious exec-permissions for nss.pc per rpmlint
  - single requires line in nss.pc.in


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-22
changelog:
  - Fix nss-config not to include nssutil
  - Add BuildRequires on nss-softokn and nss-util since build also runs the test suite


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-25
changelog:
  - Remove nss-prelink.conf as signed all shared libraries moved to nss-softokn
  - Add a temprary hack to nss.pc.in to unblock builds


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-29
changelog:
  - Restoring patches 2 and 7 as we still compile all sources
  - Applying the nss-nolocalsql.patch solves nss-tools sqlite dependency problems


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-30
changelog:
  - Fix FORTIFY_SOURCE buffer overflows in test suite on ppc and ppc64 - bug 519766
  - Fixed requires and buildrequires as per recommendations in spec file review


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-2
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - No rpath-link in nss-softokn-config


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - PEM module implements memory management for internal objects - 509705
  - PEM module doesn't crash when processing malformed key files - 512019


author: Elio Maldonado<emaldona@redhat.com - 3.12.4-9
changelog:
  - Install blank databases and configuration file for system shared database
  - nsssysinit queries system for fips mode before relying on environment variable


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-14
changelog:
  - Fix bug where user was prompted for a password when listing keys on an empty system database (#527048)
  - Fix setup-nsssysinit to handle more general flags formats (#527051)


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1.8
changelog:
  - Fix nsssysinit to set the default flags on the crypto module (#545779)
  - Fix nsssysinit to enable apps to use the system cert store, patch contributed by David Woodhouse (#546221)
  - Fix segmentation fault when listing keys or certs in the database, patch contributed by Kamil Dudka (#540387)
  - Sysinit requires coreutils for post install scriplet (#547067)
  - Remove redundant header from the pem module


author: Elio Maldonado <emaldona@redhat.com> - 3.12.5-7.1
changelog:
  - Updated to 3.12.5 from CVS import from Fedora 12
  - Moved blank legacy databases to the lookaside cache
  - Reenabled the full test suite
  - Retagging for a RHEL-6-test-build


author: Elio Maldonado <emaldona@redhat.com> - 3.12.5-7.3
changelog:
  - Resolves: #551784 rebuilt after nss-softokn and nss-util builds
  - this will generate the coorect nss.spec


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-5
changelog:
  - Appying the changes in previous log
  - Changing some BuildRequires to >= as well
  - Temporarily disabling all tests for faster builds


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-2
changelog:
  - Add suppport for pkcs8 formatted keys in the pem module
  - Add verify(not md5 size mtime) to configuration files attributes
  - Prevent nss-sysinit disabling on package upgrade
  - Create pkcs11.txt with correct permissions regardless of current umask
  - Add option to setup-nsssysinit.sh to report nss-sysinit status
  - Update test certificate which had expired


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-2
changelog:
  - Prefer user database ca cert trust settings system's ones
  - Swap internal key slot on fips mode switches


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-3
changelog:
  - Add requires for pkcs11-devel on nss-softokn-freebl devel
  - Run the test suites in check section per packaging guidelines


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-7
changelog:
  - Update expired PayPayEE.cert test certificate
  - Conditionalize some database tests on user not being root


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-1
changelog:
  - Resolves: Bug 744070 - Update to 3.13.1
  - Resolves: Bug 784674 - nss should protect against being called before nss_Init
  - Resolves: Bug 784490 - CVE-2011-3389 HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-4
changelog:
  - Add two needed patches
  - Resolves: rhbz#783315 - Need nss workaround for freebl bug that causes openswan to drop connections
  - Resolves: rhbz#747387 - Unable to contact LDAP Server during winsync


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-1
changelog:
  - Update to 3.13.3
  - Resolves: rhbz#798539 - Distrust MITM subCAs issued by TrustWave
  - Remove builtins-nssckbi_1_88_rtm.patch which the rebase obsoletes


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Resolves: rhbz#746632 - pem_CreateObject mem leak on non existing file name
  - Resolves: rhbz#768669 - PEM unregistered callback causes SIGSEGV


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-3
changelog:
  - Resolves: rhbz#746632 - pem_CreateObject mem leak on non existing file name
  - Use completed patch per code review


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-1
changelog:
  - Rebase to nss-3.14.0.0-1
  - Resolves: rhbz#837089
  - Update ssl-cbc-random-iv patch for new sources
  - Remove patches rendered obsoleted by rebase to 3.14
  - Add a patch to enforce no pkcs11 bypass


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-7
changelog:
  - Add dummy sources file to test for and prevent breaking rhpkg commands
  - Enable testing for 'rhpk upload' and 'rhpk new-sources' breakage such as hangs
  - Related: rhbz#837089


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-8
changelog:
  - PEM peminit returns CKR_CANT_LOCK when needed to inform caller module isn't thread safe
  - Resolves: rhbz#555019 - [PEM] invalid writes in multi-threaded libcurl based application


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-9
changelog:
  - Fix locking issue causing curl hangs and authenticate to the correct session
  - Resolves: rhbz#872838


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-12
changelog:
  - Recreate the distrust patch by backporting the upstream one
  - Resolves: rhpbz#890914 - Dis-trust TURKTRUST mis-issued *.google.com certificate


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3.14.3_RTM
  - Resolves: rhbz#918950 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue
  - Update expired test certificates (fixed in upstream bug 852781)
  - Sync up pem module's rsawrapr.c with softoken's upstream changes for nss-3.14.3
  - Reactivate the aia tests


author: Elio Maldonado - 3.14.3-2
changelog:
  - Install sechash.h and secmodt.h which are now provided by nss-devel
  - Resolves: rhbz#918950 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue
  - Remove unsafe -r option from commands that remove headers already shipped by nss-util and nss-softoken


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-3
changelog:
  - Ensure pem uses system freebl as with this update freebl brings in new API's
  - Resolves: rhbz#918950 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-4
changelog:
  - Revert to accepting MD5 on digital signatures by default
  - Resolves: rhbz#918136 - nss 3.14 - MD5 hash algorithm disabled


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-5
changelog:
  - Syncup with uptream changes for aes gcm and ecc suiteb
  - Enable ecc support for suite b
  - Apply several upstream AES GCM fixes
  - Use the pristine nss upstream sources with ecc included
  - Export NSS_ENABLE_ECC=1 in both the build and the check sections
  - Make failed requests for unsupoprted ssl pkcs 11 bypass non fatal
  - Resolves: rhbz#882408 - NSS_NO_PKCS11_BYPASS must preserve ABI
  - Related:  rhbz#918950  - rebase nss to 3.14.3


author: Kai Engert <kaie@redhat.com> - 3.14.3-33
changelog:
  - Configure libnssckbi.so to use the alternatives system
    in order to prepare for a drop in replacement.
    Please ensure that older packages that don't use the alternatives
    system for libnssckbi.so have a smaller n-v-r.


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-34
changelog:
  - Fix race condition in cert code related to smart cards
  - Resolves: rhbz#903017 - Firefox hang when CAC/PIV smart card certificates are viewed in the certificate manager


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-37
changelog:
  - Do not hold issuer certificate handles in the crl cache
  - Resolves: rhbz#961659 - SQL backend does not reload certificates


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-1
changelog:
  - Rebase to NSS_3.15.1_RTM
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x) 
  - Update patches on account of the shallow tree with the rebase to 3.15.1
  - Update the pem module sources  nss-pem-20130405.tar.bz2 with latest patches applied
  - Remove patches rendered obsolete by the nss rebase and the updated nss-pem sources
  - Enable the iquote.patch to access newly introduced types


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-2
changelog:
  - Fix relative path in %check section to prevent undetected test failures
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-4
changelog:
  - Require nss-softokn-fips
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-5
changelog:
  - Disable the cipher suite already run as part of the nss-softokn build
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-6
changelog:
  - Fix all.sh test for which application was last build by updating nss-versus-softoken-test.path
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Kai Engert <kaie@redhat.com> - 3.15.1-7
changelog:
  - Additional syntax fixes in nss-versus-softoken-test.patch
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-8
changelog:
  - Don't require nss-softokn-fips
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-9
changelog:
  - Rebuild for the pem module to link with freel from nss-softokn-3.14.3-6.el6
  - Related: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]
  - Related: rhbz#1010224 - NSS 3.15 breaks SSL in OpenLDAP clients


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-10
changelog:
  - Restore a mistakenly removed patch
  - Resolves: rhbz#961659 - SQL backend does not reload certificates


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-11
changelog:
  - Fix the test for zero failures in the %check section
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-12
changelog:
  - Add a zero default value to the DISABLETEST and TEST_FAILURES checks
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-13
changelog:
  - Add zero default value to DISABLETEST check and fix the TEST_FAILURES check and reporting
  - Resolves: rhbz#990631 - file permissions of pkcs11.txt/secmod.db must be kept when modified by NSS
  - Related: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-14
changelog:
  - Add s390x and ia64 to the %define multilib_arches list used for defining alt_ckbi
  - Resolves: rhbz#1016044 - nss.s390: primary link for libnssckbi.so must be /usr/lib64/libnssckbi.so


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-15
changelog:
  - Using export NSS_DISABLE_HW_GCM=1 to deal with some problemmatic build systems
  - Resolves: rhbz#1016044 - nss.s390: primary link for libnssckbi.so must be /usr/lib64/libnssckbi.so


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-1
changelog:
  - Update to NSS_3_15_3_RTM
  - Resolves: Bug 1032472 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741
  - Resolves: Bug 1031238 - deadlock in trust domain lock and object lock


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Build nss without softoken, freebl, or util sources in the build source tree
  - Resolves: Bug 1032472 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Disable hw gcm on rhel-5 based build environments where OS lacks support
  - Rollback changes to build nss without softokn until Bug 689919 is approved
  - Cipher suite was run as part of the nss-softokn build


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Revoke trust in one mis-issued anssi certificate
  - Resolves: Bug 1042686 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117) [rhel-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-5
changelog:
  - Resolves: Bug 895339 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-6
changelog:
  - make derEncodingsMatch work with encrypted keys
  - rename a patch, dropped the experimental moniker from it
  - Resolves: Bug 895339 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-7
changelog:
  - Fix the numbering and naming of the patches
  - Resolves: Bug 895339 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-8
changelog:
  - Install man pages for the nss security tools
  - Resolves: Bug 606022 - nss security tools lack man pages


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-9
changelog:
  - Improve support for ECDSA algorithm via pluggable ECC
  - Document the purpose of the iquote.patch
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-10
changelog:
  - Prevent users from disabling the internal crypto module
  - Resolves: Bug 1059176 - nss segfaults with opencryptoki module


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-11
changelog:
  - Resolves: Bug 689919 - build without any softoken or util sources in the tree
  - Add define-uint32.patch to deal with using older version of nss-softokn
  - Fix suboptimal test failure detection shell code in the %check
  unset DISPLAY
   section


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-2
changelog:
  - Restore use of indentation patch until another bug is resolved
  - Resolves: Bug 606022 - nss security tools lack man pages


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-3
changelog:
  - Fix pem module trashing of private keys on failed login
  - Resolves: Bug 1002205 - PEM module trashes private keys if login fails


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-5
changelog:
  - Move removal of directories to the end of the %prep section
  - Resolves: Bug 689919 - build without any softoken or util sources in the tree


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-6
changelog:
  - Update pem sources to the same ones used on rhel-7
  - Remove no longer needed patches on account of this update
  - Resolves: Bug 1002205


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-15
changelog:
  - Resolves: Bug 1165003 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Support TLS_FALLBACK_SCSV in tstclnt and ssltap


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Restore patch for certutil man page
  - supply missing options descriptions to the man page
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-3
changelog:
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove unused indentation pseudo patch
  - require nss util 3.16.2.3


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-1
changelog:
  - Rebase to NSS 3.18
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]
  - Keep the same cipher suite order as we had in NSS_3_15_3_RTM
  - Resolves: Bug 1202488 - openldap-2.4.23-34.el6_5.1.i686 fails after updating nss to nss-3.16.1-4.el6_5.i686
  - Resolves: Bug 1182902 - rhel65 ns-slapd crash, segfault error 4 in libnss3.so in PK11_DoesMechanism at pk11slot.c:1824


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-2
changelog:
  - Replace expired PayPal test certificate that breaks the build
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-3
changelog:
  - Restore a patch that had been mistakenly disabled
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
  - Fix shell syntax error in nss/tests/all.sh
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-5
changelog:
  - Update and reeneable nss-646045.patch on account of the rebase
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Kai Engert <kaie@redhat.com> - 3.18.0-5.1
changelog:
  - Require softokn build 22 to ensure runtime compatibility.
  - Update to CKBI 2.4 from NSS 3.18.1 (the only change in NSS 3.18.1)


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-3
changelog:
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove unused indentation pseudo patch
  - require nss util 3.16.2.3
  - Restore patch for certutil man page
  - supply missing options descriptions to the man page


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-4
changelog:
  - Keep the same cipher suite order as we had in NSS_3_15_3_RTM
  - Resolves: Bug 1123092 - openldap-2.4.23-34.el6_5.1.i686 fails after updating nss to nss-3.16.1-4.el6_5.i686


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-1
changelog:
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]
  - Resolves: Bug 1131311 - rhel65 ns-slapd crash, segfault error 4 in libnss3.so in PK11_DoesMechanism at pk11slot.c:1824
  - Temporarily disable some tests until expired PayPalEE.cert is renewed


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-2
changelog:
  - Replace expired PayPal test certificate that breaks the build
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-3
changelog:
  - Restore a patch that had been mistakenly disabled
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
  - Fix shell syntax error in nss/tests/all.sh
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-5
changelog:
  - Update and reeneable nss-646045.patch on account of the rebase
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Kai Engert <kaie@redhat.com> - 3.18.0-5.3
changelog:
  - On RHEL 6.x keep the TLS version defaults unchanged.
  - Require softokn build 22 to ensure runtime compatibility.
  - Relax the requirement from pkcs11-devel to nss-softokn-freebl-devel
    to allow same or newer.
  - Update to CKBI 2.4 from NSS 3.18.1 (the only change in NSS 3.18.1)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.4-11
changelog:
  - Move libfreebl3.so and its .chk file to /lib{64} keeping
  - symbolic links to them in /usr/lib{64} so as not break others


author: Elio Maldonado <emaldona@redhat.com> - 3.12.4-16
changelog:
  - allow prelink of softoken and freebl. Change the verify code to use
    prelink -u if prelink is installed. Fix by Robert Relyea


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-2.1
changelog:
  - Don't enable FIPS when CONFIG_CRYPTO_FIPS=n
  - Fix typo in the package description
  - Fix capitalization error in prelink conflict statement
  - Require nspr 4.8.4


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-4
changelog:
  - Resolves: rhbz#710298 - fix intel optimized aes code to handle case where input and ouput are in the same buffer


author: Elio Maldonado - 3.12.9-12
changelog:
  - Bootstrapping of the builroot in preparation for rebase to 3.14.3
  - Remove hasht.h from the %files devel list to prevent update conflicts with nss-util
  - With 3.14.3 hasht.h will be provided by nss-util-devel
  - Related: rhbz#919172 - rebase nss-softokn to 3.14.3


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3_14_3_RTM
  - Resolves: rhbz#919172 - Rebase to nss-softokn 3.14.3 to fix the lucky-13 issue
  - Add export LD_LIBRARY_PATH=$RPM_BUILD_ROOT//usr/lib before the signing commands in __spec_install_post scriplet
    to ensure signing tool links with in-tree freebl so verification uses same algorithm as in signing
  - Add %check section to run the upstream crypto reqression test suite as per packaging guidelines
  - Don't install sechash.h or secmodt.h which as per 3.14 are provided by nss-devel
  - Update the licence to MPLv2.0


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-3
changelog:
  - Add patch to conditionally compile according to old or new sqlite api
  - new is used on rhel-6 while rhel-5 uses old but we need the same code for both
  - Resolves: rhbz#919172 - Rebase to nss-softokn 3.14.3 to fix the lucky-13 issue


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-4
changelog:
  - Enable ECC support for suite b and add upstream fixes for aec gcm
  - Use the unstripped upstream sources with ecc support
  - Limit the ECC support to suite b
  - Apply several upstream aes gcm fixes
  - Rename macros EC_MIN_KEY_BITS and EC_MAX_KEY_BITS per upstream
  - Resolves: rhbz#960208 - Enable ECC in nss-softoken
  - Related: rhbz#919172


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-5
changelog:
  - Resolves: rhbz#976572 - Pick up various upstream GCM code fixes applied since nss-3.14.3 was released
  - Display cpuifo as part of the tests and make NSS_DISABLE_HW_GCM the environment variable to test for
  - When appling the patches use a backup file suffix that better describes the patch purpose


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-6
changelog:
  - create -fips packages 
  - patch submitted by Bob Relyea <rrelyea@redhat.com>
  - fix the script that splits softoken off from nss
  - patch nss/cmd/lib/basicutil.c to build against nss-util-3.15.1
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-7
changelog:
  - Fix the PR_Access stub to actually access the correct permissions
  - Resolves: rhbz#1008513 - Unable to login in fips mode
  - Run the lowhash tests
  - Require nspr-4.0.0 and nss-util-3.15.1


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-8
changelog:
  - Enable new packaging but don't apply nss-fips-post.patch
  - Related: rhbz#1008513 - Unable to login in fips mode


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-11
changelog:
  - Skip calls to CHECK_FORK in {C & NSC}_GetFunctionList
  - Resolves: Bug 1053437 - Admin server segfault when configuration DS configured on SSL port


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-12
changelog:
  - Avoid call to sdb_measureAccess in lib/softoken/sdb.c s_open if NSS_SDB_USE_CACHE is "yes" or "no"
  - Resolves: Bug 1044666 - Can curl HTTPS requests make fewer access system calls?


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-15
changelog:
  - Fix shlibsign to return non-zero on failure
  - Resolves: Bug 587634 - shlibsign returns 0 although if fails


author: Bob Relyea <rrelyea@redhat.com> - 3.14.3-21
changelog:
  - Require nss-softokn-freebl of at least the same version and release
  - Resolves: Bug 1182662 - nss-softokn-3.14.3-19.el6_6 breaking yum and rpm


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-23
changelog:
  - Pick up upstream freebl patch for CVE-2015-2730
  - Check for P == Q or P ==-Q before adding P and Q


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3_14_3_RTM
  - Resolves: rhbz#919172 - Rebase to nss-softokn 3.14.3 to fix the lucky-13 issue
  - Add export LD_LIBRARY_PATH=$RPM_BUILD_ROOT//usr/lib64 before the signing commands in __spec_install_post scriplet
    to ensure signing tool links with in-tree freebl so verification uses same algorithm as in signing
  - Add %check section to run the upstream crypto reqression test suite as per packaging guidelines
  - Don't install sechash.h or secmodt.h which as per 3.14 are provided by nss-devel
  - Update the licence to MPLv2.0


author: Dennis Gilmore <dennis@ausil.us> 3.12.3.99.3-10
changelog:
  - dont include the headers in nss-util only in the -devel package
  - nss-util-devel Requires nss-devel since its only providing a subset of the headers.


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-11
changelog:
  - Remove spurious executable permissions from nss-util-config
  - Shorten some descriptions to keep rpmlint happy


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - Apply nss-nolocalsql patch subset for nss-util
  - No rpath-link in nss-util-config


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Resolves: rhbz#799192 - Update to 3.13.3
  - Update minimum nspr version for Requires and BuildRequires to 4.9
  - Fix version/release in changelog to match the Version and Release tags, now 3.13.3-2


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-1
changelog:
  - Update to NSS_3_13_5_RTM
  - Resolves: rhbz#833480 - Update nss-util on RHEL 6.x to NSS 3.13.5 for Mozilla 10.0.6
  - Add -L${libdir}/nss3 to Libs: line in nspr.pc.in


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-3
changelog:
  - Update to nss-3.14.0.0-1
  - Add temporary patch so utilmod doesn't include any headers from softoken
  - Keep the hasht.h from current nss-softokn-devel
  - Remove the long obsoleted nss-nolocalsql.patch


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3_14_3_RTM
  - Resolves: rhbz#919174 - Rebase to 3.14.3 as part of the fix for the lucky-13 issue


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-4
changelog:
  - Resolves: rhbz#976572 - Pick up various upstream GCM code fixes applied since nss-3.14.3 was released


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-5
changelog:
  - Update to NSS_3_15_1_RTM
  - Resolves: rhbz#1002644 - Rebase RHEL 6 to NSS-UTIL 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-3
changelog:
  - Preserve existing permissions when replacing existing pkcs11.txt file, but keep strict default permissions for new files
  - Resolves: rhbz#990631 - file permissions of pkcs11.txt/secmod.db must be kept when modified by NSS


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Add nss-util portion of a fix for pluggable ecc bug in nss and nss-util
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Apply the patch for the pluggable ecc fix
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - nssutil_growList and nssutil_ReadSecmodDB cleanup
  - Resolves: Bug 1019529 - New defect found in nss-util-3.14.0.0-2.el6


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-4
changelog:
  - Resolves: Bug 1165003 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove patches rendered obsolete by the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Resolves: Bug 1165003 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Fix the required nspr version to be 4.10.6


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-1
changelog:
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove patches rendered obsolete by the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Fix the required nspr version to be 4.10.6
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Rob Crittenden <rcritten@redhat.com> 0.9.1-2
changelog:
  - rename LICENSE to COPYING
  - don't ship the .la in -devel
  - fixup devel requirement to be exactly the parent package, not >=


author: Rob Crittenden <rcritten@redhat.com> 0.9.2-1
changelog:
  - update to 0.9.2
  - Enable loading the NSS PKCS#11 pem module
  - Add a URL
  - Specify the license as LGPLv2+ instead of just LGPL


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - comment out default values for keys, warn about starting with -A (#19316).
  - take out -A from ntpd startup as well.
  - update to 4.0.99k.


author: Preston Brown <pbrown@redhat.com>
changelog:
  - allow comments in %{_sysconfdir}/ntp/step-tickers file (#28786).
  - need patch0 (glibc patch) on ia64 too


author: Pekka Savola <pekkas@netcore.fi>
changelog:
  - require/buildprereq libcap/libcap-devel
  - use 'ntp' user, tune the pre/post scripts, %files
  - add $OPTIONS to the init script


author: Pekka Savola <pekkas@netcore.fi>
changelog:
  - Add the remote root exploit patch (based on ntp-hackers).
  - Enhance droproot patch (more documentation, etc.) <Jarno.Huuskonen@uku.fi>
  - Tweak the droproot patch to include sys/prctl.h, not linux/prctl.h
  (implicit declarations)
  - Remote groupdel commands, shouldn't be needed.
  - Removed -Wcast-qual and -Wconversion due to excessive warnings (hackish).
  - Make ntp compilable with both glibc 2.1 and 2.2.x (very dirty hack)
  - Add %{_sysconfdir}/sysconfig/ntpd which drops root privs by default


author: Harald Hoyer <harald@redhat.de>
changelog:
  - new snapshot
  - removed typos and security patch (already there)
  - commented multicastclient in config file


author: Harald Hoyer <harald@redhat.de> 4.1.0-1
changelog:
  - wow, how stupid can a man be ;).. fixed #50698 
  - updated to 4.1.0 (changes are small and in non-critical regions)


author: Harald Hoyer <harald@redhat.de> 4.1.0b-4
changelog:
  - created drift with dummy value #58294
  - grep for timeservers in ntp.conf also for ntpdate #57837
  - check return value of ntpdate #58836


author: Harald Hoyer <harald@redhat.de> 4.1.1b-1
changelog:
  - updated to version 4.1.1b
  - improved initscript - use ntpdate on -x
  - improved initscript - open firewall only for timeservers
  - ntp-4.1.1a-adjtime.patch removed (already in source)
  - ntp-4.1.1a-mfp.patch removed (already in source)
  - ntp-4.0.99j-vsnprintf.patch removed (already in source)


author: Harald Hoyer <harald@redhat.com> - 4.2.0.a.20040617-4
changelog:
  - removed firewall hole punching from the initscript; rely on iptables
    ESTABLISHED,RELATED or manual firewall configuration


author: Jindrich Novy <jnovy@redhat.com> 4.2.0.a.20050816-1
changelog:
  - update to the latest stable 4.2.0.a.20050816
  - drop upstreamed .gcc4, .vsnprintf patches
  - remove obsolete .autofoo patch
  - make patch numbering less chaotic
  - don't package backup for .droproot patch


author: Petr Raszyk <praszyk@redhat.com> 4.2.0.a.20050816-2
changelog:
  - Fix fails on upgrade, if ntpd is disabled (#166773)
  - A cosmetic patch. There are some comments and braces '{' '}' added.
  - One unprintable character was converted to octal-form .
  - It can be removed anytime (conversion of the cvs-projets for C-Frame 121,
  - (auto-debug, auto-trace for cfr-printnet server).


author: Petr Raszyk <praszyk@redhat.com> 4.2.0.a.20050816-3
changelog:
  - A similar patch as ntp-4.0.99j-vsnprintf.patch in FEDORA CORE 4
  - (current patch is ntp-stable-4.2.0a-20050816-vsnprintf.patch)


author: Petr Raszyk <praszyk@redhat.com> 4.2.0.a.20050816-10
changelog:
  - ntpd does not submit his local clock (if there is no peer).
    ntpdate->ntpd #163862 , Patch13: ntp-stable-4.2.0a-20050816-loconly.patch


author: Miroslav Lichvar <mlichvar@redhat.com> - 4.2.0.a.20050816-11
changelog:
  - update man pages (#153195, #162856)
  - drop C-Frame-121, vsnprintf, minusTi and loconly patch
  - prevent segfault when loopback interface is not configured (#159056)
  - spec cleanup


author: Miroslav Lichvar <mlichvar@redhat.com> - 4.2.0.a.20050816-12
changelog:
  - fix initscript:
    - replace -U with -u in getopts (#187003)
    - don't pass group to ntpdate -U argument and ignore -i in options (#142926)
    - set ntpconf for -c
    - remove -p 8 from ntpdate arguments
    - don't call ntpdate when step-tickers doesn't contain anything useful
      and -x isn't in options
  - fix default keyfile for ntpdate (#183196)


author: Miroslav Lichvar <mlichvar@redhat.com> - 4.2.0.a.20050816-14
changelog:
  - modify ntp.conf, change default restrict, remove broadcastdelay,
    use fedora.pool.ntp.org (#189667)
  - don't install drift file
  - remove unsupported options from ntptrace manpage (#137717)
  - fix default paths in manpages for ntp-keygen and ntpdate


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2-3
changelog:
  - fix manycast support in ntpdate (#194329)
  - reply to manycast requests with null refid
  - enable mlockall (#195617)
  - correct threshold value in ntpdate manpage


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2p4-1
changelog:
  - update to 4.2.2p4
  - fix buffer overflow in WWV Audio driver (#216309)
  - don't mark init script as config


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4-1
changelog:
  - update to 4.2.4 (#146884)
  - don't use local clock in default config
  - autogenerate man pages from HTML
  - clean up spec a bit


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4-3
changelog:
  - disable autoopts option preset mechanisms for ntpd
  - document -I option of ntpd
  - generate makewhatis friendly man pages


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4-4
changelog:
  - don't wake up every second (#204748)
  - add option to enable memory locking (#195617)
  - fix broadcast client
  - use option values in ntp-keygen
  - improve man pages


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p0-1
changelog:
  - update to 4.2.4p0
  - fix init script
    - don't add second -g to ntpd options (#228424)
    - update getopts
    - skip all refclocks when parsing ntp.conf
  - spec cleanup


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p0-3
changelog:
  - fix interface updates with -I or -L option (#240254)
  - accept multiple -I options
  - fix broadcast client/server to accept/allow sending
    broadcasts on 255.255.255.255 (#226958)
  - fix return codes in init script (#240120)
  - exit with nonzero code if ntpd -q did not set clock (#240134)
  - drop revert452 patch, fixed in kernel 2.6.19
  - make with _smp_mflags


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p2-2
changelog:
  - ignore tentative addresses (#246297)
  - improve init script (#247003)
  - fix sleep patch
  - ease Autokey setup (#139673)
    - change default keysdir to /etc/ntp/crypto
    - set crypto password in /etc/ntp/crypto/pw
    - don't use randfile if /dev/urandom is used by OpenSSL
  - change default statsdir to /var/log/ntpstats/, use statistics type
    as default filename
  - package more doc files


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p2-5
changelog:
  - avoid use of uninitialized floating-point values in clock_select
  - update license tag (Tom "spot" Callaway)
  - drop sntp, MSNTP license is non-free


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p4-1
changelog:
  - update to 4.2.4p4
  - fix default NTP version for outgoing packets in ntpdate man page
    (#245408)
  - replace BSD with advertising code in ntpdc and ntpq


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p4-4
changelog:
  - reset kernel frequency when -x option is used
  - create separate init script for ntpdate
  - add note about paths and exit codes to ntpd man page


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p4-5
changelog:
  - fix building IPv6 support with new glibc-headers (#436713)
  - avoid unaligned memory access (#435301)
  - fix receiving broadcasts on 255.255.255.255


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p4-7
changelog:
  - reload resolv.conf after temporary failure in name resolution (#456743)
  - use clock_gettime
  - make subpackages for perl scripts and ntpdate (#452097, #456116)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p5-2
changelog:
  - retry failed name resolution few times before giving up (#460561)
  - don't write drift file upon exit
  - run ntpq with full path in ntp-wait script


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p6-1
changelog:
  - update to 4.2.4p6 (CVE-2009-0021)
  - include dhclient script (David Cantrell)
  - convert COPYRIGHT to UTF-8


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p6-4
changelog:
  - don't restart ntpd in dhclient script with every renewal
  - fix buffer overflow in ntpq (#490617)
  - check status in condrestart (#481261)
  - don't crash when compiled with HAVE_TIMER_CREATE (#486217)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p7-1
changelog:
  - update to 4.2.4p7 (CVE-2009-1252)
  - improve PLL response when kernel discipline is disabled
  - don't log STA_MODE changes
  - enable nanokernel support
  - allow minpoll 3
  - increase memlock limit
  - move html documentation to -doc subpackage (#492444)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p7-2
changelog:
  - fix frequency calculation when starting with no drift file
  - reduce phase adjustments beyond Allan intercept in daemon PLL


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p7-3
changelog:
  - handle system time jumps better
  - don't wake up every second for refclocks without timer
  - don't crash in ntpstat when unknown clock type is received (#505564)
  - make ntpstat process first packet in multipacket response
  - switch to editline
  - set pool.ntp.org vendor zone in spec (#512711)
  - compile with -fno-strict-aliasing


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-1
changelog:
  - update to 4.2.6p5 (#654004, #641800, #714079, #714084, #716968, #819781,
    - bind broadcast client to new interfaces (#973807)
  - allow selection of cipher for private key files (#749530)
  - retry few times in ntpdate init script before giving up (#673198)
  - print synchronization distance instead of dispersion in ntpstat (#830821)
  - ignore duplicate servers from dhclient (#862983)
  - add fourth server to default ntp.conf and use iburst (#667524, #623616)
  - drop comment enabling local driver in default config (#816645)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-2
changelog:
  - don't generate weak control key for resolver (CVE-2014-9293)
  - don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294)
  - fix buffer overflows via specially-crafted packets (CVE-2014-9295)
  - don't mobilize passive association when authentication fails (CVE-2014-9296)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-3
changelog:
  - validate lengths of values in extension fields (CVE-2014-9297)
  - drop packets with spoofed source address ::1 (CVE-2014-9298)
  - add nanosecond support to SHM refclock (#1117704)
  - allow creating all SHM segments with owner-only access (#1122015)
  - allow symmetric keys up to 32 bytes again (#1053551)
  - fix calculation of root dispersion (#1045376)
  - fix crash in ntpq mreadvar command (#1165141)
  - don't step clock for leap second with -x option (#1190619)
  - don't drop packets with source port below 123 (#1171630)
  - use larger RSA exponent in ntp-keygen (#1184421)
  - refresh peers on routing updates (#1193850)
  - increase memlock limit again (#1053568)
  - warn when monitor can't be disabled due to limited restrict (#1166596)
  - improve documentation of restrict command (#1069019)
  - update logconfig documentation for patched default (#1193849)
  - don't build ntpsnmpd (#995134)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-5
changelog:
  - reject packets without MAC when authentication is enabled (CVE-2015-1798)
  - protect symmetric associations with symmetric key against DoS attack
    (CVE-2015-1799)
  - fix generation of MD5 keys with ntp-keygen on big-endian systems
    (CVE-2015-3405)
  - log when stepping clock for leap second or ignoring it with -x (#1204625)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-5.el6_7.2
changelog:
  - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
  - allow only one step larger than panic threshold with -g (CVE-2015-5300)


author: Bill Nottingham <notting@redhat.com>
changelog:
  - update to 1.2.7
  - fix some bugs from bugzilla (#4885, #4887, #4888, #4967)
  - take include files out of base package


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add -D_REENTRANT to make threaded stuff more stable, even though it looks
    like the sources define it, too
  - mark *.ph files in migration tools as config files


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move the defaults for databases and whatnot to /var/lib/ldap (bug #10714)
  - fix some possible string-handling problems


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 1.2.10
  - add revamped version of patch from kos@bastard.net to allow execution as
    any non-root user
  - remove test suite from %build because of weirdness in the build system


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - more minimalistic fix for bug #11111 after consultation with OpenLDAP team
  - backport replacement for the ldapuser patch


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 1.2.11
  - add condrestart logic to init script
  - munge migration scripts so that you don't have to be 
    /usr/share/openldap/migration to run them
  - add code to create pid files in /var/run


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - tweak init script to return error codes properly
  - change initscripts dependency to one on /etc/init.d


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - switch to gdbm; I'm getting off the db merry-go-round
  - tweak the init script some more
  - add instdir to @INC in migration scripts


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - split off clients and servers to shrink down the package and remove the
    base package's dependency on Perl
  - make certain that the binaries have sane permissions


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - build a semistatic slurpd with threads, everything else without
  - disable reverse lookups, per email on OpenLDAP mailing lists
  - make sure the execute bits are set on the shared libraries


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add the nis.schema and inetorgperson.schema to the default server config
  - make ldapadd a hard link to ldapmodify because they're identical binaries


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.0.6
  - add buildprereq on cyrus-sasl-devel, krb5-devel, openssl-devel
  - take the -s flag off of slapadd invocations in migration tools
  - add the cosine.schema to the default server config, needed by inetorgperson


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - try adding the suffix first when doing online migrations
  - force ldapadd to use simple authentication in migration scripts
  - add indexing of a few attributes to the default configuration
  - add commented-out section on using TLS to default configuration


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add missing required attributes to conversion scripts to comply with schema
  - add schema for mail aliases, autofs, and kerberosSecurityObject rooted in
    our own OID tree to define attributes and classes migration scripts expect
  - tweak automounter migration script


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - reorganize the patch list to separate MigrationTools and OpenLDAP patches
  - switch to Luke Howard's rfc822MailMember schema instead of the aliases.schema
  - configure slapd to run as the non-root user "ldap" (#19370)
  - chdir() before chroot() (we don't use chroot, though) (#19369)
  - disable saving of the pid file because the parent thread which saves it and
    the child thread which listens have different pids


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add Norbert Klasen's patch (via Del) to fix searches using ldaps URLs
    (OpenLDAP ITS #889)
  - add "-h ldaps:///" to server init when TLS is enabled, in order to support
    ldaps in addition to the regular STARTTLS (suggested by Del)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change automount object OID from 1.3.6.1.1.1.2.9 to 1.3.6.1.1.1.2.13,
    per mail from the ldap-nis mailing list


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add support for additional OPTIONS, SLAPD_OPTIONS, and SLURPD_OPTIONS in
    a /etc/sysconfig/ldap file (#23549)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - back out pidfile patches, which interact weirdly with Linux threads
  - mark non-standard schema as such by moving them to a different directory


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - build dummy certificate in %post, use it in default config
  - configure-time shenanigans to help a confused configure script


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move shared libraries to /lib
  - redo init script for better internationalization (#26154)
  - don't use ldaprc files in the current directory (#38402) (patch from
    hps@intermeta.de)
  - add BuildPrereq on tcp wrappers since we configure with
    --enable-wrappers (#43707)
  - don't overflow debug buffer in mail500 (#41751)
  - don't call krb5_free_creds instead of krb5_free_cred_contents any
    more (#43159)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - require cyrus-sasl-md5 (support for DIGEST-MD5 is required for RFC
    compliance) by name (follows from #43079, which split cyrus-sasl's
    cram-md5 and digest-md5 modules out into cyrus-sasl-md5)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add a build-time requirement on pam-devel
  - add a build-time requirement on a sufficiently-new libtool to link
    shared libraries to other shared libraries (which is needed in order
    for prelinking to work)


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.12-1
changelog:
  - update to 2.0.12 to pull in fixes for setting of default TLS options, among
    other things
  - update to migration tools 39
  - drop tls patch, which was fixed better in this release


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - disable kbind support (deprecated, and I suspect unused)
  - configure with --with-kerberos=k5only instead of --with-kerberos=k5
  - build slapd with threads


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.20-2
changelog:
  - temporarily disable optimizations for ia64 arches
  - specify pthreads at configure-time instead of letting configure guess


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.22-2
changelog:
  - switch to an internalized Berkeley DB as the ldbm back-end  (NOTE: this breaks
    access to existing on-disk directory data)
  - add slapcat/slapadd with gdbm for migration purposes
  - remove Kerberos dependency in client libs (the direct Kerberos dependency
    is used by the server for checking {kerberos} passwords)


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.25-1
changelog:
  - update to 2.0.25 "stable", ldbm-over-gdbm (putting off migration of LDBM
    slapd databases until we move to 2.1.x)
  - use %{_smp_mflags} when running make
  - update to MigrationTools 44
  - enable dynamic module support in slapd


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.25-2
changelog:
  - change LD_FLAGS to refer to /usr/kerberos/_libdir instead of
    /usr/kerberos/lib, which might not be right on some arches


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - incorporate fixes from SuSE's security audit, except for fixes to ITS 1963,
    1936, 2007, 2009, which were included in 2.0.26.
  - add two more patches for db 4.1.24 from sleepycat's updates page
  - use openssl pkgconfig data, if any is available


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.27-8
changelog:
  - back down to db 4.0.x, which 2.0.x can compile with in ldbm-over-db setups
  - tweak SuSE patch to fix a few copy-paste errors and a NULL dereference


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.1.17
  - disable the shell backend, not expected to work well with threads
  - drop the kerberosSecurityObject schema, the krbName attribute it
    contains is only used if slapd is built with v2 kbind support


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - install the db utils for the bundled libdb as %{_sbindir}/slapd_db_*
  - install slapcat/slapadd from 2.0.x for migration purposes


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.22-0
changelog:
  - 2.1.22 now badged stable
  - be more aggressive in what we index by default
  - use/require libtool 1.5


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - actually require newer libtool, as was intended back in 2.1.22-0, noted as
    missed by Jim Richardson


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - build bundled libdb for slapd dynamically to make the package smaller,
    among other things
  - on tls-capable arches, build libdb both with and without shared posix
    mutexes, otherwise just without
  - disable posix mutexes unconditionally for db 4.0, which shouldn't need
    them for the migration cases where it's used
  - update to MigrationTools 45


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.25-1
changelog:
  - change logging facility used from daemon to local4 (#112730, reversing #11047)
    BEHAVIOR CHANGE - SHOULD BE MENTIONED IN THE RELEASE NOTES.


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.25-2
changelog:
  - fix incorrect use of find when attempting to detect a common permissions
    error in the init script (#114866)


author: Thomas Woerner <twoerner@redhat.com> 2.1.29-3
changelog:
  - removed rpath
  - added pie patch: slapd and slurpd are now pie
  - requires libtool >= 1.5.6-2 (PIC libltdl.a)


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.13-1
changelog:
  - add compat-openldap subpackage
  - default to bdb, as upstream does, gambling that we're only going to be
    on systems with nptl now


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.13-2
changelog:
  - build a separate, static set of libraries for openldap-devel with the
    non-standard ntlm bind patch applied, for use by the evolution-connector
    package (#125579), and installing them under
    evolution_connector_prefix)
  - provide openldap-evolution-devel = version-release in openldap-devel
    so that evolution-connector's source package can require a version of
    openldap-devel which provides what it wants


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move slapd startup to earlier in the boot sequence (#103160)
  - update to 2.2.15 (stable-20040822)
  - change version number on compat-openldap to include the non-compat version
    from which it's compiled, otherwise would have to start 2.2.15 at release 3
    so that it upgrades correctly


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.2.17 (stable-20040923) (#135188)
  - move nptl libraries into arch-specific subdirectories on x86 boxes
  - require a newer glibc which can provide nptl libpthread on i486/i586


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.20-1
changelog:
  - update to 2.2.20 (stable-20050103)
  - warn about unreadable krb5 keytab files containing "ldap" keys
  - warn about unreadable TLS-related files
  - own a ref to subdirectories which we create under _libdir/tls


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.23-1
changelog:
  - update to 2.2.23 (stable-20050125)
  - update notes on upgrading from earlier versions
  - drop slapcat variations for 2.0/2.1, which choke on 2.2's config files


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.24-1
changelog:
  - update to 2.2.24 (stable 20050318)
  - export KRB5_KTNAME in the init script, in case it was set in the sysconfig
    file but not exported


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.2.26 (stable 20050429)
  - enable the lmpasswd scheme
  - print a warning if slaptest fails, slaptest -u succeeds, and one of the
    directories listed as the storage location for a given suffix in slapd.conf
    contains a readable file named __db.001 (#118678)


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.26-1
changelog:
  - run slaptest with the -u flag if no id2entry db files are found, because
    you can't check for read-write access to a non-existent database (#156787)
  - add _sysconfdir/openldap/cacerts, which authconfig sets as the
    TLS_CACERTDIR path in /etc/openldap/ldap.conf now
  - use a temporary wrapper script to launch slapd, in case we have arguments
    with embedded whitespace (#158111)


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Add the tls-fix-connection-test patch to close
    bz#161991 openldap password disclosure issue
  - add the hop patches to prevent infinite looping when chasing referrals.
    OpenLDAP ITS #3578


author: Jay Fenlason <fenlason@redhat.com> 2.2.26-2
changelog:
  - Move the slapd.pem file to /etc/pki/tls/certs
    and edit the -config patch to match to close
    bz#143393  Creates certificates + keys at an insecure/bad place
  - also use _sysconfdir instead of hard-coding /etc


author: Jay Fenlason <fenlason@redhat.com> 2.3.11-2
changelog:
  - Upgrade to 2.3.11, which upstream now considers stable.
  - Switch compat-openldap to 2.2.29
  - remove references to nss_ldap_build from the spec file
  - remove references to 2.0 and 2.1 from the spec file.
  - reorganize the build() function slightly in the spec file to limit the
    number of redundant and conflicting options passedto configure.
  - Remove the attempt to hardlink ldapmodify and ldapadd together, since
    the current make install make ldapadd a symlink to ldapmodify.
  - Include the -ads patches to allow SASL binds to an Active Directory
    server to work.  Nalin <nalin@redhat.com> wrote the patch, based on my
    broken first attempt.


author: Jay Fenlason <fenlason@redhat.com> 2.3.11-3
changelog:
  - Remove Requires: cyrus-sasl and cyrus-sasl-md5 from openldap- and
    compat-openldap- to close
    bz#173313 Remove exlicit 'Requires: cyrus-sasl" + 'Requires: cyrus-sasl-md5'


author: Jay Fenlason <fenlason@redhat.com> 2.3.19-2
changelog:
  - Upgrade to 2.3.19, which upstream now considers stable
  - Modify the -config.patch, ldap.init, and this spec file to put the
    pid file and args file in an ldap-owned openldap subdirectory under
    /var/run.
  - Move back_sql* out of _sbindir/openldap , which requires
    hand-moving slapd and slurpd to _sbindir, and recreating symlinks
    by hand.
  - Retire openldap-2.3.11-ads.patch, which went upstream.
  - Update the ldap.init script to run slaptest as the ldap user rather
    than as root.  This solves
    bz#150172 Startup failure after database problem
  - Add to the servers post and preun scriptlets so that on preun, the
    database is slapcatted to /var/lib/ldap/upgrade.ldif and the
    database files are saved to /var/lib/ldap/rpmorig.  On post, if
    /var/lib/ldap/upgrade.ldif exists, it is slapadded.  This means that
    on upgrades from 2.3.16-2 to higher versions, the database files may
    be automatically upgraded.  Unfortunatly, because of the changes to
    the preun scriptlet, users have to do the slapcat, etc by hand when
    upgrading to 2.3.16-2.  Also note that the /var/lib/ldap/rpmorig
    files need to be removed by hand because automatically removing your
    emergency fallback files is a bad idea.
  - Upgrade internal bdb to db-4.4.20.  For a clean upgrade, this will
    require that users slapcat their databases into a temp file, move
    /var/lib/ldap someplace safe, upgrade the openldap rpms, then
    slapadd the temp file.


author: Jay Fenlason <fenlason@redhat.com> 2.3.27-2
changelog:
  - New upstream release
  - Include the gethostbyname_r patch so that nss_ldap won't hang
    on recursive attemts to ldap_initialize.


author: Jay Fenlason <fenlason@redhat.com> 2.3.27-3
changelog:
  - Include --enable-multimaster to close
    bz#185821: adding slapd_multimaster to the configure options
  - Upgade guide.html to the correct one for openladp-2.3.27, closing
    bz#190383: openldap 2.3 packages contain the administrator's guide for 2.2
  - Remove the quotes from around the slaptestflags in ldap.init
    This closes one part of
    bz#204593: service ldap fails after having added entries to ldap
  - include __db.* in the list of files to check ownership of in
    ldap.init, as suggested in
    bz#199322: RFE: perform cleanup in ldap.init


author: Thomas Woerner <twoerner@redhat.com> 2.3.30-1.1
changelog:
  - tcp_wrappers has a new devel and libs sub package, therefore changing build
    requirement for tcp_wrappers to tcp_wrappers-devel


author: Jay Fenlason <fenlason<redhat.com> 2.3.34-1
changelog:
  - New upstream release
  - Upgrade the scripts for migrating the database so that they might
    actually work.
  - change bind-libbind-devel to bind-devel in BuildPreReq


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-2
changelog:
  - slapadd during package update is now quiet (bz#224581)
  - use _localstatedir instead of var/ during build (bz#220970)
  - bind-libbind-devel removed from BuildRequires (bz#216851)
  - slaptest is now quiet during service ldap start, if
    there is no error/warning (bz#143697)
  - libldap_r.so now links with pthread (bz#198226)
  - do not strip binaries to produce correct .debuginfo packages
    (bz#152516)


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-3
changelog:
  - do not create script in /tmp on startup (bz#188298)
  - add compat-slapcat to openldap-compat (bz#179378)
  - do not import ddp services with migrate_services.pl
    (bz#201183)
  - sort the hosts by adders, preventing duplicities
    in migrate*nis*.pl (bz#201540)
  - start slupd for each replicated database (bz#210155)
  - add ldconfig to devel post/postun (bz#240253)
  - include misc.schema in default slapd.conf (bz#147805)


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-4
changelog:
  - Fix initscript return codes (#242667)
  - Provide overlays (as modules; #246036, #245896)
  - Add available modules to config file


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-6
changelog:
  - fix compat-slapcat compilation. Now it can be found in 
    /usr/lib/compat-openldap/slapcat, because the tool checks argv[0]
    (#246581)


author: Jan Safranek <jsafranek@redhat.com> 2.3.37-2
changelog:
  - do not use specific automake and autoconf
  - do not distinguish between NPTL and non-NPTL platforms, we have NPTL
    everywhere
  - db-4.6.18 integrated
  - updated openldap-servers License: field to reference BDB license


author: Jan Safranek <jsafranek@redhat.com> 2.3.38-2
changelog:
  - skeleton /etc/sysconfig/ldap added
  - new SLAPD_LDAP option to turn off listening on ldap:/// (#292591)
  - fixed checking of SSL (#292611)
  - fixed upgrade with empty database


author: Jan Safranek <jsafranek@redhat.com> 2.4.7-4
changelog:
  - fixed rpmlint warnings and errors
    - /etc/openldap/schema/README moved to /usr/share/doc/openldap


author: Jan Safranek <jsafranek@redhat.com> 2.4.8-3
changelog:
  - reworked the upgrade logic, slapcat/slapadd of the whole database
    is needed only if minor version changes (2.3.x -> 2.4.y)
  - do not try to save database in LDIF format, if openldap-servers package 
    is  being removed (it's up to the admin to do so manually)


author: Jan Safranek <jsafranek@redhat.com> 2.4.8-4
changelog:
  - bdb upgraded to 4.6.21
  - reworked upgrade logic again to run db_upgrade when bdb version
    changes


author: Jan Safranek <jsafranek@redhat.com> 2.4.11-3
changelog:
  - add SLAPD_SHUTDOWN_TIMEOUT to /etc/sysconfig/ldap, allowing admins
    to set non-default slapd shutdown timeout
  - add checkpoint to default slapd.conf file (#458679)


author: Jan Zeleny <jzeleny@redhat.com> 2.4.15-3
changelog:
  - extended previous patch (#481310) to remove options cfMP
    from some client tools
  - correction of patch setugid (#494330)


author: Jan Zeleny <jzeleny@redhat.com> 2.4.16-1
changelog:
  - rebase of openldap to 2.4.16
  - fixed minor issue in spec file (output looking interactive
    when installing servers)


author: Jan Zeleny <jzeleny@redhat.com> 2.4.18-2
changelog:
  - changed configuration approach. Instead od slapd.conf slapd
    is using slapd.d directory now
  - fix of some issues caused by renaming of init script
  - fix of buffer overflow issue in ldif.c pointed out by new glibc


author: Jan Zeleny <jzeleny@redhat.com> 2.4.18-4
changelog:
  - buffer overflow patch from upstream
  - added /etc/openldap/slapd.d and /etc/openldap/slapd.conf.bak
    to files owned by openldap-servers


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.19-1
changelog:
  - fixed tls connection accepting when TLSVerifyClient = allow
  - /etc/openldap/ldap.conf removed from files owned by openldap-servers
  - minor changes in spec file to supress warnings
  - some changes in init script, so it would be possible to use it when
    using old configuration style
  - rebased openldap to 2.4.19
  - rebased bdb to 4.8.24


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.19-7
changelog:
  - updated usage line in init script
  - changed return code when calling init script with bad arguments


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.19-9
changelog:
  - fixed broken link /usr/sbin/slapschema (#583568)
  - removed some static libraries from openldap-devel (#583575)


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.19-10
changelog:
  - updated overlay list in config file (#586143)
  - config dir slapd.d added to package payload (#585276)
  - init script now creates only symlink, not harldink, in /var/run (#584870)


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.19-12
changelog:
  - updated man pages - only slaptest can convert configuration schema
    (#584787)
  - openldap compiled with -fno-strict-aliasing (#596193)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-4
changelog:
  - rebase to 2.4.23 (Fedora 14) (#644077)
  - uses Mozilla NSS instead of OpenSSL for TLS/SSL
  - added LDIF (ldif.h) to the public API
  - removed embeded Berkeley DB
  - removed autofs schema (use up-to-date version from autofs package instead)
  - removed compat-openldap subpackage (use separate package instead)
  - fixes: ldapsearch -Z hangs server if starttls fails (#652823)
  - fixes: improve SSL/TLS log messages (#652819)
  - fixes: crash when TLS_CACERTDIR contains a subdirectory (#652817)
  - fixes: TLS_CACERTDIR takes precedence over TLS_CACERT (#652816)
  - fixes: openldap should ignore files not in the openssl c_hash format in cacertdir (#652814)
  - fixes: slapd init script gets stuck in an infinite loop (#644399)
  - fixes: Remove lastmod.la from default slapd.conf.bak (#630637)
  - fixes: Mozilla NSS - delay token auth until needed (#616558)
  - fixes: Mozilla NSS - support use of self signed CA certs as server certs (#616554)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-5
changelog:
  - initscript: slaptest with '-u' to skip database opening (#613966)
  - removed slurpd options from sysconfig/ldap
  - fix: verification of self issued certificates (#667795)
  - fix: move libraries from /usr/lib to /lib (#548475)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-7
changelog:
  - fix: some server certificates refused with inadequate type error (#669846)
  - fix: default encryption strength dropped in switch to using NSS (#669845)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-10
changelog:
  - fix: add symlinks for libraries moved in 2.4.23-5 to allow building
    packages which require these libraries in the old location (#678105)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-11
changelog:
  - fix: CVE-2011-1024 ppolicy forwarded bind failure messages cause success
  - fix: CVE-2011-1025 rootpw is not verified for ndb backend
  - fix: openldap startup script ignores ulimit settings (#679356)
  - fix: add symlinks into /usr/lib*/ (#680139)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-13
changelog:
  - fix update: openldap can't use TLS after a fork() (#671553)
  - fix: possible NULL pointer dereferences in NSS non-blocking patch (#684035)
  - fix: move libldif to /lib for consistency (#548475)
  - fix: openldap-servers upgrade hangs or do not upgrade the database (#685119)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-14
changelog:
  - fix update: openldap startup script ignores ulimit settings (#679356)
  - fix update: openldap-servers upgrade hangs or do not upgrade the database (#685119)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-15
changelog:
  - fix: rpm -V fail when upgrading with openldap-devel installed (#693716)
    (remove devel *.so symlinks from /lib and leave them in /usr/lib)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-16
changelog:
  - fix: memleak in tlsm_auth_cert_handler (#717738)
  - fix: segmentation fault of client tool when LDIF input file is not terminated
    by a new line character (#698921)
  - fix: segmentation fault of client tool when input line in LDIF file
    is splitted but indented incorrectly (#701227)
  - fix: server scriptlets require initscripts package (#712358)
  - enable ldapi:/// interface by default
  - set cn=config management ACLs for root user, SASL external schema (#712494)
  - fix: ldapsearch fails if no CA certificate is available (#713525)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-17
changelog:
  - fix: strict aliasing warnings during package build (#723487)
  - add partial RELRO support for libraries (#723999)
  - fix: incorrect behavior of allow/try options of VerifyCert and TLS_REQCERT (#729095)
  - fix: memleak - free the return of tlsm_find_and_verify_cert_key (#729087)
  - fix: TLS_REQCERT=never ignored when the certificate is expired (#722959)
  - fix: matching wildcard hostnames in certificate Subject field does not work (#726984)
  - fix: OpenLDAP server segfaults when using back-sql (#727533)
  - fix: conversion of constraint overlay settings to cn=config is incorrect (#722923)
  - fix: DDS overlay tolerance parametr doesn't function and breakes default TTL (#723514)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-18
changelog:
  - fix: overlay refint option refint_nothing doesn't function correctly (#725479)
  - fix: Unwanted slash printed when installing openldap-servers (#732001)
  - manpage fix: TLS options in documentation are not valid for MozNSS (#684810)
  - fix: NSS_Init* functions are not thread safe (#731168)
  - manpage fix: errors in manual page slapo-unique (#723521) 
  - new feature: honor priority/weight with ldap_domain2hostlist (#730311)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-20
changelog:
  - new feature update: honor priority/weight with ldap_domain2hostlist (#730311)
  - fix regression: openldap built without tcp_wrappers (#742592)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-21
changelog:
  - fix: ldapsearch crashes with invalid parameters (#743781)
  - fix: replication (syncrepl) with TLS causes segfault (#783445)
  - fix: openldap server in MirrorMode sometimes fails to resync via syncrepl (#784211)
  - use portreserve to reserve LDAPS port (636/tcp+udp) (#790687)
  - fix: missing options in manual pages of client tools (#745470)
  - fix: SASL_NOCANON option missing in ldap.conf manual page (#732916)
  - fix: slapd segfaults when certificate key cannot be loaded (#796808)
  - Jan Synáček <jsynacek@redhat.com>
    + fix: overlay constraint with count option work bad with modify operation (#742163)
    + fix: Default SSL certificate bundle is not found by openldap library (#742023)
    + fix: Duplicate close() calls in OpenLDAP (#784203)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-23
changelog:
  - security fix: CVE-2012-1164: assertion failure by processing search queries
    requesting only attributes for particular entry (#813162)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-24
changelog:
  - fix update: Default SSL certificate bundle is not found by openldap library (#742023)
  - fix: memberof overlay on the frontend database causes server segfault (#730745)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-26
changelog:
  - fix: MozNSS CA cert dir does not work together with PEM CA cert file (#818844)
  - fix: memory leak: def_urlpre is not freed (#816168)
  - fix update: Default SSL certificate bundle is not found by openldap library (#742023)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-28
changelog:
  - CVE-2012-2668 (#825875)
    + cipher suite selection by name can be ignored
    + default cipher suite is always selected


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-29
changelog:
  - fix: invalid order of TLS shutdown operations (#818572)
  - fix: TLS error messages overwriting in tlsm_verify_cert() (#828787)
  - fix: reading pin from file can make all TLS connections hang (#829319)
  - fix: replication with TLS does not work (#707599)
  - fix: some TLS ciphers cannot be enabled (#852339)
  - fix: connection hangs after fallback to second server when certificate hostname verification fails (#843056)
  - fix: not all certificates in OpenSSL compatible CA certificate directory format are loaded (#811468)
  - fix: MozNSS certificate database in SQL format cannot be used (#857390)
  - fix: libldap does not load PEM certificate if certdb is used as TLS_CACERTDIR (#859858)
  - fix: do not send IPv6 DNS queries when IPv6 is disabled on the host (#835012)
  - fix: modification of olcSyncrepl attribute takes server out of MirrorMode (#821848)


author: Jan Synáček <jsynacek@redhat.com> - 2.4.39-1
changelog:
  - rebase to 2.4.39 (#923680)
    + drop a lot of upstreamed patches, backport the rest
    + compile in mdb
    + remove automatic slapd.conf -> slapd-config conversion


author: Jan Synáček <jsynacek@redhat.com> - 2.4.39-3
changelog:
  - add another missing patch forgotten during the rebase
  - fix: enable dynamic linking - unresolved symbols in the smbk5pwd module


author: Jan Synáček <jsynacek@redhat.com> - 2.4.39-10
changelog:
  - revert previous patch (#1172296)
  - fix: crash in ldap_domain2hostlist when processing SRV record (#1164369)
  - support TLS 1.1 and later (#1160467)
  - enhancement: add ppolicy-check-password (#1155390)


author: Matúš Honěk <mhonek@redhat.com> - 2.4.40-7
changelog:
  - fix: regression: deadlock during SSL_ForceHandshake when getting connection to replica (#1267501)
    + apply (and modify a little) the patch from commit 1eeaeeb7


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Patch to build with neither RSA nor RSAref.
  - Miscellaneous FHS-compliance tweaks.
  - Fix for possibly-compressed man pages.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Move condrestart to server postun.
  - Move key generation to init script.
  - Actually use the right patch for moving the key generation to the init script.
  - Clean up the init script a bit.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 2.1.1p4, which includes fixes for config file parsing problems.
  - Move the init script back.
  - Add Damien's quick fix for wackiness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 20000823 snapshot.
  - Change subpackage requirements from %{version} to %{version}-%{release}
  - Back out the pipe patch.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update x11-askpass to 1.0.2. (#17835)
  - Add BuildPreReqs for /bin/login and /usr/bin/rsh so that configure will
    always find them in the right place. (#17909)
  - Set the default path to be the same as the one supplied by /bin/login, but
    add /usr/X11R6/bin. (#17909)
  - Try to handle obsoletion of ssh-server more cleanly.  Package names
    are different, but init script name isn't. (#17865)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add BuildPreReq on /usr/include/security/pam_appl.h to be sure we always
    build PAM authentication in.
  - Try setting SSH_ASKPASS if gnome-ssh-askpass is installed.
  - Clean out no-longer-used patches.
  - Patch ssh-add to try to add both identity and id_dsa, and to error only
    when neither exists.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to OpenSSH 2.3.0p1.
  - Update to x11-askpass 1.1.0.
  - Enable keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Resync with conditional options in Damien Miller's .spec file for an errata.
  - Change libexecdir from %{_libexecdir}/ssh to %{_libexecdir}/openssh.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add the primes file from the latest snapshot to the main package (#20884).
  - Add the dev package to the prereq list (#19984).
  - Remove the default path and mimic login's behavior in the server itself.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Disable the built-in MD5 password support.  We're using PAM.
  - Take a crack at doing keyboard-interactive authentication with PAM, and
    enable use of it in the default client configuration so that the client
    will try it when the server disallows password authentication.
  - Build with debugging flags.  Build root policies strip all binaries anyway.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Merge multiple PAM text messages into subsequent prompts when possible when
    doing keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to x11-askpass 1.1.1. (#21301)
  - Don't second-guess fixpaths, which causes paths to get fixed twice. (#21290)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't treat pam_setcred() failure as fatal unless pam_authenticate() has
    succeeded, to allow public-key authentication after a failure with "none"
    authentication.  (#21268)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - More gettextizing.
  - Close all files after going into daemon mode (needs more testing).
  - Extract patch from CVS to handle auth banners (in the client).
  - Extract patch from CVS to handle compat weirdness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't open a PAM session until we've forked and become the user (#25690).
  - Apply Andrew Bartlett's patch for letting pam_authenticate() know which
    host the user is attempting a login from.
  - Resync with parts of Damien Miller's openssh.spec from CVS.
  - Don't expose KbdInt responses in debug messages (from CVS).
  - Detect and handle errors in rsa_{public,private}_decrypt (from CVS).


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.0p1.
  - Use $RPM_OPT_FLAGS instead of -O when building gnome-ssh-askpass
  - Resync with parts of Damien Miller's openssh.spec from CVS, including
    update of x11 askpass to 1.2.0.
  - Only require openssl (don't prereq) because we generate keys in the init
    script now.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.1p1.
  - Add init script mods from Pekka Savola.
  - Tweak the init script to match the CVS contrib script more closely.
  - Redo patch to ssh-add to try to adding both identity and id_dsa to also try
    adding id_rsa.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Redo patch to move pam_open_session after the server setuid()s to the user.
  - Rework the nopam patch to use be picked up by autoconf.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Chuck the closing patch.
  - Add a trigger to add host keys for protocol 2 to the config file, now that
    configuration file syntax requires us to specify it with HostKey if we
    specify any other HostKey values, which we do.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Revert the patch to move pam_open_session.
  - Init script and spec file changes from Pekka Savola. (#28750)
  - Patch sftp to recognize '-o protocol' arguments. (#29540)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p1 (includes endianness fixes in the rijndael implementation)
  - don't enable challenge-response by default until we find a way to not
    have too many userauth requests (we may make up to six pubkey and up to
    three password attempts as it is)
  - remove build dependency on rsh to match openssh.com's packages more closely


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p2
  - call setcred() again after initgroups, because the "creds" could actually
    be group memberships


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make do_pam_setcred() smart enough to know when to establish creds and
    when to reinitialize them
  - add in a couple of other fixes from Damien for inclusion in the errata


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - mention that challengereponse supports PAM, so disabling password doesn't
    limit users to pubkey and rsa auth (#34378)
  - bypass the daemon() function in the init script and call initlog directly,
    because daemon() won't start a daemon it detects is already running (like
    open connections)
  - require the version of openssl we had when we were built


author: Preston Brown <pbrown@redhat.com>
changelog:
  - remove explicit openssl requirement, fixes builddistro issue
  - make initscript stop() function wait until sshd really dead to avoid 
    races in condrestart


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - finish marking strings in the init script for translation
  - modify init script to source /etc/sysconfig/sshd and pass $OPTIONS to sshd
    at startup (change merged from openssh.com init script, originally by
    Pekka Savola)
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add in Simon Wilkinson's GSSAPI patch to give it some testing in-house,
    to be removed before the next beta cycle because it's a big departure
    from the upstream version


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix an error parsing the new default sshd_config
  - add a fix from Markus Friedl (via openssh-unix-dev) for ssh-keygen not
    dealing with comments right


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change Copyright: BSD to License: BSD
  - add Markus Friedl's unverified patch for the cookie file deletion problem
    so that we can verify it
  - drop patch to check if xauth is present (was folded into cookie patch)
  - don't apply gssapi patches for the errata candidate
  - clear supplemental groups list at startup


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pull cvs patch to add session initialization to no-pty sessions
  - pull cvs patch to not cut off challengeresponse auth needlessly
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed (#49263)


author: Nalin Dahyabhai <nalin@redhat.com> 2.9p2-7
changelog:
  - fix scp's server's reporting of file sizes, and build with the proper
    preprocessor define to get large-file capable open(), stat(), etc.
    (sftp has been doing this correctly all along) (#51827)
  - configure without --with-ipv4-default on RHL 7.x and newer (#45987,#52247)
  - pull cvs patch to fix support for /etc/nologin for non-PAM logins (#47298)
  - mark profile.d scriptlets as config files (#42337)
  - refer to Jason Stone's mail for zsh workaround for exit-hanging quasi-bug
  - change a couple of log() statements to debug() statements (#50751)
  - pull cvs patch to add -t flag to sshd (#28611)
  - clear fd_sets correctly (one bit per FD, not one byte per FD) (#43221)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 3.0p1
  - update to x11-ssh-askpass 1.2.4.1
  - change build dependency on a file from pam-devel to the pam-devel package
  - replace primes with moduli


author: Nalin Dahyabhai <nalin@redhat.com> 3.0p1-1
changelog:
  - merge some of Damien Miller <djm@mindrot.org> changes from the upstream
    3.0p1 spec file and init script


author: Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-3
changelog:
  - add patches from Simon Wilkinson and Nicolas Williams for GSSAPI key
    exchange, authentication, and named key support


author: Nalin Dahyabhai <nalin@redhat.com> SNAP-20020220
changelog:
  - update to SNAP-20020220 for testing purposes (you've been warned, if there's
    anything to be warned about, gss patches won't apply, I don't mind)


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-1
changelog:
  - require sharutils for building (mindrot #137)
  - require db1-devel only when building for 6.x (#55105), which probably won't
    work anyway (3.1 requires OpenSSL 0.9.6 to build), but what the heck
  - require pam-devel by file (not by package name) again
  - add Markus's patch to compile with OpenSSL 0.9.5a (from
    http://bugzilla.mindrot.org/show_bug.cgi?id=141) and apply it if we're
    building for 6.x


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2gss
changelog:
  - reintroduce Simon's gssapi patches
  - add buildprereq for autoconf253, which is needed to regenerate configure
    after applying the gssapi patches
  - refresh to the latest version of Markus's patch to build properly with
    older versions of OpenSSL


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-3
changelog:
  - pull patch from CVS to avoid printing error messages when some of the
    default keys aren't available when running ssh-add
  - refresh to current revisions of Simon's patches


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-4
changelog:
  - drop buildreq on db1-devel
  - require pam-devel by package name
  - require autoconf instead of autoconf253 again


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-1
changelog:
  - update to 3.3p1
  - merge in spec file changes from upstream (remove setuid from ssh, ssh-keysign)
  - disable gtk2 askpass
  - require pam-devel by filename rather than by package for erratum
  - include patch from Solar Designer to work around anonymous mmap failures


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-2
changelog:
  - rework the close-on-exit docs
  - include configuration file man pages
  - make use of nologin as the privsep shell optional


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-2
changelog:
  - patch PAM configuration to use relative path names for the modules, allowing
    us to not worry about which arch the modules are built for on multilib systems


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-6
changelog:
  - move scp to the -clients subpackage, because it directly depends on ssh
    which is also in -clients (#84329)


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-6
changelog:
  - modify patch which clears the supplemental group list at startup to only
    complain if setgroups() fails if sshd has euid == 0
  - handle krb5 installed in %{_prefix} or elsewhere by using krb5-config


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-11
changelog:
  - apply patch to store the correct buffer size in allocated buffers
    (CAN-2003-0693)
  - skip the initial PAM authentication attempt with an empty password if
    empty passwords are not permitted in our configuration (#103998)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - additional fix for apparently-never-happens double-free in buffer_free()
  - extend fix for #103998 to cover SSH1


author: Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-34
changelog:
  * Wed Mar 03 2004 Phil Knirsch <pknirsch@redhat.com> 3.6.1p2-33.30.1
  - Built RHLE3 U2 update package.


author: Nalin Dahyabhai <nalin@redhat.com> 3.8.1p1-1
changelog:
  - request gssapi-with-mic by default but not delegation (flag day for anyone
    who used previous gssapi patches)
  - no longer request x11 forwarding by default


author: Nalin Dahyabhai <nalin@redhat.com> 3.9p1-8
changelog:
  - add a --enable-vendor-patchlevel option which allows a ShowPatchLevel option
    to enable display of a vendor patch level during version exchange (#120285)
  - configure with --disable-strip to build useful debuginfo subpackages


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - change permissions on pam.d/sshd to 0644 (#64697)
  - patch initscript so it doesn't kill opened sessions if
    the sshd daemon isn't running anymore (#67624)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-10
changelog:
  - enable trusted forwarding by default if X11 forwarding is 
    required by user (#137685 and duplicates)
  - disable protocol 1 support by default in sshd server config (#88329)
  - keep the gnome-askpass dialog above others (#69131)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-11
changelog:
  - don't call syslog in signal handler
  - allow password authentication when copying from remote
    to remote machine (#103364)


author: Tomas Mraz <tmraz@redhat.com> 4.0p1-2
changelog:
  - fixed Local/RemoteForward in ssh_config.5 manpage
  - fix fatal when Local/RemoteForward is used and scp run (#153258)
  - don't leak user validity when using krb5 authentication


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-3
changelog:
  - fix small regression caused by the nologin patch (#161956)
  - fix race in getpeername error checking (mindrot #1054)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-4
changelog:
  - don't deadlock on exit with multiple X forwarded channels (#152432)
  - don't use X11 port which can't be bound on all IP families (#163732)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-5
changelog:
  - use x11-ssh-askpass if openssh-askpass-gnome is not installed (#165207)
  - install ssh-copy-id from contrib (#88707)


author: Tomas Mraz <tmraz@redhat.com> 4.2p1-2
changelog:
  - use include instead of pam_stack in pam config
  - use fork+exec instead of system in scp - CVE-2006-0225 (#168167)
  - upstream patch for displaying authentication errors


author: Warren Togami <wtogami@redhat.com> - 4.2p1-7
changelog:
  - xorg-x11-devel -> libXt-devel
  - rebuild for new xauth location so X forwarding works
  - buildreq audit-libs-devel
  - buildreq automake for aclocal
  - buildreq imake for xmkmf
  -  -D_GNU_SOURCE in flags in order to get it to build
     Ugly hack to workaround openssh defining __USE_GNU which is
     not allowed and causes problems according to Ulrich Drepper
     fix this the correct way after FC5test1


author: Nalin Dahyabhai <nalin@redhat.com> - 4.2p1-8
changelog:
  - work around missing gccmakedep by wrapping makedepend in a local script
  - remove now-obsolete build dependency on "xauth"


author: Tomas Mraz <tmraz@redhat.com> - 4.2p1-9
changelog:
  - drop x11-ssh-askpass from the package
  - drop old build_6x ifs from spec file
  - improve gnome-ssh-askpass so it doesn't reveal number of passphrase 
    characters to person looking at the display
  - less hackish fix for the __USE_GNU problem


