# changelog

author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-17
changelog:
  - release 1.3.1.6-17
  - Resolves: bug 853106 - Deleting attribute present in nsslapd-allowed-to-delete-attrs returns Operations error (Ticket 443)
  - Resolves: bug 1049525 - Server hangs in cos_cache when adding a user entry (Ticket 47649)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-18
changelog:
  - release 1.3.1.6-18
  - Resolves: bug 838656 - logconv.pl tool removes the access logs contents if "-M" is not correctly used (Ticket 471)
  - Resolves: bug 922538 - improve dbgen rdn generation, output (Ticket 47374)
  - Resolves: bug 970750 - flush.pl is not included in perl5 (Ticket 47374)
  - Resolves: bug 1013898 - Fix various issues with logconv.pl (Ticket 471)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-19
changelog:
  - release 1.3.1.6-19
  - Resolves: bug 1065971 - Enrolling a host into IdM/IPA always takes two attempts (Ticket 47704)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-20
changelog:
  - release 1.3.1.6-20
  - Resolves: bug 1065242 - 389-ds-base, conflict occurs at yum installation if multilib_policy=all. (Ticket 47709)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-21
changelog:
  - release 1.3.1.6-21
  - Resolves: bug 918694 - Fix covscan defect FORWARD_NULL (Ticket 408)
  - Resolves: bug 918717 - Fix covscan defect COMPILER WARNINGS (Ticket 571)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-22
changelog:
  - release 1.3.1.6-22
  - Resolves: bug 1074084 - e_uniqueid fails to set if an entry is a conflict entry (Ticket 47735)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-23
changelog:
  - release 1.3.1.6-22
  - Resolves: bug 1074850 - EMBARGOED CVE-2014-0132 389-ds-base: 389-ds: flaw in parsing authzid can lead to privilege escalation [rhel-7.0] (Ticket 47739 - directory server is insecurely misinterpreting authzid on a SASL/GSSAPI bind)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-23
changelog:
  - Resolves: bug 1074850 - EMBARGOED CVE-2014-0132 389-ds-base: 389-ds: flaw in parsing authzid can lead to privilege escalation [rhel-7.0] (Ticket 47739 - directory server is insecurely misinterpreting authzid on a SASL/GSSAPI bind) (Added 0095-Ticket-47739-directory-server-is-insecurely-misinter.patch)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-24
changelog:
  - release 1.3.1.6-24
  - Resolves: bug 1074084 - e_uniqueid fails to set if an entry is a conflict entry (Ticket 47735); regression - sub-type length in attribute type was mistakenly subtracted.


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-26
changelog:
  - release 1.3.1.6-26
  - Resolves: #1123864
    EMBARGOED CVE-2014-3562 389-ds-base: 389-ds: unauthenticated information disclosure [rhel-7.0.z] (BZ 1123477)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-4
changelog:
  - release 1.3.3.1-4
  - Resolves: bug 1080186 - Creating a glue fails if one above level is a conflict or missing  (DS 47750)
  - Resolves: bug 1145846 - 389-ds 1.3.3.0 does not adjust cipher suite configuration on upgrade, breaks itself and pki-server (DS 47908)
  - Resolves: bug 1117979 - harden the list of ciphers available by default (phase 2) (DS 47838)
                          - provide enabled ciphers as search result (DS 47880)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-6
changelog:
  - release 1.3.3.1-6
  - Resolves: bug 1151287 - dynamically added macro aci is not evaluated on the fly (DS 47922)
  - Resolves: bug 1080186 - Need to move slapi_pblock_set(pb, SLAPI_MODRDN_EXISTING_ENTRY, original_entry->ep_entry) prior to original_entry overwritten (DS 47897)
  - Resolves: bug 1150694 - Encoding of SearchResultEntry is missing tag (DS 47920)
  - Resolves: bug 1150695 - ldbm_back_modify SLAPI_PLUGIN_BE_PRE_MODIFY_FN does not return even if one of the preop plugins fails. (DS 47919)
  - Resolves: bug 1139882 - Fix remaining compiler warnings (DS 47892)
  - Resolves: bug 1150206 - result of dna_dn_is_shared_config is incorrectly used (DS 47918)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-8
changelog:
  - release 1.3.3.1-8
  - Resolves: bug 1156607 - Crash in entry_add_present_values_wsi_multi_valued (DS 47937)
  - Resolves: bug 1153737 - Disable SSL v3, by default (DS 47928, DS 47945, DS 47948)
  - Resolves: bug 1158804 - Malformed cookie for LDAP Sync makes DS crash (DS 47939)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-9
changelog:
  - release 1.3.3.1-9
  - Resolves: bug 1153737 - Disable SSL v3, by default. (DS 47928)
  - Resolves: bug 1163461 - Should not check aci syntax when deleting an aci (DS 47953)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-10
changelog:
  - release 1.3.3.1-10
  - Resolves: bug 1172731 - CVE-2014-8112 password hashing bypassed when "nsslapd-unhashed-pw-switch" is set to off 
  - Resolves: bug 1166265 - DS hangs during online total update (DS 47942)
  - Resolves: bug 1168151 - CVE-2014-8105 information disclosure through 'cn=changelog' subtree
  - Resolves: bug 1044170 - Allow memberOf suffixes to be configurable (DS 47526)
  - Resolves: bug 1171356 - Bind DN tracking unable to write to internalModifiersName without special permissions (DS 47950)
  - Resolves: bug 1153737 - logconv.pl -- support parsing/showing/reporting different protocol versions (DS 47949)
  - Resolves: bug 1171355 - start dirsrv after chrony on RHEL7 and Fedora (DS 47947)
  - Resolves: bug 1170707 - cos_cache_build_definition_list does not stop during server shutdown (DS 47967)
  - Resolves: bug 1170708 - COS memory leak when rebuilding the cache (DS - Ticket 47969)
  - Resolves: bug 1170709 - Account lockout attributes incorrectly updated after failed SASL Bind (DS 47970)
  - Resolves: bug 1166260 - cookie_change_info returns random negative number if there was no change in a tree (DS 47960)
  - Resolves: bug 1012991 - Error log levels not displayed correctly (DS 47636)
  - Resolves: bug 1108881 - rsearch filter error on any search filter (DS 47722)
  - Resolves: bug 994690  - Allow dynamically adding/enabling/disabling/removing plugins without requiring a server restart (DS 47451)
  - Resolves: bug 1162997 - Running a plugin task can crash the server (DS 47451)
  - Resolves: bug 1166252 - RHEL7.1 ns-slapd segfault when ipa-replica-install restarts (DS 47451)
  - Resolves: bug 1172597 - Crash if setting invalid plugin config area for MemberOf Plugin (DS 47525)
  - Resolves: bug 1139882 - coverity defects found in 1.3.3.x (DS 47965)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-11
changelog:
  - release 1.3.3.1-11
  - Resolves: bug 1080186 - During delete operation do not refresh cache entry if it is a tombstone (DS 47750)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-12
changelog:
  - release 1.3.3.1-12
  - Resolves: bug 1182477 - Windows Sync accidentally cleared raw_entry (DS 47989)
  - Resolves: bug 1180325 - upgrade script fails if /etc and /var are on different file systems (DS 47991 )
  - Resolves: bug 1183655 - Schema learning mechanism, in replication, unable to extend an existing definition (DS 47988)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-14
changelog:
  - release 1.3.3.1-14
  - Resolves: bug 1189154 - DNS errors after IPA upgrade due to broken ReplSync (DS 48030)
              Fixes spec file to make sure all the server instances are stopped before upgrade
  - Resolves: bug 1186548 - ns-slapd crash in shutdown phase (DS 48005)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-16
changelog:
  - release 1.3.3.1-16
  - Resolves: bug 1212894 - CVE-2015-1854 389ds-base: access control bypass with modrdn


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-17
changelog:
  - release 1.3.3.1-17
  - Resolves: bug 1230038 - idm/ipa 389-ds-base entry cache converges to 500 KB in dblayer_is_cachesize_sane (DS 48190)
  - Resolves: bug 1230037 - async simple paged results issue (DS 48146, DS 48192)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-18
changelog:
  - release 1.3.3.1-18
  - Resolves: bug 1232100 - CVE-2015-3230 389-ds-base: nsSSL3Ciphers preference not enforced server side (DS 48194)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-20
changelog:
  - release 1.3.3.1-20
  - Resolves: bug 1243718 - Winsync fails when AD users have multiple spaces (two)inside the value of the rdn attribute (DS 48223)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-21
changelog:
  - release 1.3.3.1-21
  - Resolves: bug 1258318 - Deadlock with retrochangelog, memberof plugin (DS 47931)
  - Resolves: bug 1259466 - Enhance ACIs to have more control over MODRDN operations (DS 47553)
  - Resolves: bug 1259999 - Some filters in RHDS10 are not working fine. (DS 48265)
  - Resolves: bug 1260000 - handling of "No original_tombstone for changenumber" errors (DS 47912)
  - Resolves: bug 1260001 - cleanallruv should completely clean changelog (DS 48208)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-22
changelog:
  - release 1.3.3.1-22
  - Resolves: bug 1262363 - In MMR, double free coould occur under some special condition (DS 48226)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-23
changelog:
  - release 1.3.3.1-23
  - Resolves: bug 1262363 - In MMR, double free coould occur under some special condition (DS 48226)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-11
changelog:
  - release 1.3.4.0-11
  - Resolves: bug 1249784 - ipa-dnskeysyncd unhandled exception on named-pkcs11 start (DS 48249)
  - Resolves: bug 1252082 - removing chaining database links trigger valgrind read error (DS 47686)
  - Resolves: bug 1252207 - bashisms in 389-ds-base admin scripts (DS 47511)
  - Resolves: bug 1252533 - Man pages and help for remove-ds.pl doesn't display "-a" option (DS 48245)
  - Resolves: bug 1252781 - Slapd crashes reported from latest builds (DS 48250)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-12
changelog:
  - release 1.3.4.0-12
  - Resolves: bug 1252133 - replica upgrade failed in starting dirsrv service (DS 48243)
  - Resolves: bug 1254344 - Server crashes in ACL_LasFindFlush during shutdown if ACIs contain IP addresss restrictions (DS 48233)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-14
changelog:
  - release 1.3.4.0-14
  - Resolves: bug 1246389 - wrong password check if passwordInHistory is decreased. (DS 48228)
  - Resolves: bug 1255851 - Shell CLI fails with usage errors if an argument containing white spaces is given (DS 48254)
  - Resolves: bug 1256938 - Unable to dereference unqiemember attribute because it is dn [#UID] not dn syntax (DS 47757)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-15
changelog:
  - release 1.3.4.0-15
  - Resolves: bug 1258996 - Complex filter in a search request doen't work as expected. (regression) (DS 48265)
  - Resolves: bug 1179370 - COS cache doesn't properly mark vattr cache as invalid when there are multiple suffixes (DS 47981)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-16
changelog:
  - release 1.3.4.0-16
  - Resolves: bug 1243970 - In MMR, double free coould occur under some special condition (DS 48276, DS 48226)
  - Resolves: bug 1259949 - Fractional replication evaluates several times the same CSN (DS 48266)
  - Resolves: bug 1241723 - cleanallruv - fix regression with server shutdown (DS 48217)
  - Resolves: bug 1264224 - segfault in ns-slapd due to accessing Slapi_DN freed in pre bind plug-in (DS 48188)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-17
changelog:
  - release 1.3.4.0-17
  - Resolves: bug 1259949 - A backport error (coverity -- unused variable 'init_retry')


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-18
changelog:
  - release 1.3.4.0-18
  - Resolves: bug 1259949 - Fractional replication evaluates several times the same CSN (DS 48266, DS 48284)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-19
changelog:
  - release 1.3.4.0-19
  - Resolves: bug 1228823 - async simple paged results issue (DS 48299, DS 48192)
  - Resolves: bug 1266944 - ns-slapd crash during ipa-replica-manage del (DS 48298)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-20
changelog:
  - release 1.3.4.0-20
  - Resolves: bug 1278729 - Share nsslapd-threadnumber in the case nunc-stans is enabled (DS 48339)
  - Resolves: bug 1278730 - SimplePagedResults -- abandon could happen between the abandon check and sending results (DS 48338)
  - Resolves: bug 1279572 - Cannot upgrade a consumer to supplier in a multimaster environment (DS 48325)
  - Resolves: bug 1279573 - nunc-stans: Attempt to release connection that is not acquired (DS 48311)
  - Resolves: bug 1280210 - deadlock in mep delete post op (DS 47976)
  - Resolves: bug 1281522 - acl - regression - trailing ', (comma)' in macro matched value is not removed (DS 48344)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-21
changelog:
  - release 1.3.4.0-21
  - Resolves: bug 1278730 - SimplePagedResults -- abandon could happen between the abandon check and sending results -- Fixing a regression introduced in 1.3.4.0-20 (DS 48338)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-22
changelog:
  - release 1.3.4.0-22
  - Resolves: bug 1290725 - SimplePagedResults -- in the search error case, simple paged results slot was not released. (DS 48375)
  - Resolves: bug 1290726 - The 'eq' index does not get updated properly when deleting and re-adding attributes in the same modify operation (DS 48370)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-23
changelog:
  - release 1.3.4.0-23
  - Resolves: bug 1295684 - many attrlist_replace errors in connection with cleanallruv (DS 48283)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-24
changelog:
  - release 1.3.4.0-24
  - Resolves: bug 1298105 - 389-ds hanging after a few minutes of operation (DS 48406)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-25
changelog:
  - release 1.3.4.0-25
  - Resolves: bug 1299757 - CVE-2016-0741 389-ds-base: Worker threads do not detect abnormally closed connections causing DoS


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-27
changelog:
  - release 1.3.4.0-27
  - Resolves: bug 1309963 - keep alive entries can break replication (DS 48445)
  - Resolves: bug 1309964 - Crash in slapi_get_object_extension (DS 48536)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-28
changelog:
  - release 1.3.4.0-28
  - Resolves: bug 1315181 - change severity of some messages related to "keep alive" entries (DS 48420)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-29
changelog:
  - release 1.3.4.0-29
  - Resolves: bug 1316552 - License tag does not match actual license of code (DS 48757)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-30
changelog:
  - release 1.3.4.0-30
  - Resolves: bug 1321891 - DES to AES password conversion fails if a backend is empty (DS 48777)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-31
changelog:
  - release 1.3.4.0-31
  - Resolves: bug 1335423 - heap corruption at schema replication. (DS 48492)
  - Resolves: bug 1335107 - Paged results search returns the blank list of entries (DS 48808)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-32
changelog:
  - release 1.3.4.0-32
  - Resolves: bug 1344293 - At startup DES to AES password conversion causes timeout in start script (DS 48862)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-33
changelog:
  - release 1.3.4.0-33
  - Resolves: bug 1351323 - Improve MMR replication convergence (DS 48636)
  - Resolves: bug 1351447 - Supplier can skip a failing update, although it should retry. (DS 47788)
  - Resolves: bug 1350707 - Replication changelog can incorrectly skip over updates (DS 48766)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-2
changelog:
  - Release 1.3.5.10-2
  - Resolves: bug 1353714 - If a cipher is disabled do not attempt to look it up (DS 48743)
  - Resolves: bug 1353592 - Setup-ds.pl --update fails - regression (DS 48755)
  - Resolves: bug 1353544 - db2bak.pl task enters infinitive loop when bak fs is almost full (DS 48914)
  - Resolves: bug 1354374 - Upgrade to 389-ds-base >= 1.3.5.5 doesn't install 389-ds-base-snmp (DS 48918)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-4
changelog:
  - Release 1.3.5.10-4
  - Resolves: bug 1209128 - [RFE] Add a utility to get the status of Directory Server instances (DS 48144)
  - Resolves: bug 1333184 - (389-ds-base-1.3.5) Fixing coverity issues. (DS 48919)
  - Resolves: bug 1350799 - CVE-2016-4992 389-ds-base: Information disclosure via repeat
  - Resolves: bug 1354660 - flow control in replication also blocks receiving results (DS 48767)
  - Resolves: bug 1356261 - Fixup tombstone task needs to set proper flag when updating (DS 48924)
  - Resolves: bug 1355760 - ns-slapd crashes during the deletion of backend (DS 48922)
  - Resolves: bug 1353629 - DS shuts down automatically if dnaThreshold is set to 0 in a MMR setup (DS 48916)
  - Resolves: bug 1355879 - nunc-stans: ns-slapd crashes during startup with SIGILL on AMD Opteron 280 (DS 48925)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-5
changelog:
  - Release 1.3.5.10-5
  - Resolves: bug 1333184 - (389-ds-base-1.3.5) Fixing coverity issues. (DS 48919)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-6
changelog:
  - Release 1.3.5.10-6
  - Resolves: bug 1326077 - Page result search should return empty cookie if there is no returned entry (DS 48928)
  - Resolves: bug 1360447 - nsslapd-workingdir is empty when ns-slapd is started by systemd (DS 48939)
  - Resolves: bug 1360327 - remove-ds.pl deletes an instance even if wrong prefix was specified (DS 48934)
  - Resolves: bug 1349815 - DS logs have warning:ancestorid not indexed for all CS subsystems (DS 48940)
  - Resolves: bug 1329061 - 389-ds-base-1.3.4.0-29.el7_2 "hang" (DS 48882)
  - Resolves: bug 1360976 - EMBARGOED CVE-2016-5405 389-ds-base: Password verification vulnerable to timing attack
  - Resolves: bug 1361134 - When fine-grained policy is applied, a sub-tree has a priority over a user while changing password (DS 48943) 
  - Resolves: bug 1361321 - Duplicate collation entries (DS 48936)
  - Resolves: bug 1316580 - dirsrv service doesn't ask for pin when pin.txt is missing (DS 48450)
  - Resolves: bug 1350799 - CVE-2016-4992 389-ds-base: Information disclosure via repeat


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-7
changelog:
  - Release 1.3.5.10-7
  - Resolves: bug 1316580 - dirsrv service doesn't ask for pin when pin.txt is missing (DS 48450)
  - Resolves: bug 1360976 - fixing a compiler warning


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-8
changelog:
  - Release 1.3.5.10-8
  - Resolves: bug 1321124 - Replication changelog can incorrectly skip over updates (DS 48954)
  - Resolves: bug 1364190 - Change example in /etc/sysconfig/dirsrv to use tcmalloc (DS 48950)
  - Resolves: bug 1366561 - ns-accountstatus.pl giving error even "No such object (32)" (DS 48956)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-9
changelog:
  - Release 1.3.5.10-9
  - Resolves: bug 1364190 - Change example in /etc/sysconfig/dirsrv to use tcmalloc (DS 48950)
  - Resolves: bug 1366828 - audit on failure doesn't work if attribute nsslapd-auditlog-logging-enabled is NOT enabled (DS 48958)
  - Resolves: bug 1368520 - Crash in import_wait_for_space_in_fifo() (DS 48960)
  - Resolves: bug 1368956 - man page of ns-accountstatus.pl shows redundant entries for -p port option
  - Resolves: bug 1369537 - passwordMinAge attribute doesn't limit the minimum age of the password (DS 48967)
  - Resolves: bug 1369570 - cleanallruv changelog cleaning incorrectly impacts all backends (DS 48964)
  - Resolves: bug 1369425 - ACI behaves erratically (DS 48972)
  - Resolves: bug 1370300 - set proper update status to replication agreement in case of failure (DS 48957)
  - Resolves: bug 1209094 - Allow logging of rejected changes (DS 48969)
  - Resolves: bug 1371283 - Server Side Sorting crashes the server. (DS 48970)
  - Resolves: bug 1371284 - Disabling CLEAR password storage scheme will crash server when setting a password (DS 48975)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-10
changelog:
  - Release 1.3.5.10-10
  - Resolves: bug 1370300 - set proper update status to replication agreement in case of failure (DS 48957)
  - Resolves: bug 1209094 - Allow logging of rejected changes (DS 48969)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-11
changelog:
  - Release 1.3.5.10-11
  - Resolves: bug 1321124 - Replication changelog can incorrectly skip over updates


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-12
changelog:
  - Release 1.3.5.10-12
  - Resolves: bug 1384785 - Replica install fails with old IPA master sometimes during replication process (DS 48992)
  - Resolves: bug 1388501 - 389-ds-base is missing runtime dependency - bind-utils (DS 48328)
  - Resolves: bug 1388581 - Replication stops working only when fips mode is set to true (DS 48909)
  - Resolves: bug 1390342 - ns-accountstatus.pl shows wrong status for accounts inactivated by Account policy plugin (DS 49014)
  - Resolves: bug 1390343 - trace args debug logging must be more restrictive (DS 49009)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-13
changelog:
  - Release 1.3.5.10-13
  - Resolves: bug 1402030 - Non tombstone entry which dn starting with "nsuniqueid=...," cannot be deleted (DS 48133)
  - Resolves: bug 1402325 - do not treat missing csn as fatal (DS 49020)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-15
changelog:
  - Release 1.3.5.10-15
  - Resolves: bug 1402325 - do not treat missing csn as fatal (DS 48964)
  - Resolves: bug 1410080 - incompatible nsEncryptionConfig object definition prevents RHEL 7->6 schema replication (DS 49074)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-16
changelog:
  - Release 1.3.5.10-16
  - Resolves: bug 1414677 - (un)register/migration/remove may fail if there is no suffix (DS 49016)
  - Resolves: bug 1414678 - deadlock on cos cache rebuild (DS 49079)
  - Resolves: bug 1414679 - Release 1.3.5 may allow expired accounts access to systems (DS 49080, DS 49082)
  - Resolves: bug 1416368 - Aborted operation can leave RUV in incorrect state (DS 49008)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-17
changelog:
  - Release 1.3.5.10-17
  - Resolves: bug 1414677 - (un)register/migration/remove may fail if there is no suffix (DS 49016)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.5.10-19
changelog:
  - Release 1.3.5.10-19
  - Resolves: bug 1429495 - ns-slapd dies under heavy load 
  - Resolves: bug 1429498 - A filtered nsrole that specifies an empty nsrole in its nsRoleFilter will result in a segfault


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.5.10-20
changelog:
  - Bump version to 1.3.5.10-20
  - Resolves: bug 1437005 - CVE-2017-2668 389-ds-base: Remote crash via crafted LDAP messages


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.5.10-21
changelog:
  - Bump verison to 1.3.5.10-21
  - Resolves: Bug 1440654 - Possible deadlock while installing an ipa replica
  - Resolves: Bug 1445178 - Silent install localhost issue
  - Resolves: Bug 1445177 - retrocl crash at shutdown
  - Resolves: Bug 1445176 - case sensitivity in acl


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-7
changelog:
  - Bump version to 1.3.6.1-7
  - Resolves: bug 1394899 - RHDS should ignore passwordMinAge if "password must reset" is set(fix crash regression)
  - Resolves: bug 1381326 - dirsrv-snmp.service is provided by 389-ds-base instead of 389-ds-base-snmp
  - Resolves: bug 1049190 - Better input argument validation and error messages for db2index and db2index.pl.


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-8
changelog:
  - Bump version to 1.3.6.1-8
  - Resolves: Bug 1432016 - Possible deadlock while installing an ipa replica
  - Resolves: Bug 1438029 - Overflow in memberof


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-9
changelog:
  - Bump version to 1.3.6.1-9
  - Resolves: Bug 1442880 - setup-ds-admin.pl -u with nsslapd-localhost changed
  - Resolves: Bug 1443682 - util_info_sys_pages should be able to detect memory restrictions in a cgroup


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-10
changelog:
  - Bump version to 1.3.6.1-10
  - Resolves: Bug 1444938 - nsslapd-allowed-sasl-mechanisms doesn't reset to default val 
  - Resolves: Bug 1111400 - logconv.pl lists sasl binds with no dn as anonymous 
  - Resolves: Bug 1377452 - Integer overflow in performance counters
  - Resolves: Bug 1441790 - ldapserch for nsslapd-errorlog-level returns incorrect values
  - Resolves: Bug 1444431 - ERR - symload_report_error - Netscape Portable Runtime error -5975
  - Resolves: Bug 1447015 - Adjust db2bak.pl help and man page to reflect changes introduced to the script


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-11
changelog:
  - Bump version to 1.3.6.1-11
  - Resolves: Bug 1410207 - Utility command had better use INFO log level for the output
  - Resolves: Bug 1049190 - Better input argument validation and error messages for db2index and db2index.pl


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-13
changelog:
  - Bump version to 1.3.6.1-13
  - Resolves: Bug 1444938 - Fix backport issue from build 1.3.6.1-10 (part 2)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-14
changelog:
  - Bump version to 1.3.6.1-14
  - Resolves: Bug 1450910 - Modifying "nsslapd-cache-autosize" parameter using ldapmodify command is failing.
  - Resolves: Bug 1450893 - When nsslapd-cache-autosize is not set in dse.ldif, ldapsearch does not show the default value
  - Resolves: Bug 1449098 - ns-slapd crashes in role cache creation
  - Resolves: Bug 1441522 - AddressSanitizer: heap-use-after-free in libreplication-plugin.so
  - Resolves: Bug 1437492 - "ERR - cos-plugin - cos_cache_query_attr - cos attribute krbPwdPolicyReference failed schema check" in error log
  - Resolves: Bug 1429770 - ds-logpipe.py crashes for non-existing users
  - Resolves: Bug 1451657 - -v option is not working for db2ldif.pl


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-15
changelog:
  - Bump version to 1.3.6.1-15
  - Resolves: Bug 1429770 - ds-logpipe.py crashes for non-existing users
  - Resolves: Bug 1444938 - nsslapd-allowed-sasl-mechanisms doesn't reset to default values without a restart
  - Resolves: Bug 1450896 - Manual resetting of nsslapd-dbcachesize using ldapmodify 
  - Resolves: Bug 1357682 - RHDS fails to start with message: "Failed to delete old semaphore for stats file"
  - Resolves: Bug 1452739 - Zero value of nsslapd-cache-autosize-split makes dbcache to be equal 0


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-16
changelog:
  - Bump version to 1.3.6.1-16
  - Resolves: Bug 1444938 - nsslapd-allowed-sasl-mechanisms doesn't reset to default values without a restart
  - Resolves: Bug 1447015 - Adjust db2bak.pl help and man page to reflect changes introduced to the script
  - Resolves: Bug 1450896 - Manual resetting of nsslapd-dbcachesize using ldapmodify
  - Resolves: Bug 1454921 - Fixup memberof task throws error "memberof_fix_memberof_callback: Weird
  - Resolves: Bug 1456774 - ipa-replica server fails to upgrade


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-17
changelog:
  - Bump version to 1.3.6.1-17
  - Resolves: Bug 1476161 - replication halt - pending list first CSN not committed, pending list increasing
  - Resolves: Bug 1476162 - Change the retrochangelog default cache size


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-18
changelog:
  - Bump version to 1.3.6.1-18
  - Require srvcore 4.1.3
  - Resolves: Bug 1479757 - dse.ldif and fsync
  - Resolves: Bug 1479755 - backup fails if changelog is enabled
  - Resolves: Bug 1479756 - Locked account provides different return code if password is correct


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.19-1
changelog:
  - Bump version to 1.3.6.19-1
  - Remove old mozldap and db4 requirements
  - Resolves: Bug 1483865 - Crash while binding to a server during replication online init


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-19
changelog:
  - Bump version to 1.3.6.1-19
  - Remove old mozldap and db4 requirements
  - Resolves: Bug 1483865 - Crash while binding to a server during replication online init


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-20
changelog:
  - Bump verions to 1.3.6.1-20
  - Resolves: Bug 1489693 - PasswordCheckSyntax attribute fails to validate cn, sn, uid
  - Resovles: Bug 1492829 - patch should of been applied to 7.4 but got missed
  - Resolves: Bug 1486128 - Performance issues with RHDS 10 - NDN cache investigation
  - Resolves: Bug 1489694 - crash in send_ldap_result
  - Resolves: Bug 1491778 - crash when adding invalid repl agmt
  - Resolves: Bug 1492830 - password expired control not sent
  - Resolves: Bug 1492833 - sasl-mechanisms removed during upgrade


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-21
changelog:
  - Bump verions to 1.3.6.1-21
  - Resolves: Bug 1498958 - unable to retrieve specific cosAttribute when subtree password policy is configured


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-23
changelog:
  - Bump version to 1.3.6.1-23
  - Resolves: Bug 1504536 - [memberOf Plugin] bulk deleting users causes deadlock when there are multiple backends
  - Resolves: Bug 1503001 - Adding a database entry fails if the same database was deleted after an import
  - Resolves: Bug 1506912 - Improve valueset sort performance during valueset purging


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-24
changelog:
  - Bump version to 1.3.6.1-24
  - Resolves: Bug 1508978 - replicated MODRDN fails breaking replication
  - Resolves: Bug 1511940 - heap corruption during import
  - Resolves: Bug 1510319 - [abrt] 389-ds-base: SLL_Next(): ns-slapd killed by SIGSEGV 
  - Resolves: Bug 1509347 - cleanallruv task is not logging any information


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-25
changelog:
  - Bump version to 1.3.6.1-25
  - Resolves: Bug 1526928 - search with CoS attribute is getting slower after modifying/adding CosTemplate
  - Resolves: Bug 1523505 - opened connection are hanging, no longer poll
  - Resolves: Bug 1523507 - IPA server replication broken, after DS stop-start, due to changelog reset


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-27
changelog:
  - Bump version to 1.3.6.1-27
  - Resolves: Bug 1536343 - Indexing of internationalized matching rules is failing
  - Resolves: Bug 1535539 - CVE-2017-15135 - Authentication bypass due to lack of size check in slapi_ct_memcmp function
  - Resolves: Bug 1540105 - CVE-2018-1054 - remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-28
changelog:
  - Bump version to 1.3.6.1-28
  - Resolves: Bug 1540105 - CVE-2018-1054 - remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8


author: Paul Howarth <paul@city-fan.org> - 1.5.0-5
changelog:
  - Make GeoIP.dat -> GeoIP-initial.dat symlink in %install, not %post,
    and don't %ghost it
  - Run geoipupdate silently in %post and cron job
  - Create empty database files for %ghost to work with old rpm versions
  - Don't try to use noarch subpackages on old rpm versions
  - Update %description to mention database updates
  - Drop outdated README.Fedora


author: Jan Safranek <jsafrane@redhat.com> - 1.5.0-7
changelog:
  - Don't download the database in %post (#1029807)
  - Don't download GeoLiteASNum as it's no longer provided.


author: Jan Safranek <jsafrane@redhat.com> - 1.5.0-10
changelog:
  - Added base IPv6 database to GeoIP package
  - Added GeoIP-data subpackage with all other databases (#1201857)


author: Philip Prindeville <philipp@fedoraproject.org> - 1.5.0-1
changelog:
  - Version bump to 1.5.0
  - Have GeoIP.dat be a symlink to the real data, and install the canned
    GeoIP.dat as GeoIP-initial.dat
  - Change config as per Boris' instructions to use 'lite' databases which are
    regularly updated.
  - Add pkgconfig (.pc) file into devel subpackage
  - Add cron support for refreshing the lite databases and make a separate
    subpackage.


author: Benjamin Tissoires <benjamin.tissoires@redhat.com> 6.7.8.9-7
changelog:
  - add aarch64 as a target by using 32 set by platform, instead of hardcoding the list of 64-bit arches (rhbz#1028584)


author: Benjamin Tissoires <benjamin.tissoires@redhat.com> 6.7.8.9-7
changelog:
  - add aarch64 as a target by using 64 set by platform, instead of hardcoding the list of 64-bit arches (rhbz#1028584)


author: Jan Horak <jhorak@redhat.com> - 6.7.8.9-15
changelog:
  - Added fix for CVE-2016-5118, CVE-2016-5240, rhbz#1269562,
    rhbz#1326834, rhbz#1334188, rhbz#1269553


author: Dan Williams <dcbw@redhat.com> - 0.7.991-1.git20130607
changelog:
  - Update to 0.7.991 snapshot
  - Fix SMS validity parsing
  - Allow registration changes to 'searching' without disconnecting
  - Fix reading SMS messages from some QMI-based devices
  - Increase connection timeout for Novatel E362
  - Fix PIN retries checking when unlocking Ericsson devices
  - Better handling of supported and preferred modes (eg 2G, 3G, 4G preference)


author: Dan Williams <dcbw@redhat.com> - 0.7.991-2.git20130710
changelog:
  - Handle PNP connected devices
  - Fall back to AT for messaging if QMI modem doesn't support the WMS service
  - Fix IPv6 bearer creation for HSO devices
  - Fix detection of supported modes on Icera-based modems
  - Fix handling of some Icera-based modems with limited capability ports
  - Add support for Olivetti Olicard 200


author: Dan Williams <dcbw@redhat.com> - 1:0.9.9.1-4.git20140313
changelog:
  - core: fix startup auto-activation of slow carrier detect interfaces (rh #1076592)
  - core: align default bridge priority with kernel defaults (rh #1073664)


author: Dan Winship <danw@redhat.com> - 1:0.9.9.1-7.git20140313
changelog:
  - ifcfg-rh: give a better error on "permission denied" (rh #1070617)
  - tui: allow cancelling with "Esc" from "nmtui connect" (rh #1080059)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.9.1-8.git20140326
changelog:
  - core: fix management of some static configurations from initramfs (rh #1077743)
  - ifcfg-rh: add support for alias files (rh #1067170)
  - core: additional fixes for Data Center Bridging (DCB) (rh #799241)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.9.1-11.git20140326
changelog:
  - core: additional fixes for Data Center Bridging (DCB) (rh #799241) (rh #1081991)
  - core: ensure /etc/resolv.conf has the right SELinux label (rh #1070829)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.9.1-12.git20140326
changelog:
  - core: fix master interface DHCP handling if ignore-carrier is set (rh #1083624)
  - core: fix startup state not finishing correctly (rh #1084554)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.9.1-13.git20140326
changelog:
  - core: ignore IPv6 cache routes to fix initial connection generation (rh #1083153)
  - core: ensure slow DHCP emits 'dhcp4-change' and 'dhcp6-change' dispatcher events (rh #1091296)


author: Dan Winship <danw@redhat.com> - 1:0.9.9.1-14.git20140326
changelog:
  - core: fix connection matching with IPv6 routes (rh #1086237)
  - core: wait with startup-complete for dynamic IPv4 and IPv6 addresses (rh #1096063, rh #1086906)


author: Jiří Klimeš <jklimes@redhat.com> - 1:0.9.9.1-17.git20140326
changelog:
  - core: fix connection matching generally and for s390 as well (rh #1083196)
  - dhcp: fix DHCPv6 address lifetime handling (rh #1086237)


author: Dan Williams <dcbw@redhat.com> - 1:1.0.0-5.git20150107.1ea95cd3
changelog:
  - build: remove -bluetooth and -wwan Requires to prevent unwanted updates (rh #1066690)
  - build: remove erroneous libnm/libnm-devel dependencies


author: Thomas Haller <thaller@redhat.com> - 1:1.0.0-7.git20150107.1ea95cd3
changelog:
  - platform: fix handling of routes with special metric (rh #1172780)
  - ifcfg-rh: add reading and writing of route-metric property


author: Dan Williams <dcbw@redhat.com> - 1:1.0.0-9.git20150121.b4ea599c
changelog:
  - build: fix NetworkManager-libnm and old NetworkManager-glib conflict (rh #1066690)
  - core: accept numeric bond options (rh #1171009) (rh #1133544)
  - core/libnm: better validate setting properties (rh #1182567)
  - core: add dispatcher script to support policy based routing (rh #1160013)


author: Dan Williams <dcbw@redhat.com> - 1:1.0.0-13.git20150121.b4ea599c
changelog:
  - core: remove IPv6LL address when deactivating managed devices (rh #1184997)
  - core: recognize external IP config earlier on startup
  - core: fix bridge default metric


author: Thomas Haller <thaller@redhat.com> - 1:1.0.6-22
changelog:
  - platform: fix detection of s390 CTC device (rh #1272974)
  - core: fix queuing activation while waiting for carrier (rh #1079353)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.0.6-25
changelog:
  - vpn: cancel the secrets request on agent timeout (rh #1272023)
  - vpn: cancel the connect timer when vpn reconnects (rh #1272023)


author: Thomas Haller <thaller@redhat.com> - 1:1.4.0-3
changelog:
  - wifi: fix activation failure due to error changing MAC address (rh#1371623)
  - core: fix wrong source interface for PropertiesChanged D-Bus signal (rh#1371920)
  - team: restore validation of JSON configuration (rh#1371967)
  - device: manage firewall zone for assumed persistent connections (rh#1366288)
  - device: don't let external changes cause a release of the slave (rh#1357738)


author: Thomas Haller <thaller@redhat.com> - 1:1.4.0-5
changelog:
  - libnm,nmtui: fix handling empty cloned-mac-address property (rh#1372799)
  - ibft: grant required CAP_SYS_ADMIN capabilities (rh#1371201)


author: Thomas Haller <thaller@redhat.com> - 1:1.4.0-7
changelog:
  - wifi: another fix activation failure due to error changing MAC address (rh#1371623, rh#1374023)
  - dhcp: fix race condition that may cause lost lease events and DHCP timeouts (rh#1373276)


author: Thomas Haller <thaller@redhat.com> - 1:1.4.0-8
changelog:
  - libnm: fix crash in nm_vpn_plugin_info_list_get_service_types() (rh#1374526)
  - device: wait for MAC address change before setting up interface (rh#1371623, rh#1374023)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.4.0-9
changelog:
  - clients: handle secret requests only for current connection (rh#1351272)
  - device: fix crash reapplying connection to slave devices (rh#1376784)
  - cli: fix autocompletion after ifname (rh#1375933)


author: Francesco Giudici <fgiudici@redhat.com> - 1:1.4.0-16
changelog:
  - libnm-core: remove INFERRABLE flag from dhcp-hostname property (rh#1421082)
  - core: honor order of IP addresses from configuration (rh#1394500)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-2
changelog:
  - core: fix persisting managed state of device (rh #1440171)
  - proxy: fix use-after-free (rh #1450459)
  - device: don't wrongly delay startup complete waiting for carrier (rh #1450444)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-3
changelog:
  - dhcp: don't add route to DHCP4 server (rh #1448987)
  - libnm: fix NUL termination of device's description (rh #1443114)
  - libnm, core: ensure valid UTF-8 in device properties (rh #1443114)
  - core: fix device's UDI property on D-Bus (rh #1443114)
  - ifcfg-rh: omit empty next hop for routes in legacy format (rh #1452648)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.8.0-4
changelog:
  - device: update external configuration before commit (rh #1449873)
  - bluetooth: fix crash on connecting to a NAP (rh #1454385)
  - device: release removed devices from master on cleanup (rh #1448907)
  - core: activate slaves using ifindex order by default (rh #1452585)
  - nmcli: fix crash when setting 802-1x.password-raw (rh #1456362)
  - po: update translations (rh #1382625)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-5
changelog:
  - ifcfg-rh: fix writing legacy NETMASK value (rh #1445414)
  - tui: fix crash during connect (rh #1456826)
  - libnm: fix libnm rejecting VLAN ID 4095 (rh #1456911)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-6
changelog:
  - connectivity: fix periodic connectivity check (rh #1458399)
  - bond: improve option matching on daemon restart (rh #1457909)
  - device: fix touching device after external activation (rh #1457242)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-7
changelog:
  - bond: fix crash comparing mode while generating bond connection (rh #1459580)
  - connectivity: fix route penalty if WWAN and BT device using ip-ifindex (rh #1459932)
  - device: persist nm-owned in run state (rh #1376199)
  - device: fix assuming master device on restart (rh #1452062)
  - device: apply route metric penality only when the default route exists (rh #1459604)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.8.0-8
changelog:
  - cli: fix output of iface in overview output (rh#1460219)
  - ppp: unexport NMPPPManager instance on dispose (rh#1459579)
  - cli: remove spurious device names from wifi subcommands output (rh#1460527)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-9
changelog:
  - device: don't change MTU unless explicitly configured (rh #1460760)
  - core: don't remove external IPv4 addresses (rh #1459813)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-11
changelog:
  - core: fix wrongly delaying startup-complete for unrealized devices (rh#1498807)
  - core: fix unfreezing signals when unrealizing device fails (rh#1498755)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.8.0-0.4.rc3
changelog:
  - Update to third Release Candidate of NetworkManager 1.8
  - device: fix regressions in assuming devices on carryover from initrd (rh #1443878)
  - device: add support for SRIOV num_vfs (rh #1398934)
  - device: leave device up when setting it as unmanaged by user (rh #1371433)
  - core: properly track manager, route manager and default route manager references (rh #1440089)
  - route: properly deal with routes with non-empty host parts (rh #1439376)
  - vpn: fix a crash on disconnect (rh #1442064)
  - cli: fix hang on connection down (rh #1422786)
  - cli: fix interactive edit of bond slaves (rh #1440957)
  - vpn: fix early error handling on failed activations (rh #1440077)
  - core: only persist explicit managed state in device's state file (rh #1440171)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-1
changelog:
  - Update to upstream release 1.8.0
  - device: support dummy devices (rh#1398932)
  - core: support attaching user-data to connection profiles (rh#1421429)
  - core: fix allowing FQDN in dhcp-hostname setting (rh#1443437)
  - core: fix configuring firewall while device is activating (rh#1445242)
  - core: don't block activation without carrier for IPv6 DAD (rh#1446367)
  - tui: force writing master key to ifcfg file when editing connection (rh#1425409)


author: Avesh Agarwal <avagarwa@redhat.com> - 0.9.8.0-2
changelog:
  - Fixed rhbz#921061
  - Fixed rhbz#999353
  - Fixed rhbz#1035786
  - Fixed rhbz#1014830
  - Fixes 1035786 (and its duplicate 1040924)
  - Fixed 926225
  - Fixed dependency to libreswan.
  - Created a new sub package NetworkManager-openswan-gnome
  - Various other spec file fixes.
  - Additional code changes are as follows:
  - Fixed an issue where proper network stack is not loaded unless
    _stackmanager is run before starting pluto daemon service.
  - Fixed the termination operation of pluto daemon to comply with
    libreswan changes.
  - Fixed various debug messages.
  - Fixed initiation of pluto daemon by this plugin to reflect the
    changes in libreaswan.
  - Fixed defaults values for more parameters to help the VPN
    connection stay more reliable.
  - Rewrote pluto watch API which watches the pluto process for its status.
    Fixed memory leak issues as not all child processes were reaped correctly.
    Also g_spwan_close_pid was not being called after children were reaped.
    Also modified debugs and added more to help with debugging in the future.
  - Fixed an issue where nm-openswan service is searching for ipsec binary in
    both /sbin and /usr/sbin leading to same operation twice, as /sbin is just
    symlink to /usr/sbin, so removed /sbin from the search paths.
  - Fixed some libreswan related macro changes.
  - Fixed netmask issue when sending IP information to the nm openswan
    plugin service.
  - Fixed the current code as it does not set the default route field
    NM_VPN_PLUGIN_IP4_CONFIG_NEVER_DEFAULT when sending VPN information
    to nm-openswan plugin. This fix sets the field to TRUE.
  - Fixed some issues found by coverity scan.
  - Fixed an issue where writing configuration on stdin should not end with
    \n as it gives error. It used to work previously, but not with latest
    NetworkManager versions.
  - libreswan related fixes, as some macros have been modified after forking
    to libreswan from openswan.
  - openswan/libreswan does not provide tun0 interface, so fixed the code
    where it sends tun0 interface.
  - Fix prcoessing of nm-openswan-dialog.ui file and added more error notifications.
  - Fixed dead code based on coverity scan.
  - Fixed gnomekeyring lib dependencies.
  - Fixed Networkmanager and related lib dependencies.
  - Fixed gtk label max width issue by setting it to 35.
  - NM-openswan was missing support for nm-openswan-auth-dialog.desktop.in.in.
    So added a new nm-openswan-auth-dialog.desktop.in.in, and modified related
    Makefile and configure.ac files.


author: Lubomir Rintel <lrintel@redhat.com> - 1.2.0-0.1.beta3
changelog:
  - Update to 1.2-beta3:
  - Added support for main exchange type (rh #1292912)
  - A device libreswan is unable listen on no longer aborts connection (rh #1285367)
  - Added import/export support (rh #1129878)
  - Replace NetworkManager-openswan (rh #1264552)


author: Thomas Haller <thaller@redhat.com> - 1.2.4-1
changelog:
  - Update to 1.2.4 release
  - Move base VPN plugin library to base libreswan package
  - Don't require nm-connection-editor anymore


author: Laszlo Ersek <lersek@redhat.com> - ovmf-20160419-2.git90bb4c5.el7
changelog:
  - Submit scratch builds from the exploded tree again to
    supp-rhel-7.3-candidate, despite FatPkg being OSS at this point; see
    bz#1329559.


author: Laszlo Ersek <lersek@redhat.com> - ovmf-20160608-1.git988715a.el7
changelog:
  - Resolves: bz#1341733
    (prevent SMM stack overflow in OVMF while enrolling certificates in "db")
  - Resolves: bz#1257882
    (FEAT: support to boot from virtio 1.0 modern devices)
  - Resolves: bz#1333238
    (Q35 machine can not boot up successfully with more than 3 virtio-scsi
    storage controller under switch)
  - Resolves: bz#1330955
    (VM can not be booted up from hard disk successfully when with a passthrough
    USB stick)


author: Miroslav Rezanina <mrezanin@redhat.com> - OVMF-20160608-2.git988715a.el7
changelog:
  - ovmf-ArmPkg-ArmGicV3Dxe-configure-all-interrupts-as-non-s.patch [bz#1349407]
  - ovmf-ArmVirtPkg-PlatformBootManagerLib-Postpone-the-shell.patch [bz#1353689]
  - Resolves: bz#1349407
    (AArch64: backport fix to run over gicv3 emulation)
  - Resolves: bz#1353689
    (AAVMF: Drops to shell with uninitialized NVRAM file)


author: Miroslav Rezanina <mrezanin@redhat.com> - OVMF-20160608-3.git988715a.el7
changelog:
  - ovmf-MdePkg-PCI-Add-missing-PCI-PCIE-definitions.patch [bz#1332408]
  - ovmf-ArmPlatformPkg-NorFlashDxe-accept-both-non-secure-an.patch [bz#1353494]
  - ovmf-ArmVirtPkg-ArmVirtQemu-switch-secure-boot-build-to-N.patch [bz#1353494]
  - ovmf-ArmPlatformPkg-NorFlashAuthenticatedDxe-remove-this-.patch [bz#1353494]
  - ovmf-ArmVirtPkg-add-FDF-definition-for-empty-varstore.patch [bz#1353494]
  - ovmf-redhat-package-the-varstore-template-produced-by-the.patch [bz#1353494]
  - ovmf-ArmVirtPkg-Re-add-the-Driver-Health-Manager.patch [bz#1353494]
  - ovmf-ArmVirtPkg-HighMemDxe-allow-patchable-PCD-for-PcdSys.patch [bz#1353494]
  - ovmf-ArmVirtPkg-ArmVirtQemuKernel-make-ACPI-support-AARCH.patch [bz#1353494]
  - ovmf-ArmVirtPkg-align-ArmVirtQemuKernel-with-ArmVirtQemu.patch [bz#1353494]
  - ovmf-ArmVirtPkg-ArmVirtQemu-factor-out-shared-FV.FvMain-d.patch [bz#1353494]
  - ovmf-ArmVirtPkg-factor-out-Rules-FDF-section.patch [bz#1353494]
  - ovmf-ArmVirtPkg-add-name-GUIDs-to-FvMain-instances.patch [bz#1353494]
  - ovmf-OvmfPkg-add-a-Name-GUID-to-each-Firmware-Volume.patch [bz#1353494]
  - ovmf-OvmfPkg-PlatformBootManagerLib-remove-stale-FvFile-b.patch [bz#1353494]
  - ovmf-MdePkg-IndustryStandard-introduce-EFI_PCI_CAPABILITY.patch [bz#1332408]
  - ovmf-MdeModulePkg-PciBusDxe-look-for-the-right-capability.patch [bz#1332408]
  - ovmf-MdeModulePkg-PciBusDxe-recognize-hotplug-capable-PCI.patch [bz#1332408]
  - ovmf-OvmfPkg-add-PciHotPlugInitDxe.patch [bz#1332408]
  - ovmf-ArmPkg-ArmGicLib-manage-GICv3-SPI-state-at-the-distr.patch [bz#1356655]
  - ovmf-ArmVirtPkg-PlatformBootManagerLib-remove-stale-FvFil.patch [bz#1353494]
  - ovmf-OvmfPkg-EnrollDefaultKeys-assign-Status-before-readi.patch [bz#1356913]
  - ovmf-OvmfPkg-EnrollDefaultKeys-silence-VS2015x86-warning-.patch [bz#1356913]
  - ovmf-CryptoPkg-update-openssl-to-ignore-RVCT-3079.patch [bz#1356184]
  - ovmf-CryptoPkg-Fix-typos-in-comments.patch [bz#1356184]
  - ovmf-CryptoPkg-BaseCryptLib-Avoid-passing-NULL-ptr-to-fun.patch [bz#1356184]
  - ovmf-CryptoPkg-BaseCryptLib-Init-the-content-of-struct-Ce.patch [bz#1356184]
  - ovmf-CryptoPkg-OpensslLib-Upgrade-OpenSSL-version-to-1.0..patch [bz#1356184]
  - Resolves: bz#1332408
    (Q35 machine can not hot-plug scsi controller under switch)
  - Resolves: bz#1353494
    ([OVMF] "EFI Internal Shell" should be removed from "Boot Manager")
  - Resolves: bz#1356184
    (refresh embedded OpenSSL to 1.0.2h)
  - Resolves: bz#1356655
    (AAVMF: stop accessing unmapped gicv3 registers)
  - Resolves: bz#1356913
    (fix use-without-initialization in EnrollDefaultKeys.efi)


author: Laszlo Ersek <lersek@redhat.com> - ovmf-20160608b-1.git988715a.el7
changelog:
  - rework downstream-only commit dde83a75b566 "setup the tree for the secure
    boot feature (RHEL only)", excluding patent-encumbered files from the
    upstream OpenSSL 1.0.2g tarball [bz#1374710]
  - rework downstream-only commit dfc3ca1ee509 "CryptoPkg/OpensslLib: Upgrade
    OpenSSL version to 1.0.2h", excluding patent-encumbered files from the
    upstream OpenSSL 1.0.2h tarball [bz#1374710]


author: Laszlo Ersek <lersek@redhat.com> - ovmf-20170228-1.gitc325e41585e3.el7
changelog:
  - Rebase to upstream c325e41585e3 [bz#1416919]
  - Resolves: bz#1373812
    (guest boot from network even set 'boot order=1' for virtio disk with OVMF)
  - Resolves: bz#1380282
    (Update OVMF to openssl-1.0.2k-hobbled)
  - Resolves: bz#1412313
    (select broadcast SMI if available)
  - Resolves: bz#1416919
    (Rebase OVMF for RHEL-7.4)
  - Resolves: bz#1426330
    (disable libssl in CryptoPkg)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20170228-2.gitc325e41585e3.el7
changelog:
  - ovmf-MdeModulePkg-Core-Dxe-downgrade-CodeSegmentCount-is-.patch [bz#1433428]
  - Resolves: bz#1433428
    (AAVMF: Fix error message during ARM guest VM installation)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20170228-3.gitc325e41585e3.el7
changelog:
  - ovmf-ArmVirtPkg-FdtClientDxe-supplement-missing-EFIAPI-ca.patch [bz#1430262]
  - ovmf-ArmVirtPkg-ArmVirtPL031FdtClientLib-unconditionally-.patch [bz#1430262]
  - ovmf-MdeModulePkg-RamDiskDxe-fix-C-string-literal-catenat.patch [bz#1430262]
  - ovmf-EmbeddedPkg-introduce-EDKII-Platform-Has-ACPI-GUID.patch [bz#1430262]
  - ovmf-EmbeddedPkg-introduce-PlatformHasAcpiLib.patch [bz#1430262]
  - ovmf-EmbeddedPkg-introduce-EDKII-Platform-Has-Device-Tree.patch [bz#1430262]
  - ovmf-ArmVirtPkg-add-PlatformHasAcpiDtDxe.patch [bz#1430262]
  - ovmf-ArmVirtPkg-enable-AcpiTableDxe-and-EFI_ACPI_TABLE_PR.patch [bz#1430262]
  - ovmf-ArmVirtPkg-FdtClientDxe-install-DT-as-sysconfig-tabl.patch [bz#1430262]
  - ovmf-ArmVirtPkg-PlatformHasAcpiDtDxe-don-t-expose-DT-if-Q.patch [bz#1430262]
  - ovmf-ArmVirtPkg-remove-PURE_ACPI_BOOT_ENABLE-and-PcdPureA.patch [bz#1430262]
  - Resolves: bz#1430262
    (AAVMF: forward QEMU's DT to the guest OS only if ACPI payload is unavailable)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20170228-4.gitc325e41585e3.el7
changelog:
  - ovmf-ShellPkg-Shell-clean-up-bogus-member-types-in-SPLIT_.patch [bz#1442908]
  - ovmf-ShellPkg-Shell-eliminate-double-free-in-RunSplitComm.patch [bz#1442908]
  - Resolves: bz#1442908
    (Guest hang when running a wrong command in Uefishell)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20170228-5.gitc325e41585e3.el7
changelog:
  - ovmf-OvmfPkg-EnrollDefaultKeys-update-SignatureOwner-GUID.patch [bz#1443351]
  - ovmf-OvmfPkg-EnrollDefaultKeys-expose-CertType-parameter-.patch [bz#1443351]
  - ovmf-OvmfPkg-EnrollDefaultKeys-blacklist-empty-file-in-db.patch [bz#1443351]
  - ovmf-OvmfPkg-introduce-the-FD_SIZE_IN_KB-macro-build-flag.patch [bz#1443351]
  - ovmf-OvmfPkg-OvmfPkg.fdf.inc-extract-VARS_LIVE_SIZE-and-V.patch [bz#1443351]
  - ovmf-OvmfPkg-introduce-4MB-flash-image-mainly-for-Windows.patch [bz#1443351]
  - ovmf-OvmfPkg-raise-max-variable-size-auth-non-auth-to-33K.patch [bz#1443351]
  - ovmf-OvmfPkg-PlatformPei-handle-non-power-of-two-spare-si.patch [bz#1443351]
  - ovmf-redhat-update-local-build-instructions-with-D-FD_SIZ.patch [bz#1443351]
  - ovmf-redhat-update-OVMF-build-commands-with-D-FD_SIZE_4MB.patch [bz#1443351]
  - Resolves: bz#1443351
    ([svvp][ovmf] job "Secure Boot Logo Test" failed  with q35&ovmf)


author: Nicolas Chauvet <kwizart@gmail.com> - 1.7.1-1
changelog:
  - Update to 1.7.1

  -* Wed Jul 18 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.7.0-5
  -- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild


author: Jan Safranek <jsafrane@redhat.com> - 2.0.19-2
changelog:
  - Updated RPM scriptlets with latest systemd-rpm macros (#850246)
  - Fixed fedora-review tool complaints


author: Ledvinka Ales <aledvink@redhat.com> - 2.0.19-5
changelog:
  - Support aarch64 by replicating release toolchain.
  - Configuration subpackage with kernel probed wildcard module aliases.
    as workaround for bz#961878 and fesco#1110
  - Man pages symlinks same as bin symlinks.
  - ipmi_ui command help argument.
  - ipmilan missing options.
  - Fixed build requirements.


author: Ledvinka Ales <aledvink@redhat.com> - 2.0.19-7
changelog:
  - Hint compilation to avoid strict aliasing and prevent type-punned pointer issues.
  - Fix rPath regression for OpenIPMI-perl library.


author: Boris Ranto <branto@redhat.com> - 2.0.19-12
changelog:
  - New release
  - Move OpenIPMI modprobe conf to /usr/lib/modprobe.d/ (#1195289)
  - Avoid warning on update/removal (#1256798)
  - Stop manually creating and shipping /var/run/OpenIPMI (#1296560)


author: Richard Hughes <rhughes@redhat.com> - 0.8.9-3
changelog:
  - Backport 2 fixes from master to increase the maximum number of packages that
    can be processed, and also to fix a race in the offline updates feature.


author: Richard Hughes <rhughes@redhat.com> - 0.8.9-5
changelog:
  - Backport another fix from master to fix the passwordless install for users
    in wheel group only bug.
  - Resolves: #975214


author: Jingdong Lu <jingdong.lu@oracle.com> - 0.8.9-11.0.1
changelog:
  - change VendorName to Oracle Linux in /etc/PackageKit/Vendor.conf
    replaced PackageKit-0.3.8-Fedora-Vendor.conf.patch with PackageKit-0.3.8-Oracle-Vendor.conf.patch


author: Tom Lane <tgl@redhat.com> 4.0-1
changelog:
  - Update to PyGreSQL 4.0
  - Relabel license as PostgreSQL now that that's separately recognized by OSI.


author: Petr Pisar <ppisar@redhat.com> - 1.2.15-14
changelog:
  - Do not harness backing store by default. Export SDL_VIDEO_X11_BACKINGSTORE
    environment variable to enable it.
  - Resolves: rhbz#1245417


author: Jakub Filak <jfilak@redhat.com> 2.1.11-5
changelog:
  - abrt-cli requires libreport-rhel (the reporting workflows)
  - applet: don't notify missing ignored_problems file
  - abrt-cli: show a hint about creating a case in RHTS
  - abrt-cli: show a info text suggesting enabling the autoreporting
  - Related: #1044424
  - Resolves: #1054291, #1055565, #1056980


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-7
changelog:
  - Fix-handling-of-Machine-Check-Exceptions
  - abrt-harvest-vmcore recovers from Permission denied errors
  - never stop 'notify' event
  - install abrt-python files to arch specific dir
  - Resolves: #1032077, #1032511, #1057710
  - Related: #881123


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-9
changelog:
  - Stop consuming 100%CPU in abrt-upload-watch
  - Turn off Autoreporting
  - Enabled GPG check
  - Resolves: #1051480, #1063317


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-11
changelog:
  - Capture all necessary logs in sosreport.tar.gz
  - do not send ureport from abrt-applet
  - do not run gdb under root
  - Resolves: #1067114, #1069278, #1069719


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-13
changelog:
  - Translation updates
  - localization fixes
  - applet: confirm ignoring of notifications
  - cli: batch reporting in abrt-cli
  - cli: add option remove crash dirs after reporting
  - cli: robustize abrt-console-notification.sh
  - cli: make consistent commands in abrt-cli
  - applet: chown each notified problem before reporting it
  - dbus: fixed abrt-dbus memory leaks
  - plugins: add abrt-action-generate-machine-id
  - spec: add abrt-action-generate-machine-id
  - spec: remove dependency on crash from abrt-addon-vmcore
  - spec: hook abrt-oops.conf.5
  - spec: don't use native unwinder on arm arch
  - spec: remove stray space from %description
  - spec: add missing requires for python api
  - spec: add dependency on abrt-python
  - python: support exceptions without traceback
  - spec: hook Kernel oops configuration files
  - koops: add an option controlling MCE detection
  - gdb: disable loading of auto-loaded files
  - vmcore: start the service after kdump service
  - Resolves: #1066482, #1084031, #1067545, #1084027, #1087880, #1087777
  - Resolves: #1015473, #1139001, #1076820, #1139552, #1128637, #1066501
  - Resolves: #1086642


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-14
changelog:
  - ureport: attach contact email
  - mce: separate mce analysis from Kernel oops analysis
  - console-notifications: use return instead of exit
  - Resolves: #1150389, #1150169
  - Related: #1076820


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-15
changelog:
  - console-notifications: skip non-interactive shells
  - applet: show component instead of duphash in the notification
  - Related: #1084031, #1150169


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-19
changelog:
  - abrt-auto-reporting: add ureport authentication command line arguments
  - add python-augeas to the requirements
  - mark all strings for translations
  - translation updates
  - Related: #1087880, #1174833


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-20
changelog:
  - remove the old dump directories during upgrade
  - abrt-action-install-debuginfo-to-abrt-cache: sanitize arguments and umask
  - fix race conditions and directory traversal issues in abrt-dbus
  - use /var/spool/abrt instead of /var/tmp/abrt
  - make the problem directories owned by root and the group abrt
  - validate uploaded problem directories in abrt-handle-upload
  - don't override files with user core dump files
  - fix symbolic link and race condition flaws
  - Resolves: #1211969, #1212819, #1212863, #1212869
  - Resolves: #1214453, #1214610, #1216973, #1218583


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-22
changelog:
  - do not open the build_ids file as the user abrt
  - do not unlink failed and big user core files
  - Related: #1212819, #1216973


author: Richard Marko <rmarko@redhat.com> - 2.1.11-27
changelog:
  - abrt-merge-pstoreoops: merge files in descending order
  - abrt-auto-reporting: fix related to conditional compilation
  - Update translations
  - Related: #1233662, #1191572, #1181248


author: Richard Marko <rmarko@redhat.com> - 2.1.11-28
changelog:
  - doc: fix related to conditional compilation of man page
  - spec: add dbus dependency for abrt-cli and abrt-python
  - Related: #1191572, #1245527


author: Richard Marko <rmarko@redhat.com> - 2.1.11-29
changelog:
  - ccpp: use global TID
  - ccpp: fix comment related to 'MakeCompatCore' option in CCpp.conf
  - cli: fix testing of DBus API return codes
  - dbus-api: unify reporting of errors
  - Related: #1210601, #1252419, #1224984


author: Richard Marko <rmarko@redhat.com> - 2.1.11-31
changelog:
  - Only analyze vulnerabilities when coredump present
  - Only generate core_backtrace if it's not already present.
  - Related: #1210601


author: Richard Marko <rmarko@redhat.com> - 2.1.11-33
changelog:
  - abrt-auto-reporting documentation
  - ccpp: Use global PID
  - ccpp: correct comments mentioning TID
  - Related: #1252590, #1261036, #1223805


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-35
changelog:
  - make /var/spool/abrt owned by root
  - remove 'r' from /var/spool/abrt for other users
  - abrt-action-install-debug-info: use secure temporary directory
  - stop saving abrt's core files to /var/spool/abrt if DebugLevel < 1
  - Fixes for: CVE-2015-5273 and CVE-2015-5287
  - Resolves: #1266853


author: Matej Habrnal <mhabrnal@redhat.com> - 2.1.11-39
changelog:
  - python: fix check for absolute path
  - console-notifications: add timeout
  - vmcore: generate 'reason' file in all cases
  - Fix memory leaks in abrt-dbus
  - Resolves: #1250337, #1166633, #1249101, #1319704


author: Matej Habrnal <mhabrnal@redhat.com> - 2.1.11-46
changelog:
  - remove not implemented option AttemptHardlink in vmcore.conf
  - introduce unsafe reporting for not-reporable problems
  - rewrite skip_pfx() function to work with journal msgs
  - don't expect kernel's version '2.6.*' or '3.*.*'
  - Related: #1416586, #1257159, #1328264, #1378469


author: Jakub Filak <jfilak@redhat.com> - 1.0.6-6
changelog:
  - Make sure that agent_onload and agent_onunload are processed only once
  - Add test results for Linux-aarch64
  - Resolves: #1044756, #1063322


author: Jakub Filak <jfilak@redhat.com> - 1.0.6-1
changelog:
  - Fix a deadlock in GC start callback
  - Disable experimental features in production releases
  - Resolves: #1012827


author: Jakub Filak <jfilak@redhat.com> - 1.0.6-3
changelog:
  - Mark stack trace with remote paths as not-reportable
  - Do not provide own reporting workflows
  - Code optimization
  - Do not report exception caught by native functions
  - Use the last frame class path for executable
  - Gracefully handle JVMTI errors
  - Add an abstract to README
  - Add support for journald and syslog
  - Make log output disabled by default
  - Add support for changing log directory
  - Fix a race condition causing a crash of JVM
  - Related: #1051198
  - Resolves: #1051483, #1054720, #1054737, #1055581


author: Ray Strode <rstrode@redhat.com> - 0.6.35-11
changelog:
  - address minor bug in previous patch
    Related: #1220904

  - fix memory leak in log handler
    Resolves: #1292543


author: Ray Strode <rstrode@redhat.com> - 0.6.42-2
changelog:
  - Update to 0.6.44
    Related: #1424623
  - export password expiration policy from shadow
    Resolves: #1334464


author: Ray Strode <rstrode@redhat.com> - 0.6.45-1
changelog:
  - Update to 0.6.45 so password expiration policy is wrapped by libaccountsservice
    Related: #1424623 #1334464


author: Ray Strode <rstrode@redhat.com> - 0.6.45-2
changelog:
  - Don't tread explicitly requested users as cached
    Fixes UncacheUser operation.
    Resolves: 1446620
    Related: #1432602


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.0.18-1
changelog:
  - New version
  - Replaced RPM_BUILD_ROOT variables by {buildroot} macros
  - Updated URLs to project home page and source code
  - Dropped mk patch, handled better way in the spec


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.0.19-5
changelog:
  - Used unitdir macro instead of the hardcoded systemd paths
    Related: rhbz#1057268
  - Fixed bogus date in changelog (best effort)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.0.19-7
changelog:
  - Switched to dynamic connections (increased max connections from 20 to 1024)
    Resolves: rhbz#1351999
  - Simplified conversion script and moved it to posttrans to get rid of warnings
    during upgrade from RHEL-6 to RHEL-7
    Resolves: rhbz#1086686


author: Stef Walter <stefw@redhat.com> - 0.7.4-1
changelog:
  - Update to upstream point release 0.7.4
  - Correctly handle truncating long host names [#1001667]
  - Try to contact all available addresses for discovery [#1004442]
  - Build fixes [#1004823]


author: Stef Walter <stefw@redhat.com> - 0.7.5-1
changelog:
  - Update to upstream point release 0.7.5
  - Workaround for discovery via IPv6 address [#1004442]
  - Correctly put IPv6 addresses in temporary krb5.conf


author: Sumit Bose <sbose@redhat.com> - 0.8.1-1
changelog:
  - Update to upstream release 0.8.1
  - Rebase adcli in RHEL-7.3 to version 0.8.0 [#1292530]
  - Support Host Keytab renewal [#1288485]
  - realmd not joining AD so ssh gssapi-with-mic works [#1061371]
  - technically wrong length checks in binary parsers  [#1027905]
  - avoid alloca in _adcli_ldap_have_in_mod [#1027889]
  - [RFE] adcli --stdin-password should be able to strip newline character from
    the input [#1134330]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-3
changelog:
  - fix crash when name is specified on the command line and detect names with
    lower case characters [#1359773]


author: Kevin Kofler <Kevin@tigcc.ticalc.org> - 2.5-9
changelog:
  - also remove include/agg_conv_gpc.h as it also carries a copy of the non-Free
    GPC license (upstream also recommends removing that file under
    http://www.antigrain.com/license/index.html#toc0005) (#559611)


author: Daniel Kopecek <dkopecek@redhat.com> - 0.15.1-4
changelog:
  - added patch to fix aide in FIPS mode
  - use only FIPS approved digest algorithms in aide.conf so that
    aide works by default in FIPS mode


author: Daniel Kopecek <dkopecek@redhat.com> - 0.15.1-6
changelog:
  - warn if processing prelinked binary objects and the prelink binary
    is not available
    Resolves: rbhz#1004826


author: Daniel Kopecek <dkopecek@redhat.com> - 0.15.1-10
changelog:
  - Updated the default configuration file. New defaults contributed
    by Steve Grubb.
    Resolves: rhbz#1304334


author: Jacob Wang <jacob.wang@oracle.com> - 1.9.2-4.0.1
changelog:
  - add runtime dependecy on mysql-compat-server and remove runtime 
    dependency on mariadb-server for akonadi-mysql [20142098]


author: Jaroslav Kysela <jkysela@redhat.com> - 1.0.25-1
changelog:
  - Updated to 1.0.25
  - Moved plugin specific configuration from /etc/alsa/pcm to /usr/share/alsa/alsa.conf.d


author: Tim Jackson <rpm@timj.co.uk> - 1.0.25-4
changelog:
  - Move udev rules to /lib/udev/rules.d (rhbz #748206)
  - remove %BuildRoot and %clean sections; no longer required


author: Rahul Sundaram <sundaram@fedoraproject.org> - 1.0.26.1-3
changelog:
  - remove vendor tag from desktop file. https://fedorahosted.org/fpc/ticket/247
  - clean up spec to follow current guidelines
  - don't build -tools for RHEL. Bill Nottingham patch. Resolves rhbz#586030


author: Jaroslav Kysela <jkysela@redhat.com> - 1.1.0-1
changelog:
  - Updated to 1.1.0
  - Enable hda-verb, hdajackretast, hdajacksensetest for i686/x86_64
  - Resolves: rhbz#1172560


author: Jaroslav Kysela <jkysela@redhat.com> - 1.0.27.1-1
changelog:
  - Updated to 1.0.27.1
  - Updated alsa-info.sh to 0.4.61
  - Remove dependency on the dialog package (it is optional for alsa-info.sh)


author: Josef Ridky <jridky@redhat.com> - 3.3.3-18
changelog:
  - Resolves: #1286330 - set non-blocking connection
  - Resolves: #1299761 - fix amindex: invalid service
  - Resolves: #1306980 - fix problem with handling compressed files


author: Brian C. Lane <bcl@redhat.com> - 19.31.116-1
changelog:
  - Fix the way we create the list of DASDs needing dasdfmt. (sbueno+anaconda)
    Related: rhbz#1073982
  - Fix threading issues for dasdfmt in gui storage. (sbueno+anaconda)
    Resolves: rhbz#1073982
  - Make sure /boot is not LVM LV if we're on s390x (sbueno+anaconda)
    Resolves: rhbz#873135


author: Brian C. Lane <bcl@redhat.com> - 19.31.118-1
changelog:
  - Fix handling of md fwraid names in kickstart bootloader command. (dlehman)
    Resolves: rhbz#1167375
  - Do not bypass name setters in the custom spoke. (dlehman)
    Related: rhbz#1138370
  - Don't try to use math.ceil on blivet.size.Size instances. (dlehman)
    Resolves: rhbz#1164191
  - Preserve kickstart url behavior for mirrorlist (bcl)
    Related: rhbz#1109933
  - Use a backslash to escape nfs spaces instead of x20 (bcl)
    Related: rhbz#1109933
  - Allow adding prepboot to a blank disk in custom (bcl)
    Resolves: rhbz#1176829


author: Brian C. Lane <bcl@redhat.com> - 19.31.119-1
changelog:
  - Update error handler classes (bcl)
    Resolves: rhbz#1181146
  - Pass a Size instance to blivet instead of number of bytes (vpodzime)
    Related: rhbz#1171116
  - If using pre-existing, no size needs to be specified in ksdata (amulhern)
    Resolves: rhbz#1169783


author: Brian C. Lane <bcl@redhat.com> - 19.31.121-1
changelog:
  - network: adapt to NetworkManager package split-up (rvykydal)
    Resolves: rhbz#1182633
  - network: pass team opts to dracut for netroot (rvykydal)
    Resolves: rhbz#1075666


author: Brian C. Lane <bcl@redhat.com> - 19.31.122-1
changelog:
  - Show empty VGs in the custom spoke. (dlehman)
    Resolves: rhbz#1185832
  - network: add teamd package if team is used during installation (rvykydal)
    Resolves: rhbz#1185670


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 19.31.123-1.0.1
changelog:
  - Make sure sort function is applied [bug 20121584]
  - Keep hugepage related boot parameters together and in the proper order
    [bug 20121584]
  - Remove reference to RH in pyanaconda/ui/gui/spokes/welcome.glade.h
  - Fix exception in software selection spoke [bug 20281627]
  - Handle "Beta" string in boot menuentry [bug 20275215]
  - Make MySQL and MariaDB groups mutually exclusive [bug 20069488]
  - Catch exception for active NetworkManager timed out [bug 18920725]
  - pick up changes in rhel.py to ol.py by adding
    Set-first-boot-policy-regarding-ONBOOT-value.patch
  - Adjust GTK css file to fix background images [bug 18777671]
  - Put "with" in menuentry instead of "using" [bug 18504756]
  - Fix bug with UEK not being default on full install [bug 18706799]
  - Have XFS be first option for / for Oracle Linux.
  - Catch exception accessing NetworkManager when using boot ISO [bug 18413161]
  - replace redhat EULA reference with oracle EULA refernce [bug 18404893]
  - Make sure call to grub2-set-default is consistent with boot entry [bug 18259020]
  - Use pigz to create updates.img <vpodzime@redhat.com>
  - Set UEK as default boot option if installed [bug 18177078]
  - Add install class for Oracle Linux
  - Remove user visisble RH references
  - Disable functionality to send install log files to RH bugzilla/Ticket systems
  - Include UEK in the kernels to install list, and have it be the default


author: Brian C. Lane <bcl@redhat.com> - 19.31.74-1
changelog:
  - network: don't crash on virtual devices turned off (rvykydal)
    Resolves: rhbz#1080640
  - Do not try to set keyboard preview dialog's size (vpodzime)
    Resolves: rhbz#1011140


author: Brian C. Lane <bcl@redhat.com> - 19.31.75-1
changelog:
  - Display WWIDs in the filter UI for FCoE devices (clumens).
    Resolves: rhbz#1080316
  - Make it possible to override translation domain in GUIObjects (mkolman).
    Related: rhbz#1040240


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 19.31.79-1.0.1
changelog:
  - Put "with" in menuentry instead of "using" [bug 18504756]
  - Fix bug with UEK not being default on full install [bug 18706799]
  - Have XFS be first option for / for Oracle Linux.
  - Catch exception accessing NetworkManager when using boot ISO [bug 18413161]
  - replace redhat EULA reference with oracle EULA refernce [bug 18404893]
  - Make sure call to grub2-set-default is consistent with boot entry [bug 18259020]
  - Use pigz to create updates.img <vpodzime@redhat.com>
  - Set UEK as default boot option if installed [bug 18177078]
  - Add install class for Oracle Linux
  - Remove user visisble RH references
  - Disable functionality to send install log files to RH bugzilla/Ticket systems
  - Include UEK in the kernels to install list, and have it be the default


author: Tianyue Lan <tianyue.lan@oracle.com> - 19.31.79-1.0.3
changelog:
  - pick up changes in rhel.py to ol.py by adding
    Set-first-boot-policy-regarding-ONBOOT-value.patch


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.114-1
changelog:
  - Show the text of completions in the datetime spoke. (vponcova)
    Related: rhbz#1447984
  - Look higher for the combobox associated with an entry (dshea)
    Resolves: rhbz#1447984
  - Fix the addon handlers for the checkbox (vponcova)
    Resolves: rhbz#1448187


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.115-1
changelog:
  - Show a no network warning for network installation source. (vponcova)
    Related: rhbz#1418604
  - Show warnings about enabling the network time (vponcova)
    Resolves: rhbz#1418604
  - Fix generating UUID even for pre snapshots (jkonecny)
    Related: rhbz#1113207


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.116-1
changelog:
  - Allow nonstrict behaviour for all passwords in tui (vponcova)
    Resolves: rhbz#1450326
  - Fix setting errors and warnings in the StorageCheckHandler (vponcova)
    Resolves: rhbz#1453130
  - Mark post inst tools as disabled only if firstboot --disable is used
    (mkolman)
    Resolves: rhbz#1448940
  - Set the default filesystem type from a kickstart file (vponcova)
    Resolves: rhbz#1449099


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.117-1
changelog:
  - Root checking fixes password for password from kickstart (mkolman)
    Related: rhbz#1356966
  - Improve the GUI password checker (mkolman)
    Related: rhbz#1356966
  - Respect changesok policy on root password spoke (mkolman)
    Resolves: rhbz#1356966
  - Update translations of password checking strings (rvykydal)
    Resolves: rhbz#1383911


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.118-1
changelog:
  - rpmostreepayload: [rhel7only] Move tmpfiles to after mount setup (walters)
    Resolves: rhbz#1459623
  - rpmostreepayload: Handle /var as a user-specified mountpoint (walters)
    Resolves: rhbz#1459623


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.121-1
changelog:
  - rpmostreepayload: Stub out payload methods which use `import rpm` (walters)
    Related: rhbz#1462979


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 21.48.22.121-1.0.1
changelog:
  - Use shim from 7.3 for signing.
  - "autopart --nohome" can't disable creation of /home partition [bug 26279212]
  - Update the Oracle Linux install class to match latest RHEL install class.
  - Prevent crash when returning to install source page [bug 22262678]
  - Add patch to use kernel title to setup default kernel instead of index [bug 21957916]
  - Make sure that UEK kernel is default and /etc/sysconfig/kernel is written.
  - update Oracle Linux install class to match RHEL version [bug 21951255] (Kevin Lyons)
  - Fix crash when referencing proxy before it is initiated. [bug 21943737] (Kevin Lyons)
  - Remove help files [bug 20546064,20667883]
  - Make sure sort function is applied [bug 20121584]
  - Keep hugepage related boot parameters together and in the proper order
    [bug 20121584]
  - Remove reference to RH in pyanaconda/ui/gui/spokes/welcome.glade.h
  - Fix exception in software selection spoke [bug 20281627]
  - Handle "Beta" string in boot menuentry [bug 20275215]
  - pick up changes in rhel.py to ol.py by adding
    Set-first-boot-policy-regarding-ONBOOT-value.patch
  - Adjust GTK css file to fix background images [bug 18777671]
  - Put "with" in menuentry instead of "using" [bug 18504756]
  - Fix bug with UEK not being default on full install [bug 18706799]
  - Have XFS be first option for / for Oracle Linux.
  - replace redhat EULA reference with oracle EULA refernce [bug 18404893]
  - Make sure call to grub2-set-default is consistent with boot entry [bug 18259020]
  - Set UEK as default boot option if installed [bug 18177078]
  - Add install class for Oracle Linux
  - Remove user visisble RH references
  - Disable functionality to send install log files to RH bugzilla/Ticket systems
  - Include UEK in the kernels to install list, and have it be the default


author: Brian C. Lane <bcl@redhat.com> - 21.48.22.49-1
changelog:
  - Use correct installclass for RHEL Atomic Host (rvykydal)
    Resolves: rhbz#1265213
  - Catch blkid failure in driver-updates (bcl)
    Resolves: rhbz#1262963
  - Maximize anaconda instead of running fullscreen (dshea)
    Related: rhbz#1231856
  - Do not display markup in showDetailedError. (dshea)
    Resolves: rhbz#1263963


author: Brian C. Lane <bcl@redhat.com> - 21.48.22.50-1
changelog:
  - Fix a pylint problem with the ostree patch. (clumens)
    Related: rhbz#1253527
  - Update storage config after running dasdfmt. (sbueno+anaconda)
    Resolves: rhbz#1264411
  - rpmostreepayload: Forcibly unmount everything in sysroot (walters)
    Resolves: rhbz#1253527


author: Brian C. Lane <bcl@redhat.com> - 21.48.22.54-1
changelog:
  - ibft: fix setting dracut boot args for static ibft nic configuration
    (rvykydal)
    Resolves: rhbz#1267526
  - dracut: accept inst.dd=[file:]/dd.iso (wwoods)
    Resolves: rhbz#1268792
  - Fix issues with the date&time not being updated on timezone changes
    (vpodzime)
    Resolves: rhbz#1267450


author: Brian C. Lane <bcl@redhat.com> - 21.48.22.55-1
changelog:
  - network: create ifcfg files in tui if needed (rvykydal)
    Resolves: rhbz#1268155
  - Do not limit ONBOOT default setting to url and nfs installation methods
    (rvykydal)
    Resolves: rhbz#1269264


author: Jingdong Lu <jingdong.lu@oracle.com> - 21.48.22.56-1.0.1
changelog:
  - Make Mysql repo enabled as default [bug 21352744]
  - Add patch to use kernel title to setup default kernel instead of index [bug 21957916]
  - Make sure that UEK kernel is default and /etc/sysconfig/kernel is written.
  - Fix MySQL/MariaDB patch so that it applies.
  - update Oracle Linux install class to match RHEL version [bug 21951255] (Kevin Lyons)
  - Fix crash when referencing proxy before it is initiated. [bug 21943737] (Kevin Lyons)
  - Remove help files [bug 20546064,20667883]
  - Make sure sort function is applied [bug 20121584]
  - Keep hugepage related boot parameters together and in the proper order
    [bug 20121584]
  - Remove reference to RH in pyanaconda/ui/gui/spokes/welcome.glade.h
  - Fix exception in software selection spoke [bug 20281627]
  - Handle "Beta" string in boot menuentry [bug 20275215]
  - Make MySQL and MariaDB groups mutually exclusive [bug 20069488]
  - Catch exception for active NetworkManager timed out [bug 18920725]
  - pick up changes in rhel.py to ol.py by adding
    Set-first-boot-policy-regarding-ONBOOT-value.patch
  - Adjust GTK css file to fix background images [bug 18777671]
  - Put "with" in menuentry instead of "using" [bug 18504756]
  - Fix bug with UEK not being default on full install [bug 18706799]
  - Have XFS be first option for / for Oracle Linux.
  - Catch exception accessing NetworkManager when using boot ISO [bug 18413161]
  - replace redhat EULA reference with oracle EULA refernce [bug 18404893]
  - Make sure call to grub2-set-default is consistent with boot entry [bug 18259020]
  - Set UEK as default boot option if installed [bug 18177078]
  - Add install class for Oracle Linux
  - Remove user visisble RH references
  - Disable functionality to send install log files to RH bugzilla/Ticket systems
  - Include UEK in the kernels to install list, and have it be the default


author: Samantha N. Bueno <sbueno+anaconda@redhat.com> - 21.48.22.86-1
changelog:
  - network: don't stumble upon new Device.Statistics NM dbus iface (rvykydal)
    Resolves: rhbz#1370099


author: Samantha N. Bueno <sbueno+anaconda@redhat.com> - 21.48.22.87-1
changelog:
  - Drop T from cp command flags when copying driver disk RPMs (mkolman)
    Resolves: rhbz#1269915
  - network: set onboot correctly for vlan on bond device in ks (rvykydal)
    Related: rhbz#1234849
  - network: don't show ibft configured devices in UI (rvykydal)
    Resolves: rhbz#1309661
  - Translate press-c-to-continue correctly in TUI (mkolman)
    Resolves: rhbz#1364539
  - network: don't set empty team slave config for NM (rvykydal)
    Related: rhbz#1254929


author: Samantha N. Bueno <sbueno+anaconda@redhat.com> - 21.48.22.88-1
changelog:
  - Revert "Show network spoke in the TUI reconfig mode (mkolman)"
    Resolves: rhbz#1302165
  - Improved driver disk copying (mkolman)
    Related: rhbz#1269915
  - network: adapt to ibft plugin being enabled by default in NM (rvykydal)
    Resolves: rhbz#1371188


author: Samantha N. Bueno <sbueno+anaconda@redhat.com> - 21.48.22.89-1
changelog:
  - Default policy should not allow empty passwords (mkolman)
    Related: rhbz#1365112
    Related: rhbz#1365032
  - Add unit tests for password quality checking (mkolman)
    Related: rhbz#1365112
    Related: rhbz#1365032
  - Fix password quality checking (mkolman)
    Resolves: rhbz#1365112
    Resolves: rhbz#1365032
  - dud: fix multiple inst.dd=http:// instances stalling in dracut (rvykydal)
    Related: rhbz#1268792


author: Samantha N. Bueno <sbueno+anaconda@redhat.com> - 21.48.22.91-1
changelog:
  - Fix password length in the password policy (mkolman)
    Related: rhbz#1365112
    Related: rhbz#1365032
  - network: avoid registering GTypes from multiple threads (lkundrak)
    Resolves: rhbz#1366271
  - Fix traceback when payload have None as url (jkonecny)
    Resolves: rhbz#1371494
  - Add new Dracut test and fix another ones (jkonecny)
    Related: rhbz#1101653
  - Fix bug when we add set to list (jkonecny)
    Related: rhbz#1101653
  - Add new helper script files to build system (jkonecny)
    Related: rhbz#1101653
  - Add new helper scripts to the README-dd documentation (jkonecny)
    Related: rhbz#1101653
  - Fix driver unload is disabling network settings (jkonecny)
    Related: rhbz#1101653


author: Samantha N. Bueno <sbueno+anaconda@redhat.com> - 21.48.22.93-1
changelog:
  - Accept any non-empty password in non-strict mode (mkolman)
    Resolves: rhbz#1379323
  - Disable the potfile check on the password quality tests (mkolman)
    Related: rhbz#1365112
    Related: rhbz#1365032
  - Fix two trivial typos in the password checking code (mkolman)
    Related: rhbz#1365112
    Related: rhbz#1365032
  - Tweak lambda use in Dracut test (jkonecny)
    Related: rhbz#1101653
  - Add Dracut test for reloading mod dependencies (jkonecny)
    Related: rhbz#1101653


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 21.48.22.93-1.0.1
changelog:
  - Update the Oracle Linux install class to match latest RHEL install class.
  - Prevent crash when returning to install source page [bug 22262678]
  - Make Mysql repo enabled as default [bug 21352744]
  - Add patch to use kernel title to setup default kernel instead of index [bug 21957916]
  - Make sure that UEK kernel is default and /etc/sysconfig/kernel is written.
  - Fix MySQL/MariaDB patch so that it applies.
  - update Oracle Linux install class to match RHEL version [bug 21951255] (Kevin Lyons)
  - Fix crash when referencing proxy before it is initiated. [bug 21943737] (Kevin Lyons)
  - Remove help files [bug 20546064,20667883]
  - Make sure sort function is applied [bug 20121584]
  - Keep hugepage related boot parameters together and in the proper order
    [bug 20121584]
  - Remove reference to RH in pyanaconda/ui/gui/spokes/welcome.glade.h
  - Fix exception in software selection spoke [bug 20281627]
  - Handle "Beta" string in boot menuentry [bug 20275215]
  - Make MySQL and MariaDB groups mutually exclusive [bug 20069488]
  - Catch exception for active NetworkManager timed out [bug 18920725]
  - pick up changes in rhel.py to ol.py by adding
    Set-first-boot-policy-regarding-ONBOOT-value.patch
  - Adjust GTK css file to fix background images [bug 18777671]
  - Put "with" in menuentry instead of "using" [bug 18504756]
  - Fix bug with UEK not being default on full install [bug 18706799]
  - Have XFS be first option for / for Oracle Linux.
  - Catch exception accessing NetworkManager when using boot ISO [bug 18413161]
  - replace redhat EULA reference with oracle EULA refernce [bug 18404893]
  - Make sure call to grub2-set-default is consistent with boot entry [bug 18259020]
  - Set UEK as default boot option if installed [bug 18177078]
  - Add install class for Oracle Linux
  - Remove user visisble RH references
  - Disable functionality to send install log files to RH bugzilla/Ticket systems
  - Include UEK in the kernels to install list, and have it be the default


author: Miloš Jakubíček <xjakub@fi.muni.cz> - 0:2.7.7-23
changelog:
  - Add patch updating license on ShowString.java and StreamConverter.java
    examples (thanks to Tom Callaway, see BZ#848662)


author: Java SIG <java-devel@lists.fedoraproject.org> - 1.7-4
changelog:
  - Update for https://fedoraproject.org/wiki/Fedora_19_Maven_Rebuild
  - Replace maven BuildRequires with maven-local


author: Jaromir Capik <jcapik@redhat.com> 3.2.1-13
changelog:
  - saxon dependency removed - not needed
  - minor spec file changes according to the latest guidelines


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 1.1.2-1
changelog:
  - Update to upstream version 1.1.2
  - Convert POM to POM macros
  - Remove OSGi manifest patch; fixed upstream


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 2.0.16-12
changelog:
  - Build with XMvn
  - Remove system-scoped dependency on tools.jar
  - Update to current packaging guidelines


author: Jesper Dangaard Brouer <brouer@redhat.com> - 0.0.4-5
changelog:
  - fix issues reported by static analysis tools
    Resolves: rhbz#1027762
  - add man-pages for arptables-{save,restore}
    Resolves: rhbz#1025726


author: Jesper Dangaard Brouer <brouer@redhat.com> - 0.0.4-8
changelog:
  - Add missing long option --set-counters and update documentation
    Corrosponding short option -c was implemented, but undocumented.
    Resolves: rhbz#1050854


author: Ales Ledvinka <aledvink@redhat.com> - 14:2.1a15-26
changelog:
  - fix permissions related to collected database
  - update ethcodes defaults to current public IEEE OUI-32


author: Marcela Mašláňová <mmaslano@redhat.com> - 3.1.13-8
changelog:
  - at-3.1.13-mailwithhostname.patch in email mention also hostname address
  - at-3.1.13-usePOSIXtimers.patch use POSIX timers, so we won't need
    pm-utils hack anymore
  - at-3.1.13-help.patch update usage
  - systemd-user-sessions.service is used in unit file, so the atd should be
    started after almost all services are up and running
  - 812682 pam support work with new systemd defaults


author: Marcela Mašláňová <mmaslano@redhat.com> - 3.1.13-10
changelog:
  - fix license field
  - fix systemd macros in scriptlets part of the specfile
  - fix selinux patch to apply without fuzz=2


author: Marcela Mašláňová <mmaslano@redhat.com> - 3.1.13-16
changelog:
  - the correct solution is remove smp_flags, they don't work properly on ppc with
    the option mpower7
  - Related: rhbz#1048745


author: Tomáš Mráz <tmraz@redhat.com> - 3.1.13-21
changelog:
  - correct the DST correction when using UTC time specification (#1328832)
  - clear non-job files from at dir and test for write error on fclose
    to fix bogus syslog messages


author: Tomáš Mráz <tmraz@redhat.com> - 3.1.13-22.2
changelog:
  - fix handling of the aborted jobs (due to possibly
    temporary conditions) and avoid flooding the syslog


author: Kalev Lember <kalev@smartlink.ee> - 2.22.2-4
changelog:
  - Spec cleanup
  - Actually co-own /usr/share/devhelp/ directory
  - Require base package from -doc subpackage


author: Frantisek Kluknavsky <fkluknav@redhat.com> - 3.10.1-7
changelog:
  - change x86_64 archdef to P4, prefetch instruction from hammer is illegal on some pentium 4
  - add -fstack-protector-strong to flags
  - Resolves: rhbz#1070783


author: Frantisek Kluknavsky <fkluknav@redhat.com> - 3.10.1-9
changelog:
  - ppcle patches (conflicting patches modified)
  - tests on ppcle disabled to shorten build time and fit into 24 hour limit
  - resolves bug 1125475
  - aarch64 patches
  - Resolves: rhbz#1061956


author: Jaromir Capik <jcapik@redhat.com> - 3.10.1-10
changelog:
  - patching for Power8 to pass performance tunings and tests on P8 builders
  - re-enabling tests on ppc64le
  - Resolves: rhbz#1125475


author: Jakub Martisko <jamartis@redhat.com> - 3.10.1-11
changelog:
  - apply patches 99 and 110 to all ppc variants
  - build lapack with -frecursive flag (#1176026)
  - fix possible memory leak (#1350536)
  - fix wrong sed substitutions (#1402627)
  - Resolves: rhbz#1350536
  - Related: rhbz#1176026


author: Jakub Martisko <jamartis@redhat.com> - 3.10.1-12
changelog:
  - cleanup: merge the application of ppc patches from previous commit
    into single block
  - Related: rhbz#1350536


author: Frantisek Kluknavsky <fkluknav@redhat.com> - 3.10.1-1
changelog:
  - Rebase to 3.10.1
  - Dropped x86_64-SSE2, ix86-SSE1, ix86-3DNow, z10, z196 (uncompilable).
  - Modified incompatible patches.
  - Added armv7neon support, modified archdef from softfp abi to hard abi.
  - Modified Make.lib to include build-id, soname, versioned library name and symlinks.
  - Now builds monolithic libsatlas (serial) and libtatlas (threaded)
    libraries with lapack and blas included.
  - Lapack source tarball needed instead of static library.
  - Disabled cpu throttling detection again (sorry, could not work on atlas
    otherwise, feel free to enable yet again - atlas-throttling.patch).
  - Removed mentions of "Fedora" to promote redistribution.
  - Modified parts of atlas.spec sometimes left in place, work still in progress,
    cleanup needed.


author: Steve Grubb <sgrubb@redhat.com> 2.3.2-1
changelog:
  - New upstream bugfix/enhancement release
  resolves: #982112 Add delay between stopping and starting auditd


author: Steve Grubb <sgrubb@redhat.com> 2.3.3-2
changelog:
  - New upstream bugfix/enhancement release
  resolves: #1053804 - ausearch issues found by ausearch-test
  resolves: #1030409 - ausearch help typo for "-x" option


author: Steve Grubb <sgrubb@redhat.com> 2.4-1
changelog:
  resolves: #1115196 - Add golang bindings for libaudit
  resolves: #1105150 - audispd config file parser fails on long input
  resolves: #1104973 - auparse truncating selinux context after first category
  resolves: #1088593 - auditctl man page examples use deprecated syscalls
  resolves: #1087849 - support for setting loginuid immutable
  resolves: #1073063 - AUDIT_SECCOMP events syscall field is not interpretted
  resolves: #975796  - confusing aulast records for bad logins


author: Steve Grubb <sgrubb@redhat.com> 2.4.1-1
changelog:
  resolves: #963353 - aarch64 userspace auditing needs to be written
  resolves: #1150202 - perf trace sleep 1 does not list any syscall information
  resolves: #1142989 - Update audit package to 2.4.1
  resolves: #1155221 - adjust fstatat naming to match kernel uapi


author: Steve Grubb <sgrubb@redhat.com> 2.4.1-4
changelog:
  - Remove golang bindings added under the following bz
  resolves: #1115196 - Add golang bindings for libaudit


author: Steve Grubb <sgrubb@redhat.com> 2.6.5-3.1
changelog:
  resolves: #1415724 - write_logs option is not correctly handled
  resolves: #1415726 - Setting log_format to NOLOG make auditd core dump


author: Steve Grubb <sgrubb@redhat.com> 2.6.5-4
changelog:
  resolves: #1382397 - write_logs option is not correctly handled
  resolves: #1414812 - Setting log_format to NOLOG make auditd core dump


author: Steve Grubb <sgrubb@redhat.com> 2.7.4-1
changelog:
  resolves: #1367703 - auvirt wasn't supporting date keywords
  resolves: #1396792 - augenrules includes files ending in regexp "rules"
  resolves: #1406525 - ausearch with '--raw' parameter outputs garbage character


author: Steve Grubb <sgrubb@redhat.com> 2.7.5-1
changelog:
  resolves: #1437187 - audit rpm postinstall script points to non-existing file
  resolves: #1437426 - Remove "--backlog_wait_time" from auditctl man page & rules
  resolves: #1437626 - PF_PACKET socket address will cause ausearch to segfault
  resolves: #1438997 - SECCOMP records have wrong syscall


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-6
changelog:
  - Add patch for Sysconfig module, empty comment lines (RHBZ#1043665)
  - Add check section to run test suite
  - Add patch for testPermsErrorReported test, when root (RHBZ#1043666)
  - Add patch for Shellvars, multivariable exports (RHBZ#1043815)


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-9
changelog:
  - Add patch for yum-cron.conf incl entry (RHBZ#1058409)
  - Add patch for firewalld.conf incl entry (RHBZ#1058411)
  - Add patch for Grub, foreground option (RHBZ#1059426)
  - Add patch for Yum, spaces around equals (RHBZ#1062614)
  - Add patch for Shellvars, case and same-line ;; (RHBZ#1056541)


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-10
changelog:
  - Add patch for IPRoute2, hex and hyphen protocols (RHBZ#1063961)
  - Add patch for IPRoute2, slashes in protocols (RHBZ#1063968)


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-12
changelog:
  - Add patch for Dovecot, mailbox and quote support (RHBZ#1064387)
  - Add patch for Keepalived, virtual server fixes (RHBZ#1064388)
  - Add patch for Krb5, parse braces in values (RHBZ#1066419)


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-13
changelog:
  - aug_save: return error when unlink fails (RHBZ#1091143)
  - augtool: add aliases to autocomplete (RHBZ#1100076)
  - augtool: remove unused dump-xml arg (RHBZ#1100106)
  - Automounter: parse hostnames with hyphens (RHBZ#1075162)
  - Cgconfig: parse other valid controllers (RHBZ#1112543)
  - Chrony: add lens (RHBZ#1071947)
  - docs: update man page with new commands (RHBZ#1100077)
  - Exports: permit colons for IPv6 client addresses (RHBZ#1067030)
  - Httpd: parse continued, quoted lines (RHBZ#1100551)
  - Ldso: parse hwcap lines (RHBZ#1102629)
  - NagiosCfg: parse nrpe.cfg with Nrpe (RHBZ#1102623)
  - Rmt: add lens (RHBZ#1100549)
  - Services: permit colons in service name (RHBZ#1121527)
  - Shellvars: support arithmetic expansion (RHBZ#1100550)
  - Syslog: parse TCP loghosts (RHBZ#1129386)
  - Syslog: parse IPv6 loghost addresses (RHBZ#1129388)
  - Systemd: parse /etc/sysconfig/*.systemd (RHBZ#1083022)
  - Systemd: parse quoted environment vars (RHBZ#1100547)


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-14
changelog:
  - Kdump: parse new options, EOL comments (RHBZ#1139298)
  - Rsyslog: parse property filters and templates (RHBZ#1138402)
  - Systemd: parse semicolons inside entry values (RHBZ#1139498)
  - Systemd: parse environment variables where value is quoted (RHBZ#1138508)


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-16
changelog:
  - Iptables: parse /etc/sysconfig/iptables.save (RHBZ#1144651)
  - Lvm: parse /etc/lvm/lvm.conf (RHBZ#1145495)
  - Shadow: add lens (RHBZ#1145249)


author: Dominic Cleal <dcleal@redhat.com> - 1.4.0-1
changelog:
  - Rebase to Augeas 1.4.0
  - Revert some changes for better compatibility with 1.1.0-17:
    * Dhcpd: keep 1.1.0 behaviour, add Dhcpd_140 for 1.4.0 features
    * Dnsmasq: revert splitting of address/server options
    * Dovecot: restore quotes within values
    * Jaas: revert semicolon and line break changes
    * Slapd: keep 1.1.0 behaviour, add Slapd_140 for 1.4.0 features
    * Sshd: keep 1.1.0 behaviour, add Sshd_140 for 1.4.0 features
    * Syslog: restore tree without protocol for UDP hosts
    * UpdateDB: keep Simplevars to load config by default


author: Tomáš Mráz <tmraz@redhat.com> - 6.2.7-1
changelog:
  - samba-winbind-clients package contains the nsswitch and pam modules (#919117)
  - do not drop sss from nsswitch.conf on --update (#980861)
  - writing out smartcard/fingerprint auth policy to dconf (original patch by
    Ray Strode) (#990625)
  - document other possible return codes from authconfig invocation (#991804)
  - print error message if config file save fails (#994596)
  - never stop rpcbind (#990788)
  - do not disable sssd.service when --enablesssd is used (#953851)
  - revert use_first_pass addition to pam_sss in password stack (#953116)


author: Tomáš Mráz <tmraz@redhat.com> - 6.2.8-1
changelog:
  - detect invalid LDAP uri and report error
  - fix handling of IPA domain join errors and uninstall
  - add support for winbind authentication over Kerberos 5
  - set umask=077 by default for pam_mkhomedir and pam_oddjob_mkhomedir
  - better error checking for password quality options


author: Tomáš Mráz <tmraz@redhat.com> - 6.2.8-2
changelog:
  - updated translations
  - make pam_pkcs11 not ignore the wait_for_card option
  - gnome-screensaver does not exist anymore


author: Tomáš Mráz <tmraz@redhat.com> - 6.2.8-7
changelog:
  - check nslcd for restart when --enableforcelegacy is used
  - call restorecon on newly created configuration files


author: Tomáš Mráz <tmraz@redhat.com> - 6.2.8-8
changelog:
  - enable/start sssd only when config exists or enabled
    for both pam and nsswitch.conf
  - updated translations


author: Tomáš Mráz <tmraz@redhat.com> - 6.2.8-9
changelog:
  - do not overwrite special ldap base values
  - display error message if winbind or IPA domain join fails
  - fix invocation of IPA domain join from GUI
  - keep altfiles in nsswitch.conf if present (#1134084)
  - the winbind client is now in samba-winbind package (#1084997)
  - correct handling of SSSD enablement during IPA domain joins
  - do not bail out if multiple LDAP URIs are specified (#1142830)


author: Tomáš Mráz <tmraz@redhat.com> - 6.2.8-10
changelog:
  - fix title of IPA domain join window (#1166119)
  - add --unattended to IPA uninstall command (#1166131)
  - do not mistake comment for krb5 realm name (#1184639)
  - do not traceback with incorrect locales (#1187020)
  - correct the package needed for winbind (#1190226)
  - install empty /etc/sysconfig/authconfig file (#1194698)
  - let SSSD prompt non-local users for passwords (#1204864)
  - add includedir /var/lib/sss/pubconf/krb5.include.d/ to krb5.conf (#1207552)
  - pass the password provided by --winbindjoin to net join (#1225089)


author: Tomáš Mráz <tmraz@redhat.com> - 6.2.8-11
changelog:
  - add trigger to change pam configuration to use pam_oddjob_mkhomedir
    instead of pam_mkhomedir if oddjob-mkhomedir is installed
  - remove unusable --winbindtemplateprimarygroup option (#1242878)
  - handle inconsistency when missing realm in krb5.conf
  - sort the /etc/sysconfig/authconfig on write (#1320943)
  - avoid unnecessary update of nsswitch.conf
  - add support for myhostname nsswitch module (#1329943)


author: Pavel Březina <pbrezina@redhat.com> - 6.2.8-26
changelog:
  - CVE-2017-7488 authconfig: Information leak when SSSD is used for authentication against remote server (#1441604)


author: Tomas Mraz <tmraz@redhat.com> - 6.2.5-1
changelog:
  - fix missing cache_credentials option when saving sssd.conf
  - do not try to start/restart sssd with incomplete default domain
  - add autofs to sssd.conf activated services
  - add pam_winbind to session pam modules


author: Tomáš Mráz <tmraz@redhat.com> - 6.2.6-1
changelog:
  - add use_first_pass to pam_sss in password stack
  - more robust initialization of sssdConfig
  - check whether base DN value is a real base DN
  - use non-deprecated pam_pwquality option authtok_type= instead of type=
  - update lastlog for su


author: Pavel Raiskup <praiskup@redhat.com> - 2.69-6
changelog:
  - fedora-review (minor) fixes and typos: trim lines, remove defattr(,,), do not
    run `rm -rf %{buildroot} at the beginning of install section, use curly
    brackets only around rpm macros/variables and not around shell variables,
    remove clean section


author: Pavel Raiskup <praiskup@redhat.com> - 2.69-8
changelog:
  - the 'INSTALL' file can be used as template file for packages which are using
    autoconf - mark it for installation again (#661623)


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-32
changelog:
  - bz1011909 - NFSv4 UDP packet sent during automounting
    - only probe specific nfs version if requested.
  - Related: rhbz#1011909


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-33
changelog:
  - bz1029611 - Fresh rhel7 install can't automount nfs exports
    - regenerate configure due to missing function.
  - Resolves: rhbz#1029611


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-34
changelog:
  - bz1029611 - Fresh rhel7 install can't automount nfs exports
    - fix revision in spec file.
  - Resolves: rhbz#1029611


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-35
changelog:
  - bz1029611 - Fresh rhel7 install can't automount nfs exports
    - fix ipv6 libtirpc getport function.
  - Related: rhbz#1029611


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-35
changelog:
  - bz1030705 - Default unmount is in 10 seconds, man page says 10 minutes
    - improve timeout option description.
  - Related: rhbz#1030705


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-37
changelog:
  - bz1035977 - with IPv6 address automount fail with "hostname lookup failed"
    - fix ipv6 link local address handling.
  - Resolves: rhbz#1035977


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-40
changelog:
  - bz1063139 - autofs regression test failure.
    - fix fix ipv6 libtirpc getport.
    - get_nfs_info() should query portmapper if port is not given.
    - fix rpc_portmap_getport() proto not set.
    - fix portmap not trying proto v2.
  - Resolves: rhbz#1063139


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-41
changelog:
  - bz1094661 - autofs can ghost non-existent map entries given the right timing
    - fix negative status being reset on map read.
    - fix fix negative status being reset on map read.
    - check for non existent negative entries in lookup_ghost().
  - bz1124389 - autofs-5.0.5-88.el6 breaks maps that have a -v in the options
    - allow use of hosts map in maps (dependent patch).
    - fix options compare.
    - fix fix options compare.
  - Resolves: rhbz#1094661 rhbz#1124389


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-42
changelog:
  - bz1116184 - RFE: RHEL7: Add am-utils RPM or equivalent am-utils functionality
    to other packages
    - add amd map format parser.
  - bz1132236 - Memory leak in get_exports
    - fix memory leak in create_client().
    - fix memory leak in get_exports().
  - bz1135158 - double free or corruption (fasttop) causes abort in ldap_int_tls_destroy
    - fix deadlock in init_ldap_connection().
    - extend libldap serialization.
  - Resolves: rhbz#1116184 rhbz#1132236 rhbz#1135158


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-43
changelog:
  - bz1066772 - Clarify autofs(5) man page sections "Multiple Mounts" and
    "Replicated Server"
    - clarify multiple mounts description.
  - Resolves: rhbz#1066772


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-44
changelog:
  - bz1099800 - man page of /etc/init.d/autofs: /usr/share/man/man8/autofs.8.gz
    is not needed in RHEL-7
    - update man page autofs(8) for systemd
  - Resolves: rhbz#1099800


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-45
changelog:
  - bz1152862 - autofs shouldn't have kernel as a dependency
    - remove an ancient kernel Requires.
  - Resolves: rhbz#1152862


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-46
changelog:
  - bz1153414 - autofs-5.0.5-109 with upgrade to RHEL 6.6 no longer recognizes
    +yp: in auto.master
    - fix fix master map type check.
  - Resolves: rhbz#1153414


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-47
changelog:
  - bz1156662 - autofs /net maps do not refresh list of shares exported on
    the NFS server
    - fix typo in update_hosts_mounts().
    - fix hosts map update on reload.
  - Resolves: rhbz#1156662


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-48
changelog:
  - bz1164957 - The default installed autofs.conf doesn't have default nfs
    protocol set to 4
    - add missing line to copy RedHat customized config to spec file.
  - Resolves: rhbz#1164957


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-49
changelog:
  - bz1166457 - Autofs unable to mount indirect after attempt to mount wildcard
    - make negative cache update consistent for all lookup modules.
    - ensure negative cache isn't updated on remount.
    - dont add wildcard to negative cache.
  - bz1162041 - priv escalation via interpreter load path for program based
    automount maps
    - add a prefix to program map stdvars.
    - add config option to force use of program map stdvars.
  - bz1161474 - automount segment fault in parse_sun.so for negative parser tests
    - fix incorrect check in parse_mount().
  - bz1205600 - Autofs stopped mounting /net/hostname/mounts after seeing duplicate
    exports in the NFS server
    - handle duplicates in multi mounts.
  - bz1201582 - autofs: MAPFMT_DEFAULT is not macro in lookup_program.c
    - fix macro usage in lookup_program.c.
  - Resolves: rhbz#1166457 rhbz#1162041 rhbz#1161474 rhbz#1205600 rhbz#1201582


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-50
changelog:
  - bz1218045 - Similar but unrelated NFS exports block proper mounting of
    "parent" mount point
    - remove unused offset handling code.
    - fix mount as you go offset selection.
  - Resolves: rhbz#1218045


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-51
changelog:
  - bz1233065 - 'service autofs reload' does not reloads new mounts only
    when 'sss' or 'ldap' is used in '/etc/nsswitch.conf' file
    - init qdn before use in get_query_dn().
    - fix left mount count return from umount_multi_triggers().
    - fix return handling in sss lookup module.
    - move query dn calculation from do_bind() to do_connect().
    - make do_connect() return a status.
    - make connect_to_server() return a status.
    - make find_dc_server() return a status.
    - make find_server() return a status.
    - fix return handling of do_reconnect() in ldap module.
  - bz1233067 - autofs is performing excessive direct mount map re-reads
    - fix direct mount stale instance flag reset.
  - bz1233069 - Direct map does not expire if map is initially empty
    - fix direct map expire not set for initial empty map.
  - Resolves: rhbz#1233065 rhbz#1233067 rhbz#1233069


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-52
changelog:
  - bz1233069 - Direct map does not expire if map is initially empty
    - update patch to fix expiry problem.
  - Related: rhbz#1233069


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-53
changelog:
  - bz1238573 - RFE: autofs MAP_HASH_TABLE_SIZE description
    - update map_hash_table_size description.
  - Resolves: rhbz#1238573


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-54
changelog:
  - bz1263508 - Heavy program map usage can lead to a hang
    - fix out of order call in program map lookup.
  - Resolves: rhbz#1263508


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-55
changelog:
  - bz1298115 - The autofs service fails to load maps on boot if the maps
    are stored on a NFS mount
    - make service want network-online.
    - add remote-fs.target systemd dependency.
  - bz1300496 - Duplicate mounts created or leftovers in mtab
    - revert special case cifs escapes.
  - bz1300498 - Parent directory in nested mount gets unmounted while the
    child remains mounted
    - guard against incorrect umount return.
  - bz1305721 - autofs.conf: Fix 'nameing' typo
    - fix 'nameing' typo in autofs.conf.
  - bz1329869 - RHEL6.7: shutdown / reboot hangs with findmnt in a readlink
    system call, doing path_walk and stuck in autofs4_wait
    - always set direct mounts catatonic at exit.
    - log pipe read errors.
    - fix rwlock unlock crash.
    - fix handle_mounts() termination condition check.
  - bz1300500 - double free or corruption (fasttop) causes abort in
    ldap_int_tls_destroy
    - fix config old name lookup.
    - fix error handling on ldap bind fail.
    - fix gcc5 complaints.
    - fix fix gcc5 complaints.
    - fix missing source sss in multi map lookup.
    - fix update_hosts_mounts() return.
    - change lookup to use reinit instead of reopen.
    - fix unbind sasl external mech.
    - fix sasl connection concurrancy problem.
    - add some Coverity fixes identified for recent changes.
  - bz1300501 - Request to add a configuration option to force use of the map
    entry hostname for mounts
    - add configuration option to use fqdn in mounts
  - Resolves: rhbz#1298115 rhbz#1300496 rhbz#1300498 rhbz#1305721
  - Resolves: rhbz#1329869 rhbz#1300500 rhbz#1300501


author: Ian Kent <ikent@redhat.com> - 1:5.0.7-56
changelog:
  - bz1327388 - Fix use-after-free in st_queue_handler
    - fix use-after-free in st_queue_handler().
  - bz1252071 - [RFE] Disable alerting on non-existent automounts
    - add config option to suppress not found log message.
  - Resolves: rhbz#1327388 rhbz#1252071


author: Ian Kent <ikent@redhat.com> - 5.0.7-60
changelog:
  - bz1382093 - Improve logging in autofs
     - add the mount requestor's pid to pending_args.
     - create thread-local ID for mount attempts.
     - log functions to prefix messages with attempt_id if available.
     - factor out set_thread_mount_request_log_id().
     - add config option to use mount request log id.
  - Resolves: rhbz#1382093


author: Ian Kent <ikent@redhat.com> - 5.0.7-61
changelog:
  - bz1101782 - autofs configured with sssd is not finding any maps
    - work around sss startup delay.
    - add sss master map wait config option (wait initially 0, disabled).
  - Resolves: rhbz#1101782


author: Ian Kent <ikent@redhat.com> - 5.0.7-62
changelog:
  - bz1367576 - [RFE] Add browsing support into autofs for AMD format maps
    - use autofs_point to store expire timeout where possibe.
  - Related: rhbz#1367576


author: Ian Kent <ikent@redhat.com> - 5.0.7-63
changelog:
  - bz1101782 - autofs configured with sssd is not finding any maps
    - fix work around sss startup delay.
  - bz1367576 - [RFE] Add browsing support into autofs for AMD format maps
    - fix possible NULL derefernce.
  - Related: rhbz#1101782 rhbz#1367576


author: Ian Kent <ikent@redhat.com> - 5.0.7-64
changelog:
  - bz1440769 - autofs is facing scalability issues
    - improve scalability of direct mount path component creation.
  - Resolves: rhbz#1440769


author: Ian Kent <ikent@redhat.com> - 5.0.7-65
changelog:
  - bz1367576 - [RFE] Add browsing support into autofs for AMD format maps
    - fix invalid reference in remount_active_mount().
  - Related: rhbz#1367576


author: Ian Kent <ikent@redhat.com> - 5.0.7-66
changelog:
  - bz1435736 - autofs fails with kernel: automount[3386]:
      segfault at 7f3fb7595ca8 ip 00007f3fb61e353a sp 00007f3fb7595cb0
      error 6 in libc-2.17.so[7f3fb60b7000+1b6000]
    - increase worker thread per-thread stack size.
    - limit getgrgid_r() buffer size.
    - add congigure option for limiting getgrgid_r() stack usage.
    - use above option to limit getgrgid_r() stack usage with configure.
  - Resolves: rhbz#1435736


author: Ian Kent <ikent@redhat.com> - 5.0.7-68
changelog:
  - bz1435736 - autofs fails with kernel: automount[3386]:
      segfault at 7f3fb7595ca8 ip 00007f3fb61e353a sp 00007f3fb7595cb0
      error 6 in libc-2.17.so[7f3fb60b7000+1b6000]
    - fix unset tsd group name handling.
  - Related: rhbz#1435736


author: Ian Kent <ikent@redhat.com> - 5.0.7-69
changelog:
  - bz1435736 - autofs fails with kernel: automount[3386]:
      segfault at 7f3fb7595ca8 ip 00007f3fb61e353a sp 00007f3fb7595cb0
      error 6 in libc-2.17.so[7f3fb60b7000+1b6000]
    - fix a couple of covarity warning resulting in group name handling change.
  - Related: rhbz#1435736


author: Ian Kent <ikent@redhat.com> - 5.0.7-70.el7_4
changelog:
  - bz1503945 - autofs option parsing for maps with fstype=autofs no longer
    works [rhel-7.4.z]
    - revert fix argc off by one in mount_autofs.c.
  - bz1503946 - autofs map entry options field does not accept dot character
    [rhel-7.4.z]
    - allow dot in OPTIONSTR value lexer pattern.
    - handle additional nfs versions in mount_nfs.c.
  - Resolves: rhbz#1503945 rhbz#1503946


author: Ian Kent <ikent@redhat.com> - 5.0.7-70.el7_4.1
changelog:
  - bz1515311 - Automount cannot access host shares after a reboot [rhel-7.4.z]
    - reset master map list on startup retry.
  - Resolves: rhbz#1515311


author: Miroslav Lichvar <mlichvar@redhat.com> - 5.18-1
changelog:
  - Update to 5.18
  - Fix multilib conflicts (#831379)
  - Make some dependencies arch-specific
  - Remove obsolete macros


author: Pavel Raiskup <praiskup@redhat.com> - 1.13.1-13
changelog:
  - remove old build dependency comment
  - fix bogus dates in changelog
  - use the %{_smp_mflags} also by `make check`


author: Pavel Raiskup <praiskup@redhat.com> - 1.13.1-14
changelog:
  - fix another requirement on perl package which may cause problems in future,
    thanks to Paul Howarth (#924938)
  - f-r: remove Buildroot tag, fix license tag


author: Stef Walter <stefw@redhat.com> - 0.6.31-5
changelog:
  - Don't ship ssh service by default file since openssh-server isn't
    running by default, and shouldn't be advertised without user
    confirmation.


author: Michal Sekletar <msekleta@redhat.com> - 0.6.31-15
changelog:
  - enable hardened build (#1092506)
  - fix short option for --version, document -t option of avahi-autoipd (#948583)
  - fix crashes in D-Bus methods GetAlternativeHostName and GetAlternativeServiceName (#1003688)
  - fix bug when avahi-daemon ended up in a tight loop (#1081801)
  - remove prefix /home/lennart/tmp/avahi from references in man pages (#1120233)


author: Michal Sekletar <msekleta@redhat.com> - 0.6.31-17
changelog:
  - fix crash due to use of deprecated Gtk3 API (#1263720)
  - don't add 0pointer.de and zeroconf.org to default browse list (#1340837)
  - fix not publishing entries if a probing interface is removed (#1222646)


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 0:2.1-6
changelog:
  - aqute-bndlib renamed to aqute-bnd (#745166)
  - Fix compilation with openjdk 1.7.0
  - Use new maven macros
  - Packaging tweaks


author: Nils Philippsen <nils@redhat.com> - 0.9.6-1
changelog:
  - version 0.9.6:
    * Backport r493-494: documentation typo fixes.
    * Make the CLDR import script work with Python 2.7.
    * Fix various typos.
    * Fixed Python 2.3 compatibility (ticket #146, #233).
    * Sort output of list-locales.
    * Make the POT-Creation-Date of the catalog being updated equal to
      POT-Creation-Date of the template used to update (ticket #148).
    * Use a more explicit error message if no option or argument (command) is
      passed to pybabel (ticket #81).
    * Keep the PO-Revision-Date if it is not the default value (ticket #148).
    * Make --no-wrap work by reworking --width's default and mimic xgettext's
      behaviour of always wrapping comments (ticket #145).
    * Fixed negative offset handling of Catalog._set_mime_headers (ticket #165).
    * Add --project and --version options for commandline (ticket #173).
    * Add a __ne__() method to the Local class.
    * Explicitly sort instead of using sorted() and don't assume ordering
      (Python 2.3 and Jython compatibility).
    * Removed ValueError raising for string formatting message checkers if the
      string does not contain any string formattings (ticket #150).
    * Fix Serbian plural forms (ticket #213).
    * Small speed improvement in format_date() (ticket #216).
    * Fix number formatting for locales where CLDR specifies alt or draft
      items (ticket #217)
    * Fix bad check in format_time (ticket #257, reported with patch and tests by
      jomae)
    * Fix so frontend.CommandLineInterface.run does not accumulate logging
      handlers (#227, reported with initial patch by dfraser)
    * Fix exception if environment contains an invalid locale setting (#200)
  - install python2 rather than python3 executable (#710880)


author: Ondrej Holy <oholy@redhat.com> - 3.14.1-1
changelog:
  - Update to 3.14.1
  - Remove obsolete upstream patch
  - Add translations updates from upstream
  - Resolves: #1174557


author: John Haxby <john.haxby@oracle.com> - 4.2.46-20.0.1
changelog:
  - CVE-2016-7543: Fix for arbitrary code execution via SHELLOPTS+PS4 variables [orabug 24749446]
  - CVE-2016-0634 - Fix for arbitrary code execution via malicious hostname [orabug 24749446]


author: Ville Skyttä <ville.skytta@iki.fi> - 1:2.0-1
changelog:
  - Update to 2.0 (fixes #817902, #831835).
  - Don't try to python-bytecompile our non-python *.py (#813651).


author: Ville Skyttä <ville.skytta@iki.fi> - 1:2.1-1
changelog:
  - Update to 2.1 (fixes #860510, #906469, #912113, #919246, #928253).
  - Don't ship completions included in util-linux 2.23-rc2 for F-19+.


author: Roman Rakus <rrakus@redhat.com> - 2.1-4
changelog:
  - Added conditionals to not add completions for some commands; the packages
    has their own completions
    Resolves: #1007839


author: Ville Skyttä <ville.skytta@iki.fi> - 0:5.2-10
changelog:
  - Specify explicit source encoding to fix build with Java 7.
  - Install jar and javadocs unversioned.
  - Crosslink with JDK javadocs.


author: Andy Grimm <agrimm@gmail.com> - 0:5.2-13
changelog:
  - This package should not own _mavendepmapfragdir (RHBZ#850005)
  - Build with maven, and clean up deprecated spec constructs
  - Fix pom file (See http://jira.codehaus.org/browse/MEV-592)


author: Tomas Hozza <thozza@redhat.com> 32:9.9.4-7
changelog:
  - Create symlink /var/named/chroot/var/run -> /var/named/chroot/run (#1024384)
  - Added session-keyfile statement into default named.conf since we use /run/named (#1024384)


author: Tomas Hozza <thozza@redhat.com> 32:9.9.4-8
changelog:
  - Split chroot package for named and named-sdb
  - Extract setting-up/destroying of chroot to a separate systemd service (#1004300)


author: Tomas Hozza <thozza@redhat.com> 32:9.9.4-5
changelog:
  - Install configuration for rwtab and fix chroot setup script (#1028189)
  - use --enable-filter-aaaa when building bind to enable filter-aaaa-on-v4 option (#1025245)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-15
changelog:
  - Use /dev/urandom when generating rndc.key file (#1107568)
  - Allow authentication using TSIG in allow-notify configuration statement (#1067424)
  - Fix race condition when destroying a resolver fetch object (#1072379)
  - Increase defaults for lwresd workers and make workers and client objects number configurable (#1098959)
  - Configure BIND with --with-dlopen=yes to support dynamically loadable DLZ drivers (#1096688)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-17
changelog:
  - Fix error in dyndb API that can cause named to freeze on shutdown (#1142150)
  - Fix error in triggerun scriptlet (#1143033)
  - Remove /var/named/chroot/var/run on bind-chroot update if it is a directory (#1091341)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-18.4
changelog:
  - DNS resolution failure in high load environment with SERVFAIL and "out of memory/success" in the log (#1221180)
  - Increase ISC_SOCKET_MAXEVENTS to 2048 (#1250561)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-20
changelog:
  - DNS resolution failure in high load environment with SERVFAIL and "out of memory/success" in the log (#1221180)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-22
changelog:
  - Add version specific requires on bind for bind-pkcs11 (Related: #1097753)
  - Resolve issues found by static analysis (Related: #1097753)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-23
changelog:
  - Don't copy /etc/localtime on -chroot package installation (#1186773)
  - Fix SPF resource records check to comply with RFC7208 (#1215164)
  - Don't use ISC's DLV by default (#1223336)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-33
changelog:
  - Fix excessive queries caused by DS chasing with stub zones when DNSSEC is not used (#1291185)
  - Fix error in internal test suite (#1259514)
  - Fix named-checkconf call in *-chroot.service files (#1278082)
  - Fix incorrect path in BIND sample configuration and added comment to default configuration (#1247502)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-34
changelog:
  - Added support for CAA records (#1306610)
  - Use HTTPS URL instead of FTP for upstream sources (#1319280)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-36
changelog:
  - Added automatic interface scan functionality (#1294506)
  - Removed NetworkManager dispatcher script since it is not needed any more (#1294506)


author: Petr Menšík <pemensik@redhat.com> - 32:9.9.4-38.1
changelog:
  - Fix CVE-2016-9131 (ISC change 4508)
  - Fix CVE-2016-9147 (ISC change 4510)
  - Fix regression introduced by CVE-2016-8864 (ISC change 4530)
  - Fix CVE-2016-9444 (ISC change 4517)


author: Petr Spacek <pspacek redhat com> - 6.0-2
changelog:
  - fix bug 1161635: send DNS NOTIFY message after any modification to the zone
  - fix bug 1168131: crash caused by interaction between forward and master zones


author: Petr Spacek <pspacek redhat com> - 7.99-1
changelog:
  - preliminary update to latests snapshot of upstream Git: 158e95e (#1204110)
  - resolves: #829395  DNSSEC support
  - resolves: #1139776 LDAP MODRDN (rename) is not supported
  - resolves: #1139778 Records deleted when connection to LDAP is down are not refreshed properly
  - resolves: #1184065 PTR record synchronization for A/AAAA record tuple can fail mysteriously
  - resolves: #1207539 Add support for TLSA resource records (DANE)
  - resolves: #1207540 Plugin will crash if idnsForwardZone object is in the wrong place
  - resolves: #1207541 Generic support for unknown DNS RR types (RFC 3597)


author: Petr Spacek <pspacek redhat com> - 8.0-1
changelog:
  - update to latest upstream version
  - resolves: #1204110 Rebase bind-dyndb-ldap to latest upstream version


author: Petr Spacek <pspacek@redhat.com> - 9.0-1
changelog:
  - update to latest upstream version
  - related: #1292145 Rebase bind-dyndb-ldap to latest upstream version


author: Petr Spacek <pspacek@redhat.com> - 10.0-1
changelog:
  - update to latest upstream version
  - resolves: #1292145 Rebase bind-dyndb-ldap to latest upstream version


author: Tomas Krizek <tkrizek@redhat.com> - 11.1-1
changelog:
  - update to letest upstream version
  - resolves: #1393889 Rebase to bind-dyndb-ldap 11+
  - resolves: #1165796 bind-dyndb-ldap crashes if server is shutting down and connection to LDAP is down
  - resolves: #1413805 bind-dyndb-ldap default schema is shipped with syntax error


author: Petr Spacek <pspacek redhat com> - 5.2-1
changelog:
  - update to 5.2
  - adds DNSSEC support and supports root zone in LDAP
  - idnsZoneActive attribute is not supported anymore


author: Jeff Law <law@redhat.com> - 2.23.52.0.1-10
changelog:
  - Add libstdc++-static as a build requirement when running
    the testsuite.
  - Add remaining power8 support (#731883)


author: Jeff Law <law@redhat.com> - 2.23.52.0.1-11
changelog:
  - Add support for TDB notes section (#805115)
  - Fix length operands for cdzt, cxzt czdt and czxt (#805115)


author: Jakub Jelinek <jakub@redhat.com> - 2.23.52.0.1-12
changelog:
  - Add Intel AVX3, MPX and SHA support.
  - Add support for x86-64 -mcmodel=large -fpic TLS transitions.  (#994244)


author: Jeff Law <law@redhat.com> - 2.23.52.0.1-14
changelog:
  - Fix two may-be-uninitialized issues exposed by changes in
    compiler flags used to build binutils (#1048848).


author: Patsy Franklin <pfrankli@redhat.com> - 2.23.52.0.1-21.9
changelog:
  - This fixes a problem seen on powerpc64le ELFv2 when creating a
    function symbol alias with ld --defsym.  st_other needs to be copied
    from the source symbol to the alias in order to set up the local entry
    offset for the alias.


author: Patsy Franklin <pfrankli@redhat.com> - 2.23.52.0.1-22.9
changelog:
  - Reduce the size of aarch64 .debug_line; fix cfi encoding of fp registers;
    add register names to dumping of aarch64 cfi data. Patch provided by rth.
    Resolves: #1132641


author: Jeff Law <law@redhat.com> - 2.23.52.0.1-25.9
changelog:
  Revert this change (handled elsewhere): 
  - Additional patch from Alan to fix problems with ld --defsym.
    (#1132732)


author: Jeff Law <law@redhat.com> - 2.23.52.0.1-44
changelog:
  - Avoid reading beyond function boundary when disassembling.
    (#1060282)

  - For binary ouput, we don't have an ELF bfd output so can't access
    elf_elfheader.  (#1226864)


author: Nick Clifton <nickc@redhat.com> - 2.23.52.0.1-45
changelog:
  - Change strings program to default to -a.  Fix problems parsing
    files containg corrupt ELF group sections.  (#1157276)


author: Nick Clifton <nickc@redhat.com> 2.25.1-13
changelog:
  - Add support for Zeppelin x86 extensions.
  - Add support for the AMD MWAITX extension.
  - Add support for the PowerPC Power9 architecture.
  - Remove spurious binutils document references.
    (#1335313)
    (#1335684)
    (#1333305)


author: Nick Clifton <nickc@redhat.com> 2.25.1-14-base
changelog:
  - Extend Release string to include ".base" thus ensuring that it
    will not collide with a DTS release which might otherwise have
    the same name.
    (#1337617)


author: Nick Clifton <nickc@redhat.com> 2.25.1-17-base
changelog:
  - Close memory leak in "ar" archiver program.
    (#1162655)
  - Retire the copy-osabi patch.
    (#1252066)


author: Nick Clifton <nickc@redhat.com> 2.25.1-25-base
changelog:
  - Fix GOLD so that it will not warn about references to hidden symbols in shared objects.
    (#1326710)


author: Nick Clifton <nickc@redhat.com> 2.25.1-32.base
changelog:
  - Revert part of the objdump speed up patch which was preventing proper function name lookup.
    (#1465318)


author: Nick Clifton <nickc@redhat.com> 2.25.1-32.base.1
changelog:
  - Revert part of the objdump speed up patch which was preventing proper function name lookup.
    (#1479773)


author: Nick Clifton <nickc@redhat.com> 2.25.1-32.base.2
changelog:
  - Fix a seg-fault in the PowerPC linker when discarding .plt sections when -pie is used and undefined weak symbols are present.  
    (#1515347)
  - Add SCV, RFSCV amd LNIA instructions to Power9 port of gas.
    (#1449585)


author: Václav Pavlín <vpavlin@redhat.com> - 0.5.0-1
changelog:
  - Updating the sources to 0.5.0 version. Following are the changes:
  - Change scan of SMBIOS slot <-> PCI methods, recurse to set SMBIOS slot field
  - Save off secondary bus of PCI device for PCI tree traversal
  - Add version number to biosdevname


author: Václav Pavlín <vpavlin@redhat.com> - 0.5.0-5
changelog:
  - Fix regression introduced by the addslot function
  - CoverityScan fixes
  - Place udev rules to /usr/lib rather than /lib
  Resolves: rhbz#1008899


author: Patsy Franklin <pfrankli@redhat.com> - 3.0.4-1
changelog:
  - Rebase to 3.0.4
    - Removed obsolete patch.
    - Added build require of flex so that tests will run.
    - Removed duplicate/unpackaged files.


author: Pravin Satpute <psatpute@redhat.com> - 0.3-13
changelog:
  - added lucida-typewriter and fixed subpackage
  - removed common subpackage
  - added conf file for each subpackage


author: Jakub Martisko <jamartis@redhat.com> - 3.4.2-7
changelog:
  - fix issue with creation of srpm where __isa_bits on noarch leads to an error
  - Related: rhbz#1176026


author: Eric Sandeen <sandeen@redhat.com> - 1.0.5-7
changelog:
  - Add upstream cpu scalability patches (#1032368)
  - Remove "-k" option from manpage (#1300354)
  - Fix potential deadlock when calling stop_tracers (#1263189)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1.1.0-1
changelog:
  - New version
  - Dropped office_scen patch (upstreamed)
  - Dropped hdparm patch (upstream added support for LVM)
  - Reworked rm_sudo patch


author: Ray Strode <rstrode@redhat.com> 1.3-5
changelog:
  - Rebuild against bluez5.  This won't work, but will
    at least prevent broken dependencies
    Related: #1174545 1219504


author: Bastien Nocera <bnocera@redhat.com> 4.101-4
changelog:
  - Clean up requires and build requires
  - Use CUPS macro (#772236)
  - Enable audio socket so a2dp works in PulseAudio again (#874015)
  - Fix hid2hci not working with recent kernels (#877998)


author: Don Zickus <dzickus@redhat.com> 5.41-1
changelog:
  - Update to 5.41
  - obexd fixes to prevent crashes
  - add /etc/bluetooth/main.conf config file
  Resolves: #1313363, #1336476, #1338895


author: David Arcari <darcari@redhat.com> 5.44-1
changelog:
  - Update to 5.44
  - Ship btattach tool
  - Configure systemctl settings for bluez-obex correctly
  - Add Provides: bluez-obexd
  Resolves: #1434581, #1401501


author: Petr Machata <pmachata@redhat.com> - 1.53.0-8
changelog:
  - Install supporting files (images etc.) for documentation
    (courtesy Marcel Metz, bug 985593)
  - Add many patches for silencing unused local typedef warnings
    (boost-1.53.0-static_assert-unused_typedef.patch,
    boost-1.54.0-bind-static_assert.patch,
    boost-1.54.0-concept-unused_typedef.patch,
    boost-1.54.0-static_warning-unused_typedef.patch,
    boost-1.54.0-math-unused_typedef.patch,
    boost-1.54.0-math-unused_typedef-2.patch,
    boost-1.53.0-fpclassify-unused_typedef.patch,
    boost-1.54.0-math-unused_typedef-3.patch,
    boost-1.54.0-tuple-unused_typedef.patch,
    boost-1.54.0-random-unused_typedef.patch,
    boost-1.54.0-date_time-unused_typedef.patch,
    boost-1.54.0-date_time-unused_typedef-2.patch,
    boost-1.54.0-spirit-unused_typedef.patch,
    boost-1.54.0-spirit-unused_typedef-2.patch,
    boost-1.54.0-numeric-unused_typedef.patch,
    boost-1.54.0-multiprecision-unused_typedef.patch,
    boost-1.53.0-lexical_cast-unused_typedef.patch,
    boost-1.53.0-regex-unused_typedef.patch,
    boost-1.53.0-thread-unused_typedef.patch,
    boost-1.54.0-unordered-unused_typedef.patch,
    boost-1.54.0-algorithm-unused_typedef.patch,
    boost-1.53.0-graph-unused_typedef.patch,
    boost-1.54.0-locale-unused_typedef.patch,
    boost-1.54.0-property_tree-unused_typedef.patch,
    boost-1.54.0-xpressive-unused_typedef.patch,
    boost-1.54.0-mpi-unused_typedef.patch,
    boost-1.54.0-python-unused_typedef.patch)
  - Add a patch to turn off execstack in Boost.Context
    (boost-1.54.0-context-execstack.patch)
  - Fix boost::mpl::print on GCC (boost-1.54.0-mpl-print.patch)


author: Petr Machata <pmachata@redhat.com> - 1.53.0-13
changelog:
  - Fix compilation of Boost.Pool test cases
    (boost-1.54.0-pool-test_linking.patch)
  - Fix -Wshadow warnings in Boost.Pool
    (boost-1.54.0-pool-max_chunks_shadow.patch)
   -Wshadow warnings in Boost.Thread
    (boost-1.54.0-thread-cond_variable_shadow.patch)


author: Petr Machata <pmachata@redhat.com> - 1.53.0-15
changelog:
  - Fix misunderstanding of Boost.MPI about widths of some
    Boost.Serialization types.  (boost-1.53.0-mpi-version_type.patch)


author: Petr Machata <pmachata@redhat.com> - 1.53.0-18
changelog:
  - Turn off build flags pre-set by Boost distribution.
    (boost-1.53.0-buildflags.patch)
  - Pass RPM_OPT_FLAGS through user-config.jam.


author: Petr Machata <pmachata@redhat.com> - 1.53.0-21
changelog:
  - Fix atomic_cas32 (thanks Jaroslav Škarvada for figuring out where
    the problem is) (boost-1.54.0-interprocess-atomic_cas32-ppc.patch)


author: Jonathan Wakely <jwakely@redhat.com> - 1.53.0-26
changelog:
  - do not use arch-specific BuildRequires (#1268268)
  - support TLS libraries without SSLv3 (#1298227)


author: Jonathan Wakely <jwakely@redhat.com> - 1.53.0-26
changelog:
  - Install unpatched gcc.jam (#1305019).
  - Build libboost_python and libboost_python3 such that they depend on
    their respective libpython (#1302120).
    (boost-1.53.0-python-libpython_dep.patch,
    boost-1.53.0-python-abi_letters.patch)
  - Fix Boost.Python test suite so that PyImport_AppendInittab is called
    before PyInitialize, which broke the test suite with Python 3.
    (boost-1.53.0-python-test-PyImport_AppendInittab.patch)
  - Patch gcc.jam to not add bogus rpaths.


author: Jan Pokorný <jpokorny+rpm-booth@redhat.com> - 1.0-2.eb4256a.git
changelog:
  - update a subset of out-of-tree patches per
    https://github.com/ClusterLabs/booth/pull/22#issuecomment-216936987
  - pre-inclusion cleanups in the spec (apply systemd scriptlet operations
    with booth-arbitrator, avoid overloading file implicitly considered %doc
    as %license)
    Resolves: rhbz#1302087
    Related (Fedora): rhbz#1314865
    Related (Fedora): rhbz#1333509


author: Jan Pokorný <jpokorny+rpm-booth@redhat.com> - 1.0-3.570876d.git
changelog:
  - update per the changesets recently accepted by the upstream
    (memory/resource leaks fixes, patches previously attached separately
    that make unit test pass, internal cleanups, etc.)
    Resolves: rhbz#1302087


author: Jan Pokorný <jpokorny+rpm-booth@redhat.com> - 1.0-5.77d65dd.git
changelog:
  - update per the the current upstream, most notably the support for
    cluster-glue alternatives has been accepted (separate patches no
    longer needed)
  - make the main (envelope) package properly require the subpackages
    of the same version
  - add patches allowing for live_test.sh using pcs
  - allow building also against s390x architecture
    (per Pacemaker dependency constraint)
    Resolves: rhbz#1302087


author: Jan Pokorný <jpokorny+rpm-booth@redhat.com> - 1.0-6.ef769ef.git
changelog:
  - fix an issue with identity self-determination based on match
    between the addresses assigned at host and the configured addresses
    when a network-part-of-the-address-only match preceded a possible
    exact address match which would not be even tested if the length
    of the network prefix was the same (no longer for this exact one)
    Resolves: rhbz#1341720
  - fix a crash when running booth without determined identity
    (e.g., existing, yet empty configuration) under some circumstances
    Resolves: rhbz#1366616
  - make patches be applied using "git am" rather than "git apply"


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-1056.el7]
changelog:
  - [infiniband] ib/mlx5: Allow modify AV in DCI QP to RTR (Alaa Hleihel) [1714002]
  - [scsi] core: Allow state transitions from OFFLINE to BLOCKED (Ewan Milne) [1631136]
  - [edac] amd64: Set maximum channel layer size depending on family (Gary Hook) [1705210]
  - [edac] amd64: Adjust printed chip select sizes when interleaved (Gary Hook) [1705210]
  - [edac] amd64: Recognize x16 symbol size (Gary Hook) [1705210]
  - [edac] amd64: Support more than two Unified Memory Controllers (Gary Hook) [1705210]
  - [edac] amd64: Use a macro for iterating over Unified Memory Controllers (Gary Hook) [1705210]
  - [edac] amd64: Add Family 17h, models 10h-2fh support (Gary Hook) [1705210]
  - [vhost] vsock: add weight support (Jason Wang) [1702943] {CVE-2019-3900}
  - [vhost] vhost_net: fix possible infinite loop (Jason Wang) [1702943] {CVE-2019-3900}
  - [vhost] introduce vhost_exceeds_weight() (Jason Wang) [1702943] {CVE-2019-3900}
  - [vhost] vhost_net: introduce vhost_exceeds_weight() (Jason Wang) [1702943] {CVE-2019-3900}
  - [vhost] vhost_net: use packet weight for rx handler, too (Jason Wang) [1702943] {CVE-2019-3900}
  - [vhost] vhost-net: set packet weight of tx polling to 2 * vq size (Jason Wang) [1702943] {CVE-2019-3900}
  - [vhost] don't read and process iotlb message with bad lenth (Jason Wang)
  - [vhost] correctly check the return value of translate_desc() in log_used() (Jason Wang) [1657577]
  - [vhost] log dirty page correctly (Jason Wang) [1657577]
  - [vhost] fix OOB in get_rx_bufs() (Jason Wang) [1710182]
  - [vhost] reject zero size iova range (Jason Wang)
  - [vhost] Fix Spectre V1 vulnerability (Jason Wang) [1672554]
  - [vhost] vhost_net: flush batched heads before trying to busy polling (Jason Wang) [1710182]
  - [vhost] vhost_net: batch used ring update in rx (Jason Wang) [1710182]
  - [x86] mark AMD Rome processors supported (David Arcari) [1543509]
  - [x86] microcode: Only load the microcode once on AMD systems (Prarit Bhargava) [1710942]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-1057.el7]
changelog:
  - [fs] ext4: zero out the unused memory region in the extent tree block (Lukas Czerner) [1715280] {CVE-2019-11833}
  - [fs] revert "lockd: Show pid of lockd for remote locks" (Benjamin Coddington) [1717377]
  - [scsi] qla2xxx: Allow IRQ balance to spread vectors across multiple CPU (Himanshu Madhani) [1713412]
  - [netdrv] i40e: Do not check VF state in i40e_ndo_get_vf_config (Stefan Assmann) [1701191]
  - [netdrv] qed: Backport missing hw ptp config hunks (Manish Chopra) [1712585]
  - [infiniband] rdma/qedr: Fix incorrect device rate (Manish Chopra) [1713577]
  - [watchdog] core: Add watchdog_thresh command line parameter (Prarit Bhargava) [1714612]
  - [x86] kvm: x86: Sync the pending Posted-Interrupts (Peter Xu) [1719525]
  - [x86] kvm: vmx: remove WARN_ON_ONCE in kvm_vcpu_trigger_posted_interrupt (Peter Xu) [1719525]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-1058.el7]
changelog:
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719915] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719915] {CVE-2019-11479}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719595] {CVE-2019-11477}
  - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719595] {CVE-2019-11477}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719850] {CVE-2019-11478}
  - [fs] Revert "Fix default behaviour for empty domains and add domainauto option" (Leif Sahlberg) [1710421]
  - [fs] libceph: handle an empty authorize reply (Ilya Dryomov) [1718305]
  - [scsi] qla2xxx: Mark NVMe/FC initiator mode usage as technology preview (Ewan Milne) [1721655]
  - [nvme] Removing DMA_ATTR_NO_WARN for dma_alloc_attrs (Gopal Tiwari) [1715433]
  - [netdrv] qlcnic: fix Tx descriptor corruption on 82xx devices (Manish Chopra) [1715481]
  - [mm] mincore.c: make mincore() more conservative (Rafael Aquini) [1664199] {CVE-2019-5489}
  - [kernel] pm/hibernate: exclude all PageOffline() pages (David Hildenbrand) [1718771]
  - [hv] hv_balloon: mark inflated pages PG_offline (David Hildenbrand) [1718771]
  - [kernel] kexec: export PG_offline to VMCOREINFO (David Hildenbrand) [1718771]
  - [kernel] mm: convert PG_balloon to PG_offline (David Hildenbrand) [1718771]
  - [kernel] mm: split page_type out from _mapcount (David Hildenbrand) [1718771]
  - [kernel] mm: clean up non-standard page->_mapcount users (David Hildenbrand) [1718771]
  - [kernel] mm: consolidate all page-flags helpers in <linux/page-flags.h> (David Hildenbrand) [1718771]
  - [kernel] mm: page-flags: clean up the page flag test, set, clear macros (David Hildenbrand) [1718771]
  - [kernel] alarmtimer: Prevent overflow for relative nanosleep (Artem Savkov) [1653677] {CVE-2018-13053}
  - [kernel] module.c: Only return -EEXIST for modules that have finished loading part II (Prarit Bhargava) [1704844]
  - [x86] mm: Create an SME workarea in the kernel for early encryption (Lianbo Jiang) [1718348]
  - [x86] mm: Identify the end of the kernel area to be reserved (Lianbo Jiang) [1718348]
  - [x86] kdump: Export the SME mask to vmcoreinfo (Lianbo Jiang) [1718348]
  - [fs] proc/vmcore: Fix i386 build error of missing copy_oldmem_page_encrypted() (Lianbo Jiang) [1718348]
  - [x86] kdump, proc/vmcore: Enable kdumping encrypted memory with SME enabled (Lianbo Jiang) [1718348]
  - [iommu] amd: Remap the IOMMU device table with the memory encryption mask for kdump (Lianbo Jiang) [1718348]
  - [kernel] kexec: Allocate decrypted control pages for kdump if SME is enabled (Lianbo Jiang) [1718348]
  - [x86] ioremap: Add an ioremap_encrypted() helper (Lianbo Jiang) [1718348]
  - [x86] pti: Do not create debugfs for the pti_enabled when SME is active (Lianbo Jiang) [1720997]
  - [x86] resctrl: Prevent NULL pointer dereference when local MBM is disabled (Prarit Bhargava) [1713547]
  - [s390] pkey: Indicate old mkvp only if old and current mkvp are different (Hendrik Brueckner) [1720388]
  - [s390] qdio: clear intparm during shutdown (Hendrik Brueckner) [1720390]
  - [s390] Remove VLAIS in ptff() and clear_table() (Yauheni Kaliuta) [1691710]
  - [s390] remove 31 bit support (Yauheni Kaliuta) [1691710]
  - [s390] timex: fix get_tod_clock_ext() inline assembly (Yauheni Kaliuta) [1691710]
  - [s390] Use for_each_set_bit_inv instead of for_each_set_bit_left (Yauheni Kaliuta) [1691710]
  - [s390] bitops: add for_each_set_bit_inv helper (Yauheni Kaliuta) [1691710]
  - [s390] bitops: rename find_first_bit_left() to find_first_bit_inv() (Yauheni Kaliuta) [1691710]
  - [s390] bitops: use flogr instruction to implement __ffs, ffs, __fls, fls and fls64 (Yauheni Kaliuta) [1691710]
  - [s390] bitops: use generic find bit functions / reimplement _left variant (Yauheni Kaliuta) [1691710]
  - [s390] bitops: remove CONFIG_SMP / simplify non-atomic bitops (Yauheni Kaliuta) [1691710]
  - [s390] bitops: make use of interlocked-access facility 1 instructions (Yauheni Kaliuta) [1691710]
  - [s390] bitops: fix inline assembly constraints (Yauheni Kaliuta) [1691710]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-1059.el7]
changelog:
  - [scsi] scsi: megaraid_sas: return error when create DMA pool failed (Tomas Henzl) [1712861] {CVE-2019-11810}
  - [fs] cifs: cifs_read_allocate_pages: don't iterate through whole page array on ENOMEM (Leif Sahlberg) [1714220]
  - [fs] cifs: add more spinlocks to pretect against races (Leif Sahlberg) [1580165]
  - [fs] xfs: serialize unaligned dio writes against all other dio writes (Brian Foster) [1699800]
  - [fs] xfs: disable copy_file_range() to avoid broken splice copy (Brian Foster) [1688067]
  - [fs] ext4: check superblock mapped prior to committing (Lukas Czerner) [1721737]
  - [sound] alsa: alsa: hda - do not use ALC255_FIXUP_MIC_MUTE_LED for Huawei laptops (Jaroslav Kysela) [1721867]
  - [sound] alsa: revert "[sound] alsa: hda - Support led audio trigger" (Jaroslav Kysela) [1721867]
  - [mm] memory_hotplug: fix scan_movable_pages() for gigantic hugepages (Rafael Aquini) [1721503]
  - [mm] page_alloc: fix has_unmovable_pages for HugePages (Rafael Aquini) [1721503]
  - [mm] memory_hotplug: check zone_movable in has_unmovable_pages (Rafael Aquini) [1721503]
  - [mm] memory_hotplug: make has_unmovable_pages more robust (Rafael Aquini) [1721503]
  - [kernel] workqueue: Fix NULL pointer dereference (Denys Vlasenko) [1655834]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-1060.el7]
changelog:
  - [char] random: move FIPS continuous test to output functions (Herbert Xu) [1723910]
  - [netdrv] i40e: fix WoL support check (Stefan Assmann) [1720021]
  - [fs] revert "gfs2: Use d_materialise_unique instead of d_splice_alias" (Robert S Peterson) [1677686]
  - [mm] vmpressure: make sure there are no events queued after memcg is offlined (Vratislav Bendel) [1685447]
  - [mm] revert "mm: split page_type out from _mapcount" (David Hildenbrand) [1723689]
  - [mm] huge_memory: make pmd huge before dirty (Rafael Aquini) [1720278]
  - [mm] revert "don't split THP page when MADV_FREE syscall is called" (Rafael Aquini) [1720278]
  - [mm] revert "fix incorrect unlock error path in madvise_free_huge_pmd" (Rafael Aquini) [1720278]
  - [mm] revert "pmd dirty emulation in page fault handler" (Rafael Aquini) [1720278]
  - [mm] revert "thp: fix crash due race in MADV_FREE handling" (Rafael Aquini) [1720278]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-1061.el7]
changelog:
  - [linux] efi: Disable local interrupts across efi run-time calls (Lenny Szubowicz) [1716252]
  - [net] tcp: refine memory limit test in tcp_fragment() (Florian Westphal) [1723032]
  - [net] tcp: provide TCP_FRAG_IN_WRITE/RTX_QUEUE for tcp_fragment use (Florian Westphal) [1723032]


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.1.1.el7]
changelog:
  - [fs] nfsv4.1: Avoid false retries when RPC calls are interrupted (Benjamin Coddington) [1739077 1732427]
  - [fs] NFS4.1 handle interrupted slot reuse from ERR_DELAY (Benjamin Coddington) [1739077 1732427]
  - [fs] nfsv4.1: Fix the client behaviour on NFS4ERR_SEQ_FALSE_RETRY (Benjamin Coddington) [1739077 1732427]
  - [fs] cifs: fix panic in smb2_reconnect (Leif Sahlberg) [1737382 1702264]
  - [scsi] sg: protect against races between mmap() and SG_SET_RESERVED_SIZE (Ewan Milne) [1737380 1710533]
  - [scsi] sg: recheck MMAP_IO request length with lock held (Ewan Milne) [1737380 1710533]
  - [scsi] sg: reset 'res_in_use' after unlinking reserved array (Ewan Milne) [1737380 1710533]
  - [scsi] sg: protect accesses to 'reserved' page array (Ewan Milne) [1737380 1710533]
  - [netdrv] mlx4/en_netdev: allow offloading VXLAN over VLAN (Paolo Abeni) [1734333 1733671]
  - [netdrv] brcmfmac: assure SSID length from firmware is limited (Stanislaw Gruszka) [1704879 1704880] {CVE-2019-9500}
  - [net] tcp: be more careful in tcp_fragment() (Marcelo Leitner) [1739130 1732106]
  - [documentation] Documentation: Add swapgs description to the Spectre v1 documentation (Waiman Long) [1729810 1724510] {CVE-2019-1125}
  - [documentation] Documentation: Add section about CPU vulnerabilities for Spectre (Waiman Long) [1729810 1724510] {CVE-2019-1125}
  - [x86] x86/speculation/swapgs: Exclude ATOMs from speculation through SWAPGS (Waiman Long) [1729810 1724510] {CVE-2019-1125}
  - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Waiman Long) [1729810 1724510] {CVE-2019-1125}
  - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Waiman Long) [1729810 1724510] {CVE-2019-1125}
  - [x86] x86/feature: Relocate X86_FEATURE_INVPCID_SINGLE (Waiman Long) [1729810 1724510] {CVE-2019-1125}


author: Tianyue Lan <tianyue.lan@oracle.com> [3.10.0-1062.1.1.el7]
changelog:
  - Oracle Linux certificates (Alexey Petrenko)
  - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com)
  - Update x509.genkey [Orabug: 24817676]


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.5.1.el7]
changelog:
  - [netdrv] ixgbe: Prevent u8 wrapping of ITR value to something less than 10us (Ken Cox) [1757350 1750856]


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.6.1.el7]
changelog:
  - [virt] KVM: coalesced_mmio: add bounds checking (Bandan Das) [1746797 1746798] {CVE-2019-14821}
  - [fs] xfs: Fix deadlock between AGI and AGF with RENAME_WHITEOUT (Brian Foster) [1764245 1759117]
  - [powerpc] powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration (Desnes Augusto Nunes do Rosario) [1763625 1720930]
  - [powerpc] powerpc/pseries/mobility: prevent cpu hotplug during DT update (Desnes Augusto Nunes do Rosario) [1763625 1720930]
  - [powerpc] powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild (Desnes Augusto Nunes do Rosario) [1763625 1720930]
  - [crypto] crypto: vmx - ghash: do nosimd fallback manually (Desnes Augusto Nunes do Rosario) [1763621 1739765]
  - [crypto] crypto: vmx - Remove overly verbose printk from AES init routines (Desnes Augusto Nunes do Rosario) [1763621 1739765]
  - [crypto] powerpc: Create disable_kernel_{fp, altivec, vsx, spe}() (Desnes Augusto Nunes do Rosario) [1763621 1739765]
  - [crypto] crypto: vmx - CTR: always increment IV as quadword (Desnes Augusto Nunes do Rosario) [1763621 1739765]
  - [crypto] crypto: vmx - fix copy-paste error in CTR mode (Desnes Augusto Nunes do Rosario) [1763621 1739765]
  - [crypto] vmac - separate tfm and request context (Vladis Dronov) [1763620 1733561]
  - [crypto] crypto: blkcipher - fix crash flushing dcache in error path (Vladis Dronov) [1761804 1741525]
  - [crypto] crypto: remove direct blkcipher_walk dependency on transform (Vladis Dronov) [1761804 1741525]
  - [crypto] crypto: user - prevent operating on larval algorithms (Vladis Dronov) [1761804 1741525]
  - [netdrv] net/mlx5e: Support LAG TX port affinity distribution (Alaa Hleihel) [1759449 1724344]
  - [netdrv] net/mlx5e: Expose new function for TIS destroy loop (Alaa Hleihel) [1759449 1724344]
  - [include] net/mlx5: Add lag_tx_port_affinity capability bit (Alaa Hleihel) [1759449 1724344]
  - [netdrv] net/mlx5e: Re-work TIS creation functions (Alaa Hleihel) [1759449 1724344]
  - [netdrv] net/mlx5e: Disallow tc redirect offload cases we don't support (Alaa Hleihel) [1759003 1721626]
  - [netdrv] net/mlx5e: Support ndo_get_phys_port_name for PF under switchdev mode (Alaa Hleihel) [1759003 1721626]
  - [netdrv] net/mlx5e: Expose same physical switch_id for all representors (Alaa Hleihel) [1759003 1721626]
  - [net] tcp: reset sk_send_head in tcp_write_queue_purge (Marcelo Leitner) [1748357 1748358] {CVE-2019-15239}
  - [x86] kvm: x86: vmx: fix vpid leak (Vitaly Kuznetsov) [1755781 1716188]
  - [kvm] kvm/x86: Move MSR_IA32_ARCH_CAPABILITIES to array emulated_msrs (Paul Lai) [1757757 1708465]
  - [kvm] kvm: x86: Emulate MSR_IA32_ARCH_CAPABILITIES on AMD hosts (Paul Lai) [1757757 1708465]
  - [kvm] kvm: vmx: Tell the nested hypervisor to skip L1D flush on vmentry (Paul Lai) [1757757 1708465]
  - [kvm] kvm: vmx: support MSR_IA32_ARCH_CAPABILITIES as a feature MSR (Paul Lai) [1757757 1708465]
  - [kvm] kvm: x86: Introduce kvm_get_msr_feature() (Paul Lai) [1757757 1708465]
  - [kvm] kvm: x86: Add a framework for supporting MSR-based features (Paul Lai) [1757757 1708465]
  - [nvme] nvme: don't ask blk-mq to handle timed-out request (Ming Lei) [1758051 1750202]
  - [block] blk-mq: mark request as REQ_TIMEOUT when .timeout() is called (Ming Lei) [1758051 1750202]
  - [block] blk-mq: introduce blk_mq_clear_rq_complete() (Ming Lei) [1758051 1750202]
  - [block] blk-mq: remove 'sync' argument from __blk_mq_complete_request() (Ming Lei) [1758051 1750202]
  - [nvme] blk-mq: remove blk_mq_complete_request_sync (Ming Lei) [1763624 1730922]
  - [nvme] nvme: wait until all completed request's complete fn is called (Ming Lei) [1763624 1730922]
  - [nvme] nvme: don't abort completed request in nvme_cancel_request (Ming Lei) [1763624 1730922]
  - [block] blk-mq: introduce blk_mq_tagset_wait_completed_request() (Ming Lei) [1763624 1730922]
  - [block] blk-mq: introduce blk_mq_request_completed() (Ming Lei) [1763624 1730922]
  - [scsi] scsi: qla2xxx: Use correct size in call to dma_free_coherent() in qla2400_sp_unmap() (Himanshu Madhani) [1759447 1668767]
  - [scsi] scsi: qla2xxx: Fix different size DMA Alloc/Unmap (Himanshu Madhani) [1759447 1668767]
  - [scsi] scsi: qla2xxx: Fix DMA unmap leak (Himanshu Madhani) [1759447 1668767]
  - [scsi] scsi: qla2xxx: Prevent memory leak for CT req/rsp allocation (Himanshu Madhani) [1759447 1668767]
  - [scsi] scsi: fnic: fix msix interrupt allocation (Govindarajulu Varadarajan) [1754836 1745053]
  - [scsi] scsi: fnic: print port speed only at driver init or speed change (Govindarajulu Varadarajan) [1754836 1745053]
  - [nvme] nvme-scsi: updating struct nvme_ctrl (Gopal Tiwari) [1752423 1749524]


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.7.1.el7]
changelog:
  - [drm] drm/i915/cmdparser: Fix jump whitelist clearing (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1756815 1756816] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1756815 1756816] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Use explicit goto for error paths (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [x86] tsx: Add config options to set tsx=on|off|auto (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] tsx: Add "auto" option to the tsx= cmdline parameter (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] speculation/taa: Add sysfs reporting for TSX Async Abort (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] speculation/taa: Add mitigation for TSX Async Abort (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] cpu: Add a "tsx=" cmdline option with TSX disabled by default (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] cpu: Add a helper function x86_read_arch_cap_msr() (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] msr: Add the IA32_TSX_CTRL MSR (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [documentation] documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: mmu: Recovery of shattered NX large pages (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [virt] kvm: Add helper function for creating VM worker threads (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: mmu: ITLB_MULTIHIT mitigation (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [kernel] cpu/speculation: Uninline and export CPU mitigations helpers (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] cpu: Add Tremont to the cpu vulnerability whitelist (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: vmx, svm: always run with EFER.NXE=1 when shadow paging is active (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: add tracepoints around __direct_map and FNAME(fetch) (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: remove now unneeded hugepage gfn adjustment (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: make FNAME(fetch) and __direct_map more similar (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: mmu: Do not release the page inside mmu_set_spte() (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: mmu: Remove unused parameter of __direct_map() (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [virt] kvm: Convert kvm_lock to a mutex (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: mmu: drop vcpu param in gpte_access (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [virt] kvm: x86, powerpc: do not allow clearing largepages debugfs entry (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [kernel] sched/fair: Fix endless loop in idle_balance() (Phil Auld) [1766087 1740941]
  - [kernel] sched: Skip double execution of pick_next_task_fair() (Phil Auld) [1766098 1750819]
  - [kernel] sched/fair: Prevent throttling in early pick_next_task_fair() (Phil Auld) [1756267 1740038]
  - [kernel] sched: Check for stop task appearance when balancing happens (Phil Auld) [1756267 1740038]
  - [kernel] sched/core: Fix endless loop in pick_next_task() (Phil Auld) [1756267 1740038]
  - [kernel] sched/fair: Push down check for high priority class task into idle_balance() (Phil Auld) [1756267 1740038]
  - [kernel] sched/rt: Fix picking RT and DL tasks from empty queue (Phil Auld) [1756267 1740038]
  - [kernel] sched/core: Allow __sched_setscheduler() in interrupts when PI is not used (Phil Auld) [1756265 1722234]
  - [kernel] sched, dl: Convert switched_{from, to}_dl() / prio_changed_dl() to balance callbacks (Phil Auld) [1756265 1722234]
  - [kernel] sched,dl: Remove return value from pull_dl_task() (Phil Auld) [1756265 1722234]
  - [kernel] sched, rt: Convert switched_{from, to}_rt() / prio_changed_rt() to balance callbacks (Phil Auld) [1756265 1722234]
  - [kernel] sched,rt: Remove return value from pull_rt_task() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Allow balance callbacks for check_class_changed() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Use replace normalize_task() with __sched_setscheduler() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Handle priority boosted tasks proper in setscheduler() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Fix broken setscheduler() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Consider pi boosting in setscheduler() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Replace post_schedule with a balance callback list (Phil Auld) [1756265 1722234]
  - [kernel] sched: Guarantee task priority in pick_next_task() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Remove some #ifdeffery (Phil Auld) [1756265 1722234]
  - [kernel] sched: Clean up idle task SMP logic (Phil Auld) [1756265 1722234]
  - [kernel] sched: Fix hotplug task migration (Phil Auld) [1756265 1722234]
  - [kernel] sched/fair: Remove idle_balance() declaration in sched.h (Phil Auld) [1756265 1722234]
  - [kernel] sched: Push down pre_schedule() and idle_balance() (Phil Auld) [1756265 1722234]
  - [kernel] sched/fair: Optimize cgroup pick_next_task_fair() (Phil Auld) [1756265 1722234]
  - [kernel] sched/fair: Clean up the __clear_buddies_*() functions (Phil Auld) [1756265 1722234]
  - [kernel] sched: Push put_prev_task() into pick_next_task() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Move rq->idle_stamp up to the core (Phil Auld) [1756265 1722234]
  - [kernel] sched: Fix race in idle_balance() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Remove 'cpu' parameter from idle_balance() (Phil Auld) [1756265 1722234]
  - [kernel] sched/fair: Reset se-depth when task switched to FAIR (Phil Auld) [1756265 1722234]
  - [kernel] sched/fair: Track cgroup depth (Phil Auld) [1756265 1722234]


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.8.1.el7]
changelog:
  - [kernel] sched/fair: Fix low cpu usage with high throttling by removing expiration of cpu-local slices (Phil Auld) [1770738 1752136]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.9.1.el7]
changelog:
  - [kernel] sched: Fix race between task_group and sched_task_group (Oleksandr Natalenko) [1778545 1738415]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.10.1.el7]
changelog:
  - [net] netfilter: masquerade: don't flush all conntracks if only one address deleted on device (Patrick Talbert) [1779564 1771396]
  - [net] netfilter: conntrack: resched in nf_ct_iterate_cleanup (Patrick Talbert) [1779564 1771396]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.11.1.el7]
changelog:
  - [tty] TTY: serial_core, add ->install (Kenneth Yin) [1780163 1443152]
  - [net] gro: fix use-after-free read in napi_gro_frags() (Paolo Abeni) [1780033 1750810]
  - [net] cfg80211: wext: avoid copying malformed SSIDs (Stanislaw Gruszka) [1778631 1778632]
  - [fs] userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx (Alex Gladkov) [1777351 1749766]
  - [fs] gfs2: Use async glocks for rename (Robert S Peterson) [1777297 1677686]
  - [fs] gfs2: create function gfs2_glock_update_hold_time (Robert S Peterson) [1777297 1677686]
  - [fs] gfs2: separate holder for rgrps in gfs2_rename (Robert S Peterson) [1777297 1677686]
  - [wireless] mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings (Stanislaw Gruszka) [1776615 1776616]
  - [x86] cpuidle-haltpoll: vcpu hotplug support (Marcelo Tosatti) [1776289 1771849]
  - [cpuidle] cpuidle-haltpoll: return -ENODEV on modinit failure (Marcelo Tosatti) [1776289 1756843]
  - [wireless] mwifiex: fix possible heap overflow in mwifiex_process_country_ie() (Stanislaw Gruszka) [1776205 1776206]
  - [wireless] mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() (Stanislaw Gruszka) [1776156 1776157] {CVE-2019-14901}
  - [fs] vfs: Fix EOVERFLOW testing in put_compat_statfs64 (Eric Sandeen) [1775678 1758001]
  - [x86] x86/atomic: Fix smp_mb__{before,after}_atomic() (Prarit Bhargava) [1772812 1769569]
  - [mm] mm-vmstat-reduce-zone-lock-holding-time-by-proc-pagetypeinfo-fix (Waiman Long) [1770732 1757943]
  - [mm] mm, vmstat: reduce zone->lock holding time by /proc/pagetypeinfo (Waiman Long) [1770732 1757943]
  - [mm] mm, vmstat: hide /proc/pagetypeinfo from normal users (Waiman Long) [1770732 1757943]
  - [md] dm rq: fix handling underlying queue busy (Ming Lei) [1770113 1767482]
  - [pci] hv: Use bytes 4 and 5 from instance ID as the PCI domain numbers (Mohammed Gamal) [1766097 1634251]
  - [pci] hv: Detect and fix Hyper-V PCI domain number collision (Mohammed Gamal) [1766097 1634251]
  - [pci] hv: Serialize the present and eject work items (Mohammed Gamal) [1766097 1634251]
  - [netdrv] hv_netvsc: fix network namespace issues with VF support (Mohammed Gamal) [1766093 1741334]
  - [netdrv] hv_netvsc: move VF to same namespace as netvsc device (Mohammed Gamal) [1766093 1741334]
  - [netdrv] hv_netvsc: set master device (Mohammed Gamal) [1766093 1741334]
  - [pci] PCI: hv: Avoid use of hv_pci_dev->pci_slot after freeing it (Mohammed Gamal) [1766089 1737567]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.12.1.el7]
changelog:
  - [powerpc] powerpc/pseries: Remove confusing warning message (Gustavo Duarte) [1780148 1748306]
  - [powerpc] powerpc/pseries: Call H_BLOCK_REMOVE when supported (Gustavo Duarte) [1780148 1748306]
  - [powerpc] powerpc/pseries: Read TLB Block Invalidate Characteristics (Gustavo Duarte) [1780148 1748306]
  - [scsi] scsi: bnx2fc: Handle scope bits when array returns BUSY or TSF (Nilesh Javali) [1776290 1750577]
  - [scsi] scsi: bnx2fc: remove set but not used variables 'task', 'port', 'orig_task' (Nilesh Javali) [1776290 1750577]
  - [scsi] scsi: bnx2fc: remove set but not used variables 'lport', 'host' (Nilesh Javali) [1776290 1750577]
  - [scsi] scsi: bnx2fc: remove set but not used variable 'fh' (Nilesh Javali) [1776290 1750577]
  - [fs] SMB3: retry on STATUS_INSUFFICIENT_RESOURCES instead of failing write (Leif Sahlberg) [1767621 1764567]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.14.1.el7]
changelog:
  - [s390] jump_label: replace stop_machine with smp_call_function (Hendrik Brueckner) [1787559 1720387]
  - [s390] kernel: avoid cpu yield in SMT environment (Philipp Rudo) [1787558 1777876]
  - [x86] mm: serialize against gup_fast in pmdp_splitting_flush() (Vitaly Kuznetsov) [1783177 1674266]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.15.1.el7]
changelog:
  - [tools] perf top: Fix global-buffer-overflow issue (Michael Petlan) [1793581 1757325]
  - [tools] perf top: Always sample time to satisfy needs of use of ordered queuing (Michael Petlan) [1793581 1757325]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.16.1.el7]
changelog:
  - [netdrv] ixgbevf: Use cached link state instead of re-reading the value for ethtool (Ken Cox) [1796798 1794812]
  - [kernel] sched: Fix schedule_tail() to disable preemption (Phil Auld) [1796261 1771094]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.17.1.el7]
changelog:
  - [kvm] kvm: x86: always expose VIRT_SSBD to guests (Eduardo Habkost) [1797511 1744281]
  - [kvm] kvm: x86: fix reporting of AMD speculation bug CPUID leaf (Eduardo Habkost) [1797511 1744281]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.18.1.el7]
changelog:
  - [x86] x86/boot/64: Round memory hole size up to next PMD page (Frank Ramsay) [1798163 1773762]
  - [x86] x86/boot/64: Make level2_kernel_pgt pages invalid outside kernel area (Frank Ramsay) [1798163 1773762]
  - [fs] gfs2: Use d_materialise_unique instead of d_splice_alias (2) (Andreas Grunbacher) [1796431 1784550]
  - [fs] gfs2: gfs2_create_inode(): don't bother with d_splice_alias() (Andreas Grunbacher) [1796431 1784550]
  - [fs] gfs2: bugger off early if O_CREAT open finds a directory (Andreas Grunbacher) [1796431 1784550]
  - [scsi] scsi: hpsa: remove printing internal cdb on tag collision (Joseph Szczypek) [1793579 1741355]
  - [scsi] scsi: hpsa: correct scsi command status issue after reset (Joseph Szczypek) [1793579 1741355]
  - [infiniband] IB/mlx5: Fix MR registration flow to use UMR properly (Alaa Hleihel) [1792371 1741343]
  - [scsi] qedf: Initialize rport while creation of vport (Nilesh Javali) [1791825 1760746]
  - [scsi] scsi: hpsa: add missing hunks in reset-patch (Joseph Szczypek) [1791782 1761978]
  - [block] block: don't change REQ_NR_BITS (Ming Lei) [1791781 1779712]
  - [scsi] scsi: qla2xxx: Fix panic in qla_dfs_tgt_counters_show (Himanshu Madhani) [1791595 1729270]
  - [drm] drm/radeon: fix si_enable_smc_cac() failed issue (Dave Airlie) [1789744 1780026]
  - [scsi] scsi: bnx2fc: timeout calculation invalid for bnx2fc_eh_abort() (Nilesh Javali) [1784824 1772966]
  - [md] md/raid10: prevent access of uninitialized resync_pages offset (Nigel Croxon) [1781584 1767935]
  - [fs] fix inode leaks on d_splice_alias() failure exits (Miklos Szeredi) [1781159 1749390]
  - [fs] cachefiles: Fix page leak in cachefiles_read_backing_file while vmscan is active (David Howells) [1780149 1765975]
  - [mm] mm: swap: clean up swap readahead (Rafael Aquini) [1780035 1725396]
  - [mm] mm: do_swap_page: clean up parameter list passing a pointer to struct vm_fault (Rafael Aquini) [1780035 1725396]
  - [mm] mm: __handle_mm_fault: introduce explicit barrier after orig_pte dereference (Rafael Aquini) [1780035 1725396]
  - [x86] kvm: vmx: use MSR_IA32_TSX_CTRL to hard-disable TSX on guest that lack it (Paolo Bonzini) [1779766 1779768]
  - [x86] kvm: vmx: implement MSR_IA32_TSX_CTRL disable RTM functionality (Paolo Bonzini) [1779766 1779768] {CVE-2019-19338}
  - [x86] kvm: x86: Mark expected switch fall-throughs (Paolo Bonzini) [1779766 1779768] {CVE-2019-19338}
  - [x86] kvm: x86: implement MSR_IA32_TSX_CTRL effect on CPUID (Paolo Bonzini) [1779766 1779768] {CVE-2019-19338}
  - [x86] kvm: x86: do not modify masked bits of shared MSRs (Paolo Bonzini) [1779766 1779768] {CVE-2019-19338}
  - [x86] kvm: x86: fix presentation of TSX feature in ARCH_CAPABILITIES (Paolo Bonzini) [1779766 1779768] {CVE-2019-19338}
  - [x86] kvm/x86: Export MDS_NO=0 to guests when TSX is enabled (Paolo Bonzini) [1779766 1779768] {CVE-2019-19338}
  - [s390] scsi: zfcp: fix reaction on bit error threshold notification (Philipp Rudo) [1778691 1765123]
  - [net] ipv6: Rewind hlist offset on interrupted /proc/net/if_inet6 read (Stefano Brivio) [1778084 1753480]
  - [net] revert "[net] ipv6: Display all addresses in output of /proc/net/if_inet6" (Stefano Brivio) [1778084 1753480]
  - [wireless] rtlwifi: Fix potential overflow on P2P code (Josef Oskera) [1775235 1775236] {CVE-2019-17666}
  - [md] md: improve handling of bio with REQ_PREFLUSH in md_flush_request() (Xiao Ni) [1773482 1752061]
  - [fs] fscache: Don't use a constructor function on the slab allocator (David Howells) [1793086 1739996]
  - [mm] mm: fix insert_pfn regression (Jeff Moyer) [1793088 1739889]
  - [mm] mm/page_idle.c: fix oops because end_pfn is larger than max_pfn (Rafael Aquini) [1768386 1730471]
  - [mm] mm/mlock.c: mlockall error for flag MCL_ONFAULT (Rafael Aquini) [1768386 1730471]
  - [mm] hugetlb: use same fault hash key for shared and private mappings (Rafael Aquini) [1768386 1730471]
  - [mm] hugetlbfs: on restore reserve error path retain subpool reservation (Rafael Aquini) [1768386 1730471]
  - [mm] mm/memory.c: fix modifying of page protection by insert_pfn() (Rafael Aquini) [1768386 1730471]
  - [mm] mm, swap: bounds check swap_info array accesses to avoid NULL derefs (Rafael Aquini) [1768386 1730471]
  - [mm] mm/slub.c: remove an unused addr argument (Rafael Aquini) [1768386 1730471]
  - [mm] hugetlbfs: fix races and page leaks during migration (Rafael Aquini) [1768386 1730471]
  - [mm] mm, oom: fix use-after-free in oom_kill_process (Rafael Aquini) [1768386 1730471]
  - [mm] percpu: convert spin_lock_irq to spin_lock_irqsave (Rafael Aquini) [1768386 1730471]
  - [mm] mm/swapfile.c: use kvzalloc for swap_info_struct allocation (Rafael Aquini) [1768386 1730471]
  - [mm] hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:444! (Rafael Aquini) [1768386 1730471]
  - [mm] mm: Fix warning in insert_pfn() (Rafael Aquini) [1768386 1730471]
  - [mm] hugetlbfs: dirty pages as they are added to pagecache (Rafael Aquini) [1768386 1730471]
  - [mm] mm/swapfile.c: fix swap_count comment about nonexistent SWAP_HAS_CONT (Rafael Aquini) [1768386 1730471]
  - [mm] slab: __GFP_ZERO is incompatible with a constructor (Rafael Aquini) [1768386 1730471]
  - [mm] mm: fix the NULL mapping case in __isolate_lru_page() (Rafael Aquini) [1768386 1730471]
  - [mm] mm/filemap.c: fix NULL pointer in page_cache_tree_insert() (Rafael Aquini) [1768386 1730471]
  - [fs] block_invalidatepage(): only release page if the full page was invalidated (Rafael Aquini) [1768386 1730471]
  - [mm] mm/mempolicy.c: avoid use uninitialized preferred_node (Rafael Aquini) [1768386 1730471]
  - [mm] mm: pin address_space before dereferencing it while isolating an LRU page (Rafael Aquini) [1768386 1730471]
  - [fs] fs/hugetlbfs/inode.c: change put_page/unlock_page order in hugetlbfs_fallocate() (Rafael Aquini) [1768386 1730471]
  - [mm] mm: do not rely on preempt_count in print_vma_addr (Rafael Aquini) [1768386 1730471]
  - [mm] mm, swap: fix race between swap count continuation operations (Rafael Aquini) [1768386 1730471]
  - [mm] mm: meminit: mark init_reserved_page as __meminit (Rafael Aquini) [1768386 1730471]
  - [mm] mm/vmstat.c: fix wrong comment (Rafael Aquini) [1768386 1730471]
  - [mm] mm, hugetlb: do not allocate non-migrateable gigantic pages from movable zones (Rafael Aquini) [1768386 1730471]
  - [mm] mm: always flush VMA ranges affected by zap_page_range (Rafael Aquini) [1768386 1730471]
  - [mm] mm/mremap: fail map duplication attempts for private mappings (Rafael Aquini) [1768386 1730471]
  - [mm] mm/mmap.c: do not blow on PROT_NONE MAP_FIXED holes in the stack (Rafael Aquini) [1768386 1730471]
  - [mm] mm: numa: avoid waiting on freed migrated pages (Rafael Aquini) [1768386 1730471]
  - [mm] mm/memory-failure.c: use compound_head() flags for huge pages (Rafael Aquini) [1768386 1730471]
  - [fs] fs/block_dev: always invalidate cleancache in invalidate_bdev() (Rafael Aquini) [1768386 1730471]
  - [mm] percpu: remove unused chunk_alloc parameter from pcpu_get_pages() (Rafael Aquini) [1768386 1730471]
  - [mm] percpu: acquire pcpu_lock when updating pcpu_nr_empty_pop_pages (Rafael Aquini) [1768386 1730471]
  - [mm] mm: do not access page->mapping directly on page_endio (Rafael Aquini) [1768386 1730471]
  - [mm] mm/page_alloc: fix nodes for reclaim in fast path (Rafael Aquini) [1768386 1730471]
  - [mm] mm: alloc_contig_range: allow to specify GFP mask (Rafael Aquini) [1768386 1730471]
  - [mm] mm: vmscan: scan dirty pages even in laptop mode (Rafael Aquini) [1768386 1730471]
  - [mm] mm/mempolicy.c: do not put mempolicy before using its nodemask (Rafael Aquini) [1768386 1730471]
  - [mm] mm: fix set pageblock migratetype in deferred struct page init (Rafael Aquini) [1768386 1730471]
  - [mm] mm: delete unnecessary and unsafe init_tlb_ubc() (Rafael Aquini) [1768386 1730471]
  - [kernel] mm, mempolicy: task->mempolicy must be NULL before dropping final reference (Rafael Aquini) [1768386 1730471]
  - [mm] mm: use phys_addr_t for reserve_bootmem_region() arguments (Rafael Aquini) [1768386 1730471]
  - [mm] mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check (Rafael Aquini) [1768386 1730471]
  - [mm] mm: soft-offline: check return value in second __get_any_page() call (Rafael Aquini) [1768386 1730471]
  - [include] include/linux/memblock.h: fix ordering of 'flags' argument in comments (Rafael Aquini) [1768386 1730471]
  - [mm] rmap: fix theoretical race between do_wp_page and shrink_active_list (Rafael Aquini) [1768386 1730471]
  - [mm] mm/mremap.c: clean up goto just return ERR_PTR (Rafael Aquini) [1768386 1730471]
  - [mm] mremap should return -ENOMEM when __vm_enough_memory fail (Rafael Aquini) [1768386 1730471]
  - [mm] writeback: fix possible underflow in write bandwidth calculation (Rafael Aquini) [1768386 1730471]
  - [mm] writeback: add missing INITIAL_JIFFIES init in global_update_bandwidth() (Rafael Aquini) [1768386 1730471]
  - [mm] mm/memory.c: actually remap enough memory (Rafael Aquini) [1768386 1730471]
  - [mm] mm/compaction: fix wrong order check in compact_finished() (Rafael Aquini) [1768386 1730471]
  - [mm] mm, vmscan: prevent kswapd livelock due to pfmemalloc-throttled process being killed (Rafael Aquini) [1768386 1730471]
  - [mm] mm: fix anon_vma_clone() error treatment (Rafael Aquini) [1768386 1730471]
  - [mm] mm, thp: fix collapsing of hugepages on madvise (Rafael Aquini) [1768386 1730471]
  - [mm] cgroup/kmemleak: add kmemleak_free() for cgroup deallocations (Rafael Aquini) [1768386 1730471]
  - [mm] OOM, PM: OOM killed task shouldn't escape PM suspend (Rafael Aquini) [1768386 1730471]
  - [mm] mm, compaction: pass gfp mask to compact_control (Rafael Aquini) [1768386 1730471]
  - [mm] mm: page_alloc: abort fair zone allocation policy when remotes nodes are encountered (Rafael Aquini) [1768386 1730471]
  - [mm] mm: vmscan: only update per-cpu thresholds for online CPU (Rafael Aquini) [1768386 1730471]
  - [mm] mm, thp: replace smp_mb after atomic_add by smp_mb__after_atomic (Rafael Aquini) [1768386 1730471]
  - [mm] mm, thp: move invariant bug check out of loop in __split_huge_page_map (Rafael Aquini) [1768386 1730471]
  - [mm] thp: consolidate assert checks in __split_huge_page() (Rafael Aquini) [1768386 1730471]
  - [mm] mm: fix sleeping function warning from __put_anon_vma (Rafael Aquini) [1768386 1730471]
  - [mm] mm: cleanup add_to_page_cache_locked() (Rafael Aquini) [1768386 1730471]
  - [mm] mm: mempolicy: turn vma_set_policy() into vma_dup_policy() (Rafael Aquini) [1768386 1730471]
  - [powerpc] powerpc/pseries: correctly track irq state in default idle (Steve Best) [1767620 1751970]
  - [mm] mm: prevent get_user_pages() from overflowing page refcount (Aristeu Rozanski) [1705004 1705005] {CVE-2019-11487}
  - [mm] mm/hugetlb.c: __get_user_pages ignores certain follow_hugetlb_page errors (Aristeu Rozanski) [1705004 1705005] {CVE-2019-11487}


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.2.1.el7]
changelog:
  - [x86] aesni: initialize gcm(aes) cryptd child's key/authsize (Sabrina Dubroca) [1744442 1698551]
  - [netdrv] bnx2x: Disable multi-cos feature (Manish Chopra) [1741926 1704157]


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.3.1.el7]
changelog:
  - [net] Bluetooth: Fix faulty expression for minimum encryption key size check (Gopal Tiwari) [1743084 1743085] {CVE-2019-9506}
  - [net] Bluetooth: Fix regression with minimum encryption key size alignment (Gopal Tiwari) [1743084 1743085] {CVE-2019-9506}
  - [net] Bluetooth: Align minimum encryption key size for LE and BR/EDR connections (Gopal Tiwari) [1743084 1743085] {CVE-2019-9506}
  - [net] macvlan: Support bonding events (Davide Caratti) [1751579 1733589]
  - [wireless] mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies() (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [wireless] mwifiex: Mark expected switch fall-through (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [wireless] mwifiex: Fix skipped vendor specific IEs (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [wireless] mwifiex: fix 802.11n/WPA detection (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [wireless] mwifiex: Don't abort on small, spec-compliant vendor IEs (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [wireless] mwifiex: Abort at too short BSS descriptor element (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [wireless] mwifiex: Fix possible buffer overflows at parsing bss descriptor (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [net] sunrpc: Fix possible autodisconnect during connect due to old last_used (Dave Wysochanski) [1749290 1723537]
  - [drm] drm/ast: Fixed reboot test may cause system hanged (Dave Airlie) [1749296 1739971]
  - [block] block: blk_init_allocated_queue() set q->fq as NULL in the fail case (Ming Lei) [1739326 1739327] {CVE-2018-20856}
  - [pci] PCI: hv: Fix a use-after-free bug in hv_eject_device_work() (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: Add pci_destroy_slot() in pci_devices_present_work(), if necessary (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: Add hv_pci_remove_slots() when we unload the driver (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: Fix a memory leak in hv_eject_device_work() (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: support reporting serial number as slot information (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: Remove unused reason for refcount handler (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: Convert hv_pci_dev.refs from atomic_t to refcount_t (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: Remove the bogus test in hv_eject_device_work() (Mohammed Gamal) [1748239 1732924]
  - [fs] NFSv4: Replace closed stateids with the "invalid special stateid" (Steve Dickson) [1744946 1733347]
  - [nvme] nvme-rdma: use dynamic dma mapping per command (David Milburn) [1744444 1637693]
  - [nvme] nvme-rdma: remove redundant reference between ib_device and tagset (David Milburn) [1744444 1637693]
  - [nvme] nvme-rdma: always have a valid trsvcid (David Milburn) [1744443 1717536]
  - [nvme] nvme-rdma: use inet_pton_with_scope helper (David Milburn) [1744443 1717536]
  - [nvme] nvmet-rdma: use generic inet_pton_with_scope (David Milburn) [1744443 1717536]
  - [iommu] x86/hyper-v: add msi_setup_irq/msi_alloc_irq stubs to fix x2apic mode (Vitaly Kuznetsov) [1743324 1736750]
  - [mm] slub: make dead caches discard free slabs immediately (Aristeu Rozanski) [1741920 1649189]
  - [mm] mm: charge/uncharge kmemcg from generic page allocator paths (Aristeu Rozanski) [1741920 1649189]
  - [mm] memcg: do not account memory used for cache creation (Aristeu Rozanski) [1741920 1649189]
  - [mm] memcg: also test for skip accounting at the page allocation level (Aristeu Rozanski) [1741920 1649189]
  - [fs] kmemcg: account certain kmem allocations to memcg (Aristeu Rozanski) [1741920 1649189]
  - [mm] vmalloc: allow to account vmalloc to memcg (Aristeu Rozanski) [1741920 1649189]
  - [mm] slab: add SLAB_ACCOUNT flag (Aristeu Rozanski) [1741920 1649189]
  - [include] memcg: only account kmem allocations marked as __GFP_ACCOUNT (Aristeu Rozanski) [1741920 1649189]
  - [include] mm: get rid of __GFP_KMEMCG (Aristeu Rozanski) [1741920 1649189]
  - [mm] slb: charge slabs to kmemcg explicitly (Aristeu Rozanski) [1741920 1649189]
  - [mm] mm: rename allocflags_to_migratetype for clarity (Rafael Aquini) [1741920 1730471]
  - [x86] cpuidle-haltpoll: disable host side polling when kvm virtualized (Marcelo Tosatti) [1740192 1734501]
  - [kvm] kvm: x86: add host poll control msrs (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: add haltpoll governor (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] governors: unify last_state_idx (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: add poll_limit_ns to cpuidle_device structure (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] add cpuidle-haltpoll driver (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: poll_state: Fix default time limit (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: poll_state: Disregard disable idle states (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: poll_state: Revise loop termination condition (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: menu: Fix wakeup statistics updates for polling state (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: poll_state: Avoid invoking local_clock() too often (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: poll_state: Add time limit to poll_idle() (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: Move polling state initialization code to separate file (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: Remove time measurement in poll state (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: Set polling in poll_idle (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: dont call poll_idle_init() for every cpu (Marcelo Tosatti) [1740192 1734501]
  - [hv] hv: vmbus: Implement Direct Mode for stimer0 (Vitaly Kuznetsov) [1740188 1712344]
  - [kernel] sched: Reduce contention in update_cfs_rq_blocked_load() (Marcelo Tosatti) [1740180 1734515]
  - [ipc] ipc: drop non-RCU allocation (Vladis Dronov) [1740178 1733016]
  - [ipc] ipc/util.c: use kvfree() in ipc_rcu_free() (Vladis Dronov) [1740178 1733016]
  - [ipc] tree wide: use kvfree() than conditional kfree()/vfree() (Vladis Dronov) [1740178 1733016]
  - [ipc] standardize code comments (Waiman Long) [1740178 1373519]
  - [ipc] whitespace cleanup (Waiman Long) [1740178 1373519]
  - [fs] gfs2: gfs2_walk_metadata fix (Andreas Grunbacher) [1737373 1724362]
  - [fs] gfs2: Inode dirtying fix (Andreas Grunbacher) [1737373 1724362]
  - [fs] gfs2: Fix rounding error in gfs2_iomap_page_prepare (Andreas Grunbacher) [1737373 1724362]
  - [fs] iomap: fix page_done callback for short writes (Andreas Grunbacher) [1737373 1724362]
  - [fs] fs: fold __generic_write_end back into generic_write_end (Andreas Grunbacher) [1737373 1724362]
  - [fs] iomap: don't mark the inode dirty in iomap_write_end (Andreas Grunbacher) [1737373 1724362]
  - [fs] gfs2: Fix iomap write page reclaim deadlock (Andreas Grunbacher) [1737373 1724362]
  - [fs] iomap: Add a page_prepare callback (Andreas Grunbacher) [1737373 1724362]
  - [fs] iomap: Fix use-after-free error in page_done callback (Andreas Grunbacher) [1737373 1724362]
  - [fs] fs: Turn __generic_write_end into a void function (Andreas Grunbacher) [1737373 1724362]
  - [fs] iomap: Clean up __generic_write_end calling (Andreas Grunbacher) [1737373 1724362]


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.4.2.el7]
changelog:
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1756815 1756816] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1756815 1756816] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Use explicit goto for error paths (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [x86] tsx: Add config options to set tsx=on|off|auto (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] tsx: Add "auto" option to the tsx= cmdline parameter (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] speculation/taa: Add sysfs reporting for TSX Async Abort (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] speculation/taa: Add mitigation for TSX Async Abort (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] cpu: Add a "tsx=" cmdline option with TSX disabled by default (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] cpu: Add a helper function x86_read_arch_cap_msr() (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] msr: Add the IA32_TSX_CTRL MSR (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [documentation] documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: mmu: Recovery of shattered NX large pages (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [virt] kvm: Add helper function for creating VM worker threads (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: mmu: ITLB_MULTIHIT mitigation (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [kernel] cpu/speculation: Uninline and export CPU mitigations helpers (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] cpu: Add Tremont to the cpu vulnerability whitelist (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: vmx, svm: always run with EFER.NXE=1 when shadow paging is active (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: add tracepoints around __direct_map and FNAME(fetch) (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: remove now unneeded hugepage gfn adjustment (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: make FNAME(fetch) and __direct_map more similar (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: mmu: Do not release the page inside mmu_set_spte() (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: mmu: Remove unused parameter of __direct_map() (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [virt] kvm: Convert kvm_lock to a mutex (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: mmu: drop vcpu param in gpte_access (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [virt] kvm: x86, powerpc: do not allow clearing largepages debugfs entry (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.4.3.el7]
changelog:
  - [drm] drm/i915/cmdparser: Fix jump whitelist clearing (Dave Airlie) [1756882 1756883] {CVE-2019-0155}


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-1054.el7]
changelog:
  - [pci] Rework pcie_retrain_link() wait loop (Myron Stowe) [1677010]
  - [pci] Work around Pericom PCIe-to-PCI bridge Retrain Link erratum (Myron Stowe) [1677010]
  - [pci] Factor out pcie_retrain_link() function (Myron Stowe) [1677010]
  - [cpufreq] intel_pstate: Ignore turbo active ratio in HWP (David Arcari) [1711969]
  - [fs] vmcore: Add a kernel parameter novmcoredd (Kairui Song) [1705859]
  - [netdrv] bonding/802.3ad: fix slave link initialization transition states (Jarod Wilson) [1702807]
  - [netdrv] rtw88: new Realtek 802.11ac driver (Stanislaw Gruszka) [1487002 1487018]
  - [kernel] bitfield: fix *_encode_bits() (Stanislaw Gruszka) [1487002 1487018]
  - [kernel] Add primitives for manipulating bitfields both in host- and fixed-endian (Stanislaw Gruszka) [1487002 1487018]
  - [netdrv] phy: turn carrier off on phy attach (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: add generic Realtek PHY driver (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: load driver for all PHYs with a Realtek OUI (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: fix RTL8201F sysfs name (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: Support RTL8366RB variant (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: add missing entry for RTL8211C to mdio_device_id table (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: add support for RTL8211C (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: add missing entry for RTL8211 to mdio_device_id table (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: add support for RTL8211 (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: add suspend/resume callbacks for RTL8211B (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: Use the dummy stubs for MMD register access for rtl8211b (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: use new helpers for paged register access (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: add utility functions to read/write page addresses (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: use the same indentation for all #defines (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: group all register bit #defines for RTL821x_INER (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: rename RTL821x_INER_INIT to RTL8211B_INER_INIT (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: use the BIT and GENMASK macros (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: fix RTL8211F interrupt mode (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: add RTL8201F phy-id and functions (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: rename RTL8211F_PAGE_SELECT to RTL821x_PAGE_SELECT (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: fix enabling of the TX-delay for RTL8211F (Corinna Vinschen) [1706531]
  - [netdrv] phy: add RealTek RTL8211DN phy id (Corinna Vinschen) [1706531]
  - [netdrv] phy: Add support for Realtek RTL8211F (Corinna Vinschen) [1706531]
  - [netdrv] phy: export genphy_config_init() (Corinna Vinschen) [1706531]
  - [netdrv] phy: realtek: register/unregister multiple drivers properly (Corinna Vinschen) [1706531]
  - [netdrv] phy: Add RTL8201CP phy_driver to realtek (Corinna Vinschen) [1706531]
  - [netdrv] phy: rtl8211: fix interrupt on status link change (Corinna Vinschen) [1706531]
  - [nvme] fix memory leak for power latency tolerance (David Milburn) [1541904]
  - [base] pm / qos: Fix memory leak on resume_latency.notifiers (David Milburn) [1541904]
  - [x86] kvm: x86: use correct privilege level for sgdt/sidt/fxsave/fxrstor access (Paolo Bonzini) [1657358] {CVE-2018-10853}
  - [x86] kvm: x86: pass kvm_vcpu to kvm_read_guest_virt and kvm_write_guest_virt_system (Paolo Bonzini) [1657358] {CVE-2018-10853}
  - [x86] kvm: x86: introduce linear_{read,write}_system (Paolo Bonzini) [1657358] {CVE-2018-10853}
  - [x86] Update stepping values for Whiskey Lake U/Y (David Arcari) [1704810]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-950.el7]
changelog:
  - [kernel] posix-timer: Properly check sigevent->sigev_notify (Phil Auld) [1613711] {CVE-2017-18344}
  - [sound] alsa: rawmidi: Change resized buffers atomically (Denys Vlasenko) [1593087] {CVE-2018-10902}
  - [fs] Fix up non-directory creation in SGID directories (Miklos Szeredi) [1600953] {CVE-2018-13405}
  - [fs] pnfs: Layoutreturn must free the layout after the layout-private data (Scott Mayhew) [1625517]
  - [fs] sunrpc: Ensure we always close the socket after a connection shuts down (Steve Dickson) [1614950]
  - [fs] xfs: remove filestream item xfs_inode reference (Brian Foster) [1518623]
  - [mm] set IORESOURCE_SYSTEM_RAM to system RAM to fix memory hot-add failure (Larry Woodman) [1628349]
  - [firmware] efivars: Protect DataSize and Data in efivar_entry.var (Lenny Szubowicz) [1597868]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-951.el7]
changelog:
  - [fs] fanotify: fix logic of events on child (Miklos Szeredi) [1597738]
  - [fs] cifs: add a check for session expiry (Leif Sahlberg) [1626358]
  - [fs] xfs: completely disable per-inode DAX behavior (Eric Sandeen) [1623150]
  - [fs] fs: get_rock_ridge_filename(): handle malformed NM entries (Bill O'Donnell) [1340778] {CVE-2016-4913}
  - [md] fix 'allow faster resync only on non-rotational media' underneath dm (Nigel Croxon) [1561162]
  - [md] Revert "allow faster resync only on non-rotational media" (Nigel Croxon) [1561162]
  - [mm] madvise: fix madvise() infinite loop under special circumstances (Rafael Aquini) [1552982] {CVE-2017-18208}
  - [infiniband] srpt: Support HCAs with more than two ports (Don Dutile) [1616192]
  - [infiniband] overflow.h: Add allocation size calculation helpers (Don Dutile) [1616192]
  - [net] ip_tunnel: clean the GSO bits properly (Flavio Leitner) [1607907]
  - [kernel] revert cpuset: fix a warning when clearing configured masks in old hierarchy (Aristeu Rozanski) [1626943]
  - [s390] sclp: Change SCLP console default buffer-full behavior (Hendrik Brueckner) [1625350]
  - [x86] kvm: Take out __exit annotation in vmx_exit() (Waiman Long) [1626560]
  - [x86] mark coffeelake-s 8+2 as supported (David Arcari) [1575457]
  - [x86] kvm: vmx: fixes for vmentry_l1d_flush module parameter (Marcelo Tosatti) [1619602]
  - [x86] speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry (Marcelo Tosatti) [1619602]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-952.el7]
changelog:
  - [netdrv] mlx5e: IPoIB, Use priv stats in completion rx flow (Alaa Hleihel) [1618609]
  - [netdrv] mlx5e: IPoIB, Add ndo stats support for IPoIB child devices (Alaa Hleihel) [1618609]
  - [netdrv] mlx5e: IPoIB, Add ndo stats support for IPoIB netdevices (Alaa Hleihel) [1618609]
  - [netdrv] mlx5e: IPoIB, Initialize max_opened_tc in mlx5i_init flow (Alaa Hleihel) [1618609]
  - [netdrv] mlx5e: Present SW stats when state is not opened (Alaa Hleihel) [1618609]
  - [netdrv] mlx5e: Avoid reset netdev stats on configuration changes (Alaa Hleihel) [1618609]
  - [netdrv] mlx5e: Use bool as return type for mlx5e_xdp_handle (Alaa Hleihel) [1618609]
  - [netdrv] net: aquantia: memory corruption on jumbo frames (Igor Russkikh) [1628238]
  - [kernel] revert "platform/uv: Add adjustable set memory block size function" (Baoquan He) [1625143]
  - [x86] revert "mm: probe memory block size for generic x86 64bit" (Baoquan He) [1625143]
  - [x86] revert "mm: Use 2GB memory block size on large-memory x86-64 systems" (Baoquan He) [1625143]
  - [x86] revert "mm: Streamline and restore probe_memory_block_size()" (Baoquan He) [1625143]
  - [x86] revert "mm/memory_hotplug: determine block size based on the end of boot memory" (Baoquan He) [1625143]
  - [mm] revert "memory_hotplug: do not fail offlining too early" (Baoquan He) [1625143]
  - [mm] revert "memory_hotplug: remove timeout from __offline_memory" (Baoquan He) [1625143]
  - [kernel] revert "x86/platform/uv: Add adjustable set memory block size function" (Baoquan He) [1625143]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-953.el7]
changelog:
  - [cdrom] information leak in cdrom_ioctl_media_changed() (Sanskriti Sharma) [1578207] {CVE-2018-10940}
  - [mm] mlock: remove lru_add_drain_all() (Oleksandr Natalenko) [1624765]
  - [block] blk-mq: fix race between updating nr_hw_queues and switching io sched (Ming Lei) [1619988]
  - [block] blk-mq: avoid to map CPU into stale hw queue (Ming Lei) [1619988]
  - [block] blk-mq: fix sysfs inflight counter (Ming Lei) [1548261]
  - [block] blk-mq: count allocated but not started requests in iostats inflight (Ming Lei) [1548261]
  - [block] fix a crash caused by wrong API (Ming Lei) [1548261]
  - [block] blk-mq: enable checking two part inflight counts at the same time (Ming Lei) [1548261]
  - [block] blk-mq: provide internal in-flight variant (Ming Lei) [1548261]
  - [block] make part_in_flight() take an array of two ints (Ming Lei) [1548261]
  - [block] pass in queue to inflight accounting (Ming Lei) [1548261]
  - [x86] Mark Intel Cascade Lake supported (Steve Best) [1584343]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-954.el7]
changelog:
  - [fs] exec: Limit arg stack to at most 75 of _STK_LIM (Yauheni Kaliuta) [1625991] {CVE-2018-14634}
  - [fs] exec: account for argv/envp pointers (Yauheni Kaliuta) [1625991] {CVE-2018-14634}
  - [kernel] revert "sched/topology: Introduce NUMA identity node sched domain" (Gustavo Duarte) [1620031]
  - [powerpc] revert "powernv: Add a virtual irqchip for opal events" (Gustavo Duarte) [1617966]
  - [powerpc] revert "powernv: Reorder OPAL subsystem initialisation" (Gustavo Duarte) [1617966]
  - [char] revert "ipmi/powernv: Convert to irq event interface" (Gustavo Duarte) [1617966]
  - [tty] revert "hvc: Convert to using interrupts instead of opal events" (Gustavo Duarte) [1617966]
  - [powerpc] revert "powernv/eeh: Update the EEH code to use the opal irq domain" (Gustavo Duarte) [1617966]
  - [powerpc] revert "powernv/opal: Convert opal message events to opal irq domain" (Gustavo Duarte) [1617966]
  - [powerpc] revert "powernv/elog: Convert elog to opal irq domain" (Gustavo Duarte) [1617966]
  - [powerpc] revert "powernv/opal-dump: Convert to irq domain" (Gustavo Duarte) [1617966]
  - [powerpc] revert "opal: Remove events notifier" (Gustavo Duarte) [1617966]
  - [powerpc] revert "powernv: Increase opal-irqchip initcall priority" (Gustavo Duarte) [1617966]
  - [powerpc] revert "opal-irqchip: Fix double endian conversion" (Gustavo Duarte) [1617966]
  - [powerpc] revert "opal-irqchip: Fix deadlock introduced by "Fix double endian conversion"" (Gustavo Duarte) [1617966]
  - [sound] alsa: hda/realtek - two more lenovo models need fixup of MIC_LOCATION (Jaroslav Kysela) [1611958]
  - [sound] alsa: hda/realtek - Fix the problem of two front mics on more machines (Jaroslav Kysela) [1611958]
  - [sound] alsa: hda/realtek - Enable mic-mute hotkey for several Lenovo AIOs (Jaroslav Kysela) [1611958]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-955.el7]
changelog:
  - [netdrv] net/mlx5e: IPoIB, Set the netdevice sw mtu in ipoib enhanced flow (Alaa Hleihel) [1633652]
  - [netdrv] net/mlx5e: Fix traffic between VF and representor (Alaa Hleihel) [1633652]
  - [mm] vmscan: do not loop on too_many_isolated for ever (Waiman Long) [1632050]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-956.el7]
changelog:
  - [block] blk-mq: fix hctx debugfs entry related race between update hw queues and cpu hotplug (Ming Lei) [1619988]
  - [nvme] nvme-pci: unquiesce dead controller queues (Ming Lei) [1632424]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-957.el7]
changelog:
  - [mm] mlock: avoid increase mm->locked_vm on mlock() when already mlock2(, MLOCK_ONFAULT) (Rafael Aquini) [1633059]


author: John Mcwalters <john.mcwalters@oracle.com> - [3.10.0-957.el7.OL7]
changelog:
  - Oracle Linux certificates (Alexey Petrenko)
  - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com)
  - Update x509.genkey [bug 24817676]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.1.1.el7]
changelog:
  - [x86] boot: Fix kexec booting failure in the SEV bit detection code (Kairui Song) [1644990 1628828]
  - [net] 8021q: create device with all possible features in wanted_features (Davide Caratti) [1644675 1640645]
  - [mm] memcontrol: fix high scheduling latency source in mem_cgroup_reparent_charges (Andrea Arcangeli) [1644673 1632898]
  - [kernel] cpuset: use trialcs->mems_allowed as a temp variable (Aristeu Rozanski) [1644236 1613248]
  - [kernel] cpuset: fix a warning when clearing configured masks in old hierarchy (Aristeu Rozanski) [1644236 1613248]
  - [kernel] cpuset: initialize effective masks when clone_children is enabled (Aristeu Rozanski) [1644236 1613248]
  - [x86] efi: Only load initrd above 4g on second try (Lenny Szubowicz) [1643359 1608955]
  - [x86] efi: Support initrd loaded above 4G (Lenny Szubowicz) [1643359 1608955]
  - [x86] efi: Generalize handle_ramdisks() and rename to handle_cmdline_files() (Lenny Szubowicz) [1643359 1608955]
  - [kernel] sched/fair: Fix throttle_list starvation with low CFS quota (Phil Auld) [1640675 1601153]
  - [target] scsi: iscsi: Use bin2hex instead of a re-implementation (Maurizio Lombardi) [1634711 1627034] {CVE-2018-14633}
  - [target] scsi: iscsi: Use hex2bin instead of a re-implementation (Maurizio Lombardi) [1634711 1627034] {CVE-2018-14633}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.1.2.el7]
changelog:
  - [net] rtnetlink: give a user socket to get_target_net() (Jiri Benc) [1639635 1630694] {CVE-2018-14646}
  - [net] Add variants of capable for use on on sockets (Jiri Benc) [1639635 1630694] {CVE-2018-14646}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.2.1.el7]
changelog:
  - [md] Simplify ternary operations (Xiao Ni) [1655046 1627563]
  - [x86] Mark Intel Cascade Lake supported (Steve Best) [1650213 1639980]
  - [net] rtnetlink: give a user socket to get_target_net() (Jiri Benc) [1639635 1630694] {CVE-2018-14646}
  - [net] Add variants of capable for use on on sockets (Jiri Benc) [1639635 1630694] {CVE-2018-14646}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.3.1.el7]
changelog:
  - [mm] userfaultfd: allow get_mempolicy(MPOL_F_NODE|MPOL_F_ADDR) to trigger userfaults (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [mm] userfaultfd: shmem: uffdio_copy: set the page dirty if VM_WRITE is not set (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [mm] userfaultfd: shmem: add i_size checks (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [mm] userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [mm] userfaultfd: shmem: allocate anonymous memory for MAP_PRIVATE shmem (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [mm] userfaultfd: use ENOENT instead of EFAULT if the atomic copy user fails (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [fs] userfaultfd: disable irqs when taking the waitqueue lock (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [fs] userfaultfd.c: remove redundant pointer uwq (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [fs] userfaultfd: remove uffd flags from vma->vm_flags if UFFD_EVENT_FORK fails (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [fs] userfaultfd: hugetlbfs: fix userfaultfd_huge_must_wait() pte access (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [mm] userfaultfd: prevent non-cooperative events vs mcopy_atomic races (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [fs] userfaultfd: convert to use anon_inode_getfd() (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [fs] mm, userfaultfd, thp: avoid waiting when PMD under THP migration (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [net] packet: fix a race in packet_bind() and packet_notifier() (Andrea Claudi) [1643680 1643681] {CVE-2018-18559}
  - [x86] kvm: x86: ensure all MSRs can always be KVM_GET/SET_MSR'd (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: x86: #GP when guest attempts to write MCi_STATUS register w/o 0 (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/hyper-v: inject #GP only when invalid SINTx vector is unmasked (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/hyper-v: remove stale entries from vec_bitmap/auto_eoi_bitmap on vector change (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: x86: hyperv: avoid livelock in oneshot SynIC timers (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: x86: hyperv: add KVM_CAP_HYPERV_SYNIC2 (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: Add kvm_vcpu_get_idx to get vcpu index in kvm->vcpus (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: x86: fix NULL deref in vcpu_scan_ioapic (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: x86: use delivery to self in hyperv synic (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: x86: hyperv: make function static to avoid compiling warning (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: hyper-v: do not do hypercall userspace exits if SynIC is disabled (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V VMBus hypercall userspace exit (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Reject Hyper-V hypercall continuation (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V SynIC timers tracepoints (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V SynIC tracepoints (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Update SynIC timers on guest entry only (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Skip SynIC vector check for QEMU side (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V fix SynIC timer disabling condition (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Reorg stimer_expiration() to better control timer restart (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V unify stimer_start() and stimer_restart() (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Drop stimer_stop() function (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V timers fix incorrect logical operation (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Remove Hyper-V SynIC timer stopping (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V SynIC timers (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V SynIC message slot pending clearing at SINT ack (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Added Hyper-V vcpu_to_hv_vcpu()/hv_vcpu_to_vcpu() helpers (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Rearrange func's declarations inside Hyper-V header (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V kvm exit (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V synthetic interrupt controller (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: split ioapic-handled and EOI exit bitmaps (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/irqchip: kvm_arch_irq_routing_update renaming split (Vitaly Kuznetsov) [1647097 1631439]
  - [pinctrl] cannonlake: Fix HOSTSW_OWN register offset of H variant (Benjamin Tissoires) [1647720 1647717 1609926 1544041]
  - [pinctrl] cannonlake: Fix gpio base for GPP-E (Benjamin Tissoires) [1647720 1647717 1609926 1544041]
  - [pinctrl] cannonlake: Fix community ordering for H variant (Benjamin Tissoires) [1647720 1647717 1609926 1544041]
  - [pinctrl] intel: Do pin translation in other GPIO operations as well (Benjamin Tissoires) [1647720 1647717 1609926 1544041]
  - [pinctrl] intel: Implement intel_gpio_get_direction callback (Benjamin Tissoires) [1647720 1647717 1609926 1544041]
  - [platform] x86: dell-smbios-wmi: Correct a memory leak (Jarod Wilson) [1647706 1640399]
  - [scsi] qedi: Initialize the stats mutex lock (Chad Dupuis) [1646870 1633638]
  - [s390] facilites: use stfle_fac_list array size for MAX_FACILITY_BIT (Hendrik Brueckner) [1646868 1628088]
  - [netdrv] qed: Add missing device config for RoCE EDPM in UFP mode (Chad Dupuis) [1646866 1631593]
  - [netdrv] qed: Do not add VLAN 0 tag to untagged frames in multi-function mode (Chad Dupuis) [1646866 1631593]
  - [netdrv] qed: Fix populating the invalid stag value in multi function mode (Chad Dupuis) [1646866 1631593]
  - [netdrv] qed: Fix link flap issue due to mismatching EEE capabilities (Chad Dupuis) [1645150 1636398]
  - [netdrv] qed: Fix shmem structure inconsistency between driver and the mfw (Chad Dupuis) [1645149 1634156]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.4.1.el7]
changelog:
  - [net] macsec: let the administrator set UP state even if lowerdev is down (Sabrina Dubroca) [1658970 1626004]
  - [net] macsec: update operstate when lower device changes (Sabrina Dubroca) [1658970 1626004]
  - [fs] nfsv4.x: fix lock recovery during delegation recall (Steve Dickson) [1657840 1634086]
  - [fs] cifs: Fix autonegotiate security settings mismatch (Leif Sahlberg) [1657841 1650148]
  - [md] raid1: panic because of using freed memory (Xiao Ni) [1656500 1632575]
  - [pci] Match Root Port's MPS to endpoint's MPSS as necessary (Myron Stowe) [1656395 1524000]
  - [pci] Skip MPS logic for Virtual Functions (VFs) (Myron Stowe) [1656395 1524000]
  - [x86] kvm: vmx: re-add ple_gap module parameter (Gary Hook) [1656393 1652933]
  - [iommu] vt-d: Fix iotlb psi missing for mappings (Peter Xu) [1653592 1623856]
  - [iommu] vt-d: Introduce __mapping_notify_one() (Peter Xu) [1653592 1623856]
  - [scsi] libfc: retry PRLI if we cannot analyse the payload (Chris Leech) [1655045 1631130]
  - [scsi] libfc: Do not drop down to FLOGI for fc_rport_login() (Chris Leech) [1655044 1625721]
  - [scsi] libfc: Do not login if the port is already started (Chris Leech) [1655044 1625721]
  - [scsi] libfc: don't advance state machine for incoming FLOGI (Chris Leech) [1655044 1625721]
  - [gpu] drm/i915: Add short HPD IRQ storm detection for non-MST systems (Lyude Paul) [1654733 1608704]
  - [gpu] drm/i915: Clarify flow for disabling IRQs on storms (Lyude Paul) [1654733 1608704]
  - [gpu] drm/i915: Fix threshold check in intel_hpd_irq_storm_detect() (Lyude Paul) [1654733 1608704]
  - [gpu] drm/i915: Fix NULL deref when re-enabling HPD IRQs on systems with MST (Lyude Paul) [1654733 1608704]
  - [gpu] drm/i915: Fix possible race in intel_dp_add_mst_connector() (Lyude Paul) [1654733 1608704]
  - [iommu] amd: Clear memory encryption mask from physical address (Gary Hook) [1649025 1643293]
  - [security] Make [un]register_lsm_notifier() null ops if !selinux_enabled (Don Dutile) [1648811 1621072]
  - [netdrv] bonding/802.3ad: fix link_failure_count tracking (Jarod Wilson) [1648294 1641660]
  - [block] nvme: do not require GENERIC_HARDIRQ interfaces on s390 (Hendrik Brueckner) [1648239 1637637]
  - [nvme] nvme-pci: add a memory barrier to nvme_dbbuf_update_and_check_event (David Milburn) [1648240 1630481]
  - [x86] kprobes: Use 5-byte NOP when the code might be modified by ftrace (Josh Poimboeuf) [1647816 1577050]
  - [fs] userfaultfd: check VM_MAYWRITE was set after verifying the uffd is registered (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.5.1.el7]
changelog:
  - [fs] revert "[fs] sunrpc: Ensure we always close the socket after a connection shuts down" (Dave Wysochanski) [1660784 1657399]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.7.1.el7]
changelog:
  - [scsi] lpfc: do not set queue->page_count to 0 if pc_sli4_params.wqpcnt is invalid (Ewan Milne) [1664067 1657981]
  - [scsi] qla2xxx: Delete session for nport id change (Himanshu Madhani) [1663508 1628301]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.8.1.el7]
changelog:
  - [tty] add rwsem to close race between copy_from_read_buf calls and reset_buffer_flags (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Fix stall at n_tty_receive_char_special() (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] audit: Fix audit source (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Fix auditing support for cannonical mode (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Fix 4096-byte canonical reads (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Remove read_cnt (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Don't wrap input buffer indices at buffer size (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Get read_cnt through accessor (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] Deprecate ldisc .chars_in_buffer() method (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Split n_tty_chars_in_buffer() for reader-only interface (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Line copy to user buffer in canonical mode (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Factor canonical mode copy from n_tty_read() (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] Make ldisc input flow control concurrency-friendly (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] Simplify tty buffer/ldisc interface with helper function (Christoph von Recklinghausen) [1660815 1649343]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.9.1.el7]
changelog:
  - [input] psmouse: fix button reporting for basic protocols (Benjamin Tissoires) [1662848 1658669]
  - [input] psmouse: add support for 2nd wheel on A4Tech Dual-Scroll wheel mice (Benjamin Tissoires) [1662848 1658669]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.10.1.el7]
changelog:
  - [fs] revert "[fs] nfs: Don't write back further requests if there is a pending write error" (Benjamin Coddington) [1672510 1656674]
  - [fs] cifs: connect to servername instead of IP for IPC$ share (Leif Sahlberg) [1672448 1647844]
  - [acpi] nfit: Fix command-supported detection (Charles Rose) [1671743 1665811]
  - [acpi] nfit: Block function zero DSMs (Charles Rose) [1671743 1665811]
  - [x86] efi-bgrt: Replace early_memremap() with memremap() (Lenny Szubowicz) [1671745 1481667]
  - [x86] efi-bgrt: Replace ioremap() with early_memremap() (Lenny Szubowicz) [1671745 1481667]
  - [scsi] libiscsi: Allow sd_shutdown on bad transport (Chris Leech) [1670680 1630979]
  - [block] blk-mq: punt failed direct issue to dispatch list (Ming Lei) [1670511 1656654]
  - [block] blk-mq: fix corruption with direct issue (Ming Lei) [1670511 1656654]
  - [powerpc] rtas: Fix a potential race between CPU-Offline & Migration (Steve Best) [1669044 1650249]
  - [powerpc] pseries: Disable CPU hotplug across migrations (Steve Best) [1669044 1650249]
  - [md] Add split counter for raid1 write request in the right place (Xiao Ni) [1668208 1659951]
  - [lib] string_helpers.c: fix infinite loop in string_get_size() (Ewan Milne) [1667989 1660565]
  - [kernel] stop_machine: Atomically queue and wake stopper threads (Phil Auld) [1667328 1557061]
  - [kernel] stop_machine: Disable preemption after queueing stopper threads (Phil Auld) [1667328 1557061]
  - [kernel] stop_machine: Disable preemption when waking two stopper threads (Phil Auld) [1667328 1557061]
  - [kernel] stop_machine, sched: Fix migrate_swap() vs. active_balance() deadlock (Phil Auld) [1667328 1557061]
  - [kernel] stop_machine: Make cpu_stop_queue_work() and stop_one_cpu_nowait() return bool (Phil Auld) [1667328 1557061]
  - [fs] proc: restrict kernel stack dumps to root (Joe Lawrence) [1642401 1638194] {CVE-2018-17972}
  - [fs] proc: use "unsigned int" for /proc/*/stack (Joe Lawrence) [1642401 1638194] {CVE-2018-17972}
  - [fs] libceph: fall back to sendmsg for slab pages (Ilya Dryomov) [1665814 1647460]
  - [scsi] csiostor: remove flush_scheduled_work() (Arjun Vynipadath) [1665370 1660882]
  - [pci] shpchp: Separate existence of SHPC and permission to use it (Myron Stowe) [1663241 1633873]
  - [pci] shpchp: Manage SHPC unconditionally on non-ACPI systems (Myron Stowe) [1663241 1633873]
  - [pci] shpchp: Fix AMD POGO identification (Myron Stowe) [1663241 1633873]
  - [mm] memcontrol: factor out reclaim iterator loading and updating (Aristeu Rozanski) [1663114 1595932]
  - [net] xfrm: policy: init locks early (Herbert Xu) [1660887 1641866]
  - [kernel] mm: clear __GFP_FS when PF_MEMALLOC_NOIO is set (Rafael Aquini) [1660392 1657714]
  - [nvme] flush namespace scanning work just before removing namespaces (Ewan Milne) [1659937 1622487]
  - [fs] fuse: don't need GETATTR after every READ (Miklos Szeredi) [1657921 1648781]
  - [fs] fuse: don't invalidate attrs when not using atime (Miklos Szeredi) [1657921 1648781]
  - [net] Set sk_prot_creator when cloning sockets to the right proto (Andrea Claudi) [1657351 1657352] {CVE-2018-9568}
  - [kernel] bpf: 32-bit RSH verification must truncate input before the ALU op (Jiri Olsa) [1641387 1641388] {CVE-2018-18445}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.11.1.el7]
changelog:
  - [net] netfilter: nf_nat: skip nat clash resolution for same-origin entries (Florian Westphal) [1686766 1648965]
  - [net] netfilter: nf_conntrack: resolve clash for matching conntracks (Florian Westphal) [1686766 1648965]
  - [net] netfilter: conntrack: skip clash resolution if nat is in place (Florian Westphal) [1686766 1648965]
  - [net] netfilter: conntrack: introduce clash resolution on insertion race (Florian Westphal) [1686766 1648965]
  - [net] netfilter: conntrack: fix race between confirmation and flush (Florian Westphal) [1686766 1648965]
  - [net] netfilter: conntrack: introduce nf_ct_acct_update() (Florian Westphal) [1686766 1648965]
  - [netdrv] hv_netvsc: Fix a network regression after ifdown/ifup (Mohammed Gamal) [1679997 1661632]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.12.1.el7]
changelog:
  - [kernel] locking/rwsem: Fix (possible) missed wakeup (Waiman Long) [1690323 1547078]
  - [kernel] futex: Fix (possible) missed wakeup (Waiman Long) [1690323 1547078]
  - [kernel] futex: Use smp_store_release() in mark_wake_futex() (Waiman Long) [1690323 1547078]
  - [kernel] sched/wake_q: Fix wakeup ordering for wake_q (Waiman Long) [1690323 1547078]
  - [kernel] sched/wake_q: Document wake_q_add() (Waiman Long) [1690323 1547078]
  - [scsi] mpt3sas: As per MPI-spec, use combined reply queue for SAS3.5 controllers when HBA supports more than 16 MSI-x vectors (Tomas Henzl) [1689379 1649288]
  - [x86] cpu: avoid crash in get_cpu_cache_id() (David Arcari) [1689120 1626279]
  - [net] igmp: Allow user-space configuration of igmp unsolicited report interval (Hangbin Liu) [1686771 1663941]
  - [net] igmp: Don't flush routing cache when force_igmp_version is modified (Hangbin Liu) [1686771 1663941]
  - [net] igmp: fix incorrect unsolicit report count after link down and up (Hangbin Liu) [1688225 1623359]
  - [net] igmp: fix incorrect unsolicit report count when join group (Hangbin Liu) [1688225 1623359]
  - [net] igmp: make function __ip_mc_inc_group() static (Hangbin Liu) [1688225 1623359]
  - [net] igmp: Reduce Unsolicited report interval to 1s when using IGMPv3 (Hangbin Liu) [1688225 1623359]
  - [netdrv] cxgb4: Mask out interrupts that are not enabled (Arjun Vynipadath) [1687487 1678729]
  - [acpi] apci / watchdog: enable acpi_watchdog_uses_rtc (David Arcari) [1683078 1663637]
  - [watchdog] simplify getting .drvdata (David Arcari) [1683079 1666393]
  - [acpi] acpi / watchdog: Prefer iTCO_wdt always when WDAT table uses RTC SRAM (David Arcari) [1683079 1666393]
  - [acpi] acpi / watchdog: Prefer iTCO_wdt on Lenovo Z50-70 (David Arcari) [1683079 1666393]
  - [acpi] acpi / watchdog: properly initialize resources (David Arcari) [1683079 1666393]
  - [acpi] acpi / watchdog: Fix init failure with overlapping register regions (David Arcari) [1683079 1666393]
  - [acpi] acpi / watchdog: Print out error number when device creation fails (David Arcari) [1683079 1666393]
  - [net] netfilter: nat: limit port clash resolution attempts (Florian Westphal) [1683093 1654777]
  - [net] netfilter: nat: remove l4 protocol port rovers (Florian Westphal) [1683093 1654777]
  - [net] netfilter: nat: cope with negative port range (Florian Westphal) [1683093 1654777]
  - [x86] mm/fault: Allow stack access below rsp (Waiman Long) [1678221 1651416]
  - [nvme] nvme-rdma: fix possible double free of controller async event buffer (David Milburn) [1678214 1659532]
  - [nvme] nvme-rdma: fix possible free of a non-allocated async event buffer (David Milburn) [1678214 1659532]
  - [nvme] nvme-rdma: stop admin queue before freeing it (David Milburn) [1678214 1659532]
  - [nvme] rdma: fix double freeing of async event data (David Milburn) [1678216 1655786]
  - [md] fix memleak for mempool (Nigel Croxon) [1678215 1599780]
  - [md] Memory leak when flush bio size is zero (Nigel Croxon) [1678215 1599780]
  - [md] fix lock contention for flush bios (Nigel Croxon) [1678215 1599780]
  - [net] ipv6: rate-limit probes for neighbourless routes (Sabrina Dubroca) [1677179 1637821]
  - [net] ipv6: Re-arrange code in rt6_probe() (Sabrina Dubroca) [1677179 1637821]
  - [netdrv] cxgb4: update supported DCB version (Arjun Vynipadath) [1673821 1668570]
  - [netdrv] cxgb4: when disabling dcb set txq dcb priority to 0 (Arjun Vynipadath) [1673821 1668570]
  - [kvm] kvm: fix kvm_ioctl_create_device() reference counting (Paolo Bonzini) [1671922 1671923] {CVE-2019-6974}
  - [kvm] KVM: nVMX: unconditionally cancel preemption timer in free_nested (Paolo Bonzini) [1671905 1671906] {CVE-2019-7221}
  - [mm] page-writeback.c: fix range_cyclic writeback vs writepages deadlock (Brian Foster) [1673281 1591574]
  - [fs] rbd: avoid corruption on partially completed bios (Ilya Dryomov) [1672514 1613493]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.12.2.el7]
changelog:
  - [x86] x86/speculation/mds: Add SMT warning message (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Move arch_smt_update() call to after mitigation decisions (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] x86/speculation/mds: Add mds=full,nosmt cmdline option (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kernel] x86/speculation: Remove redundant arch_smt_update() invocation (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Update MDS mitigation status after late microcode load (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Add debugfs x86/smt_present file (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Disable automatic enabling of STIBP with SMT on (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Add MDS vulnerability documentation (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Move L1TF to separate directory (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [base] x86/speculation/mds: Add sysfs reporting for MDS (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kvm] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/speculation: Consolidate CPU whitelists (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/msr-index: Cleanup bit defines (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/l1tf: Show actual SMT state (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/speculation: Simplify sysfs report of VMX L1TF vulnerability (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/speculation: Rework SMT state change (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [kernel] sched/smt: Expose sched_smt_present static key (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [kernel] sched/smt: Make sched_smt_present track topology (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/speculation: Disable STIBP when enhanced IBRS is in use (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/speculation: Move STIPB/IBPB string conditionals out of cpu_show_common() (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spectre_v2: Make spectre_v2_mitigation mode available (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Add X86_FEATURE_USE_IBPB (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Add casting to fix compilation error (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/cpufeatures: Add Intel PCONFIG cpufeature (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.14.1.el7]
changelog:
  - [fs] move the call of __d_drop(anon) into __d_materialise_unique(dentry, anon) (Zheng Yan) [1692266 1627001]
  - [fs] dcache: d_splice_alias should ignore DCACHE_DISCONNECTED (Zheng Yan) [1692266 1627001]
  - [fs] dcache: d_splice_alias should detect loops (Zheng Yan) [1692266 1627001]
  - [fs] dcache: d_splice_alias mustn't create directory aliases (Zheng Yan) [1692266 1627001]
  - [fs] dcache: close d_move race in d_splice_alias (Zheng Yan) [1692266 1627001]
  - [fs] dcache: move d_splice_alias (Zheng Yan) [1692266 1627001]
  - [fs] dcache: don't clear DCACHE_DISCONNECTED too early (Zheng Yan) [1692266 1627001]
  - [fs] dcache: Don't set DISCONNECTED on "pseudo filesystem" dentries (Zheng Yan) [1692266 1627001]
  - [fs] dcache: use IS_ROOT to decide where dentry is hashed (Zheng Yan) [1692266 1627001]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.15.1.el7]
changelog:
  - [fs] ext4: Fix data corruption caused by unaligned direct AIO (Lukas Czerner) [1693561 1684780]
  - [net] sched: act_csum: Fix csum calc for tagged packets (Ivan Vecera) [1693110 1676462]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.16.1.el7]
changelog:
  - [netdrv] net/mlx5e: Properly set steering match levels for offloaded TC decap rules (Alaa Hleihel) [1686292 1618427]
  - [netdrv] net/mlx5e: Always use the match level enum when parsing TC rule match (Alaa Hleihel) [1686292 1618427]
  - [netdrv] net/mlx5e: Support offloaded TC flows with no matches on headers (Alaa Hleihel) [1686292 1618427]
  - [netdrv] net/mlx5e: Get the required HW match level while parsing TC flow matches (Alaa Hleihel) [1686292 1618427]
  - [netdrv] net/mlx5e: Properly order min inline mode setup while parsing TC matches (Alaa Hleihel) [1686292 1618427]
  - [netdrv] net/mlx5e: Avoid redundant zeroing of offloaded TC flow attributes (Alaa Hleihel) [1686292 1618427]
  - [netdrv] net/mlx5e: Err if asked to offload TC match on frag being first (Alaa Hleihel) [1686292 1618427]
  - [x86] hyperv: Stop suppressing X86_FEATURE_PCID (Vitaly Kuznetsov) [1697940 1691421]
  - [net] geneve: correctly handle ipv6.disable module parameter (Jiri Benc) [1694981 1677049]
  - [fs] ceph: Fix append mode for sync/direct write (Zheng Yan) [1696595 1691227]
  - [fs] ovl: fix return value from ovl_posix_acl_create() (Miklos Szeredi) [1696292 1677705]
  - [x86] mm: Unbreak modules that use the DMA API (Gary Hook) [1695511 1697241 1676613 1662887]
  - [sound] alsa/hda: add more quirks for HP Z2 G4 and HP Z240 (Jaroslav Kysela) [1693562 1680180]
  - [sound] alsa: hda/conexant - Add fixup for HP Z2 G4 workstation (Jaroslav Kysela) [1693562 1657855]
  - [block] mtip32xx: fix memory corruption by initializing internal command header (Ming Lei) [1689929 1660292]
  - [fs] nfsd: deal with revoked delegations appropriately (Dave Wysochanski) [1689811 1552203]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.19.1.el7]
changelog:
  - [security] selinux: always allow mounting submounts (Ondrej Mosnacek) [1702923 1077929]
  - [block] Make blk_queue_enter() reexamine the DYING flag (Ming Lei) [1702921 1701348]
  - [block] wakeup tasks blocked on q->mq_freeze_wq (Ming Lei) [1702921 1701348]
  - [fs] revert "[fs] xfs: use rhashtable to track buffer cache" (Brian Foster) [1702922 1658749]
  - [fs] xfs: hold xfs_buf locked between shortform->leaf conversion and the addition of an attribute (Brian Foster) [1701293 1613405]
  - [fs] xfs: add the ability to join a held buffer to a defer_ops (Brian Foster) [1701293 1613405]
  - [fs] xfs: refactor buffer logging into buffer dirtying helper (Brian Foster) [1701293 1613405]
  - [char] ipmi: ipmi_si_hardcode.c: init si_type array to fix a crash (Tony Camuso) [1701991 1692236]
  - [char] ipmi_si: Fix crash when using hard-coded device (Tony Camuso) [1701991 1692236]
  - [char] ipmi: Remove platform driver overrides and use the id_table (Tony Camuso) [1701991 1692236]
  - [security] xattr: Constify ->name member of "struct xattr" (Aaron Tomlin) [1702286 1607307]
  - [net] ipv6 Use get_hash_from_flowi6 for rt6 hash (Sabrina Dubroca) [1702282 1625454]
  - [s390] zcrypt: fix specification exception on z196 during ap probe (Hendrik Brueckner) [1700706 1669535]
  - [md] dm table: propagate BDI_CAP_STABLE_WRITES to fix sporadic checksum errors (Mike Snitzer) [1699722 1693466]
  - [fs] blockdev: Fix livelocks on loop device (Lukas Czerner) [1698110 1686149]
  - [fs] ext4: fix crash during online resizing (Lukas Czerner) [1698110 1686149]
  - [fs] ext4: fix overflow caused by missing cast in ext4_resize_fs() (Lukas Czerner) [1698110 1671293]
  - [powerpc] livepatch: return -ERRNO values in save_stack_trace_tsk_reliable() (Joe Lawrence) [1697867 1658435]
  - [powerpc] livepatch: small cleanups in save_stack_trace_tsk_reliable() (Joe Lawrence) [1697867 1658435]
  - [powerpc] livepatch: relax reliable stack tracer checks for first-frame (Joe Lawrence) [1697867 1658435]
  - [powerpc] 64s: Make reliable stacktrace dependency clearer (Joe Lawrence) [1697867 1658435]
  - [powerpc] 64s: Clear on-stack exception marker upon exception return (Joe Lawrence) [1697867 1658435]
  - [powerpc] livepatch: Fix build error with kprobes disabled (Joe Lawrence) [1697867 1658435]
  - [fs] xfs: don't screw up direct writes when freesp is fragmented (Brian Foster) [1693796 1667523]
  - [nvme] ensure forward progress during Admin passthru (David Milburn) [1690519 1672428]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.20.1.el7]
changelog:
  - [x86] x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation/mds: Fix comment (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add SMT warning message (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation: Move arch_smt_update() call to after mitigation decisions (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [documentation] x86/speculation/mds: Add mds=full,nosmt cmdline option (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [kernel] x86/speculation: Remove redundant arch_smt_update() invocation (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/spec_ctrl: Update MDS mitigation status after late microcode load (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/spec_ctrl: Add debugfs x86/smt_present file (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/spec_ctrl: Disable automatic enabling of STIBP with SMT on (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [documentation] Documentation: Add MDS vulnerability documentation (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [documentation] Documentation: Move L1TF to separate directory (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [base] x86/speculation/mds: Add sysfs reporting for MDS (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [kvm] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation: Consolidate CPU whitelists (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/msr-index: Cleanup bit defines (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/l1tf: Show actual SMT state (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation: Simplify sysfs report of VMX L1TF vulnerability (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation: Rework SMT state change (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [kernel] sched/smt: Expose sched_smt_present static key (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [kernel] sched/smt: Make sched_smt_present track topology (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation: Disable STIBP when enhanced IBRS is in use (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation: Move STIPB/IBPB string conditionals out of cpu_show_common() (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/spectre_v2: Make spectre_v2_mitigation mode available (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/spec_ctrl: Add X86_FEATURE_USE_IBPB (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/spec_ctrl: Add casting to fix compilation error (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/cpufeatures: Add Intel PCONFIG cpufeature (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.21.1.el7]
changelog:
  - [x86] spec_ctrl: Update MDS mitigation status after late microcode load (Waiman Long) [1712998 1712993 1710501 1710498] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] speculation/mds: Properly set/clear mds_idle_clear static key (Waiman Long) [1713004 1707292] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.21.2.el7]
changelog:
  - [security] xattr: use RH_KABI_CONST to avoid security_inode_init_security checksum change (Cestmir Kalina) [1702286 1710633]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.21.3.el7]
changelog:
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719914 1719915] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719914 1719915] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719849 1719850] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719594 1719595] {CVE-2019-11477}
  - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719594 1719595] {CVE-2019-11477}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.22.1.el7]
changelog:
  - [md] raid: raid5 preserve the writeback action after the parity check (Nigel Croxon) [1698109 1701350]
  - [net] route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race (Xin Long) [1709727 1630136]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.23.1.el7]
changelog:
  - [md] dm thin metadata: do not write metadata if no changes occurred (Mike Snitzer) [1713800 1710051]
  - [md] dm thin metadata: add wrappers for managing write locking of metadata (Mike Snitzer) [1713800 1710051]
  - [md] dm thin metadata: check __commit_transaction()'s return (Mike Snitzer) [1713800 1710051]
  - [md] dm space map common: zero entire ll_disk (Mike Snitzer) [1713800 1710051]
  - [scsi] smartpqi: correct lun reset issues (Don Brace) [1709469 1641112]
  - [net] openvswitch: Remove padding from packet before L3+ conntrack processing (Eelco Chaudron) [1713562 1684518]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.26.1.el7]
changelog:
  - [x86] kvm: x86: Add AMD's EX_CFG to the list of ignored MSRs (Eduardo Habkost) [1716306 1593190]
  - [x86] kvm/mmu: reset MMU context when 32-bit guest switches PAE (Vitaly Kuznetsov) [1702172 1703797]
  - [x86] kvm: x86: fix handling of role.cr4_pae and rename it to 'gpte_size' (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Do not inherit quadrant and invalid for the root shadow EPT (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/mmu: fix switch between root and guest MMUs (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: NMI-window and interrupt-window exiting should wake L2 from HLT (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: nsvm: fix switch to guest mmu (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: Fix race in emulated page table writes (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx/nsvm: Fix bug which sets vcpu->arch.tsc_offset to L1 tsc_offset (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: reintroduce pte_list_remove, but including mmu_spte_clear_track_bits (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: rename pte_list_remove to __pte_list_remove (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/mmu: check if MMU reconfiguration is needed in init_kvm_nested_mmu() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/mmu: check if tdp/shadow MMU reconfiguration is needed (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/nvmx: introduce source data cache for kvm_init_shadow_ept_mmu() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/mmu: make space for source data caching in struct kvm_mmu (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/mmu: get rid of redundant kvm_mmu_setup() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/mmu: introduce guest_mmu (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/mmu.c: add kvm_mmu parameter to kvm_mmu_free_roots() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/mmu.c: set get_pdptr hook in kvm_init_shadow_ept_mmu() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/mmu: make vcpu->mmu a pointer to the current MMU (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: move vmcs12 EPTP consistency check to check_vmentry_prereqs() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: move host EFER consistency checks to VMFail path (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: return 0 in case kvm_mmu_memory_cache has min number of objects (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Clear reserved bits of #DB exit qualification (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: restore host state in nested_vmx_vmexit for VMFail (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: fix entry with pending interrupt if APICv is enabled (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: hide flexpriority from guest when disabled at the module level (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: check for existence of secondary exec controls before accessing (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Wake blocked vCPU in guest-mode if pending interrupt in virtual APICv (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: don't reset root in kvm_mmu_setup() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/lapic: always disable MMIO interface in x2APIC mode (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Fix loss of pending IRQ/NMI before entering L2 (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Skip pae_root shadow allocation if tdp enabled (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/mmu: Combine flushing remote tlb in mmu_set_spte() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Add multi-entry LRU cache for previous CR3s (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Support selectively freeing either current or previous MMU root (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Add a root_hpa parameter to kvm_mmu->invlpg() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Add ability to skip TLB flush when switching CR3 (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Use fast CR3 switch for nested VMX (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Support resetting the MMU context without resetting roots (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Add support for fast CR3 switch across different MMU modes (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Introduce KVM_REQ_LOAD_CR3 (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Introduce kvm_mmu_calc_root_page_role() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Add fast CR3 switch code path (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Avoid taking MMU lock in kvm_mmu_sync_roots if no sync is needed (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Make sync_page() flush remote TLBs once only (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Restore exit qual for VM-entry failure due to MSR loading (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: Nested VM-entry prereqs for event inj (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: Don't expose private memslots to L2 (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: Add guest_mode to kvm_mmu_page_role (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: Basic APIC virtualization controls have three settings (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Eliminate APIC access page sharing between L1 and L2 (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: Introduce lapic_mode enumeration (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Refactor mmu_free_roots() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: move MSR_IA32_TSC handling to x86.c (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: Properly update 'tsc_offset' to represent the running guest (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] Add check for APIC access address for vmentry of L2 guests (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Do not load EOI-exitmap while running L2 (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: don't configure EPT identity map for unrestricted guest (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Update the exit_qualification access bits while walking an address (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Enforce NMI controls on vmentry of L2 guests (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Don't halt vcpu when L1 is injecting events to L2 (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: shadow more fields that are read/written on every vmexits (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Fix bug of injecting L2 exception into L1 (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm mmu: check pending exception before injecting APF (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: svm: prepare for new bit definition in nested_ctl (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Fix vmx_check_nested_events() return value in case an event was reinjected to L2 (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: ioapic: Preserve read-only values in the redirection table (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: ioapic: Clear Remote IRR when entry is switched to edge-triggered (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: ioapic: Remove redundant check for Remote IRR in ioapic_set_irq (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: ioapic: Don't fire level irq when Remote IRR set (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Fix mmu context after VMLAUNCH/VMRESUME failure (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Validate the IA32_BNDCFGS on nested VM-entry (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: extend usage of RET_MMIO_PF_* constants (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] arch/x86: remove redundant null checks before kmem_cache_destroy (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: cleanup init_rmode_identity_map() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: mmu: free_page can handle NULL (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Fix nested #PF intends to break L1's vmlauch/vmresume (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Handle deferred early VMLAUNCH/VMRESUME failure properly (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: Handle VMLAUNCH/VMRESUME failure properly (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Remove nested_vmx_succeed after successful VM-entry (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: async_pf: Fix #DF due to inject "Page not Present" and "Page Ready" exceptions simultaneously (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Validate the virtual-APIC address on nested VM-entry (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Fix trying to cancel vmlauch/vmresume (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: use kvm_event_needs_reinjection (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Fix loss of exception which has not yet been injected (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: fix use of L1 MMIO areas in nested guests (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Avoid guest page table walk when gpa_available is set (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: simplify ept_misconfig (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Disallow illegal IA32_APIC_BASE MSR values (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: Bail out immediately if there is no available mmu page (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: validate eptp pointer (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Add support for fast unprotection of nested guest page tables (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: svm: Limit PFERR_NESTED_GUEST_PAGE error_code check to L1 guest (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: fixes to nested virt interrupt injection (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: do not fill vm_exit_intr_error_code in prepare_vmcs12 (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Disallow VM-entry in MOV-SS shadow (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: async_pf: Force a nested vmexit if the injected #PF is async_pf (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: async_pf: Add L1 guest async_pf #PF vmexit handler (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Simplify kvm_x86_ops->queue_exception parameter list (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Fix nested_vmx_check_msr_bitmap_controls (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Validate the I/O bitmaps on nested VM-entry (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Don't set vmcs12 to "launched" when VMLAUNCH fails (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Validate CR3 target count on nested VM-entry (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: Flush TLB when the APIC-access address changes (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: VMCLEAR should not cause the vCPU to shut down (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: Use the hardware provided GPA instead of page walk (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: svm: Use the hardware provided GPA instead of page walk (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: svm: Add support for additional SVM NPF error codes (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: CPUID.01H:EDX.APIC[bit 9] should mirror IA32_APIC_BASE[11] (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Fetch VM_INSTRUCTION_ERROR from vmcs02 on vmx->fail (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/x86: Replace smp_mb() with smp_store_mb/release() in the walk_shadow_page_lockless_begin/end() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: coalesce more page zapping in mmu_sync_children (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: move zap/flush to kvm_mmu_get_page (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: invert return value of mmu.sync_page and *kvm_sync_page* (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: cleanup __kvm_sync_page and its callers (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: use kvm_sync_page in kvm_sync_pages (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: move TLB flush out of __kvm_sync_page (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: introduce kvm_mmu_flush_or_zap (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: Fix ubsan warnings (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: mmu: Remove unused parameter parent_pte from kvm_mmu_get_page() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: mmu: Use for_each_rmap_spte macro instead of pte_list_walk() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: mmu: Move parent_pte handling from kvm_mmu_get_page() to link_shadow_page() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: mmu: Move initialization of parent_ptes out from kvm_mmu_alloc_page() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: mmu: Make mmu_set_spte() return emulate value (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: mmu: Add helper function to clear a bit in unsync child bitmap (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] mce: Handle varying MCA bank counts (David Arcari) [1715868 1693352]
  - [drm] drm/i915/gvt: Fix mmap range check (Alex Williamson) [1713566 1713567] {CVE-2019-11085}
  - [nvme] cancel request synchronously (Ming Lei) [1715320 1688518]
  - [block] blk-mq: introduce blk_mq_complete_request_sync() (Ming Lei) [1715320 1688518]
  - [char] ipmi_si: fix use-after-free of resource->name (Tony Camuso) [1714407 1714408] {CVE-2019-11811}
  - [fs] sunrpc: make visible processing error in bc_svc_process() ("J. Bruce Fields") [1660818 1653675] {CVE-2018-16884}
  - [fs] sunrpc: remove unused xpo_prep_reply_hdr callback ("J. Bruce Fields") [1660818 1653675] {CVE-2018-16884}
  - [fs] sunrpc: remove svc_tcp_bc_class ("J. Bruce Fields") [1660818 1653675] {CVE-2018-16884}
  - [fs] sunrpc: replace svc_serv->sv_bc_xprt by boolean flag ("J. Bruce Fields") [1660818 1653675] {CVE-2018-16884}
  - [fs] sunrpc: use-after-free in svc_process_common() ("J. Bruce Fields") [1660818 1653675] {CVE-2018-16884}
  - [fs] svcauth_gss: Close connection when dropping an incoming message ("J. Bruce Fields") [1660818 1653675] {CVE-2018-16884}
  - [tty] Fix low_latency BUG (Aristeu Rozanski) [1715331 1710039]
  - [tty] n_tty: Fix termios_rwsem lockdep false positive (Artem Savkov) [1715328 1712744]
  - [tty] Fix lock order in tty_do_resize() (Aristeu Rozanski) [1708063 1684982]
  - [tty] n_tty: Access termios values safely (Aristeu Rozanski) [1708063 1684982]
  - [tty] Convert termios_mutex to termios_rwsem (Aristeu Rozanski) [1708063 1684982]
  - [md] batch flush requests. (Xiao Ni) [1713564 1576466]
  - [md] revert "md: fix lock contention for flush bios" (Xiao Ni) [1713564 1576466]
  - [mm] tlb: Remove tlb_remove_table() non-concurrent condition (Vitaly Kuznetsov) [1712766 1448188]
  - [kernel] sched/fair: Do not re-read ->h_load_next during hierarchical load calculation (Phil Auld) [1712764 1707397]
  - [x86] livepatch: apply alternatives and paravirt patches after relocations (Artem Savkov) [1712761 1706733]
  - [block] blk-mq: fix IO accounting in case of none io scheduler (Ming Lei) [1711013 1669684]
  - [net] netfilter: ipv6: Don't preserve original oif for loopback address (Florian Westphal) [1709186 1701496]
  - [net] netfilter: ipv6: Preserve link scope traffic original oif (Florian Westphal) [1709186 1701496]
  - [x86] mce/amd, edac/mce_amd: Add new error descriptions for some SMCA bank types (Gary Hook) [1703376 1685269]
  - [edac] x86/mce/amd, edac/mce_amd: Add new McaTypes for CS, PSP, and SMU units (Gary Hook) [1703376 1685269]
  - [edac] x86/mce/amd, edac/mce_amd: Add new MP5, NBIO, and PCIE SMCA bank types (Gary Hook) [1703376 1685269]
  - [x86] mce/amd: Fix the thresholding machinery initialization order (Gary Hook) [1703376 1685269]
  - [x86] mce/amd: Read MCx_MISC block addresses on any CPU (Gary Hook) [1703376 1685269]
  - [x86] mce/amd: Cache SMCA MISC block addresses (Gary Hook) [1703376 1685269]
  - [x86] mce/amd: Carve out SMCA get_block_address() code (Gary Hook) [1703376 1685269]
  - [x86] mce/amd: Get address from already initialized block (Gary Hook) [1703376 1685269]
  - [edac] x86/mce/amd, edac/mce_amd: Enumerate Reserved SMCA bank type (David Arcari) [1712763 1676301]
  - [x86] mce/amd: Pass the bank number to smca_get_bank_type() (David Arcari) [1712763 1676301]
  - [x86] mce/amd: Define a function to get SMCA bank type (David Arcari) [1712763 1676301]
  - [x86] mce/amd: Allow any CPU to initialize the smca_banks array (David Arcari) [1712763 1676301]
  - [x86] mce/amd: Carve out SMCA bank configuration (David Arcari) [1712763 1676301]
  - [x86] mce: Convert threshold_bank.cpus from atomic_t to refcount_t (David Arcari) [1712763 1676301]
  - [x86] ras/amd: Make sysfs names of banks more user-friendly (David Arcari) [1712763 1676301]
  - [x86] mce/amd: Make the init code more robust (David Arcari) [1712763 1676301]
  - [x86] ras: Hide SMCA bank names (David Arcari) [1712763 1676301]
  - [powerpc] security: Fix spectre_v2 reporting (Gustavo Duarte) [1708546 1694459]
  - [powerpc] fsl: Update Spectre v2 reporting (Gustavo Duarte) [1708546 1694459]
  - [powerpc] fsl: Add nospectre_v2 command line argument (Gustavo Duarte) [1708546 1694459]
  - [powerpc] fsl: Fix spectre_v2 mitigations reporting (Gustavo Duarte) [1708546 1694459]
  - [powerpc] powernv: Query firmware for count cache flush settings (Gustavo Duarte) [1708546 1694459]
  - [powerpc] pseries: Query hypervisor for count cache flush settings (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64s: Add support for software count cache flush (Gustavo Duarte) [1708546 1694459]
  - [powerpc] Introduce asm-prototypes.h (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64s: Add new security feature flags for count cache flush (Gustavo Duarte) [1708546 1694459]
  - [powerpc] asm: Add a patch_site macro & helpers for patching instructions (Gustavo Duarte) [1708546 1694459]
  - [powerpc] Add helper to check if offset is within relative branch range (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64: Make meltdown reporting Book3S 64 specific (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64: Call setup_barrier_nospec() from setup_arch() (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64: Add CONFIG_PPC_BARRIER_NOSPEC (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64: Make stf barrier PPC_BOOK3S_64 specific (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64: Disable the speculation barrier from the command line (Gustavo Duarte) [1708546 1694459]
  - [powerpc] powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2 (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64s: Enhance the information in cpu_show_spectre_v1() (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64: Use barrier_nospec in syscall entry (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64s: Enable barrier_nospec based on firmware settings (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64s: Patch barrier_nospec in modules (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64s: Add support for ori barrier_nospec patching (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64s: Add barrier_nospec (Gustavo Duarte) [1708546 1694459]
  - [powerpc] reuse asm-generic/barrier.h (Gustavo Duarte) [1708546 1694459]
  - [x86] locking/arch: Rename set_mb() to smp_store_mb() (Waiman Long) [1708546 1522387]
  - [kernel] locking/arch: Add WRITE_ONCE() to set_mb() (Waiman Long) [1708546 1522387]
  - [kernel] rcu: Don't wake rcuc/X kthreads on NOCB CPUs (Daniel Bristot de Oliveira) [1711325 1626129]
  - [x86] Update stepping values for coffee lake desktop (David Arcari) [1710803 1704812]
  - [security] selinux: overhaul sidtab to fix bug and improve performance (Ondrej Mosnacek) [1710468 1335986]
  - [security] selinux: use separate table for initial SID lookup (Ondrej Mosnacek) [1710468 1335986]
  - [security] selinux: refactor sidtab conversion (Ondrej Mosnacek) [1710468 1335986]
  - [nvme] nvme-pci: fix memory leak on probe failure (David Milburn) [1710799 1689008]
  - [nvme] nvme-pci: limit max IO size and segments to avoid high order allocations (David Milburn) [1710799 1689008]
  - [lib] locking/rwsem: Prevent decrement of reader count before increment (Waiman Long) [1709704 1708667]
  - [fs] nfsd: COPY and CLONE operations require the saved filehandle to be set (Scott Mayhew) [1672147 1645353] {CVE-2018-16871}
  - [iommu] amd: Set exclusion range correctly (Jerry Snitselaar) [1698338 1702763]
  - [iommu] amd: Reserve exclusion range in iova-domain (Jerry Snitselaar) [1698338 1691196]
  - [nvdimm] libnvdimm, pmem: Fix badblocks population for 'raw' namespaces (Frank Ramsay) [1708548 1672302]
  - [netdrv] mac80211_hwsim: Fix possible Spectre-v1 for hwsim_world_regdom_custom (Stanislaw Gruszka) [1706698 1639674]
  - [net] nl80211: Fix possible Spectre-v1 for NL80211_TXRATE_HT (Stanislaw Gruszka) [1706698 1639674]
  - [net] nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds (Stanislaw Gruszka) [1706698 1639674]
  - [netdrv] mac80211_hwsim: fix possible memory leak in hwsim_new_radio_nl() (Stanislaw Gruszka) [1706698 1626463]
  - [md] dm cache metadata: Fix loading discard bitset (Mike Snitzer) [1703586 1701619]
  - [infiniband] hfi1: Close race condition on user context disable and close (Alex Estrin) [1705369 1680069]
  - [mm] thp: relocate flush_cache_range() in migrate_misplaced_transhuge_page() (Andrea Arcangeli) [1698108 1636066]
  - [mm] thp: fix mmu_notifier in migrate_misplaced_transhuge_page() (Andrea Arcangeli) [1698108 1636066]
  - [mm] thp: fix MADV_DONTNEED vs migrate_misplaced_transhuge_page race condition (Andrea Arcangeli) [1698108 1636066]
  - [mm] revert "mm: numa: defer TLB flush for THP migration as long as possible" (Andrea Arcangeli) [1698108 1636066]
  - [mm] thp/migration: switch from flush_tlb_range to flush_pmd_tlb_range (Andrea Arcangeli) [1698108 1636066]
  - [mm] migrate.c: stabilise page count when migrating transparent hugepages (Andrea Arcangeli) [1698108 1636066]
  - [mm] numa: add migrated transhuge pages to LRU the same way as base pages (Andrea Arcangeli) [1698108 1636066]
  - [mm] thp: fix MADV_DONTNEED vs. MADV_FREE race (Andrea Arcangeli) [1698108 1636066]
  - [mm] memcg, slab: simplify synchronization scheme (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg, slab: do not schedule cache destruction when last page goes away (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg, slab: separate memcg vs root cache creation paths (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg, slab: cleanup memcg cache creation (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg: remove KMEM_ACCOUNTED_ACTIVATED flag (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg, slab: RCU protect memcg_params for root caches (Aaron Tomlin) [1691428 1674401]
  - [mm] slab: do not panic if we fail to create memcg cache (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg: get rid of kmem_cache_dup() (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg: fix possible NULL deref while traversing memcg_slab_caches list (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg, slab: fix barrier usage when accessing memcg_caches (Aaron Tomlin) [1691428 1674401]
  - [mm] slab: clean up kmem_cache_create_memcg() error handling (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg, kmem: use cache_from_memcg_idx instead of hard code (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg, kmem: rename cache_from_memcg to cache_from_memcg_idx (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg: make memcg_update_cache_sizes() static (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg: fix kmem_account_flags check in memcg_can_account_kmem() (Aaron Tomlin) [1691428 1674401]
  - [security] xattr: use RH_KABI_CONST to avoid security_inode_init_security checksum change (Cestmir Kalina) [1702286 1710633]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.27.1.el7]
changelog:
  - [x86] Update stepping values for Whiskey Lake U/Y (David Arcari) [1718690 1704810]
  - [x86] perf/amd: Resolve NMI latency issues for active PMCs (David Arcari) [1721611 1696764]
  - [x86] perf/amd: Resolve race condition when disabling PMC (David Arcari) [1721611 1696764]
  - [edac] amd64: Set maximum channel layer size depending on family (Gary Hook) [1720266 1705210]
  - [edac] amd64: Adjust printed chip select sizes when interleaved (Gary Hook) [1720266 1705210]
  - [edac] amd64: Recognize x16 symbol size (Gary Hook) [1720266 1705210]
  - [edac] amd64: Support more than two Unified Memory Controllers (Gary Hook) [1720266 1705210]
  - [edac] amd64: Use a macro for iterating over Unified Memory Controllers (Gary Hook) [1720266 1705210]
  - [edac] amd64: Add Family 17h, models 10h-2fh support (Gary Hook) [1720266 1705210]
  - [edac] amd64: Add Family 17h, models 10h-2fh support (Gary Hook) [1720266 1670608]
  - [x86] mark AMD Rome processors supported (David Arcari) [1721604 1543509]
  - [x86] Mark AMD EPYC guests as supported (David Arcari) [1721604 1664507]
  - [x86] mark amd rome as unsupported (David Arcari) [1721604 1638504]
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719914 1719915] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719914 1719915] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719849 1719850] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719594 1719595] {CVE-2019-11477}
  - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719594 1719595] {CVE-2019-11477}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.27.2.el7]
changelog:
  - [x86] hyper-v: fix hyperv.h UAPI header (Vitaly Kuznetsov) [1727109 1692492]
  - [iommu] hyper-v: Add Hyper-V stub IOMMU driver (Vitaly Kuznetsov) [1727109 1661654]
  - [x86] hyper-v: Set x2apic destination mode to physical when x2apic is available (Vitaly Kuznetsov) [1727109 1661654]
  - [x86] hyper-v: Consolidate code for converting cpumask to vpset (Vitaly Kuznetsov) [1727109 1661654]
  - [x86] hyper-v: Fix the circular dependency in IPI enlightenment (Vitaly Kuznetsov) [1727109 1661654]
  - [pci] hv: Refactor hv_irq_unmask() to use cpumask_to_vpset() (Vitaly Kuznetsov) [1727109 1661654]
  - [pci] hv: Replace hv_vp_set with hv_vpset (Vitaly Kuznetsov) [1727109 1661654]
  - [pci] hv: Add __aligned(8) to struct retarget_msi_interrupt (Vitaly Kuznetsov) [1727109 1661654]
  - [hwmon] k10temp: Add support for AMD family 17h, model 30h CPUs (Gary Hook) [1728000 1643292]
  - [x86] amd_nb: Add PCI device IDs for family 17h, model 30h (Gary Hook) [1728000 1643292]
  - [x86] amd_nb: Add support for newer PCI topologies (Gary Hook) [1728000 1643292]
  - [hwmon] k10temp, x86/amd_nb: Consolidate shared device IDs (Gary Hook) [1728000 1643292]
  - [hwmon] (k10temp) Use API function to access System Management Network (Gary Hook) [1728000 1643292]
  - [x86] amd_nb: Add support for Raven Ridge CPUs (Gary Hook) [1728000 1643292]
  - [hwmon] (k10temp) Add support for AMD Ryzen w/ Vega graphics (Gary Hook) [1728000 1643292]
  - [hwmon] (k10temp) Add temperature offset for Ryzen 2700X (Gary Hook) [1728000 1643292]
  - [x86] cpu/amd: Apply the Erratum 688 fix when the BIOS doesn't (Gary Hook) [1728000 1643292]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-949.el7]
changelog:
  - [scsi] libsas: fix memory leak in sas_smp_get_phy_events() (Tomas Henzl) [1558582] {CVE-2018-7757}
  - [vhost] fix info leak due to uninitialized memory (Jason Wang) [1573705] {CVE-2018-1118}
  - [pci] Fix calculation of bridge window's size and alignment (Myron Stowe) [1623800]
  - [md] dm thin metadata: try to avoid ever aborting transactions (Mike Snitzer) [1614151]
  - [crypto] api: fix finding algorithm currently being tested (Herbert Xu) [1618701]
  - [sound] alsa: hda/realtek: Fix HP Headset Mic can't record (Jaroslav Kysela) [1622721]
  - [sound] alsa: hda/realtek - Fixup for HP x360 laptops with B&O speakers (Jaroslav Kysela) [1622721]
  - [sound] alsa: hda/realtek - Fixup mute led on HP Spectre x360 (Jaroslav Kysela) [1622721]
  - [target] scsi: tcmu: use u64 for dev_size (Xiubo Li) [1603363]
  - [target] scsi: tcmu: use match_int for dev params (Xiubo Li) [1603363]
  - [target] scsi: tcmu: do not set max_blocks if data_bitmap has been setup (Xiubo Li) [1603363]
  - [target] scsi: tcmu: unmap if dev is configured (Xiubo Li) [1603363]
  - [target] scsi: tcmu: check if dev is configured before block/reset (Xiubo Li) [1603363]
  - [target] scsi: tcmu: use lio core se_device configuration helper (Xiubo Li) [1603363]
  - [target] scsi: target: add helper to check if dev is configured (Xiubo Li) [1603363]
  - [target] scsi: tcmu: initialize list head (Xiubo Li) [1603363]
  - [target] scsi: target_core_user: fix double unlock (Xiubo Li) [1603363]
  - [s390] arch: Set IORESOURCE_SYSTEM_RAM flag for resources (Gary Hook) [1627889]
  - [x86] efi-bgrt: Switch all pr_err() to pr_notice() for invalid BGRT (Lenny Szubowicz) [1464241]
  - [x86] efi/bgrt: Don't ignore the BGRT if the 'valid' bit is 0 (Lenny Szubowicz) [1464241]
  - [x86] efi: Preface all print statements with efi* tag (Lenny Szubowicz) [1464241]
  - [x86] efi-bgrt: Switch pr_err() to pr_debug() for invalid BGRT (Lenny Szubowicz) [1464241]
  - [x86] efi-bgrt: Add error handling; inform the user when ignoring the BGRT (Lenny Szubowicz) [1464241]
  - [x86] efi: Check status field to validate BGRT header (Lenny Szubowicz) [1464241]


author: Petr Sabata <contyk@redhat.com> - 1.5-1
changelog:
  - 1.5 bump
  - BuildRoot and defattr cleanup
  - Use macros in Sources
  - Drop show-ports and foreach patches -- those have been included upstream


author: Petr Sabata <contyk@redhat.com> - 1.5-2
changelog:
  - Add three latest bugfixes from upstream git on top of 1.5
  - Dropping params patch (included upstream variant)


author: Jon Ciesla <limburgher@gmail.com> - 4.5-5
changelog:
  - Add systemd unit file, BZ 916628.
  - Drop spurious post scripts.
  - Move eveything but man pages and license files top -docs.


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.5-10
changelog:
  - Hardened build
    Resolves: rhbz#1092547
  - Fixed Braille display emulator to start
    Resolves: rhbz#1304725


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.5-11
changelog:
  - Fixed Braille characters not displaying in the XW driver window
    Resolves: rhbz#1324669
  - Added AT-SPI2 driver
    Resolves: rhbz#1324672
  - Fixed requirements
    Resolves: rhbz#1324850


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.5-12
changelog:
  - Improved fix for Braille characters not displaying in the XW driver window
    Related: rhbz#1324669


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.5-13
changelog:
  - Made brltty-config executable, currently useless, but FHS compliant
    Resolves: rhbz#1332981
  - Fixed multilib
    Related: rhbz#1324850


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.5-14
changelog:
  - Rebuilt for new architectures
    Resolves: rhbz#1379884
  - Added fix to support compilation with ocaml-4.04.0
    Resolves: rhbz#1393750


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.5-15
changelog:
  - Fixed build in case ocaml is preinstalled in the build root and
    support shouldn't be built
    Resolves: rhbz#1443907


author: Eric Sandeen <sandeen@redhat.com> 0.20.rc1.20130917git194aa4a-1
changelog:
  - New upstream snapshot
  - Deprecated btrfsctl, btrfs-show, and btrfs-vol; still available in btrfs cmd


author: Liu Bo <bo.li.liu@oracle.com> 4.9.1-1.0.2
changelog:
  - fix btrfs-convert to not create corrupted btrfs image
  - fix btrfs-convert to honor nodatasum option
  - Orabug 26281418


author: Petr Machata <pmachata@redhat.com> - 1.9.20111219-1
changelog:
  - Rebase to 20111219
    - add "-s" option
    - Resolves: #769237
  - Revert default stack size to 10000
    - Related: #743343


author: Toshio Kuratomi <toshio@fedoraproject.org> - 2.5.1-12
changelog:
  - Patch for failure to gpg sign commits with no gpg-agent 
    https://bugzilla.redhat.com/show_bug.cgi?id=905087


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.1-5
changelog:
  - Apply a patch by Stephen Gallagher to patch autoconf, not configure to
    allow optflags to be passed in by build environment
  - Run autoreconf before configure
  - git rm obsolete patches
  - Apply upstream patch to stop overriding AC_CONFIG_MACRO_DIR


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-1
changelog:
  - New upstream release 1.10
  - Obsolete upstreamed patches
  - Amend the multilib patch, there's no need to patch configure since we
    are running autoreconf anyways
  - https://raw.github.com/bagder/c-ares/cares-1_10_0/RELEASE-NOTES


author: Kai Engert <kaie@redhat.com> - 2012.87-10.1
changelog:
  - Add myself as contributor to certdata2.pem.py and remove use of rcs/ident.
    (thanks to Michael Shuler for suggesting to do so)
  - Update source URLs and comments, add source file for version information.


author: Kai Engert <kaie@redhat.com> - 2012.87-10.3
changelog:
  - added a manual page and related build requirements
  - simplify the README files now that we have a manual page
  - set a certificate alias in trusted bundle (thanks to Ludwig Nussel)


author: Kai Engert <kaie@redhat.com> - 2014.1.98-70.0
changelog:
  - update to CKBI 1.98 from NSS 3.16.1
  - building on RHEL 7 no longer requires java-openjdk
  - added more detailed instructions for release numbers on RHEL branches,
    to avoid problems when rebasing on both z- and y-stream branches.


author: Kai Engert <kaie@redhat.com> - 2014.1.98-71
changelog:
  - Update to CKBI 1.98 from NSS 3.16.1
  - building on RHEL 7 no longer requires java-openjdk
  - added more detailed instructions for release numbers on RHEL branches,
    to avoid problems when rebasing on both z- and y-stream branches.


author: Stef Walter <stefw@redhat.com> - 2014.1.98-72
changelog:
  - The BasicConstraints fix for Entrust Root is no longer necessary.
    In addition it was invalid for p11-kit 0.20.x. rhbz#1130485


author: Kai Engert <kaie@redhat.com> - 2015.2.3-70.0
changelog:
  - Update to CKBI 2.3 from NSS 3.18 with legacy modifications.
  - Add a patch to the source RPM that documents the changes from the
    upstream version.
  - Introduce the ca-legacy utility, a manual page, and the ca-legacy.conf
    configuration file.
  - The new scriptlets require the coreutils package.
  - Remove the obsolete blacklist.txt file.
  - Add an alternative version of the "Thawte Premium Server CA" root,
    which carries a SHA1-RSA signature, to allow OpenJDK to verify applets
    which contain that version of the root certificate.
    This change doesn't add trust for another key, because both versions
    of the certificate use the same public key (rhbz#1170982).


author: Kai Engert <kaie@redhat.com> - 2015.2.3-71
changelog:
  - Update to CKBI 2.3 from NSS 3.18 with legacy modifications.
  - Add an alternative version of the "Thawte Premium Server CA" root,
    which carries a SHA1-RSA signature, to allow OpenJDK to verify applets
    which contain that version of the root certificate.
    This change doesn't add trust for another key, because both versions
    of the certificate use the same public key (rhbz#1170982).
  - Add a patch to the source RPM that documents the changes from the
    upstream version.
  - Introduce the ca-legacy utility, a manual page, and the ca-legacy.conf
    configuration file.
  - The new scriptlets require the coreutils package.
  - Remove the obsolete blacklist.txt file.


author: Kai Engert <kaie@redhat.com> - 2017.2.11-70.1
changelog:
  - Update to CKBI 2.11 from NSS 3.28.1 with legacy modifications.
  - Use comments in extracted bundle files.
  - Change packaging script to support empty legacy bundles.


author: Kai Engert <kaie@redhat.com> - 2017.2.11-72
changelog:
  - Changed the packaged bundle to use the flexible p11-kit-object-v1 file format,
    as a preparation to fix bugs in the interaction between p11-kit-trust and
    Mozilla applications, such as Firefox, Thunderbird etc.
  - For CAs trusted by Mozilla, set attribute nss-mozilla-ca-policy: true
  - Require p11-kit 0.23.5
  - Added an utility to help with comparing output of the trust dump command.


author: David Howells <dhowells@redhat.com> 0.10.6-1
changelog:
  - Note the correct licence.
  - Handle malformed kernel status correctly.
  - Permit culling to be disabled on the command line with the -N flag.
  - Suspend culling when cache space is short and cache objects are pinned.


author: David Howells <dhowells@redhat.com> 0.10.8-1
changelog:
  - Use systemd interaction macros in specfile installation sections [RH BZ 850053].
  - Fix the service file to use /usr/sbin/ rather than /sbin/.
  - Turn on RELRO and PIE build hardening in RPM builds (#1092561).


author: Haïkel Guémar <hguemar@fedoraproject.org> - 1.9.8-1
changelog:
  - upstream 1.9.8
  - fix issues with f15/rawhide (RHBZ #676878)
  - drop gtk-doc dependency (RHBZ #604169)


author: Kalev Lember <kalevlember@gmail.com> - 1.10.0-1
changelog:
  - Update to 1.10.0
  - Have the -doc subpackage depend on the base package
  - Modernize the spec file
  - Really own /usr/share/devhelp directory


author: Peter Jones <pjones@redhat.com> - 10.2-8
changelog:
  - Incorporate changes from Matthias Saou:
  - Include install patch, to avoid all of the ugly manual installation.
  - Cosmetic fixes (libs group, scriplets, don't mix %name with hardcode...).


author: Marcin Juszkiewicz <mjuszkiewicz@redhat.com> - 10.2-15
changelog:
  - Patched configure to use config.{guess,sub} files so 
    CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -grecord-gcc-switches  -m64 -mtune=generic}" ; export CFLAGS ; 
    CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -grecord-gcc-switches  -m64 -mtune=generic}" ; export CXXFLAGS ; 
    FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -grecord-gcc-switches  -m64 -mtune=generic -I/usr/lib64/gfortran/modules}" ; export FFLAGS ; 
    FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -grecord-gcc-switches  -m64 -mtune=generic -I/usr/lib64/gfortran/modules}" ; export FCFLAGS ; 
    LDFLAGS="${LDFLAGS:--Wl,-z,relro }"; export LDFLAGS; 
    for i in $(find . -name config.guess -o -name config.sub) ; do 
        [ -f /usr/lib/rpm/redhat/$(basename $i) ] && /usr/bin/rm -f $i && /usr/bin/cp -fv /usr/lib/rpm/redhat/$(basename $i) $i ; 
    done ; 
    ./configure --build=x86_64-redhat-linux-gnu --host=x86_64-redhat-linux-gnu \
  	--program-prefix= \
  	--disable-dependency-tracking \
  	--prefix=/usr \
  	--exec-prefix=/usr \
  	--bindir=/usr/bin \
  	--sbindir=/usr/sbin \
  	--sysconfdir=/etc \
  	--datadir=/usr/share \
  	--includedir=/usr/include \
  	--libdir=/usr/lib64 \
  	--libexecdir=/usr/libexec \
  	--localstatedir=/var \
  	--sharedstatedir=/var/lib \
  	--mandir=/usr/share/man \
  	--infodir=/usr/share/info macro can
    replace them with proper version. With this change it builds fine for AArch64
    architecture.
    Resolves: rhbz#1023783


author: Marcin Juszkiewicz <mjuszkiewicz@redhat.com> - 10.2-15
changelog:
  - Patched configure to use config.{guess,sub} files so 
    CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -grecord-gcc-switches  -m32 -march=x86-64 -mtune=generic -mfpmath=sse -fasynchronous-unwind-tables}" ; export CFLAGS ; 
    CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -grecord-gcc-switches  -m32 -march=x86-64 -mtune=generic -mfpmath=sse -fasynchronous-unwind-tables}" ; export CXXFLAGS ; 
    FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -grecord-gcc-switches  -m32 -march=x86-64 -mtune=generic -mfpmath=sse -fasynchronous-unwind-tables -I/usr/lib/gfortran/modules}" ; export FFLAGS ; 
    FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -grecord-gcc-switches  -m32 -march=x86-64 -mtune=generic -mfpmath=sse -fasynchronous-unwind-tables -I/usr/lib/gfortran/modules}" ; export FCFLAGS ; 
    LDFLAGS="${LDFLAGS:--Wl,-z,relro }"; export LDFLAGS; 
    for i in $(find . -name config.guess -o -name config.sub) ; do 
        [ -f /usr/lib/rpm/redhat/$(basename $i) ] && /usr/bin/rm -f $i && /usr/bin/cp -fv /usr/lib/rpm/redhat/$(basename $i) $i ; 
    done ; 
    ./configure --build=i686-redhat-linux-gnu --host=i686-redhat-linux-gnu \
  	--program-prefix= \
  	--disable-dependency-tracking \
  	--prefix=/usr \
  	--exec-prefix=/usr \
  	--bindir=/usr/bin \
  	--sbindir=/usr/sbin \
  	--sysconfdir=/etc \
  	--datadir=/usr/share \
  	--includedir=/usr/include \
  	--libdir=/usr/lib \
  	--libexecdir=/usr/libexec \
  	--localstatedir=/var \
  	--sharedstatedir=/var/lib \
  	--mandir=/usr/share/man \
  	--infodir=/usr/share/info macro can
    replace them with proper version. With this change it builds fine for AArch64
    architecture.
    Resolves: rhbz#1023783


author: Frantisek Kluknavsky <fkluknav@redhat.com> - 1.1.11-18
changelog:
  - ported from cdda-paranoia to libcdio-paranoia, modified paranoia-cdda.patch
  - fixed bogus date in changelog


author: Boris Ranto <branto@redhat.com> - 1:10.2.5-1
changelog:
  - New version (1:10.2.5-1)
  - Makefile: Fix dencoder build
  - Add fake fcgiapp.h for rgw
  - common: Build more files of libcommon in client
  - libradosstripper: Build libradostripper for rados as noinst


author: Nalin Dahyabhai <nalin@redhat.com> 0.66-1
changelog:
  - build as position-independent executables with early binding (#883966)
  - also don't tag the unit file as a configuration file (internal tooling)


author: Nalin Dahyabhai <nalin@redhat.com> 0.67-1
changelog:
  - when saving certificates to NSS databases, try to preserve the trust
    value assigned to a previously-present certificate with the same nickname
    and subject, if one is found
  - when saving certificates to NSS databases, also prune certificates from
    the database which have both the same nickname and subject as the one
    we're adding, to avoid tripping up tools that only fetch one certificate
    by nickname


author: Nalin Dahyabhai <nalin@redhat.com> 0.67-3
changelog:
  - pull up a patch from master to adapt self-tests to certutil's diagnostic
    output having changed (#992050)


author: Nalin Dahyabhai <nalin@redhat.com> 0.68-1
changelog:
  - notice when the OpenSSL RNG isn't seeded
  - notice when saving certificates or keys fails due to filesystem-related
    permission denial (#996581)


author: Nalin Dahyabhai <nalin@redhat.com> 0.69-1
changelog:
  - tweak how we decide whether we're on the master or a minion when we're
    told to use certmaster as a CA
  - clean up one of the tests so that it doesn't have to work around internal
    logging producing duplicate messages
  - when logging errors while setting up to contact xmlrpc servers, explicitly
    note that the error is client-side
  - don't abort() due to incorrect locking when an attempt to save an issued
    certificate to the designated location fails (part of #1032760/#1033333,
    ticket #22)
  - when reading an issued certificate from an enrollment helper, ignore
    noise before or after the certificate itself (more of #1032760/1033333,
    ticket #22)
  - run subprocesses in a cleaned-up environment (more of #1032760/1033333,
    ticket #22)
  - clear the ca-error that we saved when we had an error talking to the CA if we
    subsequently succeed in talking to the CA
  - various other static-analysis fixes


author: Nalin Dahyabhai <nalin@redhat.com> 0.70-1
changelog:
  - add a --with-homedir option to configure, and use it, since subprocesses
    which we run and which use NSS may attempt to write to $HOME/.pki, and
    0.69's strategy of setting that to "/" was rightly hitting SELinux policy
    denials (#1047798)


author: Nalin Dahyabhai <nalin@redhat.com> 0.75.9-1
changelog:
  - avoid potential use-after-free after a CA is removed dynamically (thanks to
    Keenan Brock) (#1125342)
  - add a "external-helper" property to CA objects


author: Nalin Dahyabhai <nalin@redhat.com> 0.75.10-1
changelog:
  - when attempting to contact an IPA LDAP server, if no "ldap_uri" is set in
    default.conf, and no "host" is set either, try to construct the server URI
    using the "server" setting (#1126985)


author: Nalin Dahyabhai <nalin@redhat.com> 0.75.11-1
changelog:
  - when getcert is passed a -a flag, to indicate that CA root certificates
    should be stored in the specified database, don't ignore locations which
    don't include a storage scheme (#1129537)
  - when called to 'start-tracking' with the -a or -F flags, if we have
    applicable certificates on-hand for a CA that we're either told to use
    or which we decide is the correct one, save the certificates (#1129696)


author: Nalin Dahyabhai <nalin@redhat.com> 0.75.12-1
changelog:
  - correct encoding/decoding of variant-typed data which we receive and send
    as part of the org.freedesktop.DBus.Properties interface over the bus, and
    add some tests for them (based on patch from David Kupka, ticket #36)


author: Nalin Dahyabhai <nalin@redhat.com> 0.75.14-1
changelog:
  - make pathname canonicalization slightly smarter, to handle ".." in
    locations
  - updates to self-tests


author: Jan Cholasta <jcholast@redhat.com> - 0.75.14-2
changelog:
  - backport dogtag-submit: accept additional options to pass to the server when
    approving requests using agent creds (#1165155)


author: Jan Cholasta <jcholast@redhat.com> - 0.75.14-3
changelog:
  - backport change from git to correctly retrieve string values from DBus
    property interface replies (#1181022)


author: Nalin Dahyabhai <nalin@redhat.com> 0.75.14-1
changelog:
  - make pathname canonicalization slightly smarter, to handle ".." in
    locations (#1131758)
  - updates to self-tests (#1144082)


author: Jan Cholasta <jcholast@redhat.com> - 0.78.1-1
changelog:
  - Resolves: #1140241 RFE: Add SCEP support to certmonger
  - Resolves: #1148001 ipa-getcert killed by SIGABRT
  - Resolves: #1205756 Rebase certmonger to 0.77 or later
    - Update to upstream 0.78.1


author: Jan Cholasta <jcholast@redhat.com> - 0.78.3-1
changelog:
  - Resolves: #1244914 scep ca helper does not parse command line options
    correctly
  - Related:  #1205756 Rebase certmonger to 0.77 or later
    - Update to upstream 0.78.3


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-1
changelog:
  - Resolves: #1249753 challenge password not added in csr using start-tracking
  - Resolves: #1250397 Remove certmonger rekey feature in 7.2
    - Remove rekey feature
  - Related:  #1205756 Rebase certmonger to 0.77 or later
    - Update to upstream 0.78.4


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-2
changelog:
  - Resolves: #1345755 Support for specifying IPA lightweight CA
    - Add 'issuer' request option for specifying issuer
    - Documentation: mark $CERTMONGER_CA_ISSUER as 0.79
    - Comment/whitespace fixup
    - ipa-submit: Retry without "ca" on OptionError
    - getcert: fix a potential out-of-bounds
    - Document the -X option in the ipa-submit man page
  - Resolves: #1351052 certmonger build for RHEL 7.3 failure
    - Stop assuming RSA 512 works
    - Stop assuming RSA 512 works, part two
    - Fix a flakiness in the 028-dbus test


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-3
changelog:
  - Resolves: #1367683 getcert request command fails to use Sub CA using -X
    argument
    - Fix CA option name for ipa cert-request


author: Dan Walsh <dwalsh@redhat.com> - 2.1.11-3
changelog:
  - Update to latest patches from eparis/Upstream
  -   checkpolicy: libsepol: implement default type policy syntax
  -   
  -   We currently have a mechanism in which the default user, role, and range
  -   can be picked up from the source or the target object.  This implements
  -   the same thing for types.  The kernel will override this with type
  -   transition rules and similar.  This is just the default if nothing
  -   specific is given.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-1
changelog:
  - Update to upstream 
          * Fix errors found by coverity
          * implement default type policy syntax
          * Free allocated memory when clean up / exit.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-4
changelog:
  - Fix a segmentation fault if the --handle-unknown option was set without
  arguments.
  - Thanks to Alexandre Rebert and his team at Carnegie Mellon University
  for detecting this crash.


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-3
changelog:
  - Fix typos in test/dispol
  - Set flex as default lexer
  - Fix checkmodule output message
  - Build policy on systems not supporting DCCP protocol
  - Fail if module name different than output base filename


author: Hans de Goede <hdegoede@redhat.com> - 2:3.8.2-3
changelog:
  - Add a number of bug-fixes to deal better with high res cams (#873434)
  - Fix cheese-introduction.png being in both cheese and cheese-libs (#893756)
  - Put the COPYING file in the docs for cheese-libs (#893800)
  - Fix the flash when taking a photo being dark grey instead of white (#965813)
  - Fix needing to press the effects button twice to select effects after
    selecting an effect for the first time
  - Various other bug-fixes


author: Hans de Goede <hdegoede@redhat.com> - 2:3.8.2-4
changelog:
  - Fix misbehavior when started without a camera
  - Don't crash when the (last) camera gets unplugged
  - Automatically use a newly plugged camera when going from 0 to 1 cameras
  - Misc. other bugfixes


author: Bill Nottingham <notting@redhat.com> 1.3.57-1
changelog:
  - assorted cleanups to LSB dependency support (#693202 fixed properly, #701573)
  - fix kill values for LSB-only scripts (#696305, <jbastian@redhat.com>)
  - don't apply start deps for services that aren't starting anywhere (#750446)


author: Bill Nottingham <notting@redhat.com> 1.3.58-1
changelog:
  - fix forwarding to systemctl with systemd >= 41 (#789256)
  - assorted regression fixes from 1.3.57 (#782152, etc.)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.3.60-1
changelog:
  - don't completely override LDFLAGS
  - pass along any rpm-configured LD flags
  - make sure install_initd/remove_initd provides appropriate help output for those commands (#803818)
  - check for overridden services in /etc too (#850899)
  - chconfig should own /etc/rc.d (#894328)
  - isXinetdEnabled should also ask systemd (#820363)
  - alternatives: look for service file also in /etc
  - alternatives: add --list option (#622635)
  - chkconfig: add hint to call systemctl list-unit-files and list-dependencies (#800334)
  - chkconfig: correctly handle unreadable init.d (#913807)
  - alternatives: call systemctl enable with --force (#915667)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.3.61-5
changelog:
  - chkconfig: don't create symlinks if they already exist
  - fix combination --type xinetd --list service
  - leveldb: restore selinux context for xinetd conf files


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.3.62-1
changelog:
  - use systemctl preset, not systemctl enable
  - fix typo in manpage
  - partly support socket activated services


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.4-1
changelog:
  - ntsysv: show systemd services and sockets
  - fix combination --type xinetd --list service
  - leveldb: restore selinux context for xinetd conf files
  - alternatives: remove unused variable
  - alternatives: warn if the target is not a symlink
  - spec: add link to git
  - lets simplify version


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.5-1
changelog:
  - add systemd-sysv-install alias
  - don't create symlinks if they already exist
  - fix wrongly behaving LDFLAGS


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.6-1
changelog:
  - systemd-sysv-install: don't play ping-pong with systemctl
  - ntsysv: add description to systemd services
  - ntsysv: skip templates
  - Makefile: fix typo


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.7.2-1
changelog:
  - alternatives: introduce --keep-missing
  - alternatives: allow family in --set and display it in --config


author: Miroslav Lichvar <mlichvar@redhat.com> 1.27-2
changelog:
  - suppress error messages from tr when generating key (#907914)
  - fix delta calculation with extreme frequency offsets


author: Miroslav Lichvar <mlichvar@redhat.com> 1.27-3
changelog:
  - disable chrony-wait service by default (#961047)
  - drop old systemd scriptlets
  - don't own ntp-units.d directory
  - move files from /lib
  - remove unncessary dependency on syslog target


author: Miroslav Lichvar <mlichvar@redhat.com> 1.29.1-1
changelog:
  - update to 1.29.1 (#1053022, CVE-2014-0021)
  - fix selecting of sources with prefer option (#1061048)
  - fix potential bug in writing of drift files (#1061106)
  - replace hardening build flags with _hardened_build (#1061036)


author: Miroslav Lichvar <mlichvar@redhat.com> 2.1-1
changelog:
  - update to 2.1 (#1117882 #1169353 #1206504 #1209568 CVE-2015-1821
    CVE-2015-1822 CVE-2015-1853)
  - extend chrony-helper to allow using servers from DNS SRV records (#1211600)
  - add servers from DHCP with iburst option by default (#1219492)
  - execute test suite


author: Miroslav Lichvar <mlichvar@redhat.com> 3.1-1
changelog:
  - update to 3.1 (#1387223 #1274250 #1350669 #1406445)
  - don't start chronyd without capability to set system clock (#1306046)
  - fix chrony-helper to escape names of systemd units (#1418968)
  - package chronyd sysconfig file (#1396840)


author: Petr Machata <pmachata@redhat.com> - 0.13-11
changelog:
  - Add missing last entry in long options array
    (chrpath-0.13-getopt_long.patch)
  - Update config.sub and config.guess to support aarch64
    (chrpath-0.13-aarch64.patch)


author: Jeff Layton <jlayton@redhat.com> 6.2-3
changelog:
  - fixes for bugs reported by coverity:
  - update bad bit shift patch with one that patches getcifsacl.c too
  - remove some dead code from getcifsacl.c, asn1.c, and data_blob.c
  - fix bad handling of allocated memory in del_mtab in mount.cifs.c


author: Sachin Prabhu <sprabhu@redhat.com> - 6.2-8
changelog:
  - Prevent unnecessary linking of libwbclient
  - Uppercase orig_dev on 2nd try at mounting
  - Include paths.h in mtab.c
  - Clarify use of backupuid/backupgid in manpage
  - Ignore x-* mount options


author: Sachin Prabhu <sprabhu@redhat.com> - 6.2-10
changelog:
  - aclocal: fix typo in idmap.m4
  - mount.cifs: Removed extra comma in front of domain
  - mount.cifs: Accept empty domains on the command line
  - mount.cifs: Fixed command line parsing and aligned with kernel
  - mount.cifs: Remove unneeded stdbool header include
  - manpage: document mfsymlinks in the mount.cifs man page


author: Nathaniel McCallum <npmccallum@redhat.com> - 5-1
changelog:
  - New upstream release
  - Run clevis decryption from udisks2 under an unprivileged user
  - Reenable udisks2 subpackage


author: Nathaniel McCallum <npmccallum@redhat.com> - 6-1
changelog:
  - New upstream release
  - Specify unprivileged user/group during configuration
  - Move clevis user/group creation to base clevis package


author: Lars Kellogg-Stedman <lars@redhat.com> - 0.7.6-8
changelog:
  - make rh_subscription plugin do nothing in the absence of a valid
    configuration [RH:1295953]
  - move rh_subscription module to cloud_config stage


author: Lars Kellogg-Stedman <lars@redhat.com> 0.7.9-6
changelog:
  - add power-state-change module to cloud_final_modules (rhbz#1252477)
  - remove 'tee' command from logging configuration (rhbz#1424612)
  - limit permissions on def_log_file (rhbz#1424612)
  - Bounce network interface for Azure when using the built-in path. (rhbz#1434109)
  - OpenStack: add 'dvs' to the list of physical link types. (rhbz#1442783)


author: Lars Kellogg-Stedman <lars@redhat.com> 0.7.9-7
changelog:
  - Add missing sysconfig unit test data (rhbz#1438082)
  - Fix dual stack IPv4/IPv6 configuration for RHEL (rhbz#1438082)
  - sysconfig: Raise ValueError when multiple default gateways are present. (rhbz#1438082)
  - Bounce network interface for Azure when using the built-in path. (rhbz#1434109)
  - Do not write NM_CONTROLLED=no in generated interface config files (rhbz#1385172)


author: Lars Kellogg-Stedman <lars@redhat.com> 0.7.9-9
changelog:
  - RHEL/CentOS: Fix default routes for IPv4/IPv6 configuration. (rhbz#1438082)
  - azure: ensure that networkmanager hook script runs (rhbz#1440831 rhbz#1460206)
  - Fix ipv6 subnet detection (rhbz#1438082)


author: Ryan McCabe <rmccabe@redhat.com> 0.7.9-9.3
changelog:
  - Disable NetworkManager management of resolv.conf if nameservers
    are specified by configuration.
    Resolves: rhbz#1537439


author: Ryan McCabe <rmccabe@redhat.com> 0.7.9-9.4
changelog:
  - sysconfig: Fix rendering of default gateway for ipv4
    Resolves: rhbz#1540094
  - sysconfig: Correct rendering for dhcp on ipv6
    Resolves: rhbz#1540093


author: Rex Dieter <rdieter@fedoraproject.org> 2.3.3.4-6
changelog:
  - contribs-lib is not built and installed even with config (#794795, upstream ID: 3392466)
  - pkgconfig file is missing clucene-shared (upstream ID: 3461512)
  - non-descriptive descripton (#757319)


author: Jan Pokorný <jpokorny+rpm-clufter@redhat.com> - 0.57.0-1
changelog:
  - bump upstream package, see https://pagure.io/clufter/releases
  - generate man pages also for offered commands
  - auto-generate SEE ALSO sections for the man pages
  - move entry_points.txt to clufter-cli sub-package
  - general spec file refresh (pagure.io as a default project base, etc.)
  - make Python interpreter execution sane
  - fix *2pcscmd* commands so they do not suggest
    "pcs cluster cib <file> --config" that doesn't currently
    work for subsequent local-modification pcs commands
    [rhbz#1328078]
  - add support for ticket constraints to *2pcscmd commands
    [rhbz#1340243]


author: Jan Pokorný <jpokorny+rpm-clufter@redhat.com> - 0.58.0-1
changelog:
  - fix Python interpreter propagated as enquoted string with old setuptools
  - bump upstream package, see https://pagure.io/clufter/releases


author: Jan Pokorný <jpokorny+rpm-clufter@redhat.com> - 0.59.0-1
changelog:
  - add ability to borrow validation schemas from pacemaker installed along
  - bump upstream package, see https://pagure.io/clufter/releases


author: Jan Pokorný <jpokorny+rpm-clufter@redhat.com> - 0.70.0-2
changelog:
  - split -bin and -common packages, the former becoming the only arch-specific
  - also move python-specific (entry points, main files) back from -cli package
  - also add virtual provides for python-clufter as python2-clufter
  - bump upstream package (version rolling the above changes out)
  - build for ppc64le
    [rhbz#1402565]


author: Jan Pokorný <jpokorny+rpm-clufter@redhat.com> - 0.75.0-1
changelog:
  - move nano fallback editor dependency to -cli package [PGissue#1]
  - bump upstream package, see https://pagure.io/clufter/releases


author: Jan Pokorný <jpokorny+rpm-clufter@redhat.com> - 0.76.0-1
changelog:
  - factor "borrow validation schemas from pacemaker" out to a separate script
  - bump upstream package, see https://pagure.io/clufter/releases


author: Florian Müllner <fmuellner@redhat.com> - 1.14.4-7
changelog:
  - Backport device manager cleanups for pointer emulation for touch events
    in mutter
    Resolves: rhbz#1051029


author: Owen Taylor <otaylor@redhat.com> - 1.14.4-9
changelog:
  - Add upstream patches fixing problems that resulted in the entire
    screen being redrawn too often with gnome shell.
    Resolves: rhbz#1034941


author: Owen Taylor <otaylor@redhat.com> - 1.20.0-6
changelog:
  - Fix problem with stereo patch (missing export declarations) that resulted
    in added symbols not being exported.
    Resolves: #1306801


author: Owen Taylor <otaylor@redhat.com> - 1.20.0-8
changelog:
  - Add a patch that adds clutter_x11_enable_threaded_swap_wait(),
    enabling proper waiting for frame completion on NVIDIA.
  - Add a patch to fix Cogl Glib source added multiple times.
    See https://bugzilla.gnome.org/show_bug.cgi?id=768243
    Resolves: #1306801


author: Rui Matos <rmatos@redhat.com> - 1.20.0-10
changelog:
  - Add patches to make the backend driver selection explicit instead of
    changing the default to gl3
    Resolves: #1361251


author: Petr Machata <pmachata@redhat.com> - 2.8.11-2
changelog:
  - Pass -fno-strict-aliasing to cm_sha2.c to avoid strict aliasing
    problems that GCC warns about.
  - Icon name in CMake.desktop shouldn't include filename extension.


author: Patsy Franklin <pfrankli@redhat.com> - 2.8.12.2-1
changelog:
  - Rebase to 2.8.12.2 including some recent patches. (BZ #1195919)
  - Fix to find python libs version 3.4 (BZ #1246369)
  - Don't fail if certain Qt modules are unavailable. (BZ #1192188)


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.105-5
changelog:
  - Avoid a PV label scan while in a critical section.
  - Add Requires: resource-agents to lvm2-cluster and cmirror subpackage.
  - Add new lvm2-cluster-standalone and cmirror-standalone subpackages.
  - Add systemd native service for clvmd, cmirrord and clustered LV activation.
  - Move obsolete clvmd/cmirrord initscripts to lvm2-sysvinit subpackage.
  - Use --ignoreskippedcluster in lvm2-monitor initscript/systemd unit.
  - Use --ignoreskippedcluster in activation systemd units if use_lvmetad=0.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.105-6
changelog:
  - Add initial support for LVM cache and cachepool segment types.
  - Include various bug fixes from upcoming lvm2 v2.02.106 release
    detailed in WHATS_NEW and WHATS_NEW_DM file.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.105-10
changelog:
  - Fix cache consistency in lvmetad when PV moves around.
  - Fix memleak when lvmetad discovers PV to appear on another device.
  - Fix invalid memory read in lvmetad that could cause a deadlock.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.105-12
changelog:
  - Do not try to check empty pool with scheduled messages.
  - Fix return value in pool_has_message() when quering for any message.
  - Fix dmeventd logging with parallel wait event processing.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.105-13
changelog:
  - Use VG read lock during 'pvscan --cache -aay' autoactivation.
  - Issue a VG refresh before autoactivation only if the PV has changed/is new.
  - Add flag to lvmetad protocol to indicate the PV scanned has changed/is new.
  - Also add vgname to lvmetad protocol when referencing VGs for PVs scanned.
  - Use correct PATH_MAX for locking dir path.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.105-14
changelog:
  - Increase wait time for finishing initial lvmetad scan that's run in parallel.
  - Reinitialise lvmcache properly on fork to fix polldaemon exiting prematurely.
  - Add more cleanup for stray "cpg_dispatch_failed" cmirror messages.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.111-1
changelog:
  - Update to latest upstream release with various fixes and
    enhancements documented in WHATS_NEW and WHATS_NEW_DM file.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.113-1
changelog:
  - Fix missing rounding to 64KB when estimating optimal thin pool chunk size.
  - Fix size in pvresize "Resizing to ..." verbose msg to show proper result size.
  - Add --cachepolicy and --cachesettings options to lvchange.
  - Validate that converted volume and specified pool volume differ in lvconvert.
  - Fix regression in vgscan --mknodes usage (2.02.112).
  - Respect --prefix when setting CLMVD_PATH configure (2.02.89).
  - Default to configure --enable-udev-systemd-background-jobs for systemd>=205.
  - Fix ignore_vg() to properly react on various vg_read errors (2.02.112).
  - Failed recovery returns FAILED_RECOVERY status flag for vg_read().
  - Exit with non-zero status code when pvck encounters a problem.
  - Fix clean_tree after activation/resume for cache target (2.02.112).
  - Fix memory corruption with sorting empty string lists (1.02.86).
  - Fix man dmsetup.8 syntax warning of Groff
  - Accept unquoted strings and / in place of {} when parsing configs.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.114-2
changelog:
  - Release socket in daemon_close and protocol string in daemon_open error path.
  - Add --cachepolicy and --cachesettings to lvcreate.
  - Fix regression when parsing /dev/mapper dir (2.02.112).
  - Fix typo in clvmd initscript causing CLVMD_STOP_TIMEOUT var to be ignored.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.114-3
changelog:
  - Add cache_policy and cache_settings reporting fields.
  - Add missing recognition for --binary option with {pv,vg,lv}display -C.
  - Fix vgimportclone to notify lvmetad about changes done if lvmetad is used.
  - Fix vgimportclone to properly override config if it is missing in lvm.conf.
  - Fix automatic use of configure --enable-udev-systemd-background-jobs.
  - Correctly rename active split LV with -splitmirrors for raid1.
  - Still restrict mirror region size to power of 2 when VG extent size is not.
  - Fix segfault while using selection with regex and unbuffered reporting.
  - Remove unimplemented dm_report_set_output_selection from libdevmapper.h.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.114-4
changelog:
  - Fix incorrect rimage names when converting from mirror to raid1 LV (2.02.112).
  - Avoid excessive re-reading of metadata and related error messages in pvremove.
  - Check for cmirror availability during cluster mirror creation and activation.
  - Fix possible segfault when using cache_policy and cache_settings fields.
  - Fix reserved values recognition for cache_policy and cache_settings fields.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.114-5
changelog:
  - Report lv_health_status and health attribute also for thin pool.
  - Add lv_error_when_full reporting field.
  - Add support for lvcreate --errorwhenfull y|n for thin pools.
  - Report more info from thin pool status (out of data, metadata-ro, fail).
  - Support error_if_no_space for thin pool target.
  - Do not filter out snapshot origin LVs as unusable devices for an LVM stack.
  - Fix process_each_pv to match item by device not by its PV device name only.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.115-1
changelog:
  - Report segment types without monitoring support as undefined.
  - Support lvchange --errorwhenfull for thin pools.
  - Improve the processing and reporting of duplicate PVs.
  - Add support for lvcreate --errorwhenfull y|n for thin pools
  - Fix lvconvert --repair to honour resilience requirement for segmented RAID LV.
  - Also call lvscan --cache in dmeventd for mirror device update in lvmetad.
  - Filter out partitioned device-mapper devices as unsuitable for use as PVs.
  - Also notify lvmetad about filtered device if using pvscan --cache DevicePath.
  - Add report/compact_output to lvm.conf to enable/disable compact report output.
  - Rename lv_error_when_full reporting field to lv_when_full.
  - Reduce severity of ioctl error message when dmeventd waitevent is interrupted.
  - Report 'unknown version' when incompatible version numbers were not obtained.
  - Add dm_report_compact_fields to remove empty fields from report output.
  - Add BuildRequires: device-mapper-persistent-data for proper thin_check configuration.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.115-2
changelog:
  - Remove rules from 10-dm.rules which handle multipath, rules for handling
    multipath devices are directly part of device-mapper-multipath package.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.115-3
changelog:
  - Preserve chunk size with repair and metadata swap of a thin pool.
  - Fix raid --splitmirror 1 functionality (2.02.112).
  - Fix tree preload to handle splitting raid images.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.115-3.el7_1.1
changelog:
  - Fix lvm2app lvm_lv_get_property return value for fields with info/status ioctl.
  - Fix lvm2app regression in lvm_lv_get_attr causing unknown values (2.02.115).


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.126-1
changelog:
  - Fix long option hyphen removal. (2.02.122)
  - Fix clvmd freeze if client disappears without first releasing its locks.
  - Fix lvconvert segfaults while performing snapshots merge.
  - Ignore errors during detection if use_blkid_wiping=1 and --force is used.
  - Recognise DM_ABORT_ON_INTERNAL_ERRORS env var override in lvm logging fn.
  - Fix alloc segfault when extending LV with fewer stripes than in first seg.
  - Fix handling of cache policy name.
  - Set cache policy before with the first lvm2 cache pool metadata commit.
  - Fix detection of thin-pool overprovisioning (2.02.124).
  - Fix lvmpolld segfaults on 32 bit architectures.
  - Add lvmlockd lock_args validation to vg_validate.
  - Fix ignored --startstopservices option if running lvmconf with systemd.
  - Hide sanlock LVs when processing LVs in VG unless named or --all used.
  - Introduce libdevmapper wrappers for all malloc-related functions.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.127-1
changelog:
  - Do not init filters, locking, lvmetad, lvmpolld if command doesn't use it.
  - Order fields in struct cmd_context more logically.
  - Add lock_type to lvmcache VG summary and info structs.
  - Fix regression in cache causing some PVs to bypass filters (2.02.105).
  - Make configure --enable-realtime the default now.
  - Add dmstats.8 man page.
  - Add dmstats --segments switch to create one region per device segment.
  - Add dmstats --regionid, --allregions to specify a single / all stats regions.
  - Add dmstats --allprograms for stats commands that filter by program ID.
  - Add dmstats --auxdata and --programid args to specify aux data and program ID.
  - Add report stats sub-command to provide repeating stats reports.
  - Add clear, delete, list, and print stats sub-commands.
  - Add create stats sub-command and --start, --length, --areas and --areasize.
  - Recognize 'dmstats' as an alias for 'dmsetup stats' when run with this name.
  - Add a 'stats' command to dmsetup to configure, manage and report stats data.
  - Add statistics fields to dmsetup -o.
  - Add libdm-stats library to allow management of device-mapper statistics.
  - Add --nosuffix to suppress dmsetup unit suffixes in report output.
  - Add --units to control dmsetup report field output units.
  - Add support to redisplay column headings for repeating column reports.
  - Fix report header and row resource leaks.
  - Report timestamps of ioctls with dmsetup -vvv.
  - Recognize report field name variants without any underscores too.
  - Add dmsetup --interval and --count to repeat reports at specified intervals.
  - Add dm_timestamp functions to libdevmapper.
  - Recognise vg/lv name format in dmsetup.
  - Move size display code to libdevmapper as dm_size_to_string.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.128-1
changelog:
  - Allocation setting cache_pool_cachemode is replaced by cache_mode.
  - Don't attempt to close config file that couldn't be opened.
  - Check for valid cache mode in validation of cache segment.
  - Change internal interface handling cache mode and policy.
  - When no cache policy specified, prefer smq (if available) over mq.
  - Add demo cache-mq and cache-smq profiles.
  - Add cmd profilable allocation/cache_policy,cache_settings,cache_mode.
  - Require cache_check 0.5.4 for use of --clear-needs-check-flag.
  - Fix lvmetad udev rules to not override SYSTEMD_WANTS, add the service instead.
  - Fix 'dmstats list -o all' segfault.
  - Separate dmstats statistics fields from region information fields.
  - Add interval and interval_ns fields to dmstats reports.
  - Do not include internal glibc headers in libdm-timestamp.c (1.02.104)
  - Exit immediately if no device is supplied to dmsetup wipe_table.
  - Suppress dmsetup report headings when no data is output. (1.02.104)
  - Adjust dmsetup usage/help output selection to match command invoked.
  - Fix dmsetup -o all to select correct fields in splitname report.
  - Restructure internal dmsetup argument handling across all commands.
  - Add dm_report_is_empty() to indicate there is no data awaiting output.
  - Add more arg validation for dm_tree_node_add_cache_target().
  - Add --alldevices switch to replace use of --force for stats create / delete.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.129-1
changelog:
  - Drop error message when vgdisplay encounters an exported VG. (2.02.27)
  - Fix shared library generation to stop exporting internal functions.(2.02.120)
  - Accept --cachemode with lvconvert.
  - Fix and improve reporting properties of cache-pool.
  - Enable usage of --cachepolicy and --cachesetting with lvconvert.
  - Don't allow to reduce size of thin-pool metadata.
  - Fix debug buffer overflows in cmirrord logging.
  - Add --foreground and --help to cmirrord.
  - Add 'precise' column to statistics reports.
  - Add --precise switch to 'dmstats create' to request nanosecond counters.
  - Add precise argument to dm_stats_create_region().
  - Add support to libdm-stats for precise_timestamps
  - Fix devmapper.pc pkgconfig file to declare -lrt dependency properly.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.130-1
changelog:
  - Fix use of uninitialized device status if reading outdated .cache record.
  - Restore support for --monitor option in lvcreate (2.02.112).
  - Read thin-pool data and metadata percent without flush.
  - Detect blocked thin-pool and avoid scanning their thin volumes.
  - Check if dm device is usable before checking its size (2.02.116).
  - Extend parsing of cache_check version in configure.
  - Make lvpoll error messages visible in lvmpolld's stderr and in syslog.
  - Add 'make install_full_man' to install all man pages regardless of config.
  - Parse thin-pool status with one single routine internally.
  - Add --histogram to select default histogram fields for list and report.
  - Add report fields for displaying latency histogram configuration and data.
  - Add dmstats --bounds to specify histogram boundaries for a new region.
  - Add dm_histogram_to_string() to format histogram data in string form.
  - Add public methods to libdm to access numerical histogram config and data.
  - Parse and store histogram data in dm_stats_list() and dm_stats_populate().
  - Add an argument to specify histogram bounds to dm_stats_create_region().
  - Add dm_histogram_bounds_from_{string,uint64_t}() to parse histogram bounds.
  - Add dm_histogram handle type to represent a latency histogram and its bounds.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.130-2
changelog:
  - Fix vgimportclone cache_dir path name (2.02.115).
  - Disallow usage of --stripe and --stripesize when creating cache pool.
  - Swapping of LV identifiers handles more complex LVs.
  - Fix VG metadata comparison failure while scanning the VG for lvmetad.
  - Ignore persistent cache if configuration changed. (2.02.127)
  - Do not check for full thin pool when activating without messages (1.02.107).


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.130-3
changelog:
  - Enforce writethrough mode for cleaner policy.
  - Check for enough space in thin-pool in command before creating new thin.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.130-5.el7_2.1
changelog:
  - Fix possible data loss caused by lost buffered writes during thin pool
    resize after reaching its capacity.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.163-1
changelog:
  - Add profile for lvmdbusd which uses lvm shell json report output.
  - Restrict in-command modification of some parms in lvm shell.
  - Apply LVM_COMMAND_PROFILE early for lvm shell.
  - Refactor reporting so lvm shell log report collects whole of cmd execution.
  - Support LVM_*_FD envvars to redirect output to file descriptors.
  - Limit use of --corelog and --mirrorlog to mirrors in lvconvert.
  - Reject --nosync option for RAID6 LVs in lvcreate.
  - Do not refresh whole cmd context if profile dropped after processing LVM cmd.
  - Support straightforward lvconvert between striped and raid4 LVs. 
  - Support straightforward lvconvert between raid1 and mirror LVs. 
  - Report supported conversions when asked for unsupported raid lvconvert.
  - Add "--rebuild PV" option to lvchange to allow for PV selective rebuilds.
  - Preserve existing mirror region size when using --repair.
  - Forbid stripe parameters with lvconvert --repair.
  - Unify stripe size validation into get_stripe_params to catch missing cases.
  - Further lvconvert validation logic refactoring.
  - Add "lvm fullreport" man page.
  - Add dm_report_destroy_rows/dm_report_group_output_and_pop_all for lvm shell.
  - Adjust group handling and json production for lvm shell.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.164-2
changelog:
  - Suppress some unnecessary --stripesize parameter warnings.
  - Fix selection of PVs when allocating raid0_meta.
  - Specify max stripes for raid LV types: raid0:64; 1:10; 4,5:63; 6:62; 10:32.
  - Avoid double suffix when naming _rmeta LV paired with _rimage LV.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.164-3
changelog:
  - Disallow segtype and mirror conversions of raid10 volumes.
  - Fix dmeventd unmonitoring when segment type (and dso) changes.
  - Don't allow lvconvert --repair on raid0 devices or attempt to monitor them.
  - No longer adjust incorrect number of raid stripes supplied to lvcreate.
  - Move lcm and gcd to lib/misc.
  - Suppress some unnecessary --stripesize parameter warnings.
  - Fix 'pvmove -n name ...' to prohibit collocation of RAID SubLVs


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.164-4
changelog:
  - Use lsblk -s and lsblk -O in lvmdump only if these options are supported.
  - Fix typo in report/columns_as_rows config option name recognition (2.02.99).
  - Do not monitor cache-pool metadata when LV is just being cleared.
  - Add allocation/cache_pool_max_chunks to prevent misuse of cache target.
  - Fix number of stripes shown in lvcreate raid10 message when too many.
  - Give error not segfault in lvconvert --splitmirrors when PV lies outside LV.
  - Avoid PV tags when checking allocation against parallel PVs.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.164-5
changelog:
  - Use udev db to check for mpath components before running pvscan for lvmetad.
  - Use devices/allow_changes_with_duplicate_pvs=1 by default.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.165-1
changelog:
  - Support raid scrubbing on cache origin LV.
  - Add lvmraid(7) man page.
  - Use udev db to check for mpath components before running pvscan for lvmetad.
  - Improve explanation of udev fallback in libdevmapper.h.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.165-2
changelog:
  - Fix possible NULL pointer dereference when checking for monitoring.
  - Add lvmreport(7) man page.
  - Report 0% as dirty (copy%) for cache without any used block.
  - Fix lvm2api reporting of cache data and metadata percent.
  - Restore reporting of metadata usage for cache volumes (2.02.155).


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.165-3
changelog:
  - Fix lvchange --discard|--zero for active thin-pool.
  - Fix lvconvert --repair regression for RAID LVs.
  - Always specify snapshot cow LV for monitoring not internal LV. (2.02.165)
  - Ensure memory allocated internally for --filemap histogram bounds are freed.
  - Fix missing display of last created dmstats file map.
  - Use --alloc normal for mirror logs even if the mimages were stricter.
  - Fix reported origin lv field for cache volumes. (2.02.133)
  - Fix lock-holder device for thin pool with inactive thin volumes.
  - Enforce 4MiB or 25% metadata free space for thin pool operations.
  - Fix lvmetad metadata validation when rescanning VG.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.166-1
changelog:
  - Disable lvconvert of thin pool to raid while active.
  - Use dm_config_parse_without_dup_node_check() to speedup metadata reading.
  - Fix lvm2-activation-generator to read all LVM2 config sources. (2.02.155)
  - Fix man entry for dmsetup status.
  - Introduce new dm_config_parse_without_dup_node_check().


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.166-1.el7_3.1
changelog:
  - Fix lvconvert to allow repair for cache raid LVs.
  - Fix time when dmeventd is reloaded on package upgrade to start using new code.
  - Fix libdm versioning for dm_tree_node_size_changed symbol.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.166-1.el7_3.2
changelog:
  - Prevent raid4 creation/conversion on non-supporting kernels
  - Add direct striped -> raid4 conversion
  - Fix raid4 parity image pair position on conversions from striped/raid0*


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.171-1
changelog:
  - Fix dmstats and dmfilemapd permissions.
  - Fix memory warnings by using mempools for command definition processing.
  - Fix running commands from a script file.
  - Adjust pvresize/pvcreate messages and prompt if underlying device size
    differs.
  - Preserve region size on raid1 image count changes.
  - Handle insufficient space on RAID takeover.
  - Raise mirror/raid default regionsize to 2MiB.


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.171-2
changelog:
  - Stop using '--yes' mode when fsadm runs without terminal.
  - Extend validation of filesystems resized by fsadm.
  - Enhance lvconvert automatic settings of possible (raid) LV types.
  - Allow lvchange to change properties on a thin pool data sub LV.
  - Fix lvcreate extent percentage calculation for mirrors.
  - Don't reinstate still-missing devices when correcting inconsistent metadata.
  - Properly handle subshell return codes in fsadm.
  - Disallow cachepool creation with policy cleaner and mode writeback.


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.171-4
changelog:
  - Converting linear to raid1 using "recover" not "resync".
  - Print a warning about in-use PVs with no VG using them.
  - Disable automatic clearing of PVs that look like in-use orphans.


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.171-5
changelog:
  - Improve lvcreate --cachepool arg validation.
  - Limit maximal size of thin-pool for specific chunk size.
  - Accept truncated files in calls to dm_stats_update_regions_from_fd().


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.171-6
changelog:
  - Reenable conversion of data and metadata thin-pool volumes to raid.
  - Improve handling of RAID status in lvs.
  - Disable RAID reshape/take-over in a cluster or when snapshot exists.


author: Jan Safranek <jsafrane@redhat.com> - 0.5.2-6
changelog:
  - Fixed 'env' parameter value in 'get_providers()' function
    Resolves: #919082
  - Fixed embedded instance properties
    Resolves: #919081


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 0.9.5-3
changelog:
  - Fix placement of *.py[co] files
    Resolves: #921547
  - Remove /usr/share/cmpi - it's used by ruby binding that we don't build


author: Dominik Perpeet <dperpeet@redhat.com> 138-3
changelog:
  - Fix issues with connections between multiple hosts
  - Fix format string type mismatch on some architectures


author: Martin Pitt <mpitt@redhat.com> 138-10
changelog:
  - Backport upstream patches to fix integration tests
  - Fix unit test failure in mock with nspawn
  - Fix created timer units so that they can actually get enabled and started
    rhbz#1478832
  - Fix connecting to remote servers with non-standard ssh port rhbz#1478828


author: Bruce Hill <bruce.hill@oracle.com> - 138-10.0.2
changelog:
  - Revert to enable git patch and update patch 0024-remove-rh-reference.patch
  - Drop subscription-manager requires due to we did not ship it (tianyue.lan@oralce.com)
  - Remove Red Hat references.


author: EL Errata <el-errata_ww@oracle.com> - 138-9.0.1
changelog:
  - Drop subscription-manager requires due to we did not ship it (tianyue.lan@oralce.com)
  - Remove Red Hat references.


author: Adam Jackson <ajax@redhat.com> 1.14.0-5.1
changelog:
  - Enable GLX_MESA_copy_sub_buffer on llvmpipe, since RHEL's Mesa includes
    a fix for that; also conflict with Mesas that don't.


author: Owen Taylor <otaylor@redhat.com> - 1.18.2-12
changelog:
  - Add patches to improve display synchronization on NVIDIA
      
    When testing quadbuffer stereo patches, GNOME Shell would sometimes
    hang up on restart. This turned out to be a problem with display
    synchronization on NVIDIA. The patches added here make display
    synchronization work much more similarly with the NVIDIA drivers
    and the open source drivers, which not only fixes this bug, but should
    reduce future bugs.
      
    Resolves: #1305076

  - Add patches improving frame completion events in Cogl


author: Richard Hughes <richard@hughsie.com> - 1-7
changelog:
  - Add the user-writable system-wide per-machine ICC profile directory from
    the new version of the OpenIccDirectoryProposal.


author: Richard Hughes <richard@hughsie.com> 0.1.33-1
changelog:
  - New upstream version
  - Add some translated profile descriptions for the CMYK profiles
  - Add the FOGRA45L and FOGRA47L CMYK and eciRGBv1 profiles
  - Check the generated CCMX matrix for invalid data
  - Do not print a warning if the DBus property does not exist
  - Ensure mbstowcs() has an LC_CTYPE of 'en_US.UTF-8'
  - Always write C-locale floating point values in IT8 files
  - Initialize the value of the CCMX matrix
  - Never promote localized v2 ICC profiles to v4
  - Rename ISOnewspaper26 to IFRA26S_2004_newsprint


author: Richard Hughes <richard@hughsie.com> 0.1.34-1
changelog:
  - New upstream version
  - Add a ICC transform object for simple RGB conversions
  - Add a warning for RGB profiles with unlikely whitepoint values
  - Add Qt DBus annotations
  - Allow clients to call org.freedesktop.DBus.Peer
  - Correct a lot more company names when creating devices
  - Do not automatically add EDID profiles with warnings to devices
  - Increase the delay between patches in the session-helper
  - Install the bash completion support into /usr


author: Richard Hughes <richard@hughsie.com> 1.0.0-1
changelog:
  - New upstream version
  - Add a config option for monitors with identical EDID values
  - Allow a different input and output format in CdTransform
  - Build all installed binaries with PIE
  - Build the colord binary with full RELRO
  - Do not show a warning when using 'colormgr device-get-profile-for-qualifier'
  - Fix crash in cd-iccdump by working around an lcms2 bug
  - Fix using the color sensors on ARM hardware
  - Set the STANDARD_space metadata for the print profiles
  - Show all the translations when dumping an ICC profile


author: Richard Hughes <richard@hughsie.com> 1.0.1-1
changelog:
  - New upstream version
  - Do not unconditionally enable BPC on the color transform
  - Fix profile created time for non-UTC timezones
  - Record the gamma table in the session helper error message


author: Richard Hughes <richard@hughsie.com> 1.0.2-1
changelog:
  - New upstream version
  - Add cd_icc_save_data() so that we can easily set _ICC_PROFILE
  - Add CdIccStore to monitor directories of ICC profiles
  - Add SystemVendor and SystemModel properties to the main interface
  - Allow to specify a non-qualified path when using FindProfileByFilename
  - Allow using the key 'Filename' when using FindProfileByProperty
  - Always return the error if any sync method failed
  - Fix GObject introspection when getting lists
  - Fix GObject introspection when getting metadata


author: Richard Hughes <richard@hughsie.com> 1.0.4-1
changelog:
  - Rebase to a new upstream version to fix small security bug
  - Use %ghost in the to avoid removing databases on upgrades
  - Resolves: #1012832


author: Richard Hughes <richard@hughsie.com> 0.1.22-2
changelog:
  - Backport a patch from git master that fixes an include issue with
    projects that want to use colord-gtk.h and colord.h at the same time.


author: Richard Hughes <richard@hughsie.com> 0.1.25-1
changelog:
  - New upstream version.
  - Give the sample widget slightly curved corners and a gray outline
  - Do not use deprecated functions from libcolord
  - Fix warnings when building ColordGtk-1.0.gir
  - Fix up the licence boilerplate for CdSampleWidget


author: Jay Fenlason <fenlason@redhat.com> 1:1.2.15-1.el5
changelog:
  - Change sysconfig file to /etc/rdma/compat-dapl to match the change in dapl
  - Split out into separate source rpm from the dapl-2.0.25-2.el5.src.rpm
    Resolves: rhbz#557170 split compat-dapl into a separate srpm


author: Doug Ledford <dledford@redhat.com> - 1:1.2.15-2.el6
changelog:
  - Fix various rpmlint wanrings in spec file
  - Version all of the obsoletes
  - Now that this is no longer part of the dapl rpm, it needs its own
    doc macro so that the license and whatnot are on the system when the
    package is installed
  - Related: bz555835


author: Jay Fenlason <fenlason@redhat.com> - 1:1.2.15-2.1.el6
changelog:
  - Include pipe-leak patch to close
    Resolves: rhbz619439 - OFED1.5.1: uDAPL - cma: memory leak of FD's (DB2 pureScale)
    This required some whitspace editing--apparently the patch was garbled
    somewhere in transit.
  - Include the cma-memleak-verbs-CQ-compl-chans-fix patch to close
    Resolves: rhbz619443 - OFED1.5.1: uDAPL handles close on forked child exit (DB2 pureScale)


author: Doug Ledford <dledford@redhat.com> - 1:1.2.19-1
changelog:
  - Update to latest upstream release (1.2.15 -> 1.2.19)
  - Remove 3 patches rolled into upstream
  - Update exclusive arch to accommodate i686 arch
  - Related: bz725016, bz724896


author: Jindrich Novy <jnovy@redhat.com> 4.7.25-18
changelog:
  - really fix the update path (#627019, #627387)
  - introduce -headers subpackage to avoid conflicts on multiarch
    systems (#590973)
  - install package license


author: Jakub Jelinek <jakub@redhat.com> 3.2.3-70
changelog:
  - filter out -fstack-protector-strong, -grecord-gcc-switches and new
    i686, ppc and s390 tunings (#1048850)


author: Jakub Jelinek <jakub@redhat.com> 4.4.7-7
changelog:
  - change -fstack-protector-strong to -fstack-protector in optflags,
    remove -march=x86-64 and -mfpmath=sse for ix86 (#1048852)


author: Jeff Law <law@redhat.com> - 1:2.12-1.80.4
changelog:
  - Fix passing of -z execstack to the linker.
  - Remove -mnew-mnenomics from PPC build flags
  - Pull over patch for 911307 from Fedora


author: Jan Vcelak <jvcelak@redhat.com> 1:2.3.43-3
changelog:
  - enhancement: build with hardening flags (RELRO)
  - fix: querying for IPv6 DNS records when IPv6 is disabled on the host (#835013)
  - drop unnecessary patches
  - clean configure flags


author: Michal Schmidt <mschmidt@redhat.com> - 1.10.0-3
changelog:
  - Workaround psm vs psm2 conflict by having two separate packages.
  - Related: #947311
  - Related: #1173305


author: Michal Schmidt <mschmidt@redhat.com> - 1.10.0-4
changelog:
  - Disambiguate names of rpm macros among the built variants.
  - Use --with-verbs instead of the deprecated synonym --with-openib.
  - Related: #947311
  - Related: #1173305


author: Michal Schmidt <mschmidt@redhat.com> - 1.10.0-10
changelog:
  - Remove psm2 package variant. Instead use MCA exclusion using config file.
  - Related: #947311
  - Related: #1173305


author: Michal Schmidt <mschmidt@redhat.com> - 1.10.3-1
changelog:
  - Update to upstream release 1.10.3.
  - Stop excluding psm2 MTL by default. The psm/psm2 conflict has been resolved.
  - Resolves: #1273175
  - Resolves: #1285292


author: Michal Schmidt <mschmidt@redhat.com> - 1.10.6-1
changelog:
  - Update to upstream release 1.10.6.
  - Fix missing RPM provides.
  - Resolves: #1382800
  - Resolves: #1365792


author: Doug Ledford <dledford@redhat.com> - 3.3.5-2
changelog:
  - Drop libibmad as it didn't soname bump, and also remove the lower level
    opensm libs, libosm{comp,vendor} as they didn't soname bump either
  - Related: bz725016


author: Doug Ledford <dledford@redhat.com> - 3.3.5-3
changelog:
  - Change the file spec so we don't accidentally pick up the debug files in
    the base package on 32bit arches
  - Resolves: bz732495


author: Marek Kasik <mkasik@redhat.com> - 0.22.5-4
changelog:
  - Add back glib, cpp and qt frontends so that existing applications
  - loads correct libpoppler.so.*.
  - Resolves: #1184215


author: Denys Vlasenko <dvlasenk@redhat.com> - 0.2.7-4
changelog:
  - Forward-porting fixes from RHEL6.
  - Enlarge buffer used for formatting date in a string format.
  - Resolves: rhbz#891938.
  - Allow configuration of the maximum number of open files.
  - Resolves: rhbz#738967.


author: Denys Vlasenko <dvlasenk@redhat.com> - 0.2.7-9
changelog:
  - Added commented-out "LimitNOFILE=" directive to conman.service.
  - This is systemd-esque way to change process limits for serivces.
  - Also and a comment when to use it.
  - Resolves: rhbz#1035228.


author: Paul Wouters <pwouters@redhat.com> - 1.4.2-8
changelog:
  - Resolves: rhbz#CVE-2015-6496
  - Fold in upstream patches since 1.4.2 release up to git 900d7e8
  - Fold in upstream patch set of 2015-08-18 for coverity issues


author: Paul Wouters <pwouters@redhat.com> - 1.4.4-3
changelog:
  - Resolves: rhbz#1425552 (explicitely Require: libnetfilter_conntrack >= 1.0.6 as it is same .so version)


author: Bastien Nocera <bnocera@redhat.com> - 3.22.2-1
changelog:
  + control-center-3.22.2-1
  - Update to 3.22.2
  - Add cursor size selection patch
  Resolves: #1386839, #1298881


author: Bastien Nocera <bnocera@redhat.com> - 3.22.2-5
changelog:
  + control-center-3.22.2-5
  - Don't show veth interfaces, we don't have code to set them up
  Resolves: #1457691


author: Nils Philippsen <nphilipp@redhat.com> - 1.10-3
changelog:
  - don't expect find output to be sorted, move "make test" to %check (#237687,
    patch by Giuseppe Bonacci)
  - change license tag to "GPLv2"


author: Nils Philippsen <nphilipp@redhat.com> - 1.12-1
changelog:
  - version 1.12
  - remove obsolete tests patch
  - don't run md5sum against MD5sums as it lists a non-existing .MD5sums file
    which causes md5sum to error out
  - change license tag to "GPLv2 or GPLv3"


author: Robert Relyea <rrelyea@redhat.com> - 1.1.0-34
changelog:
  - recognize up to 32 keys and certs in coolkeys. (can go up to 62 with just #define changes)
  - own our cache file.
  - verify we are using the correct mechanisms


author: Jiri Vanek <jvanek@redhat.com> - 1.1-2
changelog:
  - package now "installs" also during pretrans, so pretrasn scripts can use it
  - pretrasn "install" is removed in postrans


author: Jiri Vanek <jvanek@redhat.com> - 1.1-3
changelog:
  - commented requires on lua posix to stop blocking composes.
  - changed it to 644 to dont mislead by executable flags
  - Resolves: rhbz#1296430


author: Jiri Vanek <jvanek@redhat.com> - 1.1-5
changelog:
  - posttrans silenced, the error is appearing only in state, when there is nothing to copy
  - Resolves: rhbz#1296430


author: Jiri Vanek <jvanek@redhat.com> - 2.2-1
changelog:
  - added "jre/lib/security/blacklisted.certs" to cared files
  - moved to newest release 2.1
  - moved to new upstream at pagure.io
  - added new script of copy_jdk_configs_fixFiles.sh 
  - copy_jdk_configs.lua  aligned to it
  - Resolves: rhbz#1427463


author: Ondrej Vasik <ovasik@redhat.com> 8.22-3
changelog:
  - mark deprecated SELinux related downstream options as
    deprecated in usage/man
  - temporarily disable setting SELinux contexts recursively
    for existing directories - broken (#1045122)


author: Ondrej Vasik <ovasik@redhat.com> 8.22-5
changelog:
  - do not modify SELinux contexts of existing parent
    directories when copying files (fix by P.Brady, #1045122)


author: Ondrej Vasik <ovasik@redhat.com> 8.22-10
changelog:
  - cp/mv/install: do not crash when getfscreatecon() is
    returning a NULL context
  - fix the cut optimizations to UTF-8 locales only
  - unset the unnecessary envvars after colorls scripts


author: Ondrej Vasik <ovasik@redhat.com> - 8.22-13
changelog:
  - call utilities in colorls.* scripts with full path (#1222223)
  - tail: disable inotify in --follow for vxfs (#1109083)
  - remove circular dependency for util-linux (not relevant for RHEL 7 - #1155963)
  - sort: do not look at more than specified keys for mb locales (#1148347)
  - i18n patch: fix buffer overruns and compiler warnings (#1148347)
  - xfs: fix dd sparse false test failure on btrfs and xfs (#1223041)
  - dd: new status=progress level to print stats periodically (#1147701)
  - id/groups - print correct group for session (#1115430)
  - cp,install,mknod,mkfifo,mkdir: separate -Z and --context options
    in --help and manpage (#1084471)
  - ls: clarify --scontext/--context/--lcontext options behaviour
    in info documentation, mention deprecation (#1099508)
  - du: handle bindmount cycles more gracefully (#1238191)
  - mv: prevent possible race condition for hardlinks (#1166570)
  - df: improve filtering of NFS mounts and bind mounts
    (#1197463, #1100026, #1129661)


author: Ondrej Vasik <ovasik@redhat.com> - 8.22-18
changelog:
  - fix xfs build failure in chrooted environment (#1263341)
  - update filesystem lists for stat and tail from latest upstream
    (#1327881, #1280357) 
  - disable id/setgid.sh test(missing chroot feature), fix 
    cp-a-selinux test (#1266500,#1266501)
  - colorls.sh - change detection of interactive shell for ksh
    compatibility (#1321648)
  - fix date --date crash with empty or invalid TZ envvar (#1325786)
  - df -l: do not hang on a dead autofs mount point (#1309247)
  - sort -h: fix functionality of human readable numeric sort for other
    than first field (#1328360)


author: Jan Friesse <jfriesse@redhat.com> 2.3.1-3
changelog:
  - Resolves: rhbz#998362

  - Fix scheduler pause-detection timeout (rhbz#998362)
  - merge upstream commit 2740cfd1eac60714601c74df2137fe588b607866 (rhbz#998362)


author: Jan Friesse <jfriesse@redhat.com> 2.3.2-3
changelog:
  - Resolves: rhbz#1031832

  - cfgtool: return error on reload failure (rhbz#1031832)
  - merge upstream commit 7014f10123a634cf026491edc9a09d6044106116 (rhbz#1031832)


author: Jan Friesse <jfriesse@redhat.com> 2.3.3-2
changelog:
  - Resolves: rhbz#1067028

  - cpg: Refactor mh_req_exec_cpg_procleave (rhbz#1067028)
  - merge upstream commit fcf26e03036b6ae5a8ef762ea0b5691a4f790c92 (rhbz#1067028)
  - cpg: Make sure nodid is always logged as hex num (rhbz#1067028)
  - merge upstream commit 83c63b247f4030fe8123df7c9f96d7a1c8e245b1 (rhbz#1067028)
  - cpg: Make sure left nodes are really removed (rhbz#1067028)
  - merge upstream commit fbe8768f1bbab6d546023d70e7f7b91a9dc213b0 (rhbz#1067028)


author: Jan Friesse <jfriesse@redhat.com> 2.3.3-3
changelog:
  - Resolves: rhbz#1059607
  - Resolves: rhbz#1069254
  - Resolves: rhbz#1074673
  - Resolves: rhbz#1078361
  - Resolves: rhbz#1078363
  - Resolves: rhbz#1085468
  - Resolves: rhbz#1086233
  - Resolves: rhbz#1108508
  - Resolves: rhbz#1108511
  - Resolves: rhbz#1108522
  - Resolves: rhbz#1108525
  - Resolves: rhbz#1108708
  - Resolves: rhbz#1117911

  - Free object allocated at quorum_register_callback (rhbz#1059607)
  - merge upstream commit fa71067a93ea99d8dc4812e3a028ae154216a91a (rhbz#1059607)
  - votequorum: Add extended options to auto_tie_breaker (rhbz#1059607)
  - merge upstream commit 90d448af3b4b4508ca890cce67113cb226475d3b (rhbz#1059607)
  - totemsrp: Fix typo with cont gather (rhbz#1108508)
  - merge upstream commit 38c04d9a66ba41dae14a57eba119dabb31cbb18f (rhbz#1108508)
  - mon: Make mon compilable with libstatgrab ver 0.9 (rhbz#1108511)
  - merge upstream commit e1e2390b61fb5d47a8639f2538721675dd411b08 (rhbz#1108511)
  - mon: Fix comparsion typo (rhbz#1108511)
  - merge upstream commit 57ff693b70cb7aaa81e52e9d24f38aa0399a8c46 (rhbz#1108511)
  - mon: Pass correct pointer to inst (rhbz#1108511)
  - merge upstream commit 099f704cdddfb3b72fe93fb1f4fc777672eb9fdf (rhbz#1108511)
  - mon: Make monitoring work (rhbz#1108511)
  - merge upstream commit ff67daa55f6cfcb48357a8fddaa312b9fb49602b (rhbz#1108511)
  - votequorum: Properly initialize atb and atb_string (rhbz#1059607)
  - merge upstream commit e1801ba49738a3ae2ba3ca08c2b74dda5ff9056c (rhbz#1059607)
  - config: Handle totem_set_volatile_defaults errors (rhbz#1078361)
  - merge upstream commit 2f0cad20a9a368683fd59a869b2cb360bd31f95b (rhbz#1078361)
  - Log: Make reload of logging work (rhbz#1078361)
  - merge upstream commit 1b6abcc7d5afd4651efcdba1a65effb259f6ee3e (rhbz#1078361)
  - Really clear totemconfig nodes on reload (rhbz#1078361)
  - merge upstream commit eeb2384157351ff460be0648d954e5e97213d532 (rhbz#1078361)
  - totemconfig: Key change process dependencies (rhbz#1078361)
  - merge upstream commit b95ebd640eb45267d69822c8292a0098a8e4180e (rhbz#1078361)
  - totemconfig: Log errors on key change and reload (rhbz#1078361)
  - merge upstream commit 9a8de87c34071f54a9e3b545a1a7460d64568579 (rhbz#1078361)
  - Add token_coefficient option (rhbz#1078361)
  - merge upstream commit 58176d6779a0f5ff23dabf61dff7544db29af25a (rhbz#1078361)
  - init: Make init script configurable (rhbz#1078363)
  - merge upstream commit 1f7e78ab9cc686a7528ac4601651ded9d204b01f (rhbz#1078363)
  - config: Allow dynamic change of token_coefficient (rhbz#1078361)
  - merge upstream commit 7557fdec487cb5fad7c449949ba58496bd396458 (rhbz#1078361)
  - upstart: Make job conf file configurable (rhbz#1108522)
  - merge upstream commit d23ee6a3e0d5299f488bf9abed98f1853fd0e8b0 (rhbz#1108522)
  - Indent: Remove space in negation of expression (rhbz#1108522)
  - merge upstream commit b6e2c8024dd314ce17eac4f3f83a2320ebb7017d (rhbz#1108522)
  - Indent: Remove newline before else branch start (rhbz#1108522)
  - merge upstream commit d0dc9ae93c6f41ab9139242d754428fcf9bcc653 (rhbz#1108522)
  - totemiba: Add multicast recovery (rhbz#1108522)
  - merge upstream commit 4d6a18d8a5c0001f2eaeebb79d75f999c671cb74 (rhbz#1108522)
  - totemiba: Fix incorrect failed log message (rhbz#1108522)
  - merge upstream commit e905f92bf532c291d9be23b6a16d972f36d5d464 (rhbz#1108522)
  - logsys: Log error if blackbox cannot be created (rhbz#1108525)
  - merge upstream commit 19c5b63ff5fae43c2acf28ce95cca6460f500176 (rhbz#1108525)
  - logsys: Log warning if flightrecorder init fails (rhbz#1108525)
  - merge upstream commit 8f13a983204c2bc16c7490cee6db90138ecc43f1 (rhbz#1108525)
  - Introduce get_run_dir function (rhbz#1108525)
  - merge upstream commit d310b251c3ba5e92c7ca1b8f6f8197d71141a8d6 (rhbz#1108525)
  - Move ringid store and load from totem library (rhbz#1108525)
  - merge upstream commit da46ecfc3087de97ad9a76fe6a156f10170503a2 (rhbz#1108525)
  - init: change return value when starting corosync (rhbz#1078363)
  - merge upstream commit 7a6cc6b5a2f6ec5d88e52e34e62f18db1915afd7 (rhbz#1078363)
  - Install doc: Correct a typo (rhbz#1108522)
  - merge upstream commit a64696698718071e4e531a5a3332c363742c550b (rhbz#1108522)
  - coroparse: More strict numbers parsing (rhbz#1108708)
  - merge upstream commit 4e9716ed30ffe6a5750f5c6c2565815e88413c23 (rhbz#1108708)
  - Doc: Enhance INSTALL file a bit (rhbz#1108522)
  - merge upstream commit e8a5c56ab27fff4beef910804841d73aaa17a6a1 (rhbz#1108522)
  - Make config.reload_in_progress key read only (rhbz#1085468)
  - merge upstream commit c8e3f14fdb284aadf023d7e62c0f951181f21736 (rhbz#1085468)
  - votequorum: Do not process events during reload (rhbz#1085468)
  - merge upstream commit 72cf15af27ea9dbf918839ac44929ed9c65eea5e (rhbz#1085468)
  - systemd: Config example for corosync wd service (rhbz#1108522)
  - merge upstream commit f6d6a9b0a0ca99a201bb9e9353a05075b700bcbd (rhbz#1108522)
  - fix memory leak produced by 'corosync -v' (rhbz#1117911)
  - merge upstream commit cc80c8567d6eec1d136f9e85d2f8dfb957337eef (rhbz#1117911)
  - Handle SIGSEGV and SIGABRT signals (rhbz#1117911)
  - merge upstream commit 384760cb670836dc37e243f594612c6e68f44351 (rhbz#1117911)
  - Fix compiler warning introduced by previous patch (rhbz#1117911)
  - merge upstream commit dfaca4b10a005681230a81e229384b6cd239b4f6 (rhbz#1117911)
  - corosync-cmapctl: Allow -p option to delete keys (rhbz#1108522)
  - merge upstream commit 7a4bb37723777bf6bcd08035696d8d7317c0ce1d (rhbz#1108522)
  - Implement config file testing mode (rhbz#1108522)
  - merge upstream commit e3ffd4fedc8158cdb5057f9fe40b6459e3d85846 (rhbz#1108522)
  - cleanup after test-driver (rhbz#1108522)
  - merge upstream commit c7ebb09530349b7b1bbec7b1d9ef4b05ad186a63 (rhbz#1108522)
  - be consistent in using CPPFLAGS vs CFLAGS (rhbz#1108522)
  - merge upstream commit 84b9e5989aa4a7090aeccbeb6cb8910735274a65 (rhbz#1108522)
  - Slightly rework corosync-keygen. (rhbz#1108522)
  - merge upstream commit 520fe686c5e45f0f7143e749a3f6c2001a2ea0d7 (rhbz#1108522)
  - totemconfig: Free ifaddrs list (rhbz#1108522)
  - merge upstream commit dc35bfae6213256fd7f0d5bf4dd9d5fa0f77a6f6 (rhbz#1108522)
  - totemconfig: totem_config_get_ip_version (rhbz#1108522)
  - merge upstream commit 10c80f454e70b42fc394d3326af1eb81c4be0d75 (rhbz#1108522)
  - totemconfig: refactor nodelist_to_interface func (rhbz#1108522)
  - merge upstream commit 63bf09776fb84e939cd56ec2c2d1bbea97c2e0e1 (rhbz#1108522)
  - corosync-keygen: Replace printf/exit call with err (rhbz#1108522)
  - merge upstream commit 0ce8d51c6d989c4e62d8c1f3fc42785c4f3d250c (rhbz#1108522)
  - config: Fix typos (rhbz#1108522)
  - merge upstream commit 3b8365e80668eea55bdd3f7178693c82884331ae (rhbz#1108522)
  - totemconfig: Make sure join timeout is less than consensus (rhbz#1074673)
  - merge upstream commit 88dbb9f722122f04dc7c95681375a53a3a1301a5 (rhbz#1074673)
  - votequorum: Return current ring id in callback (rhbz#1108522)
  - merge upstream commit 5f6f68805c48f8f72f66f7fff9abc44b4c65df1e (rhbz#1108522)
  - votequorum: Add ring id to poll call (rhbz#1108522)
  - merge upstream commit b8902464d1b040326108ce7ec0934c1de5fe04ee (rhbz#1108522)
  - ipc: Process votequorum messages during sync (rhbz#1108522)
  - merge upstream commit 7cad804629fe7d936d098569122f84979959b554 (rhbz#1108522)
  - votequorum: Block sync until qdevice poll (rhbz#1108522)
  - merge upstream commit b4c99346352ce39cf96f7b12943811c896b89caa (rhbz#1108522)
  - testvotequorum2: Opt for polling with old ringid (rhbz#1108522)
  - merge upstream commit f8413350b2df4e37822e6d34e9337da87993d271 (rhbz#1108522)
  - votequorum: Make qdev timeout in sync configurable (rhbz#1108522)
  - merge upstream commit 17488909d4ae0dc948eb9a4a15133570faaf9c0b (rhbz#1108522)
  - Cancel token holding while in retransmition (rhbz#1108522)
  - merge upstream commit f135b680967aaef1d466f40170c75ae3e470e147 (rhbz#1108522)
  - votequorum: Add cmap key to reset wait_for_all (rhbz#1086233)
  - merge upstream commit cbf753405b7924e48aa1838cc1d14044229449b3 (rhbz#1086233)
  - quorumtool: Sort output by nodeid (rhbz#1108522)
  - merge upstream commit ddb017fa0e2026ee4f0d05e9bf780898c32c129a (rhbz#1108522)
  - YKD: Fix loading of YKD quorum module (rhbz#1108522)
  - merge upstream commit 02f58aec9cd53887aa1dfe1616fcbb32671987d4 (rhbz#1108522)
  - corosync-quorumtool: add sort options (rhbz#1108522)
  - merge upstream commit f53580c2c1c8fa621cbc18de81974811799bafd8 (rhbz#1108522)
  - TODO: Remove TODO file (rhbz#1108522)
  - merge upstream commit c9232d5d6cbfb1e4de9eb09afadda630ad4fee83 (rhbz#1108522)
  - Makefile: Do not install TODO file (rhbz#1108522)
  - merge upstream commit 4b7293da7a03253a7f96401642e1afb006e7750c (rhbz#1108522)
  - totem: Inform RRP about membership changes (rhbz#1069254)
  - merge upstream commit acb55cdb03808a4cea745b1b6a80c7ef1769880f (rhbz#1069254)
  - totemnet: Add totemnet_member_set_active (rhbz#1069254)
  - merge upstream commit 4c717942cf5f35902be630f393b81a03a81bb194 (rhbz#1069254)
  - totemrrp: Implement *_membership_changed (rhbz#1069254)
  - merge upstream commit 371a99e96147f600510bd9d819b92a4de94fcc30 (rhbz#1069254)
  - totemudpu: Implement member_set_active (rhbz#1069254)
  - merge upstream commit 71f1b99649329ab06309791d0a621d3cfbb74bdb (rhbz#1069254)
  - totemudpu: Send msgs to all members occasionally (rhbz#1069254)
  - merge upstream commit 2429481b96d895c366ca27c82a2bd7cfee55af15 (rhbz#1069254)


author: Jan Friesse <jfriesse@redhat.com> 2.3.4-3
changelog:
  - Resolves: rhbz#1078361
  - Resolves: rhbz#1136429
  - Resolves: rhbz#1149916

  - [crypto] fix crypto block rounding/padding calculation (rhbz#1136429)
  - merge upstream commit 239e2397820f9fa7ef430ebef0947ec1246eb50f (rhbz#1136429)
  - Adjust MTU for IPv6 correctly (rhbz#1136429)
  - merge upstream commit 03f95ddaa1d223e1e93788a307dc1b36d86b22b5 (rhbz#1136429)
  - init: Don't wait for ipc if corosync doesn't start (rhbz#1149916)
  - merge upstream commit b627844f3d5c5788bd8bb140d8852ba666da16aa (rhbz#1149916)
  - manpage: Fix English (rhbz#1078361)
  - merge upstream commit f77a61ac1795e794244440e1bfe804f02cc5d2b6 (rhbz#1078361)
  - Store configuration values used by totem to cmap (rhbz#1078361)
  - merge upstream commit bb52fc2774ef690d6bb951fe9cc34e5b373caffe (rhbz#1078361)
  - man page: Improve description of token timeout (rhbz#1078361)
  - merge upstream commit 57539d1abc09e5aef322cb9cca5b3e6c496cfae9 (rhbz#1078361)


author: Jan Friesse <jfriesse@redhat.com> 2.3.4-4
changelog:
  - Resolves: rhbz#1184154

  - Handle adding and removing UDPU members atomically (rhbz#1184154)
  - merge upstream commit d77cec24d0025d353681762fe707794c621665c7 (rhbz#1184154)


author: Jan Friesse <jfriesse@redhat.com> 2.3.4-5
changelog:
  - Resolves: rhbz#1197091
  - Resolves: rhbz#1197671

  - Votequorum: Fix auto_tie_breaker default (rhbz#1197091)
  - merge upstream commit 314a01c98e5f98ff686333966dbe675935b7b6a8 (rhbz#1197091)
  - Don't allow both two_node and auto_tie_breaker in corosync.conf (rhbz#1197671)
  - merge upstream commit c832ade034fa737561ccabefbe417c9d7855d970 (rhbz#1197671)


author: Jan Friesse <jfriesse@redhat.com> 2.3.4-6
changelog:
  - Resolves: rhbz#1170347
  - Resolves: rhbz#1225441
  - Resolves: rhbz#1226842
  - Resolves: rhbz#1229194
  - Resolves: rhbz#1234261
  - Resolves: rhbz#1234266
  - Resolves: rhbz#682771
  - Resolves: rhbz#773464

  - config: Make sure user doesn't mix IPv6 and IPv4 (rhbz#773464)
  - merge upstream commit 6c028d4d9c53decaa9469c792ac68fd2a886e7d9 (rhbz#773464)
  - config: Process broadcast option consistently (rhbz#773464)
  - merge upstream commit 70bd35fc06e68a010d780dfa39bd68d4bd2f7da7 (rhbz#773464)
  - config: Ensure mcast address/port differs for rrp (rhbz#773464)
  - merge upstream commit 6449bea835c90045baa23e3e041fed1df2abf070 (rhbz#773464)
  - Reset timer_problem_decrementer on fault (rhbz#1234261)
  - merge upstream commit 8f284b26b3331e1ab252969ba65543e6d9217ab1 (rhbz#1234261)
  - automake: Check minimum automake version (rhbz#773464)
  - merge upstream commit 114b826c67126fe1f690ad976b5217a8487994a4 (rhbz#773464)
  - Set RR priority by default (rhbz#1170347)
  - merge upstream commit 177ef0e5240b4060ff5b14eab6f2eefee3aa777d (rhbz#1170347)
  - Log auto-recovery of ring only once (rhbz#773464)
  - merge upstream commit e0ac861efdc32831366a2b5f5cc1d61e2ffa5504 (rhbz#773464)
  - totem: Ignore duplicated commit tokens in recovery (rhbz#1234261)
  - merge upstream commit 4ee84c51fa73c4ec7cbee922111a140a3aaf75df (rhbz#1234261)
  - corosync_ring_id_store: Use safer permissions (rhbz#1234266)
  - merge upstream commit 252b38ab8a62ff083e83b1d6f514109f7b7cbb42 (rhbz#1234266)
  - totemsrp: Format member list log as unsigned int (rhbz#773464)
  - merge upstream commit 5d9acc5604eb4e8a739cb37a4ad46bcc5ad8deb6 (rhbz#773464)
  - cpg: Add support for messages larger than 1Mb (rhbz#682771)
  - merge upstream commit 8cc8e513633a1a8b12c416e32fb5362fcf4d65dd (rhbz#682771)
  - Really add cpghum (rhbz#682771)
  - merge upstream commit 3842ba6080e00fd9484a2a875d982e149f67bc44 (rhbz#682771)
  - quorum: don't allow quorum_trackstart to be called twice (rhbz#1229194)
  - merge upstream commit 82526d2fe9137e8b604f1bbae6d6e39ba41377f9 (rhbz#1229194)
  - totemconfig: Check for duplicate nodeids (rhbz#773464)
  - merge upstream commit 997074cc3e1ea425ca63e453b7e2181741bdcef0 (rhbz#773464)
  - totem: Log a message if JOIN or LEAVE message is ignored (rhbz#773464)
  - merge upstream commit 53f67a2a7914228f1a406aad61ea6768525e11b0 (rhbz#773464)
  - totemsrp: Improve logging of left/down nodes (rhbz#773464)
  - merge upstream commit ab8942f6260fde93824ed2a18e09e572b59ceb25 (rhbz#773464)
  - votequorum: Fix auto_tie_breaker behaviour in odd-sized clusters (rhbz#1229194)
  - merge upstream commit b9f5c290b7dedd0a677cdfc25db7dd111245a745 (rhbz#1229194)
  - Add note about rrp active beeing unsupported (rhbz#1226842)
  - merge upstream commit 219965f4fe694eaaf2eb4ea05cdc7e35f5146114 (rhbz#1226842)
  - Log: Add logrotate configuration file (rhbz#1225441)
  - merge upstream commit aabbace625b3c68332b4356887378fca81f8f387 (rhbz#1225441)


author: Jan Friesse <jfriesse@redhat.com> 2.3.4-7
changelog:
  - Related: rhbz#682771

  - Don't link with libz when not needed (rhbz#682771)
  - merge upstream commit 145f9279d12cf0b981494bbd4dabbc9c3641378e (rhbz#682771)


author: Jan Friesse <jfriesse@redhat.com> 2.3.6-1
changelog:
  - Related: rhbz#1306680
  - Resolves: rhbz#1289169
  - Resolves: rhbz#1306349
  - Resolves: rhbz#1282372
  - Resolves: rhbz#1317573
  - Resolves: rhbz#1336462

  - Rebase to Corosync 2.3.6


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-2
changelog:
  - Resolves: rhbz#1363654

  - Config: Flag config uidgid entries (rhbz#1363654)
  - merge upstream commit f837f95dfe96d60f2367e900efd4def7a07b2a89 (rhbz#1363654)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-3
changelog:
  - Related: rhbz#1363654

  - Enhance spec so corosync-qdevice subpackage depends on same version of
    the corosync and corosynclib packages.


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-4
changelog:
  - Resolves: rhbz#1367813

  - Man: Fix corosync-qdevice-net-certutil link (rhbz#1367813)
  - merge upstream commit 49a9f722bba13e4b2762151b7b96b1d4196fd5e0 (rhbz#1367813)
  - man: mention qdevice incompatibilites in votequorum.5 (rhbz#1367813)
  - merge upstream commit 0da1b7446239424b76b1d5eb7c3640afce9b054e (rhbz#1367813)
  - Qnetd LMS: Fix two partition use case (rhbz#1367813)
  - merge upstream commit b0c850f308d44ddcdf1a1f881c1e1142ad489385 (rhbz#1367813)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-6
changelog:
  - Resolves: rhbz#1371880

  - libvotequorum: Bump version (rhbz#1371880)
  - merge upstream commit 96f91f23a6a413535cc2f0e8492e2300373fed40 (rhbz#1371880)
  - votequorum: Don't update expected_votes display if value is too high (rhbz#1371880)
  - merge upstream commit 596433066805af029be1292a37a35ce31307f0bf (rhbz#1371880)
  - votequorum: simplify reconfigure message handling (rhbz#1371880)
  - merge upstream commit 4a385f2e94c7168dbd92168c54a80ee97a3c2140 (rhbz#1371880)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-7
changelog:
  - Related: rhbz#1371880

  - Fix build on RHEL7.3 latest (rhbz#1371880)
  - merge upstream commit 19e48a6eee20d5f34f79a3b8d4e1c694169c1d7b (rhbz#1371880)
  - Enable aarch64 build (bz#1422598)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-8
changelog:
  - Resolves: rhbz#1434528
  - Resolves: rhbz#1434529
  - Resolves: rhbz#1434534

  - cfg: Prevents use of uninitialized buffer (rhbz#1434528)
  - merge upstream commit 52e6ae57ea06d0bef61c5c9250881bef1372ead2 (rhbz#1434528)
  - man: Fix typos in man page (rhbz#1434529)
  - merge upstream commit b642904ea9640bd7a1573a8c0d2c5bcb43a10dfc (rhbz#1434529)
  - Fix typo: Destorying -> Destroying (rhbz#1434529)
  - merge upstream commit 117d9e4eb77ef9941fdeaf17ddfd892514da8143 (rhbz#1434529)
  - init: Add doc URIs to the systemd service files (rhbz#1434529)
  - merge upstream commit 21a728785027483786e41c19f6aff57a95b80aa5 (rhbz#1434529)
  - man: Modify man-page according to command usage (rhbz#1434529)
  - merge upstream commit 79898e8cb1715e79b7467b91661b7341e2664550 (rhbz#1434529)
  - Totempg: remove duplicate memcpy in mcast_msg func (rhbz#1434528)
  - merge upstream commit 4a8e9d80409590cb42732ae3105b5ae71fda52c1 (rhbz#1434528)
  - upstart: Add softdog module loading example (rhbz#1434529)
  - merge upstream commit 75474d69bebea6c9c4ef2252476ce738cf92f0f4 (rhbz#1434529)
  - Remove deprecated doxygen flags (rhbz#1434529)
  - merge upstream commit b252013e42007ea7284ae54d035a30ca40f20fc0 (rhbz#1434529)
  - Remove redundant header file inclusion (rhbz#1434528)
  - merge upstream commit d6c7ade277a4a23d84c56d7fde6b60b377a1023b (rhbz#1434528)
  - Qdevice: fix spell errors in qdevice (rhbz#1434529)
  - merge upstream commit d9caa09c45d4560c89a1ad873087c0476cabab46 (rhbz#1434529)
  - doc: document watchdog_device parameter (rhbz#1434529)
  - merge upstream commit a5f97ae1b99063383d8f45168125b34232b91faf (rhbz#1434529)
  - Logsys: Change logsys syslog_priority priority (rhbz#1434534)
  - merge upstream commit 609cc0cc100aa1070d97b405273373682da0e270 (rhbz#1434534)
  - logconfig: Do not overwrite logger_subsys priority (rhbz#1434534)
  - merge upstream commit c866a2f8603b44e89eb21a6cf7d88134af2e8b66 (rhbz#1434534)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-9
changelog:
  - Resolves: rhbz#1445001

  - Main: Call mlockall after fork (rhbz#1445001)
  - merge upstream commit 238e2e62d8b960e7c10bfa0a8281d78ec99f3a26 (rhbz#1445001)
  - Disable aarch64 build (bz#1422598)


author: Pavel Raiskup <praiskup@redhat.com> - 2.11-14
changelog:
  - fix bad changelog entries
  - allow to build in Fedora Rawhide (temporarily because of #872336) (the value
    is guessed from from /usr/include/asm-generic/fcntl.h)


author: Pavel Raiskup <praiskup@redhat.com> - 2.11-17
changelog:
  - fix small memory leak in copyin.c (#919454)
  - remove %defattr and install 'cpio' to real %{_bindir}
  - CovScan: add %{?_rawbuild}


author: Pavel Raiskup <praiskup@redhat.com> - 2.11-20
changelog:
  - fix another bogus date in changelog
  - update config.guess/config.sub for aarm64 build (#925189)
  - run autoreconf instead of autoheader


author: Jakub Jelinek <jakub@redhat.com> 4.8.2-10
changelog:
  - update from the 4.8 branch (#1052892)
    - PRs ada/55946, ada/59772, c++/56060, c++/58954, c++/59255, c++/59730,
  	fortran/57042, fortran/58998, fortran/59493, fortran/59612,
  	fortran/59654, ipa/59610, middle-end/59584, pch/59436,
  	rtl-optimization/54300, rtl-optimization/58668,
  	rtl-optimization/59137, rtl-optimization/59647,
  	rtl-optimization/59724, target/57386, target/59587, target/59625,
  	target/59652, testsuite/58630, tree-optimization/54570,
  	tree-optimization/59125, tree-optimization/59362,
  	tree-optimization/59715, tree-optimization/59745
  - default to -march=z196 instead of -march=z10 on s390/s390x (#1052890)


author: Jakub Jelinek <jakub@redhat.com> 4.8.2-12
changelog:
  - update from the 4.8 branch (#1052892)
    - PRs c++/59838, debug/54694, fortran/34547, fortran/58410,
  	middle-end/59827, middle-end/59860, target/58139, target/59142,
  	target/59695, target/59794, target/59826, target/59839
  - fix handling of initialized vars with flexible array members
    (#1035413, PR middle-end/28865)


author: Jakub Jelinek <jakub@redhat.com> 4.8.2-13
changelog:
  - when removing -Wall from CXXFLAGS, if -Werror=format-security
    is present, add -Wformat to it, so that GCC builds on F21


author: Jakub Jelinek <jakub@redhat.com> 4.8.2-15
changelog:
  - fix exception spec instantiation ICE (#1067398, PR c++/60046)
  - fix pch on aarch64 (#1058991, PR pch/60010)
  - configure with --enable-gnu-indirect-function on architectures
    and distros that support it and don't support it by default
    yet (#1067245)
  - fix vector permutation handling on i?86/x86_64 (PR target/57896)
  - fix __atomic_compare_exchange_* not to store into *expected
    on success (PR c++/60272)
  - fix -march=native on VMs where saving/restoring of YMM state
    is not supported, yet CPU supports f16c (PR driver/60233)
  - add ref7.C testcase (PR c++/60274)


author: Jakub Jelinek <jakub@redhat.com> 4.8.2-16.2
changelog:
  - backport two further OpenMP 4.0 libgomp tasking fixes (#1121077)
  - fix scheduler wrong-code with DEBUG_INSNs containing volatile ASM_OPERANDS
    (#1127120, PR rtl-optimization/61801)


author: Jakub Jelinek <jakub@redhat.com> 4.8.2-7
changelog:
  - update from the 4.8 branch
    - PRs libgomp/59467, rtl-optimization/58295, target/56807,
  	testsuite/59442
    - fix LRA coalescing for real (PR middle-end/59470)


author: Jakub Jelinek <jakub@redhat.com> 4.8.2-18
changelog:
  - update from the 4.8 branch
    - PRs c++/60367, c++/60628, c++/60689, c++/60708, c++/60713, debug/60603,
  	driver/61106, libfortran/56919, libfortran/60810, libstdc++/60497,
  	libstdc++/60594, libstdc++/61117, middle-end/36282, middle-end/55022,
  	middle-end/60635, middle-end/60729, middle-end/60750,
  	middle-end/60849, middle-end/60895, rtl-optimization/60769,
  	target/57589, target/58595, target/59952, target/60516, target/60609,
  	target/60672, target/60693, target/60839, target/60909, target/60941,
  	target/60991, target/61026, target/61055, tree-optimization/57864,
  	tree-optimization/59817, tree-optimization/60453,
  	tree-optimization/60502, tree-optimization/60740,
  	tree-optimization/60766, tree-optimization/60836,
  	tree-optimization/60903, tree-optimization/60930,
  	tree-optimization/60960
  - backport OpenMP 4.0 support to libgomp (library only; PR libgomp/58691)


author: Jakub Jelinek <jakub@redhat.com> 4.8.3-1
changelog:
  - update from the 4.8 branch
    - GCC 4.8.3 release
    - PRs c++/60605, c++/60731, c++/61134, fortran/45187, ipa/61393,
  	libfortran/61187, libfortran/61310, libstdc++/60734, libstdc++/60966,
  	rtl-optimization/60866, rtl-optimization/60901, rtl-optimization/61094,
  	rtl-optimization/61446, target/61044, target/61193, target/61202,
  	target/61208, target/61231, target/61239, target/61249, target/61300,
  	target/61415, target/61423, target/61431, target/61443, target/61483,
  	target/61545, target/61570, tree-optimization/61383


author: Jakub Jelinek <jakub@redhat.com> 4.8.3-2
changelog:
  - update from the 4.8 branch
    - PRs c++/61500, c++/61539, c++/61647, fortran/58883, fortran/61459,
  	middle-end/53590, rtl-optimization/61801, target/61542, target/61586,
  	tree-optimization/61306, tree-optimization/61684
  - for rhel 7.1 keep the old 4.8.2 pathnames and use 4.8.3 symlinks
  - merge in aarch64 support (#1070290)
  - small improvements on s390x for z196 and later (#1088542)
  - make sure OpenMP outlined artificial functions have DW_AT_name (#844959)


author: Jakub Jelinek <jakub@redhat.com> 4.8.3-4
changelog:
  - update from the 4.8 branch
    - PRs fortran/61780, libobjc/61920, target/47230, tree-optimization/61375,
  	tree-optimization/61964
    - fix libgfortran overflows on allocation (CVE-2014-5044)
  - backport ibm-ldouble performance improvements (#1090620)


author: Jakub Jelinek <jakub@redhat.com> 4.8.3-6
changelog:
  - update from the 4.8 branch (#1140019)
    - PRs c++/58714, c++/59823, c++/59956, c++/60241, c++/60361, c++/61959,
  	c/61271, debug/55794, debug/60655, debug/61923, fortran/61999,
  	fortran/62214, fortran/62270, ipa/61986, ipa/62015, libgfortran/62188,
  	libstdc++/58962, libstdc++/61946, middle-end/61010, middle-end/61045,
  	middle-end/62103, rtl-optimization/62004, rtl-optimization/62030,
  	target/61996, target/62038, target/62195, testsuite/56194,
  	tree-optimization/60196, tree-optimization/60707,
  	tree-optimization/61452, tree-optimization/62073,
  	tree-optimization/62075, tree-optimization/63189


author: Jakub Jelinek <jakub@redhat.com> 4.8.3-8
changelog:
  - fix PowerPC unaligned vectorization bug (#1146871,
    PR tree-optimization/63341)
  - fix another -fcompare-debug issue (PR debug/63284)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-3
changelog:
  - backport aarch64 crc enablement - -mcpu=generic+crc (#1179935)
  - rebuild against fixed binutils to fix up systemtap markers on aarch64
    (#1238462)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-5
changelog:
  - fix up libitm HTM fastpath (#1180633)
  - on ppc64le default to -mcpu=power8 instead of -mcpu=power7 (#1213268)
  - fix up size in .debug_pubnames (#1278872)
  - turn powerpc* HTM insns into memory barriers (#1282755, PR target/67281)
  - make sure to handle __builtin_alloca_with_align like alloca in
    -fstack-protector* (#1289022, PR tree-optimization/68680)
  - improve DW_AT_abstract_origin of DW_TAG_GNU_call_site on s390 with -fPIC
    (#1312436)
  - fix up libstdc++ pretty-printers (#1076690, PR libstdc++/53477)
  - don't pass explicit --oformat option to ld on powerpc* (#1296211)
  - backport Intel Memory Protection Keys ISA support - -mpku (#1304449)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-6
changelog:
  - backport s390 z13 support (#1182152)
  - fix up -fsanitize=address on powerpc64 with 46-bit virtual address space
    (#1312850)
  - throw exception on std::random_device::_M_getval() failure (#1262846,
    PR libstdc++/65142, CVE-2015-5276)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-8
changelog:
  - fix a bug in C++ ref-to-ptr conversion (#1344807)
  - fix combiner handling of jumps on aarch64 (#1344672,
    PR rtl-optimization/52714)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-9
changelog:
  - backport OpenMP 4.5 support to libgomp (library only; #1357060,
    PRs libgomp/68579, libgomp/64625)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-11
changelog:
  - on aarch64 emit scheduling barriers before stack deallocation in
    function epilogues (#1362635, PR target/63293)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-12
changelog:
  - fix up std::rethrow_exception (#1375711, PR libstdc++/62258)
  - use _Unwind_GetIPInfo in __gcc_personality_v0 (#1387402, PR libgcc/78064)
  - fix vec_vsx_ld/st on ppc64le (#1389801, PR target/72863, PR target/78084)
  - fix ICE in gfc_compare_derived_types (#1369183)
  - fix EH from C++ thunks (#1427412, PR ipa/68184)
  - on ppc64{,le} emit nop after recursive call if the current function
    is replaceable (#1420723, PR target/79439)
  - on aarch64 with -frounding-math use fnmul only with -(a*b) and not
    with (-a)*b (#1418446, PR target/66731)
  - constrain std::valarray functions and operators (#1416214,
    PR libstdc++/69116)
  - fix gimplification of aggregate assignments when lhs is used
    (#1396298, PR middle-end/72747, PR c/78408)
  - fix aarch64 TLS with -mcmodel=large (#1389276, PR target/78796)
  - fix aarch64 reloading of floating point constants into general purpose
    registers (#1349067, PR target/70549)
  - fix DW_AT_decl_line on DW_TAG_enumeration_type for C enumeration
    definitions following forward declarations (#1423460, PR c/79969)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-13
changelog:
  - add -mstack-protector-guard={tls,global}, -mstack-protector-guard-reg=
    and -mstack-protector-guard-offset= options on ppc* (#1415952,
    PR target/78875)


author: Jose E. Marchesi <jose.marchesi@oracle.com> 4.8.5-16.0.1.el7_4.1
changelog:
  - [Orabug: 27524661]
  - Support for retpolines as a mitigation for CVE-2017-5715 aka
    variant-2 in x86 targets.


author: Bruce Hill <bruce.hill@oracle.com> 4.8.5-16.0.3.el7_4.2
changelog:
  - [Orabug: 27557686] (Egeyar Bagcioglu)
  - Introduce 'oracle_release' into .spec file. Echo it to gcc/DEV-PHASE.


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-1
changelog:
  - update from the 4.8 branch (#1230103)
    - GCC 4.8.5 release
    - fix -imacros handling (#1004526, PR c/57653)
    - fix up IPA type handling (#1217267, PRs ipa/63551, ipa/64153)
    - add PowerPC analyze swaps optimization pass (#1208103, #1200336)
    - fix PowerPC vsx_extract_<mode>* patterns (#1206341)
    - fix PowerPC -mcrypto handling (#1200335)
    - Power8 unaligned vectorization improvements (#1199221, PR target/65456)
    - PRs ada/47500, ada/63225, bootstrap/64213, c++/56710, c++/58624,
  	c++/63415, c++/63455, c++/64251, c++/64297, c++/64487, c++/65721,
  	c++/65727, c/52769, c/61553, c/64766, debug/63342, debug/65549,
  	fortran/56674, fortran/56867, fortran/57023, fortran/58813,
  	fortran/59016, fortran/59024, fortran/59488, fortran/60898,
  	fortran/61138, fortran/61407, fortran/63733, fortran/63744,
  	fortran/63938, fortran/64244, fortran/64528, fortran/65024,
  	gcov-profile/64634, inline-asm/63282, ipa/59626, ipa/63838,
  	libfortran/63589, libgfortran/59513, libgfortran/60956, libgomp/61200,
  	libstdc++/57440, libstdc++/59603, libstdc++/61947, libstdc++/63449,
  	libstdc++/63840, libstdc++/65279, libstdc++/65543, lto/65015,
  	lto/65193, middle-end/43631, middle-end/56917, middle-end/57748,
  	middle-end/58624, middle-end/59990, middle-end/63608,
  	middle-end/63665, middle-end/63704, middle-end/64067,
  	middle-end/64111, middle-end/64199, middle-end/64225,
  	middle-end/65409, middle-end/65680, middle-end/66133,
  	middle-end/66251, pch/65550, preprocessor/60436,
  	rtl-optimization/61058, rtl-optimization/63475,
  	rtl-optimization/63483, rtl-optimization/63659,
  	rtl-optimization/64037, rtl-optimization/64557, sanitizer/64265,
  	target/49423, target/52941, target/53988, target/55351, target/56846,
  	target/59593, target/60111, target/61413, target/62218, target/62642,
  	target/63335, target/63428, target/63673, target/63947, target/64113,
  	target/64115, target/64304, target/64358, target/64387, target/64409,
  	target/64452, target/64453, target/64479, target/64513, target/64579,
  	target/64580, target/64795, target/64882, target/64979, target/65138,
  	target/65163, target/65196, target/65286, target/65368, target/65787,
  	target/65849, target/66140, target/66148, target/66215, target/66275,
  	target/66470, target/66474, tree-optimization/59124,
  	tree-optimization/60656, tree-optimization/61634,
  	tree-optimization/61686, tree-optimization/61969,
  	tree-optimization/62031, tree-optimization/62167,
  	tree-optimization/63375, tree-optimization/63379,
  	tree-optimization/63551, tree-optimization/63593,
  	tree-optimization/63605, tree-optimization/63841,
  	tree-optimization/63844, tree-optimization/64269,
  	tree-optimization/64277, tree-optimization/64493,
  	tree-optimization/64495, tree-optimization/64563,
  	tree-optimization/65063, tree-optimization/65388,
  	tree-optimization/65518, tree-optimization/66123,
  	tree-optimization/66233, tree-optimization/66251,
  	tree-optimization/66272


author: Tomáš Mráz <tmraz@redhat.com> - 2.9.0-3
changelog:
  - fix the python module to work with compressed dictionaries (#972542)
  - fix various dictionary lookup errors (#986400, #986401)
  - make the library reentrant and fix compilation warnings


author: Tomáš Mráz <tmraz@redhat.com> - 2.9.0-5
changelog:
  - make the simplistic check and the purging of special characters much
    less aggressive (#1003624, #985378)


author: Dave Anderson <anderson@redhat.com> - 7.0.2-1
changelog:
  - Update to latest upstream release
  - Fix for ppc64 embedded gdb NULL pointer translation sigsegv
  - Fix for bt -F failure


author: Dave Anderson <anderson@redhat.com> - 7.0.2-2
changelog:
  - Compressed kdump 46-bit physical memory support
    Resolves: rhbz#1015250
  - Fix incorrect backtrace for dumps taken with "virsh dump --memory-only"
    Resolves: rhbz#1020469
  - Fix cpu number display on systems with more than 254 cpus
    Resolves: rhbz#1020536


author: Dave Anderson <anderson@redhat.com> - 7.0.2-4
changelog:
  - Fixes for "kmem -S" command for CONFIG_SLUB.
  - Resolves: rhbz#1045591
  - Increase S390X NR_CPUS
  - Resolves: rhbz#1051156


author: Dave Anderson <anderson@redhat.com> - 7.0.2-5
changelog:
  - Fix for a missing kernel-mode exception frame dump by the x86_64 
    "bt" command if a page fault was generated by a bogus RIP.
  - Resolves: rhbz#1057353
  - Fix for the x86_64 "bt" command to prevent an unwarranted message
    indicating "WARNING: possibly bogus exception frame" generated
    from a blocked kernel thread that was in the process of exec'ing
    a user process via the call_usermodehelper() facility.
  - Resolves: rhbz#1057357


author: Dave Anderson <anderson@redhat.com> - 7.0.8-1
changelog:
  - Rebase to upstream version 7.0.8.
  - Resolves: rhbz#1110513
  - Fix to calculate the physical base address of dumpfiles created
    by a "virsh dump" of an OVMF guest.
  - Resolves: rhbz#1080698
  - Support for aarch64 architecture.
  - Resolves: rhbz#1110551
  - Fix to prevent crash from spinning endlessly on a corrupted/truncated
    dumpfile whose bitmap data is not wholly contained within the file.
  - Resolves: rhbz#1114088
  - Support for ppc64le architecture.
  - Resolves: rhbz#1123991


author: Dave Anderson <anderson@redhat.com> - 7.0.8-2
changelog:
  - Fix ps performance patch regression on live systems.
  - Resolves: rhbz#1134177
  - Minor build-related fixes for ppc64le.
  - Resolves: rhbz#1123991


author: Dave Anderson <anderson@redhat.com> - 7.0.9-2
changelog:
  - Use registers from QEMU-generated ELF and compressed kdump headers 
    for active task backtraces.
  - Resolves: rhbz#1169555


author: Dave Anderson <anderson@redhat.com> - 7.0.9-5
changelog:
  - Support new sadump format that can represent more than 16 TB physical memory space
    Resolves: rhbz#1182383


author: Dave Anderson <anderson@redhat.com> - 7.1.1-1
changelog:
  - Rebase to upstream version 7.1.1
    Resolves: rhbz#1207696
  - Display s390x vector registers from a kernel dump.
    Resolves: rhbz#1182161
  - Fix date displayed on initial system banner and by the "sys" command on ARM64.
    Resolves: rhbz#1223044
  - Fix ARM64 page size calculation on 4.1 and later kernels.
    Resolves: rhbz#1222645


author: Dave Anderson <anderson@redhat.com> - 7.1.2-1
changelog:
  - Rebase to upstream version 7.1.2
    Resolves: rhbz#1207696
  - Fix several ppc64 backtrace issues
    Resolves: rhbz#1235447


author: Dave Anderson <anderson@redhat.com> - 7.1.2-2
changelog:
  - Fix "kmem -s <address>", "bt -F[F]", and "rd -S[S]" options in kernels 
    configured with CONFIG_SLUB having multiple-page slabs.
    Resolves: rhbz#1244003
  - Fix for SIGSEGV generated by "bt -[f|F]" in ARM64 kernels.
    Resolves: rhbz#1248859


author: Dave Anderson <anderson@redhat.com> - 7.1.2-3
changelog:
  - crash fails to read or wrongly reads some parts of memory in sadump vmcore format
    Resolves: rhbz#1282997


author: Dave Anderson <anderson@redhat.com> - 7.1.5-1
changelog:
  - Rebase to upstream version 7.1.5
    Resolves: rhbz#1292566
  - Decode clflushopt instruction
    Resolves: rhbz#1262479
  - Support AArch64 QEMU generated dumps 
    Resolves: rhbz#1299873
  - crash: zero-size memory allocation (aarch64) 
    Resolves: rhbz#1312738


author: Dave Anderson <anderson@redhat.com> - 7.1.5-2
changelog:
  - Fix for kernel module symbol gathering when the ordering of module
    symbol name strings does not match the order of the kernel_symbol
    structures.
  - Resolves: rhbz#1375130


author: Dave Anderson <anderson@redhat.com> - 7.1.8-1
changelog:
  - Rebase to upstream version 7.1.8
    Resolves: rhbz#1393534
  - POWER9 - Power ISA 3.0 related support for crash utility
    Resolves: rhbz#1368711
  - crash package update - ppc64/ppc64le
    Resolves: rhbz#1384944
  - exception RIP: unknown or invalid address
    Resolves: rhbz#1350457
  - Crash does not always parse correctly the modules symbol tables
    Resolves: rhbz#1360415
  - ARM64: crash live system from: WARNING: cannot read linux_banner string
    Resolves: rhbz#1392007
  - kmem: invalid structure member offset: page_count
    Resolves: rhbz#1392011
  - Kernel address space randomization [KASLR] support 
    Resolves: rhbz#1392658
  - invalid structure size: tnt
    Resolves: rhbz#1420653


author: Dave Anderson <anderson@redhat.com> - 7.1.9-1
changelog:
  - Rebase to upstream version 7.1.9
    Resolves: rhbz#1393534
  - Fix gdb "set scope" option for KASLR kernels.
    Resolves: rhbz#1440725
  - Fix for the determination of the x86_64 "phys_base" value when it is
    not passed in the VMCOREINFO data of ELF vmcores
    Resolves: rhbz#1439170


author: Dave Anderson <anderson@redhat.com> - 7.1.9-2
changelog:
  - Rebase to github commits 87179026 to ad3b8476
    Resolves: rhbz#1393534
  - Prohibit native gdb disassemble command when KASLR
    Resolves: rhbz#1445649


author: HATAYAMA Daisuke <d.hatayama@jp.fujitsu.com> - 1.0-1
changelog:
  - Remove inclusion of kvmdump.h and unwind_x86_64.h due to non-supporting issue
    on crash-devel package. Instead, use a new interface for them.
  - Remove ppc64, ia64, s390 and s390x from ExclusiveArch, leave x86_64
    and %{ix86} there.
  - Add descriptions in BuildRequires and Requires about crash and crash-devel.


author: Dave Anderson <anderson@redhat.com> - 1.0.3-2.el7
changelog:
  - Add RPM_OPT_FLAGS to gcc line in ptdump.mk
    Resolves: rhbz#1450708
  - Set gdb scope to get appropriate ring_buffer structure
    Resolves: rhbz#1451181


author: Dave Anderson <anderson@redhat.com> - 2.0-3
changelog:
  - Replace obsolete _init() and _fini() functions.
  - Fix possible segmentation violation on calloc() failure.
  - Initialize trace_dat to avoid compiler warning.


author: Dave Anderson <anderson@redhat.com> - 2.0.12
changelog:
  - Differentiate ppc64 .ring_buffer_read text symbol from ring_buffer_read data symbol
  - Fix for ring_buffer_per_cpu.nr_pages size change on big-endian systems 
  - Fix for Linux 4.7 change to the TRACE_EVENT_FL_TRACEPOINT flag
    Resolves: rhbz#1441914
    Resolves: rhbz#1440726


author: Dave Anderson <anderson@redhat.com> - 1.0-3
changelog:
  - Remove trace_dump.patch, which requires a kernel later than
    the RHEL6 base of 2.6.32.
    Resolves: rbhz#601536


author: John W. Linville <linville@redhat.com> - 1.1.3_2013.02.13-3
changelog:
  - setregdomain: remove sed and awk calls
  - setregdomain: reimplement COUNTRY assignment with shell function


author: John W. Linville <linville@redhat.com> - 1.1.3_2014.06.13-1
changelog:
  - Update wireless-regdb to version 2014.06.13
  - Add logger commands to setregdomain to make it more communicative


author: John W. Linville <linville@redhat.com> - 1.1.3_2015.04.06-2
changelog:
  - Update wireless-regdb to version 2015.04.06
  - Add patch for regdbdump to display DFS region
  - Make some improvements to setregdomain and its man page


author: Zdenek Pavlas <zpavlas at redhat.com> - 0.9.9-14
changelog:
  - update to latest HEAD
  - Fix the deadlock issue.  BZ 856363
  - Manually set the permmissions for tempfile created cachefiles. BZ 833350
  - modifyrepo: use available compression only.  BZ 865845
  - No baseurl means no baseurl.  BZ 875029
  - Change the compress-type for modifyrepo to .gz for compat. BZ 874682.
  - fix the --skip-symlinks option
  - no repomd.xml && --checkts: skip .rpm timestamp checking.  BZ 877301
  - new worker piping code (no tempfiles, should be faster)


author: Zdenek Pavlas <zpavlas at redhat.com> - 0.9.9-16
changelog:
  - update to latest HEAD
  - turn off stdout buffering in worker to prevent a deadlock
  - modifyrepo: use integer timestamps


author: Zdenek Pavlas <zpavlas@redhat.com> - 0.9.9-21
changelog:
  - update to latest HEAD
  - don't BuildRequire bash-completion in rhel
  - Fail for bad compress-type options to modifyrepo, like createrepo. BZ 886589
  - Fix options documentation. BZ 892657.
  - modifyrepo: fix --compress option bug. BZ 950724
  - modifyrepo: add --checksum and --{unique,simple}-md-filenames options


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 0.9.9-24
changelog:
  - mergerepo: merge package versions from multiple repos.
  - Related: bug#1178763
  - Close lock file before unlink().
  - Related: bug#1256216


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 0.9.9-26
changelog:
  - Make sure filename doesn't already contain a checksum.
  - Resolves: bug#1270784
  - Catch IOErrors when loading pkglist.
  - Resolves: bug#1083182
  - Add missing options to the manpage.
  - Resolves: bug#1285761


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 0.9.9-27
changelog:
  - Fix temporary files cleanup.
  - Resolves: bug#1406418
  - Fix --update for pkgs with same nevra.
  - Resolves: bug#1404239


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 0.9.9-28
changelog:
  - createrepo: allow xz and bz2 for xml files.
  - Resolves: bug#1125437
  - modifyrepo: fix handling of already compressed input.
  - Resolves: bug#1227782
  - modifyrepo: handle empty file with LZMA.
  - Resolves: bug#1287685
  - modifyrepo: docs: remove compat compress type.
  - Resolves: bug#1287714


author: Adrian Reber <areber@redhat.com> - 1.6.1-2
changelog:
  - removed criu.service (CVE-2015-5228, CVE-2015-5231)
  - removed devel sub-package (related to above CVEs)


author: Marcela Mašláňová <mmaslano@redhat.com> - 1.4.11-2
changelog:
  - scriptlets are not created correctly if systemd is not in BR 986698
  - remove sub-package sysvinit, which is not needed anymore
  - update license, anacron is under GPLv2+


author: Marcela Mašláňová <mmaslano@redhat.com> - 1.4.11-3
changelog:
  - 919290 systemd script use "KillMode=process"
  - Fcntl locking has different semantics than flock. Prefer flock.
    - 49225e172d156531ca142518d2638350752e373a
  - Pull PAM environment variables also from session modules.
    - c8e7d1b43c86a85441cb09cf7e08090f3ec1f384


author: Marcela Mašláňová <mmaslano@redhat.com> - 1.4.11-5
changelog:
  - Cronie doesn't work when is executed as stand alone without systemd (for 
    debuging issues)
  - Fix another permission, hopefully all now.
  - Resolves: rhbz#1012420, rhbz#1015567


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-14
changelog:
  - mark the 0hourly and dailyjobs crontabs as config
  - properly handle users for whose getpwnam() returns NULL temporarily
  - log when crond is shutting down


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-16
changelog:
  - disable mail from anacron with empty MAILTO
  - crontab: do not block access with PAM when running as root
  - improve the crontab man page
  - do not hardcode system_u selinux user but use the user from
    the current context


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-18
changelog:
  - make anacron not to contradict itself in syslog
    (job output does not have to be necessarily mailed)


author: Joe Orton <jorton@redhat.com> - 2.4.1-40.1
changelog:
  - keyutil: use SHA1 as default hash in created certs (#1030470)
  - genkey: default to 2048 bit keysize (#1039896)


author: Joe Orton <jorton@redhat.com> - 2.4.1-42
changelog:
  - genkey: skip cert generation after CSR for OpenSSL (#1039896)
  - keyutil: fix error reporting (#1039896)


author: Milan Broz <mbroz@redhat.com> - 1.6.0-0.1
changelog:
  - Update to cryptsetup 1.6.0-rc1.
  - Relax license to GPLv2+ according to new release.
  - Compile cryptsetup with libpwquality support.


author: Milan Broz <mbroz@redhat.com> - 1.6.0-1
changelog:
  - Update to cryptsetup 1.6.0.
  - Change default LUKS encryption mode to aes-xts-plain64 (AES128).
  - Force use of gcrypt PBKDF2 instead of internal implementation.


author: Ondrej Kozina <okozina@redhat.com> - 1.6.2-1
changelog:
  - Update to cryptsetup 1.6.2.
  - Add dracut module for cryptsetup-reencrypt (90reencrypt).
  - 90reencrypt: Rename dracut parameteres to be compliant with actual naming guidance.
  - 90reencrypt: Install and load loop kernel module.
  - 90reencrypt: Fix lock file name.
  - 90reencrypt: Add conflict with 90crypt dracut module (more info in #1010287)
  - Resolves: #1010278 #1010287


author: Ondrej Kozina <okozina@redhat.com> - 1.6.2-2
changelog:
  - 90reencrypt: Move conflict with 90crypt to install() section.
  - 90reencrypt: Drop to emergency_shell after successful reencryption.
  - Resolves: #1021593


author: Ondrej Kozina <okozina@redhat.com> - 1.6.3-1
changelog:
  - Update to cryptsetup 1.6.3.
  - various fixes related to block devices with 4KiB sectors
  - enable reencryption using specific keyslot (dracut module)
  - fix failure in reading last keyslot from external LUKS header
  - update FIPS POST to be complaint with actual requirements
  - fix hash limiting if parameter is not numeric
  - Resolves: #1028362 #1029032 #1029406 #1030288 #1034388 #1038097


author: Ondrej Kozina <okozina@redhat.com> - 1.6.7-1
changelog:
  - Update to cryptsetup 1.6.7.
  - patch: avoid use of kernel crypto API socket which is known
    to be broken in RHEL7.0 kernel (7.1+ is fine).
  - Resolves: #1206170


author: John Dennis <jdennis@redhat.com> - 5.8-11
changelog:
  - add ctags-5.8-memmove.patch
    bug #284 absoluteFilename uses strcpy on overlapping strings 
    http://sourceforge.net/p/ctags/bugs/284/  
    The bug was fixed upstream on 2012-03-26 in the following commit
    http://sourceforge.net/p/ctags/code/782/
    ctags-5.8-memmove.patch simply adds the same patch as the above commit.


author: Sumit Bose <sbose@redhat.com> - 2.1-1
changelog:
  - Update to ctdb version  2.1
  - added fix for tevent configure check
  - make sure autogen.sh is called before configure
    Resolves: rhbz#925204


author: Guenther Deschner <gdeschner@redhat.com> - 4.2.3-11
changelog:
  - resolves: #1290710
  - CVE-2015-3223 Remote DoS in Samba (AD) LDAP server
  - CVE-2015-5299 Missing access control check in shadow copy code
  - CVE-2015-5252 Insufficient symlink verification in smbd
  - CVE-2015-5296 Samba client requesting encryption vulnerable to
                  downgrade attack


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.10-6.1
changelog:
  - Fix issues caused by security tightening for Badlock:
    - Only validate MIC when "map to guest" is set
    - NetApp SMB servers don't negotiate NTLMSSP_SIGN
    - Anonymous connections don't work anymore
    - wbinfo -u or 'net ads search' don't work anymore
    - Handle empty session in client code
  - resolves: #1333794


author: Andreas Schneider <asn@redhat.com> - 4.2.10-6.2
changelog:
  - related: #1333794 - Fix issues caused by security tightening for Badlock
    o ntlm_auth issues and segfault
    o rpcclient doesn't respect "client ipc *" options
    o fix anonymous authentication if signing is mandatory


author: Andreas Schneider <asn@redhat.com> - 4.2.3-9
changelog:
  - resolves: #1273912 - Fix dependencies to samba-common
  - resolves: #1273393 - Fix user after free in smb name resolution


author: Andreas Schneider <asn@redhat.com> - 4.2.10-6.3
changelog:
  - resolves: #1350759 - Fix idmap_hash when used with other modules
  - resolves: #1351260 - Fix krb5 encryption type setup during join


author: Andreas Schneider <asn@redhat.com> - 4.2.3-1
changelog:
  - related: #1196140 - Rebase to version 4.2.3
  - resolves: #1237036 - Fix DCERPC PDU calculation
  - resolves: #1237039 - Fix winbind request cancellation
  - resolves: #1223981 - Fix possible segfault with smbX protocol setting


author: Andreas Schneider <asn@redhat.com> - 4.2.3-2
changelog:
  - resolves: #1238194 - Fix the 'dfree command'
  - resolves: #1216062 - Document netbios name length limitation


author: Andreas Schneider <asn@redhat.com> - 4.2.3-6
changelog:
  - resolves: #1255322 - Fix 'map to guest = Bad uid' option
  - resolves: #1255326 - Fix segfault with 'mangling method = hash'


author: Andreas Schneider <asn@redhat.com> - 4.4.4-3
changelog:
  - related: #1260214 - Correctly warn about missing realm for ad domains
                        with 'security=domain'


author: Andreas Schneider <asn@redhat.com> - 4.4.4-4
changelog:
  - resolves: #1351655 - Fix winbind meomory leak with each cached credentials
                         login
  - resolves: #1351961 - Fix CVE-2016-2119


author: Andreas Schneider <asn@redhat.com> - 4.4.4-5
changelog:
  - resolves: #1359091 - Package /usr/lib/samba/ldb in the common-libs package
  - resolves: #1360788 - Fix multilib issue with ctdb-tests package
  - resolves: #1362385 - Fix Samba ignoring supplementary groups
  - resolves: #1364051 - Fix smbd panic with stale ctdb entries


author: Andreas Schneider <asn@redhat.com> - 4.4.4-6
changelog:
  - resolves: #1367316 - Increase required Kerbersion version number
  - resolves: #1366477 - Fix using the right krb5 ccache in libads
  - resolves: #1356501 - Fix high CPU usage with smbclient connection to
                         non-reachable IP


author: Andreas Schneider <asn@redhat.com> - 4.4.4-10
changelog:
  - resolves: #1393050 - Fix linking nss_wins with libreplace
  - resolves: #1393051 - Fix nss_wins function definitions for gethostbyname*
  - resolves: #1393048 - Fix %G substitution in AD case
  - resolves: #1393052 - Fix regression of smbclient unable to connect to
                         Apple and Azure


author: Andreas Schneider <asn@redhat.com> - 4.4.4-13
changelog:
  - resolves: #1437816 - Fix krb5 memory cache in libads sasl code
  - resolves: #1437741 - Fix CVE-2016-2125, CVE-2016-2126 and CVE-2017-2619


author: Andreas Schneider <asn@redhat.com> - 4.4.4-1
changelog:
  - resolves: #1303076 - Rebase Samba to version 4.4.4
  - resolves: #1314673 - Fix CVE-2015-7560
  - resolves: #1263322 - Add '--no-dns-updates' option to 'net ads join'
  - resolves: #1264433 - Fix segfault in pam_winbind.so with invalid config
                         options
  - resolves: #1193504 - Fix smbget to retrieve files recursively
  - resolves: #1193502 - Fix smbget to use command line credentials
  - resolves: #1193493 - Fix smbget url credentials parsing
  - resolves: #1273999 - Support printing with Kerberos credentials on newer
                         CUPS versions
  - resolves: #1296821 - Define /etc/pam.d/samba as a non replaceable config
  - resolves: #1261107 - Fix memory leak because of missing talloc stackframe
  - resolves: #1333562 - Fix memory leak after smbc_free_context()
  - resolves: #1315422 - Fix regression from CVE-2015-5252
  - resolves: #1316899 - Fixed idmap_hash module issues when used with others
  - resolves: #1322691 - Fix badlock related bugs
  - Fix CVE-2015-5370
  - Fix CVE-2016-2110
  - Fix CVE-2016-2111
  - Fix CVE-2016-2112
  - Fix CVE-2016-2113
  - Fix CVE-2016-2114
  - Fix CVE-2016-2115
  - Fix CVE-2016-2118
  - resolves: #1327951 - Fix regression with anonymous connections from OS X
  - resolves: #1327845 - Fix pcap_cache_reload() with spoolssd
  - resolves: #1289640 - Fix ctdb selinux issue with read only tracking dbs
  - resolves: #1341208 - Fix enumerating groups over NSS with idmap_ad
  - resolves: #1345827 - Fix resolving trusted domain users on domain member
  - resolves: #1346334 - Fix typo in smb.conf.example
  - resolves: #1335292 - Fix site-aware 'net ads join -k'
  - resolves: #1260214 - Accept empty realm for ad domains with 'security=domain'


author: Andreas Schneider <asn@redhat.com> - 4.6.2-7
changelog:
  - resolves: #1461336 - Fix smbclient username parsing
  - resolves: #1460937 - Fix username normalization with winbind


author: Andreas Schneider <asn@redhat.com> - 4.6.2-10
changelog:
  - resolves: #1484423 - Require at least krb5 version 1.15.1
  - resolves: #1484713 - Fix password changes for users via smbpasswd
  - resolves: #1484723 - Be more graceful on FSCTL_VALIDATE_NEGOTIATE_INFO
                         returned errors


author: Tim Waugh <twaugh@redhat.com> - 1:1.6.3-7
changelog:
  - Reverted upstream change to FINAL_CONTENT_TYPE in order to fix
    printing to remote CUPS servers (bug #1013040).


author: Tim Waugh <twaugh@redhat.com> - 1:1.6.3-12
changelog:
  - Return jobs in rank order when handling IPP-Get-Jobs (bug #1046841).
  - dbus notifier: call _exit when handling SIGTERM (STR #4314, bug #1030666).
  - Use '-f' when using rm in %setup section (bug #1046374).


author: Tim Waugh <twaugh@redhat.com> - 1:1.6.3-16
changelog:
  - Apply upstream patch to fix CVE-2014-5029 (bug #1122600),
    CVE-2014-5030 (bug #1128764), CVE-2014-5031 (bug #1128767). Also:
    - Fix conf/log file reading for authenticated users (STR #4461).
    - Fix icon display in web interface during server restart (STR #4475).
  - Apply upstream patch to fix privilege escalation due to insufficient
    checking (CVE-2014-3537, bug #1115576).
  - Describe ErrorPolicy in the cupsd.conf man page (bug #1120591).
  - Reduce package dependencies (bug #1115057):
    - New client subpackage containing command line client tools.
    - Removed 'Requires: /sbin/chkconfig'.
    - Moved 'Provides: lpd' to lpd subpackage.
  - Avoid race condition in cupsdReadClient() (bug #1113045).
  - Apply upstream patch to avoid 10 second timeouts in cupsd caused by
    reading when no data ready (bug #1110259).
  - Use colord interface correctly (bug #1087323).
  - Fix for cupsEnumDest() 'removed' callbacks (bug #1072954, STR #4380).


author: Tim Waugh <twaugh@redhat.com> - 1:1.6.3-17
changelog:
  - Support for failover without load-balancing (bug #1115219).
  - Fix cupsGetPPD3() so it doesn't give the caller an unreadable file
    (part of fix for CVE-2014-5031, STR #4500).
  - Can no longer reproduce bug #1010580 so removing final-content-type
    patch as it causes issues for some backends (bug #1149245).
  - Start cups.service after network.target (bug #1144780).


author: Tim Waugh <twaugh@redhat.com> - 1:1.6.3-19
changelog:
  - Validate ErrorPolicy in configuration (bug #1196218, STR #4591).
  - Don't use SSLv3 by default (bug #1161172, STR #4476).


author: Tim Waugh <twaugh@redhat.com> - 1:1.6.3-20
changelog:
  - Don't start jobs while cancelling others (bug #1233002, STR #4648).
  - Fix slow resume of jobs after restart (bug #1233006, STR #4646).
  - Fixes for post-install scriptlet (bug #1235035).


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.6.3-23
changelog:
  - 1257051 - cups-lpd man page incomplete
  - 1275790 - spec file includes triggers with overlapping version intervals
  - 1259770 - permission changed after writing to /etc/cups/subscriptions.conf


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.6.3-25
changelog:
  - 1297035 - gnome-settings-daemon leaks file descriptors
  - 1257751 - Email notifications ("lp -m") for printer classes don't work


author: Tim Waugh <twaugh@redhat.com> - 1.0.35-6
changelog:
  - Set cost for text filters to 200 so that the paps filter gets
    preference for the time being (bug #988909).


author: Tim Waugh <twaugh@redhat.com> - 1.0.35-7
changelog:
  - Upstream patch to re-work filter costs (bug #998981). No longer need
    text filter costs patch as paps gets used by default now if
    installed.


author: Tim Waugh <twaugh@redhat.com> - 1.0.35-15:.1
changelog:
  - Applied upstream patch to fix BrowseAllow parsing issue
    (CVE-2014-4338, bug #1091568).
  - Applied upstream patch for cups-browsed DoS via
    process_browse_data() out-of-bounds read (CVE-2014-4337,
    bug #1111510).


author: Tim Waugh <twaugh@redhat.com> - 1.0.35-18
changelog:
  - Fix segfault in texttopdf filter (bug #1194263).
  - Improve cups-browsed efficiency (bug #1191691).
  - Fetch printer descriptions with cups-browsed (bug #1223719).
  - Fix cups-browsed "_" handling for printer names (bug #1167408).


author: Tim Waugh <twaugh@redhat.com> - 1.0.35-21
changelog:
  - Fix heap-based buffer overflow in texttopdf filter (bug #1241242,
    CVE-2015-3258, CVE-2015-3279).


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-15
changelog:
  - allow to use ECC ciphers if NSS implements them (#1058776)
  - re-use of wrong HTTP NTLM connection in libcurl (CVE-2014-0015)


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-16
changelog:
  - allow to use TLS > 1.0 if built against recent NSS (#1036789)
  - use proxy name in error message when proxy is used (#1042831)
  - refresh expired cookie in test172 from upstream test-suite (#1063693)


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-20
changelog:
  - eliminate unnecessary delay when resolving host from /etc/hosts (#1130239)
  - allow to enable/disable new AES cipher-suites (#1066065)
  - call PR_Cleanup() on curl tool exit if NSPR is used (#1071254)
  - implement non-blocking TLS handshake (#1091429)
  - fix limited connection re-use for unencrypted HTTP (#1101092)
  - disable libcurl-level downgrade to SSLv3 (#1154060)
  - include response headers added by proxy in CURLINFO_HEADER_SIZE (#1161182)
  - ignore CURLOPT_FORBID_REUSE during NTLM HTTP auth (#1166264)


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-21
changelog:
  - use only full matches for hosts used as IP address in cookies (CVE-2014-3613)
  - fix handling of CURLOPT_COPYPOSTFIELDS in curl_easy_duphandle (CVE-2014-3707)


