# changelog

author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-8.el7
changelog:
  - Resolves: #1443869 Command "openssl pkcs12 ..." failed during IPA upgrade
    - Fix CAInstance.import_ra_cert for empty passwords


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-7.el7
changelog:
  - Resolves: #1431520 ipa cert-find runs a large number of searches, so IPA
    WebUI is slow to display user details page
    - cert: defer cert-find result post-processing
  - Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
    helper when installing replica
    - server-install: No double Kerberos install
  - Resolves: #1437502 ipa-replica-install fails with requirement to
    use --force-join that is a client install option.
    - Add the force-join option to replica install
    - replicainstall: better client install exception handling
  - Resolves: #1437953 Server CA-less impossible option check
    - server-install: remove broken no-pkinit check
  - Resolves: #1441160 FreeIPA client <= 4.4 fail to parse 4.5 cookies
    - Add debug log in case cookie retrieval went wrong
  - Resolves: #1441548 ipa server install fails with --external-ca option
    - ext. CA: correctly write the cert chain
  - Resolves: #1441718 Conversion of CA-less server to CA fails on CA instance
    spawn
    - Fix CA-less to CA-full upgrade
  - Resolves: #1442133 Do not link libkrad, liblber, libldap_r and
    libsss_nss_idmap to every binary in IPA
    - configure: fix AC_CHECK_LIB usage
  - Resolves: #1442815 Replica install fails during migration from older IPA
    master
    - Fix RA cert import during DL0 replication
  - Related: #1442004 Building IdM/FreeIPA internally on all architectures -
    filtering unsupported packages
    - Build all subpackages on all architectures


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-6.el7
changelog:
  - Resolves: #1382053 Need to have validation for idrange names
    - idrange-add: properly handle empty --dom-name option
  - Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
    helper when installing replica
    - dsinstance: reconnect ldap2 after DS is restarted by certmonger
    - httpinstance: avoid httpd restart during certificate request
    - dsinstance, httpinstance: consolidate certificate request code
    - install: request service certs after host keytab is set up
    - renew agent: revert to host keytab authentication
    - renew agent, restart scripts: connect to LDAP after kinit
  - Resolves: #1436987 ipasam: gidNumber attribute is not created in the trusted
    domain entry
    - ipa-sam: create the gidNumber attribute in the trusted domain entry
    - Upgrade: add gidnumber to trusted domain entry
  - Resolves: #1438679 [ipa-replica-install] - IncorrectPasswordException:
    Incorrect client security database password
    - Add pki_pin only when needed
  - Resolves: #1438348 Console output message while adding trust should be
    mapped with texts changed in Samba.
    - ipaserver/dcerpc: unify error processing
  - Resolves: #1438366 ipa trust-fetch-domains: ValidationError: invalid
    'Credentials': Missing credentials for cross-forest communication
    - trust: always use oddjobd helper for fetching trust information
  - Resolves: #1441192 Add the name of URL parameter which will be check for
    username during cert login
    - WebUI: cert login: Configure name of parameter used to pass username
  - Resolves: #1437879 [copr] Replica install failing
    - Create system users for FreeIPA services during package installation
  - Resolves: #1441316 WebUI cert auth fails after ipa-adtrust-install
    - Fix s4u2self with adtrust


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-5.el7
changelog:
  - Resolves: #1318186 Misleading error message during external-ca IPA master
    install
    - httpinstance: make sure NSS database is backed up
  - Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
    CA certificate chain in ... incomplete"
    - httpinstance: make sure NSS database is backed up
  - Resolves: #1393726 Enumerate all available request type options in ipa
    cert-request help
    - Hide request_type doc string in cert-request help
  - Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
    - spec file: bump libsss_nss_idmap-devel BuildRequires
    - server: make sure we test for sss_nss_getlistbycert
  - Resolves: #1437378 ipa-adtrust-install produced an error and failed on
    starting smb when hostname is not FQDN
    - adtrust: make sure that runtime hostname result is consistent with the
      configuration
  - Resolves: #1437555 ipa-replica-install with DL0 fails to get annonymous
    keytab
    - Always check and create anonymous principal during KDC install
    - Remove duplicate functionality in upgrade
  - Resolves: #1437946 Upgrade to FreeIPA 4.5.0 does not configure anonymous
    principal for PKINIT
    - Upgrade: configure PKINIT after adding anonymous principal
    - Remove unused variable from failed anonymous PKINIT handling
    - Split out anonymous PKINIT test to a separate method
    - Ensure KDC is propery configured after upgrade
  - Resolves: #1437951 Remove pkinit-related options from server/replica-install
    on DL0
    - Fix the order of cert-files check
    - Don't allow setting pkinit-related options on DL0
    - replica-prepare man: remove pkinit option refs
    - Remove redundant option check for cert files
  - Resolves: #1438490 CA-less installation fails on publishing CA certificate
    - Get correct CA cert nickname in CA-less
    - Remove publish_ca_cert() method from NSSDatabase
  - Resolves: #1438838 Avoid arch-specific path in /etc/krb5.conf.d/ipa-certmap
    - IPA-KDB: use relative path in ipa-certmap config snippet
  - Resolves: #1439038 Allow erasing ipaDomainResolutionOrder attribute
    - Allow erasing ipaDomainResolutionOrder attribute


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-4.el7
changelog:
  - Resolves: #1434032 Run ipa-custodia with custom SELinux context
    - Require correct custodia version


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-3.el7
changelog:
  - Resolves: #800545 [RFE] Support SUDO command rename
    - Reworked the renaming mechanism
    - Allow renaming of the sudorule objects
  - Resolves: #872671 IPA WebUI login for AD Trusted User fails
    - WebUI: check principals in lowercase
    - WebUI: add method for disabling item in user dropdown menu
    - WebUI: Add support for login for AD users
  - Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
    certificates on smart cards (pkinit)
    - ipa-kdb: add ipadb_fetch_principals_with_extra_filter()
    - IPA certauth plugin
    - ipa-kdb: do not depend on certauth_plugin.h
    - spec file: bump krb5-devel BuildRequires for certauth
  - Resolves: #1264370 RFE: disable last successful authentication by default in
    ipa.
    - Set "KDC:Disable Last Success" by default
  - Resolves: #1318186 Misleading error message during external-ca IPA master
    install
    - certs: do not implicitly create DS pin.txt
    - httpinstance: clean up /etc/httpd/alias on uninstall
  - Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
    CA certificate chain in ... incomplete"
    - certs: do not implicitly create DS pin.txt
    - httpinstance: clean up /etc/httpd/alias on uninstall
  - Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
    - configure: fix --disable-server with certauth plugin
    - rpcserver.login_x509: Actually return reply from __call__ method
    - spec file: Bump requires to make Certificate Login in WebUI work
  - Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
    - extdom: do reverse search for domain separator
    - extdom: improve cert request
  - Resolves: #1430363 [RFE] HBAC rule names command rename
    - Reworked the renaming mechanism
    - Allow renaming of the HBAC rule objects
  - Resolves: #1433082 systemctl daemon-reload needs to be called after
    httpd.service.d/ipa.conf is manipulated
    - tasks: run `systemctl daemon-reload` after httpd.service.d updates
  - Resolves: #1434032 Run ipa-custodia with custom SELinux context
    - Use Custodia 0.3.1 features
  - Resolves: #1434384 RPC client should use HTTP persistent connection
    - Use connection keep-alive
    - Add debug logging for keep-alive
    - Increase Apache HTTPD's default keep alive timeout
  - Resolves: #1434729 man ipa-cacert-manage install needs clarification
    - man ipa-cacert-manage install needs clarification
  - Resolves: #1434910 replica install against IPA v3 master fails with ACIError
    - Fixing replica install: fix ldap connection in domlvl 0
  - Resolves: #1435394 Ipa-kra-install fails with weird output when backspace is
    used during typing Directory Manager password
    - ipapython.ipautil.nolog_replace: Do not replace empty value
  - Resolves: #1435397 ipa-replica-install can't install replica file produced by
    ipa-replica-prepare on 4.5
    - replica prepare: fix wrong IPA CA nickname in replica file
  - Resolves: #1435599 WebUI: in self-service Vault menu item is shown even if
    KRA is not installed
    - WebUI: Fix showing vault in selfservice view
  - Resolves: #1435718 As a ID user I cannot call a command with --rights option
    - ldap2: use LDAP whoami operation to retrieve bind DN for current connection
  - Resolves: #1436319 "Truncated search results" pop-up appears in user details
    in WebUI
    - WebUI: Add support for suppressing warnings
    - WebUI: suppress truncation warning in select widget
  - Resolves: #1436333 Uninstall fails with No such file or directory:
    '/var/run/ipa/services.list'
    - Create temporaty directories at the begining of uninstall
  - Resolves: #1436334 WebUI: Adding certificate mapping data using certificate
    fails
    - WebUI: Allow to add certs to certmapping with CERT LINES around
  - Resolves: #1436338 CLI doesn't work after ipa-restore
    - Backup ipa-specific httpd unit-file
    - Backup CA cert from kerberos folder
  - Resolves: #1436342 Bump samba version, required for FIPS mode and privilege
    separation
    - Bump samba version for FIPS and priv. separation
  - Resolves: #1436642 [ipalib/rpc.py] - "maximum recursion depth exceeded" with
    ipa vault commands
    - Avoid growing FILE ccaches unnecessarily
    - Handle failed authentication via cookie
    - Work around issues fetching session data
    - Prevent churn on ccaches
  - Resolves: #1436657 Add workaround for pki_pin for FIPS
    - Generate PIN for PKI to help Dogtag in FIPS
  - Resolves: #1436714 [vault] cache KRA transport cert
    - Simplify KRA transport cert cache
  - Resolves: #1436723 cert-find does not find all certificates without
    sizelimit=0
    - cert: do not limit internal searches in cert-find
  - Resolves: #1436724 Renewal of IPA RA fails on replica
    - dogtag-ipa-ca-renew-agent-submit: fix the is_replicated() function
  - Resolves: #1436753 Master tree fails to install
    - httpinstance.disable_system_trust: Don't fail if module 'Root Certs' is not
      available


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-2.el7
changelog:
  - Resolves: #1432630 python2-jinja2 needed for python2-ipaclient
    - Remove csrgen
  - Resolves: #1432903 Set GssProxy options to enable caching of ldap tickets
    - Add options to allow ticket caching


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-1.el7
changelog:
  - Resolves: #828866 [RFE] enhance --subject option for ipa-server-install
  - Resolves: #1160555 ipa-server-install: Cannot handle double hyphen "--" in
    hostname
  - Resolves: #1286288 Insufficient 'write' privilege to the 'ipaExternalMember'
    attribute
  - Resolves: #1321652 ipa-server-install fails when using external certificates
    that encapsulate RDN components in double quotes
  - Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
    revocation reasons
  - Resolves: #1340880 ipa-server-install: improve prompt on interactive
    installation
  - Resolves: #1353841 ipa-replica-install fails to install when resolv.conf
    incomplete entries
  - Resolves: #1356104 cert-show command does not display Subject Alternative
    Names
  - Resolves: #1357511 Traceback message seen when ipa is provided with invalid
    configuration file name
  - Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
    converted from CA-less to CA-full
  - Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
  - Resolves: #1367572 improve error message in ipa migrate-ds: mention ipa
    config-mod --enable-migration=TRUE
  - Resolves: #1367868 Add options to retrieve lightweight CA certificate/chain
  - Resolves: #1371927 Implement ca-enable/disable commands.
  - Resolves: #1372202 Add Users into User Group editors fails to show Full names
  - Resolves: #1373091 Adding an auth indicator from the CLI creates an extra
    check box in the UI
  - Resolves: #1375596 Ipa-server WebUI - long user/group name show wrong error
    message
  - Resolves: #1375905 "Normal" group type in the UI is confusing
  - Resolves: #1376040 IPA client ipv6 - invalid --ip-address shows traceback
  - Resolves: #1376630 IDM admin password gets written to
    /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
  - Resolves: #1376729 ipa-server-install script option --no_hbac_allow should
    match other options
  - Resolves: #1378461 IPA Allows Password Reuse with History value defined when
    admin resets the password.
  - Resolves: #1379029 conncheck failing intermittently during single step
    replica installs
  - Resolves: #1379858 [RFE] better debugging for ipa-replica-conncheck
  - Resolves: #1384310 ipa dnsrecord-add fails with Keyerror stack trace
  - Resolves: #1392778 Update man page for ipa-adtrust-install by
    removing --no-msdcs option
  - Resolves: #1392858 Rebase to FreeIPA 4.5+
    - Rebase to 4.5.0
  - Resolves: #1399133 Delete option shouldn't be available for hosts applied to
    view.
  - Resolves: #1399190 [RFE] Certificates issued by externally signed IdM CA
    should contain full trust chain
  - Resolves: #1400416 RFE: Provide option to take backup of IPA server before
    uninstalling IPA server
  - Resolves: #1400529 cert-request is not aware of Kerberos principal aliases
  - Resolves: #1401526 IPA WebUI certificates are grayed out on overview page but
    not on details page
  - Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
  - Resolves: #1404750 ipa-client-install fails to get CA cert via LDAP when
    non-FQDN name of IPA server is first in /etc/hosts
  - Resolves: #1409628 [RFE] Semi-automatic integration with external DNS using
    nsupdate
  - Resolves: #1413742 Backport request for bug/issue Change IP address
    validation errors to warnings
  - Resolves: #1415652 IPA replica install log shows password in plain text
  - Resolves: #1427897 different behavior regarding system wide certs in master
    and replica.
  - Resolves: #1430314 The ipa-managed-entries command failed, exception:
    AttributeError: ldap2


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.7
changelog:
  - Resolves: #1419735 ipa-replica-install fails promotecustodia.create_replica
    with cert errors (untrusted)
    - added ssl verification using IPA trust anchor
  - Resolves: #1428472 batch param compatibility is incorrect
    - compat: fix `Any` params in `batch` and `dnsrecord`
  - Renamed patches 1011 and 1012 to 0159 and 0157, as they were merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.6
changelog:
  - Resolves: #1416454 replication race condition prevents IPA to install
    - wait_for_entry: use only DN as parameter
    - Wait until HTTPS principal entry is replicated to replica
    - Use proper logging for error messages


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.5
changelog:
  - Resolves: #1365858 ipa-ca-install fails on replica when IPA Master is
    installed without CA
    - Set up DS TLS on replica in CA-less topology
  - Resolves: #1398600 IPA replica install fails with dirsrv errors.
    - Do not configure PKI ajp redirection to use "::1"
  - Resolves: #1413137 CVE-2017-2590 ipa: Insufficient permission check for
    ca-del, ca-disable and ca-enable commands
    - ca: correctly authorise ca-del, ca-enable and ca-disable


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.4
changelog:
  - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
    by abusing password policy
    - ipa-kdb: search for password policies globally
  - Renamed patches 1011 and 1012 to 0151 and 0150, as they were merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.3
changelog:
  - Resolves: #1398670 Check IdM Topology for broken record caused by replication
    conflict before upgrading it
    - Check for conflict entries before raising domain level


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.2
changelog:
  - Resolves: #1382812 Creation of replica for disconnected environment is
    failing with CA issuance errors; Need good steps.
    - gracefully handle setting replica bind dn group on old masters
  - Resolves: #1397439 ipa-ca-install on promoted replica hangs on creating a
    temporary CA admin
    - replication: ensure bind DN group check interval is set on replica config
    - add missing attribute to ipaca replica during CA topology update
  - Resolves: #1401088 IPA upgrade of replica without DNS fails during restart of
    named-pkcs11
    - bindinstance: use data in named.conf to determine configuration status


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.1
changelog:
  - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
    by abusing password policy
    - password policy: Add explicit default password policy for hosts and
      services
  - Resolves: #1395311 CVE-2016-9575 ipa: Insufficient permission check in
    certprofile-mod
    - certprofile-mod: correctly authorise config update


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14
changelog:
  - Resolves: #1378353 Replica install fails with old IPA master sometimes during
    replication process
    - spec file: bump minimal required version of 389-ds-base
  - Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
    - Fix missing file that fails DL1 replica installation
  - Resolves: #1387782 WebUI: Services are not displayed correctly after upgrade
    - WebUI: services without canonical name are shown correctly
  - Resolves: #1389709 Traceback seen in error_log when trustdomain-del is run
    - trustdomain-del: fix the way how subdomain is searched


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-13
changelog:
  - Resolves: #1318616 CA fails to start after doing ipa-ca-install --external-ca
    - Keep NSS trust flags of existing certificates
  - Resolves: #1360813 ipa-server-certinstall does not update all certificate
    stores and doesn't set proper trust permissions
    - Add cert checks in ipa-server-certinstall
  - Resolves: #1371479 cert-find --all does not show information about revocation
    - cert: add revocation reason back to cert-find output
  - Resolves: #1375133 WinSync users who have First.Last casing creates users who
    can have their password set
    - ipa passwd: use correct normalizer for user principals
  - Resolves: #1377858 Users with 2FA tokens are not able to login to IPA servers
    - Properly handle LDAP socket closures in ipa-otpd
  - Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
    - Make httpd publish its CA certificate on DL1


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-12
changelog:
  - Resolves: #1373910 IPA server upgrade fails with DNS timed out errors.
  - Resolves: #1375269 ipa trust-fetch-domains throws internal error


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-11
changelog:
  - Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
    - Fix regression introduced in ipa-certupdate


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-10
changelog:
  - Resolves: #1355753 adding two way non transitive(external) trust displays
    internal error on the console
    - Always fetch forest info from root DCs when establishing two-way trust
    - factor out `populate_remote_domain` method into module-level function
    - Always fetch forest info from root DCs when establishing one-way trust
  - Resolves: #1356101 Lightweight sub-CA certs are not tracked by certmonger
    after `ipa-replica-install`
    - Track lightweight CAs on replica installation
  - Resolves: #1357488 ipa command stuck forever on higher versioned client with
    lower versioned server
    - compat: Save server's API version in for pre-schema servers
    - compat: Fix ping command call
    - schema cache: Store and check info for pre-schema servers
  - Resolves: #1363905 man page for ipa-replica-manage has a typo in -c flag
    - Fix man page ipa-replica-manage: remove duplicate -c option
      from --no-lookup
  - Resolves: #1367865 webui: cert_revoke should use --cacn to set correct CA
    when revoking certificate
    - cert: include CA name in cert command output
    - WebUI add support for sub-CAs while revoking certificates
  - Resolves: #1368424 Unable to view certificates issued by Sub CA in Web UI
    - Add support for additional options taken from table facet
    - WebUI: Fix showing certificates issued by sub-CA
  - Resolves: #1368557 dnsrecord-add does not prompt for missing record parts
    internactively
    - dns: normalize record type read interactively in dnsrecord_add
    - dns: prompt for missing record parts in CLI
    - dns: fix crash in interactive mode against old servers
  - Resolves: #1370519 Certificate revocation in service-del and host-del isn't
    aware of Sub CAs
    - cert: fix cert-find --certificate when the cert is not in LDAP
    - Make host/service cert revocation aware of lightweight CAs
  - Resolves: #1371901 Use OAEP padding with custodia
    - Use RSA-OAEP instead of RSA PKCS#1 v1.5
  - Resolves: #1371915 When establishing external two-way trust, forest root
    Administrator account is used to fetch domain info
    - do not use trusted forest name to construct domain admin principal
  - Resolves: #1372597 Incorrect CA ACL evaluation of SAN DNS names in
    certificate request
    - Fix CA ACL Check on SubjectAltNames
  - Resolves: #1373272 CLI always sends default command version
    - cli: use full name when executing a command
  - Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
    - Fix ipa-certupdate for CA-less installation
  - Resolves: #1373540 client-install with IPv6 address fails on link-local
    address (always)
    - Fix parse errors with link-local addresses


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-9
changelog:
  - Resolves: #1081561 CA not start during ipa server install in pure IPv6 env
    - Fix ipa-server-install in pure IPv6 environment
  - Resolves: #1318169 Tree-root domains in a trusted AD forest aren't marked as
    reachable via the forest root
    - trust: make sure ID range is created for the child domain even if it exists
    - ipa-kdb: simplify trusted domain parent search
  - Resolves: #1335567 Update Warning in IdM Web UI API browser
    - WebUI: add API browser is tech preview warning
  - Resolves: #1348560 Mulitple domain Active Directory Trust conflict
    - ipaserver/dcerpc: reformat to make the code closer to pep8
    - trust: automatically resolve DNS trust conflicts for triangle trusts
  - Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
    certificate revocation
    - cert-revoke: fix permission check bypass (CVE-2016-5404)
  - Resolves: #1353936 custodia.conf and server.keys file is world-readable.
    - Remove Custodia server keys from LDAP
    - Secure permissions of Custodia server.keys
  - Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
    converted from CA-less to CA-full
    - custodia: include known CA certs in the PKCS#12 file for Dogtag
    - custodia: force reconnect before retrieving CA certs from LDAP
  - Resolves: #1362333 ipa vault container owner cannot add vault
    - Fix: container owner should be able to add vault
  - Resolves: #1365546 External trust with root domain is transitive
    - trust: make sure external trust topology is correctly rendered
  - Resolves: #1365572 IPA server broken after upgrade
    - Require pki-core-10.3.3-7
  - Resolves: #1367864 Server assumes latest version of command instead of
    version 1 for old / 3rd party clients
    - rpcserver: assume version 1 for unversioned command calls
    - rpcserver: fix crash in XML-RPC system commands
  - Resolves: #1367773 thin client ignores locale change
    - schema cache: Fallback to 'en_us' when locale is not available
  - Resolves: #1368754 ipa server uninstall fails with Python "Global Name error"
    - Fail on topology disconnect/last role removal
  - Resolves: #1368981 ipa otptoken-add --type=hotp --key creates wrong OTP
    - otptoken, permission: Convert custom type parameters on server
  - Resolves: #1369414 ipa server-del fails with Python stack trace
    - Handled empty hostname in server-del command
  - Resolves: #1369761 ipa-server must depend on a version of httpd that support
    mod_proxy with UDS
    - Require httpd 2.4.6-31 with mod_proxy Unix socket support
  - Resolves: #1370512 Received ACIError instead of DuplicatedError in
    stageuser_tests
    - Raise DuplicatedEnrty error when user exists in delete_container
  - Resolves: #1371479 cert-find --all does not show information about revocation
    - cert: add missing param values to cert-find output
  - Renamed patch 1011 to 0100, as it was merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-8
changelog:
  - Resolves: #1298288 [RFE] Improve performance in large environments.
    - cert: speed up cert-find
  - Resolves: #1317379 [EXPERIMENTAL][RFE] Web UI: allow Smart Card
    authentication
    - service: add flag to allow S4U2Self
    - Add 'trusted to auth as user' checkbox
    - Added new authentication method
  - Resolves: #1353881 ipa-replica-install suggests about
    non-existent --force-ntpd option
    - Don't show --force-ntpd option in replica install
  - Resolves: #1354441 DNS forwarder check is too strict: unable to add
    sub-domain to already-broken domain
    - DNS: allow to add forward zone to already broken sub-domain
  - Resolves: #1356146 performance regression in CLI help
    - schema: Speed up schema cache
    - frontend: Change doc, summary, topic and NO_CLI to class properties
    - schema: Introduce schema cache format
    - schema: Generate bits for help load them on request
    - help: Do not create instances to get information about commands and topics
    - schema cache: Do not reset ServerInfo dirty flag
    - schema cache: Do not read fingerprint and format from cache
    - Access data for help separately
    - frontent: Add summary class property to CommandOverride
    - schema cache: Read server info only once
    - schema cache: Store API schema cache in memory
    - client: Do not create instance just to check isinstance
    - schema cache: Read schema instead of rewriting it when SchemaUpToDate
  - Resolves: #1360769 ipa-server-certinstall couldnt unlock private key file
    - server install: do not prompt for cert file PIN repeatedly
  - Resolves: #1364113 ipa-password: ipa: ERROR: RuntimeError: Unable to create
    cache directory: [Errno 13] Permission denied: '/home/test_user'
    - schema: Speed up schema cache
  - Resolves: #1366604 `cert-find` crashes on invalid certificate data
    - cert: do not crash on invalid data in cert-find
  - Resolves: #1366612 Middle replica uninstallation in line topology works
    without '--ignore-topology-disconnect'
    - Fail on topology disconnect/last role removal
  - Resolves: #1366626 caacl-add-service: incorrect error message when service
    does not exists
    - Fix ipa-caalc-add-service error message
  - Resolves: #1367022 The ipa-server-upgrade command failed when named-pkcs11
    does not happen to run during dnf upgrade
    - DNS server upgrade: do not fail when DNS server did not respond
  - Resolves: #1367759 [RFE] [webui] warn admin if there is only one IPA server
    with CA
    - Add warning about only one existing CA server
    - Set servers list as default facet in topology facet group
  - Resolves: #1367773 thin client ignores locale change
    - schema check: Check current client language against cached one


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-7
changelog:
  - Resolves: #1361119 UPN-based search for AD users does not match an entry in
    slapi-nis map cache
    - support multiple uid values in schema compatibility tree


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-6
changelog:
  - Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
    - Revert "spec: add conflict with bind-chroot to freeipa-server-dns"
  - Resolves: #1341249 Subsequent external CA installation fails
    - install: fix external CA cert validation
  - Resolves: #1353831 ipa-server-install fails in container because of
    hostnamectl set-hostname
    - server-install: Fix --hostname option to always override api.env values
    - install: Call hostnamectl set-hostname only if --hostname option is used
  - Resolves: #1356091 ipa-cacert-manage --help and man differ
    - Improvements for the ipa-cacert-manage man and help
  - Resolves: #1360631 ipa-backup is not keeping the
    /etc/tmpfiles.d/dirsrv-<instance>.conf
    - ipa-backup: backup /etc/tmpfiles.d/dirsrv-<instance>.conf
  - Resolves: #1361047 ipa-replica-install --help usage line suggests the replica
    file is needed
    - Update ipa-replica-install documentation
  - Resolves: #1361545 ipa-client-install starts rhel-domainname.service but does
    not rpm-require it
    - client: RPM require initscripts to get *-domainname.service
  - Resolves: #1364197 caacl: error when instantiating rules with service
    principals
    - caacl: fix regression in rule instantiation
  - Resolves: #1364310 ipa otptoken-add bytes object has no attribute confirm
    - parameters: move the `confirm` kwarg to Param
  - Resolves: #1364464 Topology graph: ca and domain adders shows question marks
    instead of plus icon
    - Fix unicode characters in ca and domain adders
  - Resolves: #1365083 Incomplete output returned for command ipa vault-add
    - client: add missing output params to client-side commands
  - Resolves: #1365526 build fails during "make check"
    - ipa-kdb: Fix unit test after packaging changes in krb5


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-5
changelog:
  - Resolves: #1353829 traceback message seen in ipaserver-uninstall.log file.
    - Do not initialize API in ipa-client-automount uninstall
  - Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
    client changes
    - idrange: fix unassigned global variable
  - Resolves: #1360792 Migrating users doesn't update krbCanonicalName
    - re-set canonical principal name on migrated users
  - Resolves: #1362012 ipa hbactest produces error about cannot concatenate 'str'
    and 'bool' objects
    - Fix ipa hbactest output
  - Resolves: #1362260 ipa vault-mod no longer allows defining salt
    - vault: add missing salt option to vault_mod
  - Resolves: #1362312 ipa vault-retrieve internal error when using the wrong
    public key
    - vault: Catch correct exception in decrypt
  - Resolves: #1362537 ipa-server-install fails to create symlink from
    /etc/ipa/kdcproxy/ to /etc/httpd/conf.d/
    - Correct path to HTTPD's systemd service directory
  - Resolves: #1363756 Increase length of passwords generated by installer
    - Increase default length of auto generated passwords


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-4
changelog:
  - Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
    aliases)
    - harden the check for trust namespace overlap in new principals
  - Resolves: #1351142 CLI is not using session cookies for communication with
    IPA API
    - Fix session cookies
  - Resolves: #1353888 Fix the help for ipa otp and other topics
    - help: Add dnsserver commands to help topic 'dns'
  - Resolves: #1354406 host-del updatedns options complains about missing ptr
    record for host
    - Host-del: fix behavior of --updatedns and PTR records
  - Resolves: #1355718 ipa-replica-manage man page example output differs actual
    command output
    - Minor fix in ipa-replica-manage MAN page
  - Resolves: #1358229 Traceback message should be fixed, seen while editing
    winsync migrated user information in Default trust view.
    - baseldap: Fix MidairCollision instantiation during entry modification
  - Resolves: #1358849 CA replica install logs to wrong log file
    - unite log file name of ipa-ca-install
  - Resolves: #1359130 ipa-server-install command fails to install IPA server.
    - DNS Locations: fix update-system-records unpacking error
  - Resolves: #1359237 AVC on dirsrv config caused by IPA installer
    - Use copy when replacing files to keep SELinux context
  - Resolves: #1359692 ipa-client-install join fail with traceback against
    RHEL-6.8 ipa-server
    - compat: fix ping call
  - Resolves: #1359738 ipa-replica-install --domain=<IPA primary domain> option
    does not work
    - replica-install: Fix --domain
  - Resolves: #1360778 Vault commands are available in CLI even when the server
    does not support them
    - Revert "Enable vault-* commands on client"
    - client: fix hiding of commands which lack server support
  - Related: #1281704 Rebase to softhsm 2.1.0
    - Remove the workaround for softhsm bug #1293340
  - Related: #1298288 [RFE] Improve performance in large environments.
    - Create indexes for krbCanonicalName attribute


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-3
changelog:
  - Resolves: #1296140 Remove redhat-access-plugin-ipa support
    - Obsolete and conflict redhat-access-plugin-ipa
  - Resolves: #1351119 Multiple issues while uninstalling ipa-server
    - server uninstall fails to remove krb principals
  - Resolves: #1351758 ipa commands not showing expected error messages
    - frontend: copy command arguments to output params on client
    - Show full error message for selinuxusermap-add-hostgroup
  - Resolves: #1352883 Traceback on adding default automember group and hostgroup
    set
    - allow 'value' output param in commands without primary key
  - Resolves: #1353888 Fix the help for ipa otp and other topics
    - schema: Fix subtopic -> topic mapping
  - Resolves: #1354348 ipa trustconfig-show throws internal error.
    - allow 'value' output param in commands without primary key
  - Resolves: #1354381 ipa trust-add with raw option gives internal error.
    - trust-add: handle `--all/--raw` options properly
  - Resolves: #1354493 Replica install fails with old IPA master
    - DNS install: Ensure that DNS servers container exists
  - Resolves: #1354628 ipa hostgroup-add-member does not return error message
    when adding itself as member
    - frontend: copy command arguments to output params on client
  - Resolves: #1355856 ipa otptoken-add --type=totp gives internal error
    - messages: specify message type for ResultFormattingError
  - Resolves: #1356063 "ipa radiusproxy-add" command needs to prompt to enter
    secret key
    - expose `--secret` option in radiusproxy-* commands
    - prevent search for RADIUS proxy servers by secret
  - Resolves: #1356099 Bug in the ipapwd plugin
    - Heap corruption in ipapwd plugin
  - Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
    client changes
    - Use server API in com.redhat.idm.trust-fetch-domains oddjob helper
  - Resolves: #1356964 Renaming a user removes all of his principal aliases
    - Preserve user principal aliases during rename operation


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-2.1
changelog:
  - Resolves: #1274524 [RFE] Qualify up to 60 IdM replicas
  - Resolves: #1320838 [RFE] Support IdM Client in a DNS domain controlled by AD
  - Related: #1356134 'kinit -E' does not work for IPA user


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-2
changelog:
  - Resolves: #1356102 Server uninstall does not stop tracking lightweight sub-CA
    with certmonger
    - uninstall: untrack lightweight CA certs
  - Resolves: #1351807 ipa-nis-manage config.get_dn missing
    - ipa-nis-manage: Use server API to retrieve plugin status
  - Resolves: #1353452 ipa-compat-manage command failed,
    exception: NotImplementedError: config.get_dn()
    - ipa-compat-manage: use server API to retrieve plugin status
  - Resolves: #1353899 ipa-advise: object of type 'type' has no len()
    - ipa-advise: correct handling of plugin namespace iteration
  - Resolves: #1356134 'kinit -E' does not work for IPA user
    - kdb: check for local realm in enterprise principals
  - Resolves: #1353072 ipa unknown command vault-add
    - Enable vault-* commands on client
    - vault-add: set the default vault type on the client side if none was given
  - Resolves: #1353995 Default CA can be used without a CA ACL
    - caacl: expand plugin documentation
  - Resolves: #1356144 host-find should not print SSH keys by default, only
    SSH fingerprints
    - host-find: do not show SSH key by default
  - Resolves: #1353506 ipa migrate-ds command fails for IPA in RHEL 7.3
    - Removed unused method parameter from migrate-ds


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-1
changelog:
  - Resolves: #747612 [RFE] IPA should support and manage DNS sites
  - Resolves: #826790 Disabling password expiration (--maxlife=0 and --minlife=0)
    in the default global_policy in IPA sets user's password expiration
    (krbPasswordExpiration) to be 90 days
  - Resolves: #896699 ipa-replica-manage -H does not delete DNS SRV records
  - Resolves: #1084018 [RFE] Add IdM user password change support for legacy
    client compat tree
  - Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
    aliases)
    - Fix incorrect check for principal type when evaluating CA ACLs
  - Resolves: #1146860 [RFE] Offer OTP generation for host enrollment in the UI
  - Resolves: #1238190 ipasam unable to lookup group in directory yet manual
    search works
  - Resolves: #1250110 search by users which don't have read rights for all attrs
    in search_attributes fails
  - Resolves: #1263764 Show Certificate displays in useless format
  - Resolves: #1272491 [WebUI] Certificate action dropdown does not display all
    the options after adding new certificate
  - Resolves: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.4.0
  - Resolves: #1294503 IPA fails to issue 3rd party certs
  - Resolves: #1298242 [RFE] API compatibility - compatibility of clients
  - Resolves: #1298848 [RFE] Centralized topology management
  - Resolves: #1298966 [RFE] Extend Smart Card support
  - Resolves: #1315146 Multiple clients cannot join domain simultaneously:
    /var/run/httpd/ipa/clientcaches race condition?
  - Resolves: #1318903 ipa server install failing when SUBCA signs the cert
  - Resolves: #1319003 ipa-winsync-migrate: Traceback should be fixed with proper
    console output
  - Resolves: #1324055 IPA always qualify requests for admin
  - Resolves: #1328552 [RFE] Allow users to authenticate with alternative names
  - Resolves: #1334582 Inconsistent UI and CLI options for removing certificate
    hold
  - Resolves: #1346321 Exclude o=ipaca subtree from Retro Changelog (syncrepl)
  - Resolves: #1349281 Fix `Conflicts` with ipa-python
  - Resolves: #1350695 execution of copy-schema script fails
  - Resolves: #1351118 upgrade failed for RHEL-7.3 from RHEL-7.2.z
  - Resolves: #1351153 AVC seen on Replica during ipa-server upgrade test
    execution to 7.3
  - Resolves: #1351276 ipa-server-install with dns cannot resolve itself to
    create ipa-ca entry
  - Related: #1343422 [RFE] Add GssapiImpersonate option


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-0.2.alpha1
changelog:
  - Resolves: #1348948 IPA server install fails with build
    ipa-server-4.4.0-0.el7.1.alpha1
    - Revert "Increased mod_wsgi socket-timeout"


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-0.1.alpha1
changelog:
  - Resolves: #712109 "krbExtraData not allowed" is logged in DS error log while
    setting password for default sudo binddn.
  - Resolves: #747612 [RFE] IPA should support and manage DNS sites
  - Resolves: #768316 [RFE] ipa-getkeytab should auto-detect the ipa server name
  - Resolves: #825391 [RFE] Replica installation should provide a means for
    inheriting nssldap security access settings
  - Resolves: #921497 Incorrect *.py[co] files placement
  - Resolves: #1029640 RHEL7 IPA to add DNA Plugin config for dnaRemote support
  - Resolves: #1029905 389 DS cache sizes not replicated to IPA replicas
  - Resolves: #1196958 IPA replica installation failing with high number of users
    (160000).
  - Resolves: #1219402 IPA suggests to uninstall a client when the user needs to
    uninstall a replica
  - Resolves: #1224057 [RFE] TGS authorization decisions in KDC based on
    Authentication Indicator
  - Resolves: #1234222 [WebUI] UI error message is not appropriate for "Kerberos
    principal expiration"
  - Resolves: #1234223 [WebUI] General invalid password error message appearing
    for "Locked user"
  - Resolves: #1254267 ipa-server-install failure applying ldap updates with
    limits exceeded
  - Resolves: #1258626 realmdomains-mod --add-domain command throwing error when
    doamin already is in forwardzone.
  - Resolves: #1259020 ipa-server-adtrust-install doesn't allow
    NetBIOS-name=EXAMPLE-TEST.COM (dash character)
  - Resolves: #1260993 DNSSEC signing enablement on dnszone should throw error
    message when DNSSEC master not installed
  - Resolves: #1262747 dnssec options missing in ipa-dns-install man page
  - Resolves: #1265900 Fail installation immediately after dirsrv fails to
    install using ipa-server-install
  - Resolves: #1265915 idoverrideuser-find fails if any SID anchor is not
    resolvable anymore
  - Resolves: #1268027 ipa-dnskeysync-replica crash with backtrace -
    LimitsExceeded: limits exceeded for this query
  - Resolves: #1269089 Certificate of managed-by host/service fails to resubmit
  - Resolves: #1269200 ipa-server crashing while trying to preserve admin user
  - Resolves: #1271321 Reduce ioblocktimeout and idletimeout defaults
  - Resolves: #1271579 Automember rule expressions disappear from tables on
    single expression delete
  - Resolves: #1275816 Incomplete ports for IPA ad-trust
  - Resolves: #1276351 [RFE] Remove
    /usr/share/ipa/updates/50-lockout-policy.update file from IPA releases
  - Resolves: #1277109 Add tool tips for Revert, Refresh, Undo, and Undo All in
    the IPA UI
  - Resolves: #1278426 Better error message needed for invalid ca-signing-algo
    option
  - Resolves: #1279932 ipa-client-install --request-cert needs workaround in
    anaconda chroot
  - Resolves: #1282521 Creating a user w/o private group fails when doing so in
    WebUI
  - Resolves: #1283879 ipa-winsync-migrate: Traceback message should be replaced
    by "IPA is not configured on this system"
  - Resolves: #1285071 ipa-kra-install fails on replica looking for admin cert
    file
  - Resolves: #1287194 [RFE] Support of UPN for trusted domains
  - Resolves: #1288967 Normalize Manager entry in ipa user-add
  - Resolves: #1289487 Priority field missing in Password Policy detail tab
  - Resolves: #1291140 ipa client should configure kpasswd_server directive in
    krb5.conf
  - Resolves: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.4.0.alpha1
  - Resolves: #1298848 [RFE] Centralized topology management
  - Resolves: #1300576 Browser setup page includes instructions for Internet
    Explorer
  - Resolves: #1301586 ipa host-del --updatedns should remove related dns
    entries.
  - Resolves: #1304618 Residual Files After IPA Server Uninstall
  - Resolves: #1305144 ipa-python does not require its dependencies
  - Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
  - Resolves: #1313798 Console output post ipa-winsync-migrate command should be
    corrected.
  - Resolves: #1314786 [RFE] External Trust with Active Directory domain
  - Resolves: #1319023 Include description for 'status' option in man page for
    ipactl command.
  - Resolves: #1319912 ipa-server-install does not completely change hostname and
    named-pkcs11 fails
  - Resolves: #1320891 IPA Error 3009: Validation error: Invalid 'ptrrecord':
    Reverse zone in-addr.arpa. requires exactly 4 IP address compnents, 5 given
  - Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
    revocation reasons
  - Resolves: #1328549 "ipa-kra-install" command reports incorrect message when
    it is executed on server already installed with KRA.
  - Resolves: #1329209 ipa-nis-manage enable: change service name from 'portmap'
    to 'rpcbind'
  - Resolves: #1329275 ipa-nis-manage command should include status option
  - Resolves: #1330843 'man ipa' should be updated with latest commands
  - Resolves: #1333755 ipa cert-request causes internal server error while
    requesting certificate
  - Resolves: #1337484 EOF is not handled for ipa-client-install command
  - Resolves: #1338031 Insufficient 'write' privilege on some attributes for the
    members of the role which has "User Administrators" privilege.
  - Resolves: #1343142 IPA DNS should do better verification of DNS zones
  - Resolves: #1347928 Frontpage exposes runtime error with no cookies enabled in
    browser


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605241723GIT1b427d3.1
changelog:
  - Resolves: #1339483 ipa-server-install fails with ERROR pkinit_cert_files
    - Fix incorrect rebase of patch 1001


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605241723GIT1b427d3
changelog:
  - Resolves: #1339233 CA installed on replica is always marked as renewal master
  - Related: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.3.1.201605241723GIT1b427d3


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605191449GITf8edf37.1
changelog:
  - Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
    because of missing dependencies
    - Rebuild with krb5-1.14.1


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605191449GITf8edf37
changelog:
  - Resolves: #837369 [RFE] Switch to client promotion to replica model
  - Resolves: #1199516 [RFE] Move replication topology to the shared tree
  - Resolves: #1206588 [RFE] Visualize FreeIPA server replication topology
  - Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
  - Resolves: #1212713 ipa-csreplica-manage: it could be nice to have also
    list-ruv / clean-ruv / abort-clean-ruv for o=ipaca backend
  - Resolves: #1267206 ipa-server-install uninstall should warn if no
    installation found
  - Resolves: #1295865 The Domain option is not correctly set in idmapd.conf when
    ipa-client-automount is executed.
  - Resolves: #1327092 URI details missing and OCSP-URI details are incorrectly
    displayed when certificate generated using IPA on RHEL 7.2up2.
  - Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
    because of missing dependencies
  - Related: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.3.1.201605191449GITf8edf37


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-16
changelog:
  - Resolves: #1277696 IPA certificate auto renewal fail with "Invalid
    Credential"
    - cert renewal: make renewal of ipaCert atomic
  - Resolves: #1278330 installer options are not validated at the beginning of
    installation
    - install: fix command line option validation
  - Resolves: #1282845 sshd_config change on ipa-client-install can prevent sshd
    from starting up
    - client install: do not corrupt OpenSSH config with Match sections
  - Resolves: #1282935 ipa upgrade causes vault internal error
    - install: export KRA agent PEM file in ipa-kra-install
  - Resolves: #1283429 Default CA ACL rule is not created during
    ipa-replica-install
    - TLS and Dogtag HTTPS request logging improvements
    - Avoid race condition caused by profile delete and recreate
    - Do not erroneously reinit NSS in Dogtag interface
    - Add profiles and default CA ACL on migration
    - disconnect ldap2 backend after adding default CA ACL profiles
    - do not disconnect when using existing connection to check default CA ACLs
  - Resolves: #1283430 ipa-kra-install: fails to apply updates
    - suppress errors arising from adding existing LDAP entries during KRA
      install
  - Resolves: #1283748 Caching of ipaconfig does not work in framework
    - fix caching in get_ipa_config
  - Resolves: #1283943 IPA DNS Zone/DNS Forward Zone details missing after
    upgrade from RHEL 7.0 to RHEL 7.2
    - upgrade: fix migration of old dns forward zones
    - Fix upgrade of forwardzones when zone is in realmdomains
  - Resolves: #1284413 ipa-cacert-manage renew fails on nonexistent ldap
    connection
    - ipa-cacert-renew: Fix connection to ldap.
  - Resolves: #1284414 ipa-otptoken-import fails on nonexistent ldap connection
    - ipa-otptoken-import: Fix connection to ldap.
  - Resolves: #1286635 IPA server upgrade fails from RHEL 7.0 to RHEL 7.2 using
    "yum update ipa* sssd"
    - Set minimal required version for openssl
  - Resolves: #1286781 ipa-nis-manage does not update ldap with all NIS maps
    - Upgrade: Fix upgrade of NIS Server configuration
  - Resolves: #1289311 umask setting causes named-pkcs11 issue with directory
    permissions on /var/lib/ipa/dnssec
    - DNS: fix file permissions
    - Explicitly call chmod on newly created directories
    - Fix: replace mkdir with chmod
  - Resolves: #1290142 Broken 7.2.0 to 7.2.z upgrade - flawed version comparison
    - Fix version comparison
    - use FFI call to rpmvercmp function for version comparison
  - Resolves: #1292595 In IPA-AD trust environment some secondary IPA based Posix
    groups are missing
    - ipa-kdb: map_groups() consider all results
  - Resolves: #1293870 User should be notified for wrong password in password
    reset page
    - Fixed login error message box in LoginScreen page
  - Resolves: #1296196 Sysrestore did not restore state if a key is specified in
    mixed case
    - Allow to used mixed case for sysrestore
  - Resolves: #1296214 DNSSEC key purging is not handled properly
    - DNSSEC: Improve error reporting from ipa-ods-exporter
    - DNSSEC: Make sure that current state in OpenDNSSEC matches key state in
      LDAP
    - DNSSEC: Make sure that current key state in LDAP matches key state in BIND
    - DNSSEC: remove obsolete TODO note
    - DNSSEC: add debug mode to ldapkeydb.py
    - DNSSEC: logging improvements in ipa-ods-exporter
    - DNSSEC: remove keys purged by OpenDNSSEC from master HSM from LDAP
    - DNSSEC: ipa-dnskeysyncd: Skip zones with old DNSSEC metadata in LDAP
    - DNSSEC: ipa-ods-exporter: add ldap-cleanup command
    - DNSSEC: ipa-dnskeysyncd: call ods-signer ldap-cleanup on zone removal
    - DNSSEC: Log debug messages at log level DEBUG
  - Resolves: #1296216 ipa-server-upgrade fails if certmonger is not running
    - prevent crash of CA-less server upgrade due to absent certmonger
    - always start certmonger during IPA server configuration upgrade
  - Resolves: #1297811 The ipa -e skip_version_check=1 still issues
    incompatibility error when called against RHEL 6 server
    - ipalib: assume version 2.0 when skip_version_check is enabled
  - Resolves: #1298289 install fails when locale is "fr_FR.UTF-8"
    - Do not decode HTTP reason phrase from Dogtag
  - Resolves: #1300252 shared certificateProfiles container is missing on a
    freshly installed RHEL7.2 system
    - upgrade: unconditional import of certificate profiles into LDAP
  - Resolves: #1301674 --setup-dns and other options is forgotten for using an
    external PKI
    - installer: Propagate option values from components instead of copying them.
    - installer: Fix logic of reading option values from cache.
  - Resolves: #1301687 issues with migration from RHEL 6 self-signed to RHEL 7 CA
    IPA setup
    - ipa-ca-install: print more specific errors when CA is already installed
    - cert renewal: import all external CA certs on IPA CA cert renewal
    - CA install: explicitly set dogtag_version to 10
    - fix standalone installation of externally signed CA on IPA master
    - replica install: validate DS and HTTP server certificates
    - replica install: improvements in the handling of CA-related IPA config
      entries
  - Resolves: #1301901 [RFE] compat tree: show AD members of IPA groups
    - slapi-nis: update configuration to allow external members of IPA groups
  - Resolves: #1305533 ipa trust-add succeded but after that ipa trust-find
    returns "0 trusts matched"
    - upgrade: fix config of sidgen and extdom plugins
    - trusts: use ipaNTTrustPartner attribute to detect trust entries
    - Warn user if trust is broken
    - fix upgrade: wait for proper DS socket after DS restart
    - Insure the admin_conn is disconnected on stop
    - Fix connections to DS during installation
    - Fix broken trust warnings
  - Resolves: #1321092 Installers fail when there are multiple versions of the
    same certificate
    - certdb: never use the -r option of certutil
  - Related: #1317381 Crash during IPA upgrade due to slapd
    - spec file: update minimum required version of slapi-nis
  - Related: #1322691 CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112
    CVE-2016-2113 CVE-2016-2114 CVE-2016-2115 CVE-2016-2118 samba: various flaws
    [rhel-7.3]
    - Rebuild against newer Samba version


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15
changelog:
  - Resolves: #1252556 Missing CLI param and ACL for vault service operations
    - vault: fix private service vault creation


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-14
changelog:
  - Resolves: #1262996 ipa vault internal error on replica without KRA
    - upgrade: make sure ldap2 is connected in export_kra_agent_pem
  - Resolves: #1270608 IPA upgrade fails for server with CA cert signed by
    external CA
    - schema: do not derive ipaVaultPublicKey from ipaPublicKey


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-13
changelog:
  - Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
    - Fix an integer underflow bug in libotp
  - Resolves: #1262996 ipa vault internal error on replica without KRA
    - install: always export KRA agent PEM file
    - vault: select a server with KRA for vault operations
  - Resolves: #1269777 IPA restore overwrites /etc/passwd and /etc/group files
    - do not overwrite files with local users/groups when restoring authconfig
  - Renamed patch 1011 to 0138, as it was merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-12
changelog:
  - Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
    Trusts
    - winsync-migrate: Convert entity names to posix friendly strings
    - winsync-migrate: Properly handle collisions in the names of external groups
  - Resolves: #1261074 Adjust Firefox configuration to new extension signing
    policy
    - webui: use manual Firefox configuration for Firefox >= 40
  - Resolves: #1263337 IPA Restore failed with installed KRA
    - ipa-backup: Add mechanism to store empty directory structure
  - Resolves: #1264793 CVE-2015-5284 ipa: ipa-kra-install includes certificate
    and private key in world readable file [rhel-7.2]
    - install: fix KRA agent PEM file permissions
  - Resolves: #1265086 Mark IdM API Browser as experimental
    - WebUI: add API browser is experimental warning
  - Resolves: #1265277 Fix kdcproxy user creation
    - install: create kdcproxy user during server install
    - platform: add option to create home directory when adding user
    - install: fix kdcproxy user home directory
  - Resolves: #1265559 GSS failure after ipa-restore
    - destroy httpd ccache after stopping the service


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-11
changelog:
  - Resolves: #1258965 ipa vault: set owner of vault container
    - baseldap: make subtree deletion optional in LDAPDelete
    - vault: add vault container commands
    - vault: set owner to current user on container creation
    - vault: update access control
    - vault: add permissions and administrator privilege
    - install: support KRA update
  - Resolves: #1261586 ipa config-mod addattr fails for ipauserobjectclasses
    - config: allow user/host attributes with tagging options
  - Resolves: #1262315 Unable to establish winsync replication
    - winsync: Add inetUser objectclass to the passsync sysaccount


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-10
changelog:
  - Resolves: #1260663 crash of ipa-dnskeysync-replica component during
    ipa-restore
    - IPA Restore: allows to specify files that should be removed
  - Resolves: #1261806 Installing ipa-server package breaks httpd
    - Handle timeout error in ipa-httpd-kdcproxy
  - Resolves: #1262322 Failed to backup CS.cfg message in upgrade.
    - Server Upgrade: backup CS.cfg when dogtag is turned off


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-9
changelog:
  - Resolves: #1257074 The KRA agent cert is stored in a PEM file that is not
    tracked
    - cert renewal: Include KRA users in Dogtag LDAP update
    - cert renewal: Automatically update KRA agent PEM file
  - Resolves: #1257163 renaming certificatte profile with --rename option leads
    to integrity issues
    - certprofile: remove 'rename' option
  - Resolves: #1257968 kinit stop working after ipa-restore
    - Backup: back up the hosts file
  - Resolves: #1258926 Remove 'DNSSEC is experimental' warnings
    - DNSSEC: remove "DNSSEC is experimental" warnings
  - Resolves: #1258929 Uninstallation of IPA leaves extra entry in /etc/hosts
    - Installer: do not modify /etc/hosts before user agreement
  - Resolves: #1258944 DNSSEC daemons may deadlock when processing more than 1
    zone
    - DNSSEC: backup and restore opendnssec zone list file
    - DNSSEC: remove ccache and keytab of ipa-ods-exporter
    - DNSSEC: prevent ipa-ods-exporter from looping after service auto-restart
    - DNSSEC: Fix deadlock in ipa-ods-exporter <-> ods-enforcerd interaction
    - DNSSEC: Fix HSM synchronization in ipa-dnskeysyncd when running on DNSSEC
      key master
    - DNSSEC: Fix key metadata export
    - DNSSEC: Wrap master key using RSA OAEP instead of old PKCS v1.5.
  - Resolves: #1258964 revert to use ldapi to add kra agent in KRA install
    - Using LDAPI to setup CA and KRA agents.
  - Resolves: #1259848 server closes connection and refuses commands after
    deleting user that is still logged in
    - ldap: Make ldap2 connection management thread-safe again
  - Resolves: #1259996 AttributeError: 'NameSpace' object has no attribute
    'ra_certprofile' while ipa-ca-install
    - load RA backend plugins during standalone CA install on CA-less IPA master


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-8
changelog:
  - Resolves: #1254689 Storing big file as a secret in vault raises traceback
    - vault: Limit size of data stored in vault
  - Resolves: #1255880 ipactl status should distinguish between different
    pki-tomcat services
    - ipactl: Do not start/stop/restart single service multiple times


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-7
changelog:
  - Resolves: #1256840 [webui] majority of required fields is no longer marked as
    required
    - fix missing information in object metadata
  - Resolves: #1256842 [webui] no option to choose trust type when creating a
    trust
    - webui: add option to establish bidirectional trust
  - Resolves: #1256853 Clear text passwords in KRA install log
    - Removed clear text passwords from KRA install log.
  - Resolves: #1257072 The "Standard Vault" MUST not be the default and must be
    discouraged
    - vault: change default vault type to symmetric
  - Resolves: #1257163 renaming certificatte profile with --rename option leads
    to integrity issues
    - certprofile: prevent rename (modrdn)


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-6
changelog:
  - Resolves: #1249226 IPA dnssec-validation not working for AD dnsforwardzone
    - DNSSEC: fix forward zone forwarders checks
  - Resolves: #1250190 idrange is not added for sub domain
    - trusts: format Kerberos principal properly when fetching trust topology
  - Resolves: #1252334 User life cycle: missing ability to provision a stage user
    from a preserved user
    - Add user-stage command
  - Resolves: #1252863 After applying RHBA-2015-1554 errata, IPA service fails to
    start.
    - spec file: Add Requires(post) on selinux-policy
  - Resolves: #1254304 Changing vault encryption attributes
    - Change internal rsa_(public|private)_key variable names
    - Added support for changing vault encryption.
  - Resolves: #1256715 Executing user-del --preserve twice removes the user
    pernamently
    - improve the usability of `ipa user-del --preserve` command


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-5
changelog:
  - Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
    - user-undel: Fix error messages.
  - Resolves: #1200694 [RFE] Support for multiple cert profiles
    - Prohibit deletion of predefined profiles
  - Resolves: #1232819 testing ipa-restore on fresh system install fails
    - Backup/resore authentication control configuration
  - Resolves: #1243331 pkispawn fails when migrating to 4.2 server from 3.0
    server
    - Require Dogtag PKI >= 10.2.6
  - Resolves: #1245225 Asymmetric vault drops traceback when the key is not
    proper
    - Asymmetric vault: validate public key in client
  - Resolves: #1248399 Missing DNSSEC related files in backup
    - fix typo in BasePathNamespace member pointing to ods exporter config
    - ipa-backup: archive DNSSEC zone file and kasp.db
  - Resolves: #1248405 PassSync should be disabled after ipa-winsync-migrate is
    finished
    - winsync-migrate: Add warning about passsync
    - winsync-migrate: Expand the man page
  - Resolves: #1248524 User can't find any hosts using "ipa host-find $HOSTNAME"
    - adjust search so that it works for non-admin users
  - Resolves: #1250093 ipa certprofile-import accepts invalid config
    - Require Dogtag PKI >= 10.2.6
  - Resolves: #1250107 IPA framework should not allow modifying trust on AD trust
    agents
    - trusts: Detect missing Samba instance
  - Resolves: #1250111 User lifecycle - preserved users can be assigned
    membership
    - ULC: Prevent preserved users from being assigned membership
  - Resolves: #1250145 Add permission for user to bypass caacl enforcement
    - Add permission for bypassing CA ACL enforcement
  - Resolves: #1250190 idrange is not added for sub domain
    - idranges: raise an error when local IPA ID range is being modified
    - trusts: harden trust-fetch-domains oddjobd-based script
  - Resolves: #1250928 Man page for ipa-server-install is out of sync
    - install: Fix server and replica install options
  - Resolves: #1251225 IPA default CAACL does not allow cert-request for services
    after upgrade
    - Fix default CA ACL added during upgrade
  - Resolves: #1251561 ipa vault-add Unknown option: ipavaultpublickey
    - validate mutually exclusive options in vault-add
  - Resolves: #1251579 ipa vault-add --user should set container owner equal to
    user on first run
    - Fixed vault container ownership.
  - Resolves: #1252517 cert-request rejects request with correct
    krb5PrincipalName SAN
    - Fix KRB5PrincipalName / UPN SAN comparison
  - Resolves: #1252555 ipa vault-find doesn't work for services
    - vault: Add container information to vault command results
    - Add flag to list all service and user vaults
  - Resolves: #1252556 Missing CLI param and ACL for vault service operations
    - Added CLI param and ACL for vault service operations.
  - Resolves: #1252557 certprofile: improve profile format documentation
    - certprofile-import: improve profile format documentation
    - certprofile: add profile format explanation
  - Resolves: #1253443 ipa vault-add creates vault with invalid type
    - vault: validate vault type
  - Resolves: #1253480 ipa vault-add-owner does not fail when adding an existing
    owner
    - baseldap: Allow overriding member param label in LDAPModMember
    - vault: Fix param labels in output of vault owner commands
  - Resolves: #1253511 ipa vault-find does not use criteria
    - vault: Fix vault-find with criteria
  - Resolves: #1254038 ipa-replica-install pk12util error returns exit status 10
    - install: Fix replica install with custom certificates
  - Resolves: #1254262 ipa-dnskeysync-replica crash cannot contact kdc
    - improve the handling of krb5-related errors in dnssec daemons
  - Resolves: #1254412 when dirsrv is off ,upgrade from 7.1 to 7.2 fails with
    starting CA and named-pkcs11.service
    - Server Upgrade: Start DS before CA is started.
  - Resolves: #1254637 Add ACI and permission for managing user userCertificate
    attribute
    - add permission: System: Manage User Certificates
  - Resolves: #1254641 Remove CSR allowed-extensions restriction
    - cert-request: remove allowed extensions check
  - Resolves: #1254693 vault --service does not normalize service principal
    - vault: normalize service principal in service vault operations
  - Resolves: #1254785 ipa-client-install does not properly handle dual stacked
    hosts
    - client: Add support for multiple IP addresses during installation.
    - Add dependency to SSSD 1.13.1
    - client: Add description of --ip-address and --all-ip-addresses to man page


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-4
changelog:
  - Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
    users in IdM
    - store certificates issued for user entries as
    - user-show: add --out option to save certificates to file
  - Resolves: #1145748 [RFE] IPA running with One Way Trust
    - Fix upgrade of sidgen and extdom plugins
  - Resolves: #1195339 ipa-client-install changes the label on various files
    which causes SELinux denials
    - Use 'mv -Z' in specfile to restore SELinux context
  - Resolves: #1198796 Text in UI should describe differing LDAP vs Krb behavior
    for combinations of "User authentication types"
    - webui: add LDAP vs Kerberos behavior description to user auth
  - Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
    - ULC: Fix stageused-add --from-delete command
  - Resolves: #1200694 [RFE] Support for multiple cert profiles
    - certprofile-import: do not require profileId in profile data
    - Give more info on virtual command access denial
    - Allow SAN extension for cert-request self-service
    - Add profile for DNP3 / IEC 62351-8 certificates
    - Work around python-nss bug on unrecognised OIDs
  - Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
    - Validate vault's file parameters
    - Fixed missing KRA agent cert on replica.
  - Resolves: #1225866 display browser config options that apply to the browser.
    - webui: add Kerberos configuration instructions for Chrome
    - Remove ico files from Makefile
  - Resolves: #1246342 Unapply idview raises internal error
    - idviews: Check for the Default Trust View only if applying the view
  - Resolves: #1248102 [webui] regression - incorrect/no failed auth messages
    - webui: fix regressions failed auth messages
  - Resolves: #1248396 Internal error in DomainValidator.__search_in_dc
    - dcerpc: Fix UnboundLocalError for ccache_name
  - Resolves: #1249455 ipa trust-add failed CIFS server configuration does not
    allow access to \\pipe\lsarpc
    - Fix selector of protocol for LSA RPC binding string
    - dcerpc: Simplify generation of LSA-RPC binding strings
  - Resolves: #1250192 Error in ipa trust-fecth-domains
    - Fix incorrect type comparison in trust-fetch-domains
  - Resolves: #1251553 Winsync setup fails with unexpected error
    - replication: Fix incorrect exception invocation
  - Resolves: #1251854 ipa aci plugin is not parsing aci's correctly.
    - ACI plugin: correctly parse bind rules enclosed in
  - Resolves: #1252414 Trust agent install does not detect available replicas to
    add to master
    - adtrust-install: Correctly determine 4.2 FreeIPA servers


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-3
changelog:
  - Resolves: #1170770 [AD TRUST]IPA should detect inconsistent realm domains
    that conflicts with AD DC
    - trusts: Check for AD root domain among our trusted domains
  - Resolves: #1195339 ipa-client-install changes the label on various files
    which causes SELinux denials
    - sysrestore: copy files instead of moving them to avoind SELinux issues
  - Resolves: #1196656 [ipa-client][rhel71] enable debugging for spawned
    commands / ntpd -qgc $tmpfile hangs
    - enable debugging of ntpd during client installation
  - Resolves: #1205264 Migration UI Does Not Work When Anonymous Bind is Disabled
    - migration: Use api.env variables.
  - Resolves: #1212719 abort-clean-ruv subcommand should allow
    replica-certifyall: no
    - Allow value 'no' for replica-certify-all attr in abort-clean-ruv subcommand
  - Resolves: #1216935 ipa trust-add shows ipa: ERROR: an internal error has
    occurred
    - dcerpc: Expand explanation for WERR_ACCESS_DENIED
    - dcerpc: Fix UnboundLocalError for ccache_name
  - Resolves: #1222778 idoverride group-del can delete user and user-del can
    delete group
    - dcerpc: Add get_trusted_domain_object_type method
    - idviews: Restrict anchor to name and name to anchor conversions
    - idviews: Enforce objectclass check in idoverride*-del
  - Resolves: #1234919 Be able to request certificates without certmonger service
    running
    - cermonger: Use private unix socket when DBus SystemBus is not available.
    - ipa-client-install: Do not (re)start certmonger and DBus daemons.
  - Resolves: #1240939 Please add dependency on bind-pkcs11
    - Create server-dns sub-package.
    - ipaplatform: Add constants submodule
    - DNS: check if DNS package is installed
  - Resolves: #1242914 Bump minimal selinux-policy and add booleans to allow
    calling out oddjobd-activated services
    - selinux: enable httpd_run_ipa to allow communicating with oddjobd services
  - Resolves: #1243261 non-admin users cannot search hbac rules
    - fix hbac rule search for non-admin users
    - fix selinuxusermap search for non-admin users
  - Resolves: #1243652 Client has missing dependency on memcache
    - do not import memcache on client
  - Resolves: #1243835 [webui] user change password dialog does not work
    - webui: fix user reset password dialog
  - Resolves: #1244802 spec: selinux denial during kdcproxy user creation
    - Fix selinux denial during kdcproxy user creation
  - Resolves: #1246132 trust-fetch-domains: Do not chown keytab to the sssd user
    - oddjob: avoid chown keytab to sssd if sssd user does not exist
  - Resolves: #1246136 Adding a privilege to a permission avoids validation
    - Validate adding privilege to a permission
  - Resolves: #1246141 DNS Administrators cannot search in zones
    - DNS: Consolidate DNS RR types in API and schema
  - Resolves: #1246143 User plugin - user-find doesn't work properly with manager
    option
    - fix broken search for users by their manager


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-2
changelog:
  - Resolves: #1131907 [ipa-client-install] cannot write certificate file
    '/etc/ipa/ca.crt.new': must be string or buffer, not None
  - Resolves: #1195775 unsaved changes dialog internally inconsistent
  - Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
    - Stageusedr-activate: show username instead of DN
  - Resolves: #1200694 [RFE] Support for multiple cert profiles
    - Prevent to rename certprofile profile id
  - Resolves: #1222047 IPA to AD Trust: IPA ERROR 4016: Remote Retrieve Error
  - Resolves: #1224769 copy-schema-to-ca.py does not overwrites schema files
    - copy-schema-to-ca: allow to overwrite schema files
  - Resolves: #1241941 kdc component installation of IPA failed
    - spec file: Update minimum required version of krb5
  - Resolves: #1242036 Replica install fails to update DNS records
    - Fix DNS records installation for replicas
  - Resolves: #1242884 Upgrade to 4.2.0 fails when enabling kdc proxy
    - Start dirsrv for kdcproxy upgrade


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-1
changelog:
  - Resolves: #846033  [RFE] Documentation for JSONRPC IPA API
  - Resolves: #989091  Ability to manage IdM/IPA directly from a standard LDAP
    client
  - Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
    users in IdM
  - Resolves: #1115294 [RFE] Add support for DNSSEC
  - Resolves: #1145748 [RFE] IPA running with One Way Trust
  - Resolves: #1199520 [RFE] Introduce single upgrade tool - ipa-server-upgrade
  - Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
  - Resolves: #1200694 [RFE] Support for multiple cert profiles
  - Resolves: #1200728 [RFE] Replicate PKI Profile information
  - Resolves: #1200735 [RFE] Allow issuing certificates for user accounts
  - Resolves: #1204054 SSSD database is not cleared between installs and
    uninstalls of ipa
  - Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
    Trusts
  - Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
  - Resolves: #1204504 [RFE] Add access control so hosts can create their own
    services
  - Resolves: #1206534 [RFE] Offer Kerberos over HTTP (kdcproxy) by default
  - Resolves: #1206613 [RFE] Configure IPA to be a trust agent by default
  - Resolves: #1209476 package ipa-client does not require package dbus-python
  - Resolves: #1211589 [RFE] Add option to skip the verify_client_version
  - Resolves: #1211608 [RFE] Generic support for unknown DNS RR types (RFC 3597)
  - Resolves: #1215735 ipa-replica-prepare automatically adds a DNS zone
  - Resolves: #1217010 OTP Manager field is not exposed in the UI
  - Resolves: #1222475 krb5kdc : segfault at 0 ip 00007fa9f64d82bb sp
    00007fffd68b2340 error 6 in libc-2.17.so
  - Related:  #1204809 Rebase ipa to 4.2
    - Update to upstream 4.2.0
    - Move /etc/ipa/kdcproxy to the server subpackage


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-0.2.alpha1
changelog:
  - Resolves: #1228671 pkispawn fails in ipa-ca-install and ipa-kra-install
  - Related:  #1204809 Rebase ipa to 4.2
    - Fix minimum version of slapi-nis
    - Require python-sss and python-sss-murmur (provided by sssd-1.13.0)


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-0.1.alpha1
changelog:
  - Resolves: #805188  [RFE] "ipa migrate-ds" ldapsearches with scope=1
  - Resolves: #1019272 With 20000+ users, adding a user to a group intermittently
    throws Internal server error
  - Resolves: #1035494 Unable to add Kerberos principal via kadmin.local
  - Resolves: #1045153 ipa-managed-entries --list -p <badpassword> still requires
    DM password
  - Resolves: #1125950 ipa-server-install --uinstall doesn't remove port 7389
    from ldap_port_t
  - Resolves: #1132540 [RFE] Expose service delegation rules in UI and CLI
  - Resolves: #1145584 ipaserver/install/cainstance.py creates pkiuser not
    matching uidgid
  - Resolves: #1176036 IDM client registration failure in a high load environment
  - Resolves: #1183116 Remove Requires: subscription-manager
  - Resolves: #1186054 permission-add does not prompt to enter --right option in
    interactive mode
  - Resolves: #1187524 Replication agreement with replica not disabled when
    ipa-restore done without IPA installed
  - Resolves: #1188195 Fax number not displayed for user-show when kinit'ed as
    normal user.
  - Resolves: #1189034 "an internal error has occurred" during ipa host-del
    --updatedns
  - Resolves: #1193554 ipa-client-automount: failing with error LDAP server
    returned UNWILLING_TO_PERFORM. This likely means that minssf is enabled.
  - Resolves: #1193759 IPA extdom plugin fails when encountering large groups
  - Resolves: #1194312 [ipa-python] ipalib.errors.LDAPError: failed to decode
    certificate: (SEC_ERROR_INVALID_ARGS) security library: invalid arguments.
  - Resolves: #1194633 Default trust view can be deleted in lower case
  - Resolves: #1196455 ipa-server-install step [8/27]: starting certificate
    server instance - confusing CA staus message on TLS error
  - Resolves: #1198263 Limit deadlocks between DS plugin DNA and slapi-nis
  - Resolves: #1199527 [RFE] Use datepicker component for datetime fields
  - Resolves: #1200867 [RFE] Make OTP validation window configurable
  - Resolves: #1200883 [RFE] Switch apache to use mod_auth_gssapi
  - Resolves: #1202998 CVE-2015-1827 ipa: memory corruption when using
    get_user_grouplist() [rhel-7.2]
  - Resolves: #1204637 slow group operations
  - Resolves: #1204642 migrate-ds: slow add o users to default group
  - Resolves: #1208461 IPA CA master server update stuck on checking getStatus
    via https
  - Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
  - Resolves: #1211708 ipa-client-install gets stuck during NTP sync
  - Resolves: #1215197 ipa-client-install ignores --ntp-server option during time
    sync
  - Resolves: #1215200 ipa-client-install configures IPA server as NTP source
    even if IPA server has not ntpd configured
  - Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
  - Related:  #1204809 Rebase ipa to 4.2
    - Update to upstream 4.2.0.alpha1


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-18.3
changelog:
  - [ipa-python] ipalib.errors.LDAPError: failed to decode certificate:
    (SEC_ERROR_INVALID_ARGS) security library: invalid arguments. (#1194312)


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.1.0-18.2
changelog:
  - IPA extdom plugin fails when encountering large groups (#1193759)
  - CVE-2015-0283 ipa: slapi-nis: infinite loop in getgrnam_r() and getgrgid_r()
    (#1202998)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-18.1
changelog:
  - "an internal error has occurred" during ipa host-del --updatedns (#1198431)
  - Renamed patch 1013 to 0114, as it was merged upstream
  - Fax number not displayed for user-show when kinit'ed as normal user.
    (#1198430)
  - Replication agreement with replica not disabled when ipa-restore done without
    IPA installed (#1199060)
  - Limit deadlocks between DS plugin DNA and slapi-nis (#1199128)


author: Martin Kosek <mkosek@redhat.com> - 4.1.0-18
changelog:
  - Fix ipa-pwd-extop global configuration caching (#1187342)
  - group-detach does not add correct objectclasses (#1187540)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-17
changelog:
  - Wrong directories created on full restore (#1186398)
  - ipa-restore crashes if replica is unreachable (#1186396)
  - idoverrideuser-add option --sshpubkey does not work (#1185410)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-16
changelog:
  - PassSync does not sync passwords due to missing ACIs (#1181093)
  - ipa-replica-manage list does not list synced domain (#1181010)
  - Do not assume certmonger is running in httpinstance (#1181767)
  - ipa-replica-manage disconnect fails without password (#1183279)
  - Put LDIF files to their original location in ipa-restore (#1175277)
  - DUA profile not available anonymously (#1184149)
  - IPA replica missing data after master upgraded (#1176995)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-14
changelog:
  - IPA Replicate creation fails with error "Update failed! Status: [10 Total
    update abortedLDAP error: Referral]" (#1166265)
  - running ipa-server-install --setup-dns results in a crash (#1072502)
  - DNS zones are not migrated into forward zones if 4.0+ replica is added
    (#1175384)
  - gid is overridden by uid in default trust view (#1168904)
  - When migrating warn user if compat is enabled (#1177133)
  - Clean up debug log for trust-add (#1168376)
  - No error message thrown on restore(full kind) on replica from full backup
    taken on master (#1175287)
  - ipa-restore proceed even IPA not configured (#1175326)
  - Data replication not working as expected after data restore from full backup
    (#1175277)
  - IPA externally signed CA cert expiration warning missing from log (#1178128)
  - ipa-upgradeconfig fails in CA-less installs (#1181767)
  - IPA certs fail to autorenew simultaneouly (#1173207)
  - More validation required on ipa-restore's options (#1176034)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-13
changelog:
  - Expand the token auth/sync windows (#919228)
  - Access is not rejected for disabled domain (#1172598)
  - krb5kdc crash in ldap_pvt_search (#1170695)
  - RHEL7.1 IPA server httpd avc denials after upgrade (#1164896)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-12
changelog:
  - RHEL7.1 ipa-cacert-manage renewed certificate from MS ADCS not compatible
    (#1169591)
  - CLI doesn't show SSHFP records with SHA256 added via nsupdate (regression)
    (#1172578)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-11
changelog:
  - Throw zonemgr error message before installation proceeds (#1163849)
  - Winsync: Setup is broken due to incorrect import of certificate (#1169867)
  - Enable last token deletion when password auth type is configured (#919228)
  - ipa-otp-lasttoken loads all user's tokens on every mod/del (#1166641)
  - add --hosts and --hostgroup options to allow/retrieve keytab methods
    (#1007367)
  - Extend host-show to add the view attribute in set of default attributes
    (#1168916)
  - Prefer TCP connections to UDP in krb5 clients (#919228)
  - [WebUI] Not able to unprovisioning service in IPA 4.1 (#1168214)
  - webui: increase notification duration (#1171089)
  - RHEL7.1 ipa automatic CA cert renewal stuck in submitting state (#1166931)
  - RHEL7.1 ipa-cacert-manage cannot change external to self-signed ca cert
    (#1170003)
  - Improve validation of --instance and --backend options in ipa-restore
    (#951581)
  - RHEL7.1 ipa replica unable to replicate to rhel6 master (#1167964)
  - Disable TLS 1.2 in nss.conf until mod_nss supports it (#1156466)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-9
changelog:
  - schema update on RHEL-6.6 using latest copy-schema-to-ca.py from RHEL-7.1
    build fails (#1167196)
  - Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
  - "ipa trust-add ... " cmd says : (Trust status: Established and verified)
    while in the logs we see "WERR_ACCESS_DENIED" during verification step.
    (#1144121)
  - POODLE: force using safe ciphers (non-SSLv3) in IPA client and server
    (#1156466)
  - Add support/hooks for a one-time password system like SecureID in IPA
    (#919228)
  - Tracebacks with latest build for --zonemgr cli option (#1167270)
  - ID Views: Support migration from the sync solution to the trust solution
    (#891984)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-8
changelog:
  - Improve otptoken help messages (#919228)
  - Ensure users exist when assigning tokens to them (#919228)
  - Enable QR code display by default in otptoken-add (#919228)
  - Show warning instead of error if CA did not start (#1158410)
  - CVE-2014-7850 freeipa: XSS flaw can be used to escalate privileges (#1165774)
  - Traceback when adding zone with long name (#1164859)
  - Backup & Restore mechanism (#951581)
  - ignoring user attributes in migrate-ds does not work if uppercase characters
    are returned by ldap (#1159816)
  - Allow ipa-getkeytab to optionally fetch existing keys (#1007367)
  - Failure when installing on dual stacked system with external ca (#1128380)
  - ipa-server should keep backup of CS.cfg (#1059135)
  - Tracebacks with latest build for --zonemgr cli option (#1167270)
  - webui: use domain name instead of domain SID in idrange adder dialog
    (#891984)
  - webui: normalize idview tab labels (#891984)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-7
changelog:
  - ipa-csreplica-manage connect fails (#1157735)
  - error message which is not understandable when IDNA2003 characters are
    present in --zonemgr (#1163849)
  - Fix warning message should not contain CLI commands (#1114013)
  - Renewing the CA signing certificate does not extend its validity period end
    (#1163498)
  - RHEL7.1 ipa-server-install --uninstall Could not set SELinux booleans for
    httpd (#1159330)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-6
changelog:
  - Fix: DNS installer adds invalid zonemgr email (#1056202)
  - ipaplatform: Use the dirsrv service, not target (#951581)
  - Fix: DNS policy upgrade raises asertion error (#1161128)
  - Fix upgrade referint plugin (#1161128)
  - Upgrade: fix trusts objectclass violationi (#1161128)
  - group-add doesn't accept gid parameter (#1149124)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-5
changelog:
  - Update slapi-nis dependency to pull 0.54-2 (#891984)
  - ipa-restore: Don't crash if AD trust is not installed (#951581)
  - Prohibit setting --rid-base for ranges of ipa-trust-ad-posix type (#1138791)
  - Trust setting not restored for CA cert with ipa-restore command (#1159011)
  - ipa-server-install fails when restarting named (#1162340)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-4
changelog:
  - Update Requires on pki-ca to 10.1.2-4 (#1129558)
  - build: increase java stack size for all arches
  - Add ipaSshPubkey and gidNumber to the ACI to read ID user overrides (#891984)
  - Fix dns zonemgr validation regression (#1056202)
  - Handle profile changes in dogtag-ipa-ca-renew-agent (#886645)
  - Do not wait for new CA certificate to appear in LDAP in ipa-certupdate
    (#886645)
  - Add bind-dyndb-ldap working dir to IPA specfile
  - Fail if certmonger can't see new CA certificate in LDAP in ipa-cacert-manage
    (#886645)
  - Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
  - Deadlock in schema compat plugin (#1161131)
  - ipactl stop should stop dirsrv last (#1161129)
  - Upgrade 3.3.5 to 4.1 failed (#1161128)
  - CVE-2014-7828 freeipa: password not required when OTP in use (#1160877)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-29
changelog:
  - Server installation fails using external signed certificates with
    "IndexError: list index out of range" (#1111320)
  - Add rhino to BuildRequires to fix Web UI build error


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-28
changelog:
  - ipa-client-automount fails with incompatibility error when installed against
    older IPA server (#1083108)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-26
changelog:
  - When IdM server trusts multiple AD forests, IPA client returns invalid group
    membership info (#1079498)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-22
changelog:
  - ipa-replica-install never checks for 7389 port (#1075165)
  - Non-terminated string may be passed to LDAP search (#1075091)
  - ipa-sam may fail to translate group SID into GID (#1073829)
  - Excessive LDAP calls by ipa-sam during Samba FS operations (#1075132)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-20
changelog:
  - trustdomain-find with pkey-only fails (#1068611)
  - Invalid credential cache in trust-add (#1069182)
  - ipa-replica-install prints unexpected error (#1069722)
  - Too big font in input fields in details facet in Firefox (#1069720)
  - trust-add for POSIX AD does not fetch trustdomains (#1070925)
  - Misleading trust-add error message in some cases (#1070926)
  - Access is not rejected for disabled domain (#1070924)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-18
changelog:
  - Display server name in ipa command's verbose mode (#1061703)
  - Remove sourcehostcategory from default HBAC rule (#1061187)
  - dnszone-add cannot add classless PTR zones (#1058688)
  - Move ipa-otpd socket directory to /var/run/krb5kdc (#1063850)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-16
changelog:
  - Fallback to global policy in ipa lockout plugin (#912725)
  - Migration does not add users to default group (#903232)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-13
changelog:
  - Do not add krbPwdPolicyReference for new accounts, hardcode it (#1045218)
  - Increase default timeout for IPA services (#1033273)
  - Error while running trustdomain-find (#1054376)
  - group-show lists SID instead of name for external groups (#1054391)
  - Fix IPA server NetBIOS name in samba configuration (#1030517)
  - dnsrecord-mod produces missing API version warning (#1054869)
  - Hide trust-resolve command as internal (#1052860)
  - Add Trust domain Web UI (#1054870)
  - ipasam cannot delete multiple child trusted domains (#1056120)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-12
changelog:
  - Missing objectclasses when empty password passed to host-add (#1052979)
  - sudoOrder missing in sudoers (#1052983)
  - Missing examples in sudorule help (#1049464)
  - Client automount does not uninstall when fstore is empty (#910899)
  - Error not clear for invalid realm given to trust-fetch-domains (#1052981)
  - trust-fetch-domains does not add idrange for subdomains found (#1049926)
  - Add option to show if an AD subdomain is enabled/disabled (#1052973)
  - ipa-adtrust-install still failed with long NetBIOS names (#1030517)
  - Error not clear for invalid relam given to trustdomain-find (#1049455)
  - renewed client cert not recognized during IPA CA renewal (#1033273)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-8
changelog:
  - Fix status trust-add command status message (#910453)
  - NetBIOS was not trimmed at 15 characters (#1030517)
  - Harden CA subsystem certificate renewal on CA clones (#1040018)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-6
changelog:
  - Remove "Listen 443 http" hack from deployed nss.conf (#1029046)
  - Re-adding existing trust fails (#1033216)
  - IPA uninstall exits with a samba error (#1033075)
  - Added RELRO hardening on /usr/libexec/ipa-otpd (#1026260)
  - Fixed ownership of /usr/share/ipa/ui/js (#1026260)
  - ipa-tests: support external names for hosts (#1032668)
  - ipa-client-install fail due fail to obtain host TGT (#1029354)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-5
changelog:
  - Trust add tries to add same value of --base-id for sub domain,
    causing an error (#1033068)
  - Improved error reporting for adding trust case (#1029856)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-3
changelog:
  - Installer did not detect different server and IPA domain (#1026845)
  - Allow kernel keyring CCACHE when supported (#1026861)


author: Martin Kosek <mkosek@redhat.com> - 3.3.2-5
changelog:
  - Temporarily move ipa-backup and ipa-restore functionality
    back to make them available in public Beta (#1003933)


author: Martin Kosek <mkosek@redhat.com> - 3.3.2-4
changelog:
  - Server install failure during client enrollment shouldn't
    roll back (#1023086)
  - nsds5ReplicaStripAttrs are not set on agreements (#1023085)
  - ipa-server conflicts with mod_ssl (#1018172)


author: Martin Kosek <mkosek@redhat.com> - 3.3.2-2
changelog:
  - Deprecate --serial-autoincrement option (#1016645)
  - CA installation always failed on replica (#1005446)
  - Re-initializing a winsync connection exited with error (#994980)


author: Martin Kosek <mkosek@redhat.com> - 3.3.2-1
changelog:
  - Update to upstream 3.3.2 (#991064)
  - Add delegation info to MS-PAC (#915799)
  - Warn about incompatibility with AD when IPA realm and domain
    differs (#1009044)
  - Allow PKCS#12 files with empty password in install tools (#1002639)
  - Privilege "SELinux User Map Administrators" did not list
    permissions (#997085)
  - SSH key upload broken when client joins an older server (#1009024)


author: Martin Kosek <mkosek@redhat.com> - 3.3.1-5
changelog:
  - Remove dependency on python-paramiko (#1002884)
  - Broken redirection when deleting last entry of DNS resource
    record (#1006360)


author: Martin Kosek <mkosek@redhat.com> - 3.3.1-3
changelog:
  - Replica installation fails for RHEL 6.4 master (#1004680)
  - Server uninstallation crashes if DS is not available (#998069)


author: Martin Kosek <mkosek@redhat.com> - 3.3.1-2
changelog:
  - Unable to remove replica by ipa-replica-manage (#1001662)
  - Before uninstalling a server, warn about active replicas (#998069)


author: Martin Kosek <mkosek@redhat.com> - 3.3.0-4
changelog:
  - ipa-server-install fails if --subject parameter is other than default
    realm (#983075)
  - do not allow configuring bind-dyndb-ldap without persistent search (#967876)


author: Martin Kosek <mkosek@redhat.com> - 3.3.0-2
changelog:
  - Remove ipa-server-selinux obsoletes as upgrades from version prior to
    3.3.0 are not allowed
  - Wrap server-trust-ad subpackage description better
  - Add (noreplace) flag for %{_sysconfdir}/tmpfiles.d/ipa.conf
  - Change permissions on default_encoding_utf8.so to fix ipa-python Provides


author: Martin Kosek <mkosek@redhat.com> - 3.2.2-1
changelog:
  - Update to upstream 3.2.2
  - Drop ipa-server-selinux subpackage
  - Drop redundant directory /var/cache/ipa/sessions
  - Do not create /var/lib/ipa/pki-ca/publish, retain reference as ghost
  - Run ipa-upgradeconfig and server restart in posttrans to avoid inconsistency
    issues when there are still old parts of software (like entitlements plugin)


author: Rob Crittenden <rcritten@redhat.com> - 3.2.0-1
changelog:
  - Update to upstream 3.2.0 GA
  - ipa-client-install fails if /etc/ipa does not exist (#961483)
  - Certificate status is not visible in Service and Host page (#956718)
  - ipa-client-install removes needed options from ldap.conf (#953991)
  - Handle socket.gethostbyaddr() exceptions when verifying hostnames (#953957)
  - Add triggerin scriptlet to support OpenSSH 6.2 (#953617)
  - Require nss 3.14.3-12.0 to address certutil certificate import
    errors (#953485)
  - Require pki-ca 10.0.2-3 to pull in fix for sslget and mixed IPv4/6
    environments. (#953464)
  - ipa-client-install removes 'sss' from /etc/nsswitch.conf (#953453)
  - ipa-server-install --uninstall doesn't stop dirsrv instances (#953432)
  - Add requires for openldap-2.4.35-4 to pickup fixed SASL_NOCANON behavior for
    socket based connections (#960222)
  - Require libsss_nss_idmap-python
  - Add Conflicts on nss-pam-ldapd < 0.8.4. The mapping from uniqueMember to
    member is now done automatically and having it in the config file raises
    an error.
  - Add backup and restore tools, directory.
  - require at least systemd 38 which provides the journal (we no longer
    need to require syslog.target)
  - Update Requires on policycoreutils to 2.1.14-37
  - Update Requires on selinux-policy to 3.12.1-42
  - Update Requires on 389-ds-base to 1.3.1.0
  - Remove a Requires for java-atk-wrapper


author: Rob Crittenden <rcritten@redhat.com> - 3.2.0-0.3.beta1
changelog:
  - Add a Requires for java-atk-wrapper until we can determine which package
    should be pulling it in, dogtag or tomcat.


author: Martin Kosek <mkosek@redhat.com> - 3.2.0-0.1.pre1
changelog:
  - Update to upstream 3.2.0 Prerelease 1
  - Use upstream reference spec file as a base for Fedora spec file


author: Rob Crittenden <rcritten@redhat.com> - 3.1.2-1
changelog:
  - Update to upstream 3.1.2
  - CVE-2012-4546: Incorrect CRLs publishing
  - CVE-2012-5484: MITM Attack during Join process
  - CVE-2013-0199: Cross-Realm Trust key leak
  - Updated strict dependencies to 389-ds-base = 1.3.0.2 and
    pki-ca = 10.0.1


author: Martin Kosek <mkosek@redhat.com> - 3.1.0-2
changelog:
  - Remove redundat Requires versions that are already in Fedora 17
  - Replace python-crypto Requires with m2crypto
  - Add missing Requires(post) for client and server-trust-ad subpackages
  - Restart httpd service when server-trust-ad subpackage is installed
  - Bump selinux-policy Requires to pick up PKI/LDAP port labeling fixes


author: Rob Crittenden <rcritten@redhat.com> - 3.1.0-1
changelog:
  - Updated to upstream 3.1.0 GA
  - Set minimum for sssd to 1.9.2
  - Set minimum for pki-ca to 10.0.0-1
  - Set minimum for 389-ds-base to 1.3.0
  - Set minimum for selinux-policy to 3.11.1-60
  - Remove unneeded dogtag package requires


author: Rob Crittenden <rcritten@redhat.com> - 3.0.0-1
changelog:
  - Updated to upstream 3.0.0 GA
  - Set minimum for samba to 4.0.0-153.
  - Make sure server-trust-ad subpackage alternates winbind_krb5_locator.so
    plugin to /dev/null since they cannot be used when trusts are configured
  - Restrict krb5-server to 1.10.
  - Update BR for 389-ds-base to 1.3.0
  - Add directory /var/lib/ipa/pki-ca/publish for CRL published by pki-ca
  - Add Requires on zip for generating FF browser extension


author: Rob Crittenden <rcritten@redhat.com> - 3.0.0-0.10
changelog:
  - Updated to upstream 3.0.0 rc 2
  - Include new FF configuration extension
  - Set minimum Requires of selinux-policy to 3.11.1-33
  - Set minimum Requires dogtag to 10.0.0-0.43.b1
  - Add new optional strict sub-package to allow users to limit other
    package upgrades.


author: Rob Crittenden <rcritten@redhat.com> - 3.0.0-0.8
changelog:
  - Updated to upstream 3.0.0 rc 1
  - Update BR for 389-ds-base to 1.2.11.14
  - Update BR for krb5 to 1.10
  - Update BR for samba4-devel to 4.0.0-139 (rc1)
  - Add BR for python-polib
  - Update BR and Requires on sssd to 1.9.0
  - Update Requires on policycoreutils to 2.1.12-5
  - Update Requires on 389-ds-base to 1.2.11.14
  - Update Requires on selinux-policy to 3.11.1-21
  - Update Requires on dogtag to 10.0.0-0.33.a1
  - Update Requires on certmonger to 0.60
  - Update Requires on tomcat to 7.0.29
  - Update minimum version of bind to 9.9.1-10.P3
  - Update minimum version of bind-dyndb-ldap to 1.1.0-0.16.rc1
  - Remove Requires on authconfig from python sub-package


author: Rob Crittenden <rcritten@redhat.com> - 2.2.0-1
changelog:
  - Updated to upstream 2.2.0 GA
  - Update minimum n-v-r of certmonger to 0.53
  - Update minimum n-v-r of slapi-nis to 0.40
  - Add Requires in client to oddjob-mkhomedir and python-krbV
  - Update minimum selinux-policy to 3.10.0-110


author: Rob Crittenden <rcritten@redhat.com> - 2.1.90-0.2
changelog:
  - Update to upstream 2.2.0 beta 1 (2.1.90.rc1)
  - Set minimum n-v-r for pki-ca and pki-silent to 9.0.18.
  - Add Conflicts on mod_ssl
  - Update minimum n-v-r of 389-ds-base to 1.2.10.4
  - Update minimum n-v-r of sssd to 1.8.0
  - Update minimum n-v-r of slapi-nis to 0.38
  - Update minimum n-v-r of pki-* to 9.0.18
  - Update conflicts on bind-dyndb-ldap to < 1.1.0-0.9.b1
  - Update conflicts on bind to < 9.9.0-1
  - Drop requires on krb5-server-ldap
  - Add patch to remove escaping arguments to pkisilent


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.1.4-5
changelog:
  - Force to use 389-ds 1.2.10-0.8.a7 or above
  - Improve upgrade script to handle systemd 389-ds change
  - Fix freeipa to work with python-ldap 2.4.6


author: Martin Kosek <mkosek@redhat.com> - 2.1.4-4
changelog:
  - Fix ipa-replica-install crashes
  - Fix ipa-server-install and ipa-dns-install logging
  - Set minimum version of pki-ca to 9.0.17 to fix sslget problem
    caused by FEDORA-2011-17400 update (#771357)


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.1.4-3
changelog:
  - Allow Web-based migration to work with tightened SE Linux policy (#769440)
  - Rebuild slapi plugins against re-enterant version of libldap


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.1.4-2
changelog:
  - Allow longer dirsrv startup with systemd:
    - IPAdmin class will wait until dirsrv instance is available up to 10 seconds
    - Helps with restarts during upgrade for ipa-ldap-updater
  - Fix pylint warnings from F16 and Rawhide


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.1.3-6
changelog:
  - Introduce upgrade script to recover existing configuration after systemd migration
    as user has no means to recover FreeIPA from systemd migration
  - Upgrade script:
    - recovers symlinks in Dogtag instance install
    - recovers systemd configuration for FreeIPA's directory server instances
    - recovers freeipa.service
    - migrates directory server and KDC configs to use proper keytabs for systemd services


author: Rob Crittenden <rcritten@redhat.com> - 2.0.1-1
changelog:
  - Update minimum selinux-policy to 3.9.16-18
  - Update minimum pki-ca and pki-selinux to 9.0.7
  - Update minimum 389-ds-base to 1.2.8.0-1
  - Update to upstream 2.0.1


author: Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.4.rc2
changelog:
  - Update to upstream freeipa-2.0.0.rc2
  - Set minimum version of python-nss to 0.11 to make sure IPv6 support is in
  - Set minimum version of sssd to 1.5.1
  - Patch to include SuiteSpotGroup when setting up 389-ds instances
  - Move a lot of BuildRequires so this will build with ONLY_CLIENT enabled


author: Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.1.rc1
changelog:
  - Set minimum version of sssd to 1.5.1
  - Update to upstream freeipa-2.0.0.rc1
  - Move server-only binaries from admintools subpackage to server


author: Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.1.beta2
changelog:
  - Set min version of 389-ds-base to 1.2.8
  - Set min version of mod_nss 1.0.8-10
  - Set min version of selinux-policy to 3.9.7-27
  - Add dogtag themes to Requires
  - Update to upstream freeipa-2.0.0.pre2


author: Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.2.beta.git80e87e7
changelog:
  - Remove unnecessary moving of v1 CA serial number file in post script
  - Add Obsoletes for server-selinxu subpackage
  - Using git snapshot 442d6ad30ce1156914e6245aa7502499e50ec0da


author: Rob Crittenden <rcritten@redhat.com> - 1.99-41
changelog:
  - Re-arrange doc and defattr to clean up rpmlint warnings
  - Remove conditionals on older releases
  - Move some man pages into admintools subpackage
  - Remove some explicit Requires in client that aren't needed
  - Consistent use of buildroot vs RPM_BUILD_ROOT


author: Simo Sorce <ssorce@redhat.com> - 1.99-39
changelog:
  - Remove dependency on nss_ldap/nss-pam-ldapd
  - The official client is sssd and that's what we use by default.


author: Rob Crittenden <rcritten@redhat.com> - 1.99-29
changelog:
  - Drop requires on python-configobj (not used any more)
  - Drop ipa-ldap-updater message, upgrades are done differently now


author: Rob Crittenden <rcritten@redhat.com> - 1.99-28
changelog:
  - Drop conflicts on mod_nss
  - Require nss-pam-ldapd on F-14 or higher instead of nss_ldap (#606847)
  - Drop a slew of conditionals on older Fedora releases (< 12)
  - Add a few conditionals against RHEL 6
  - Add Requires of nss-tools on ipa-client


author: Rob Crittenden <rcritten@redhat.com> - 1.99-27
changelog:
  - Set minimum version of certmonger to 0.26 (to pck up #621670)
  - Set minimum version of pki-silent to 1.3.4 (adds -key_algorithm)
  - Set minimum version of pki-ca to 1.3.6
  - Set minimum version of sssd to 1.2.1


author: Rob Crittenden <rcritten@redhat.com> - 1.99-23
changelog:
  - Change Requires from fedora-ds-base to 389-ds-base
  - Set minimum level of 389-ds-base to 1.2.6 for the replication
    version plugin.


author: Jason Gerard DeRose <jderose@redhat.com> - 1.99-8
changelog:
  - Removed python-cherrypy from BuildRequires and Requires
  - Added Requires python-assets, python-wehjit


author: Simo Sorce <ssorce@redhat.com> - 1.2.0-3
changelog:
  - Respin after the tarball has been re-released upstream
    New hash is 506c9c92dcaf9f227cba5030e999f177


author: Rob Crittenden <rcritten@redhat.com> - 1.2.0-1
changelog:
  - Update to upstream version 1.2.0
  - Set fedora-ds-base minimum version to 1.1.3 for winsync header
  - Set the minimum version for SELinux policy
  - Remove references to Fedora 7


author: Simo Sorce <ssorce@redhat.com> - 1.1.0-3
changelog:
  - Fix for CVE-2008-3274
  - Fix segfault in ipa-kpasswd in case getifaddrs returns a NULL interface
  - Add fix for bug #453185
  - Rebuild against openldap libraries, mozldap ones do not work properly
  - TurboGears is currently broken in rawhide. Added patch to not build
    the UI locales and removed them from the ipa-server files section.


author: Rob Crittenden <rcritten@redhat.com> - 1.1.0-1
changelog:
  - Update to upstream version 1.1.0
  - Patch for indexing memberof attribute
  - Patch for indexing uidnumber and gidnumber
  - Patch to change DNA default values for replicas
  - Patch to fix uninitialized variable in ipa-getkeytab


author: Rob Crittenden <rcritten@redhat.com> - 1.0.0-5
changelog:
  - Set fedora-ds-base minimum version to 1.1.0.1-4 and mod_nss minimum
    version to 1.0.7-4 so we pick up the NSS fixes.
  - Add selinux-policy-base(post) to Requires (446496)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.0-4
changelog:
  - Add missing entry for /var/cache/ipa/kpasswd (444624)
  - Added patch to fix permissions problems with the Apache NSS database.
  - Added patch to fix problem with DNS querying where the query could be
    returned as the answer.
  - Fix spec error where patch1 was in the wrong section


author: Rob Crittenden <rcritten@redhat.com> - 1.0.0-2
changelog:
  - Fix Requires for krb5-server that was missing for Fedora versions > 9
  - Remove quotes around test for fedora version to package egg-info


author: Rob Crittenden <rcritten@redhat.com> 0.99-11
changelog:
  - Pull upstream changelog 698
  - Fix ownership of /var/log/ipa_error.log during install (435119)
  - Add pwpolicy command and man page


author: Rob Crittenden <rcritten@redhat.com> 0.99-10
changelog:
  - Pull upstream changelog 678
  - Add new subpackage, ipa-server-selinux
  - Add Requires: authconfig to ipa-python (bz #433747)
  - Package i18n files


author: Rob Crittenden <rcritten@redhat.com> 0.99-9
changelog:
  - Pull upstream changelog 641
  - Require minimum version of krb5-server on F-7 and F-8
  - Package some new files


author: Rob Crittenden <rcritten@redhat.com> 0.99-7
changelog:
  - Ensure that /etc/ipa exists before moving user-modifiable html files there
  - Put html files into /etc/ipa/html instead of /etc/ipa


author: Rob Crittenden <rcritten@redhat.com> 0.99-3
changelog:
  - Included LICENSE and README in all packages for documentation
  - Move user-modifiable content to /etc/ipa and linked back to
    /usr/share/ipa/html
  - Changed some references to /usr to the {_usr} macro and /etc
    to {_sysconfdir}
  - Added popt-devel to BuildRequires for Fedora 8 and higher and
    popt for Fedora 7
  - Package the egg-info for Fedora 9 and higher for ipa-python


author: Rob Crittenden <rcritten@redhat.com> - 0.4.1-2
changelog:
  - Broke invididual Requires and BuildRequires onto separate lines and
    reordered them
  - Added python-tgexpandingformwidget as a dependency
  - Require at least fedora-ds-base 1.1


author: Karl MacMillan <kmacmill@redhat.com> - 0.4.0-2
changelog:
  * Fri Sep 7 2007 Karl MacMillan <kmacmill@redhat.com> - 0.3.0-1
  - Added support for libipa-dna-plugin


author: Rob Crittenden <rcritten@redhat.com> - 0.1.0-2
changelog:
  - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires
  - Remove references to admin server in ipa-server-setupssl
  - Generate a client certificate for the XML-RPC server to connect to LDAP with
  - Create a keytab for Apache
  - Create an ldif with a test user
  - Provide a certmap.conf for doing SSL client authentication


author: Thomas Graf <tgraf at, redhat.com> 0.4-5
changelog:
  - Fix CVE-2010-2522 and CVE-2010-2523 by including the patches:
    - Additional sanity checks for ND options length
    - Security fix: Check origin of netlink messages in netlink helpers.


author: Thomas Graf <tgraf at, redhat.com> 0.4-4
changelog:
  - Fixed initscript according to SysVInitScript guidelines:
      - Corrected usage text
      - Added force-reload, condrestart and try-restart actions
      - Fixed return code of status action
      - Only start/stop daemon if not already running/stopped


author: Josef Ridky <jridky@redhat.com> - 1.5.7-1
changelog:
  - Rebase to the latest upstream release 1.5.7 (#1435848)
  - Fix manpage command examples (#1353981) in separate commit


author: Ales Ledvinka <aledvink@redhat.com> - 1.2.9-1
changelog:
  - Updated to upstream freeipmi-1.2.9
   - Fix threshold output corner case in ipmi-sensors.
   - Fix invalid declaration in libipmimonitoring header.
   - Fix older compiler build problems.
   -
   - Fix portability build bug on ARM systems.
   - Add 'internal IPMI error' troubleshooting to manpages.
   - Fix bmc-info corner case on Bull 510 systems.


author: Ales Ledvinka <aledvink@redhat.com> - 1.2.6-2
changelog:
  - spec update by Christopher Meng <rpm@cicku.me>
   - hardened build flags should include PIE also for bmc-watchdog.


author: Ales Ledvinka <aledvink@redhat.com> - 1.2.6-1
changelog:
  - Updated to freeipmi-1.2.6
   - Support HP Proliant DL160 G8 OEM sensors.
   - Support Supermicro X9SCM-iiF OEM sensors and events.
   - Support output of temperature sampling period to ipmi-dcmi.
   - Clarify error message when SOL session cannot be stolen in
     ipmiconsole/libipmiconsole.
   - Fix dcmi rolling average time period output error
   - Fix ipmi-dcmi output errors with --get-dcmi-sensor-info.
   - Fix corner case in calculation of confidentiality pad length with
     AES-CBC-128 encryption.  Incorrect pad effects some vendor firmware
     implementations.
   - Send IPMI 2.0 packets differently than IPMI 1.5 packets, as the
     former does not require legacy pad data to be appended to payloads.
   - Fix Intel OEM SEL buffer overflow.
   - Fix out of trunk source build.
   - Support new ipmi_rmcpplus_sendto() and ipmi_rmcpplus_recvfrom()
     functions.
   - Support new HP Proliant DL160 G8 OEM sensor events.


author: Ales Ledvinka <aledvink@redhat.com> - 1.2.5-1
changelog:
  - Updated to freeipmi-1.2.5:
   - Support Supermicro X9SPU-F-O OEM sensors and events.
   - Support Supermicro X9DRI-LN4F+ OEM intepretations (previously
     forgotten).


author: Ales Ledvinka <aledvink@redhat.com> - 1.2.4-1
changelog:
  - Updated to freeipmi-1.2.4:
   - Support Supermicro X9DRI-LN4F+ OEM sensors and events.
   - Fix output corner case for "session-based" channels.
   - Fix ipmi-oem set-power-restore-delay corner case in time settings.
   - Fix ipmiseld memleak.
   - Fix libfreeipmi potential fd leak when generating random numbers.
   - Fix libfreeipmi error output bug in RMCP interface.
   - Fix several minor corner cases discovered by static code analysis.


author: Ales Ledvinka <aledvink@redhat.com> - 1.2.3-1
changelog:
  - Updated to freeipmi-1.2.3:
   - In ipmi-oem, support new Dell Poweredge R720 OEM commands extensions,
     including:
    - get-nic-selection-failover
    - set-nic-selection-failover
    - power-monitoring-over-interval
    - power-monitoring-interval-range
    - get-last-post-code
   - In ipmi-oem, update active-lom-status for Dell Poweredge R720.
   - In ipmi-oem, support new Dell Poweredge R720 get-system-info option
     'cmc-info'.
   - In ipmi-oem, Dell get-system-info "slot-number" key changed to
     "blade-slot-info".  Legacy option still supported.
   - In ipmi-sel, support Dell Poweredge R720 OEM SEL extensions.
   - In all tools, support nochecksumcheck workaround option.
   - In all daemons (ipmiseld, ipmidetectd, bmc-watchdog), check for
     syscall errors during daemon setup.

   - In libfreeipmi, support Dell R720 OEM extension intepretations.
   - In libfreeipmi, libipmimonitoring, and libipmiconsole, support
     NO_CHECKSUM_CHECK workaround flag.
   - In libipmiconsole, IPMICONSOLE_DEBUG_FILE logs debug to files in
     current working directory and not /var/log.  PID is also appended to
     debug files.


author: Ales Ledvinka <aledvink@redhat.com> - 1.2.2-1
changelog:
  - Updated to freeipmi-1.2.2:
   - Support new --sol-payload-instance and --deactivate-all-instances
     options in ipmiconsole.
   - Fix ipmiseld compile issue with -Werror=format-security.


author: Jan Safranek <jsafrane@redhat.com> - 1.2.1-1
changelog:
  - Reworked RPM scriptlets to use systemd-rpm macros (#850117).
  - Updated to freeipmi-1.2.1:
   - Support new ipmiseld daemon, a daemon that regularly polls the SEL
     and stores the events to the local syslog.
   - In ipmipower, support --oem-power-type option to support OEM
     specific power control operations.  Included in this support were
     the follow changes to ipmipower:
     - Support initial OEM power type of C410X.
     - Re-architect to allow input of extra information for an OEM power
       operation via the '+' operator after the hostname.
     - Re-architect to allow input of target hostname multiple times
       under OEM power cases.
     - Re-architect to allow serialization of power control operations to
       the same host.
   - Globally in tools, support --target-channel-number and
     --target-slave-address to specify specific targets.
   - Globally in tools, support ability to specify alternate port via
     optional [:port] in hostname or host config.
   - In ipmi-fru, support --bridge-fru option to allow reading FRU entries
     from satellite controllers.
   - In bmc-config, add configuration support for
     Maximum_Privilege_Cipher_Suite_Id_15 under RMCPplus_Conf_Privilege.
   - Globally support Cipher Suite ID 15 and 16 based on comments from
     Intel.
   - In ipmi-sensors, support --output-sensor-thresholds, to allow
     outputting of sensor thresholds in default output for scripting.
   - In ipmi-sel, support new --post-clear option.
   - In bmc-device, support new --set-sensor-reading-and-event-status
     option.
   - In ipmi-oem, support additional Intel Node Manager commands,
     including:
     - get-node-manager-capabilities
     - node-manager-policy-control 
     - get-node-manager-policy
     - set-node-manager-policy
     - remove-node-manager-policy
     - get-node-manager-alert-thresholds
     - set-node-manager-alert-thresholds
     - get-node-manager-policy-suspend-periods
     - set-node-manager-policy-suspend-periods
     - set-node-manager-power-draw-range
   - In ipmi-oem, support Wistron OEM commands extensions.
   - In ipmi-sel, support Wistron OEM SEL interpretations.
   - In ipmi-fru, support Wistron OEM FRU records.
   - In ipmi-pef-config, support configuration volatile Alert String 0
     and Lan Alert Destination 0.


author: Jan Safranek <jsafrane@redhat.com> - 1.1.7-1
changelog:
  - Updated to freeipmi-1.1.7:
    - In ipmi-sensors and ipmi-sel, fix units output corner case.
    - In bmc-info, detect unsupported system info corner case.
    - Update documentation with motherboard support.


author: Jan Safranek <jsafrane@redhat.com> - 1.1.6-1
changelog:
  - Updated to freeipmi-1.1.6:
    - In ipmi-sel, support Supermicro SEL OEM interpretations in
      --output-event-state.
    - In ipmi-sel and ipmi-sensors, support additional sensor/SEL
      interpretations including:
      - System Firmware Progress Transition Severity
      - Button/Switch Transition Severity
      - Chassis Transition Severity
      - POST Memory Resize State
      - Cable/Interconnect Transition Severity
      - Boot Error Transition Severity
      - Slot Connector Transition Severity
      - Memory State
      - Memory Transition Severity
    - In bmc-config, ipmi-chassis-config, ipmi-pef-config, and
      ipmi-chassis-config, support cipher suite ID argument.
    - Support Supermicro X9DRi-F OEM sensors and events.
    - Fix Intel S2600JF/Appro 512x OEM SEL interpretations based on
      comments from Intel.
    - Support Supermicro SEL OEM interpretations.
    - Support new sensor/SEL interpretations.
    - Various documentation updates and fixes.


author: Jan Safranek <jsafrane@redhat.com> - 1.1.5-1
changelog:
  - Updated to freeipmi-1.1.5:
    - Support Supermicro OEM sensors/SEL on H8DGU-F motherboards.
    - In ipmiconsole, fix password length check bug.
    - In bmc-watchdog, fix --start-if-stopped and --reset-if-running
      options.
    - In ipmidetectd, fix usage output typos.
    - In ipmi-sensors-config, fix several parallel output corner cases.
    - For consistency to other tools, turn on quiet-caching if
      communicating with multiple hosts in bmc-device and ipmi-oem.
    - In ipmi-sensors, fix bug in which multiple workarounds could not be
      used or used in combination with bridging.
    - Fix start run levels in ipmidetectd init script. 
    - In libfreeipmi fru-parse API, handle additional device busy errors.
    - Various documentation updates.


author: Jan Safranek <jsafrane@redhat.com> - 1.1.4-1
changelog:
  - Updated to freeipmi-1.1.4:
    - In ipmi-oem, fix error message output in several Supermicro OEM
      commands.
    - In ipmi-oem, add Intel --get-power-restore-delay and
      --set-power-restore-delay support.
    - In ipmi-sel, support Intel S2600JF/Appro 512x OEM SEL
      interpretations.
    - In libfreeipmi, support new sensor and SEL event interpretations,
      including Session Audit, Voltage Limits.
    - In libfreeipmi, support new OEM interpretations for Intel S5000PAL
      NMI State and SMI timeout sensors/SEL events.
    - In libfreeipmi, support Intel S2600JF/Appro 512x OEM SEL
      interpretations.
    - Various documentation updates.


author: Jan Safranek <jsafrane@redhat.com> - 1.1.3-1
changelog:
  - Updated to freeipmi-1.1.3:
    - Support Supermicro CPU temperature SEL events.
    - In ipmi-oem, fix corner case with Dell C410x power control
      calculation.
    - In all tools, fix error messages to differentiate between invalid
      and unsupported cipher suite IDs.
    - In bmc-config, fix a Cipher Suite Privilege configuration
      corner case in the workaround for an HP DL145 workaround.
    - In bmc-config, add workaround for Cipher Suite Privilege
      configuration on Intel S2600JF/Appro 512X.
    - Various documentation updates.
    - In libfreeipmi, fix incorrect packet layout for the Get Lan
      Configuration Parameters RMCPplus Messaging Cipher Suite Entry Support
      response.
    - In libipmimonitoring, properly return connection timeout error on
      connection timeout.
    - Fix build when using --docdir. 
    - Various documentation updates.


author: Jan Safranek <jsafrane@redhat.com> - 1.1.2-1
changelog:
  - Updated to freeipmi-1.1.2:
    - In ipmi-oem, support new Dell C410x OEM extensions
      slot-power-toggle, slot-power-control, get-port-map, set-port-map.
    - Fix daemon setup race condition in ipmidetectd and bmc-watchdog that
      can affect systemd.
    - In ipmiconsole, support new --serial-keepalive-empty option.
    - In bmc-device, support new --rearm-sensor option.
    - In ipmi-oem, add additional Dell get-system-info options
    - slot-number
    - system-revision
    - embedded-video-status
    - idrac-info
    - idrac-ipv4-url
    - idrac-gui-webserver-control
    - cmc-ipv4-url,
    - cmc-ipv6-info
    - cmc-ipv6-url
    - In ipmi-oem, support Dell 12G mac addresses under get-system-info.   
    - In ipmi-sensors, some sensors that reported "Unknown" may now report
      "N/A" due to an interpretation change of several IPMI error codes.
    - In ipmi-sensors, workaround sensor reading issue on Sun Blade x6250
      and Sun Blade 6000M2.
    - Fix several freeipmi.conf config file parsing bugs.
    - In libipmiconsole, fix serial keepalive timeout calculation bug that
      can lead to excessive packets retransmitted.
    - In libipmiconsole, support new SERIAL_KEEPALIVE_EMPTY engine flag.
    - In libipmiconsole, do not deactivate a SOL payload if it appears the
      SOL payload has been stolen, but we did not receive a SOL deactivating
      flag.
    - In libipmiconsole, fix corner case in which session not closed
      cleanly when DEACTIVATE_ONLY flag specified.
    - In libipmiconsole, workaround bug in Dell Poweredge M605, M610, and
      M915 where instance count of SOL is always returned as 0.
    - In libfreeipmi, add functions for re-arm sensor events IPMI payload. 
    - In libfreeipmi/sensor-read, under some error conditions return error
      of "unavailable" instead of "cannot be obtained" error code.
    - In libfreeipmi/sensor-read, add workarounds to handle issues on Sun
      Blade x6250 and Sun Blade 6000M2.
    - Various documentation updates.
    - Redo formattig of include/freeipmi/templates/ documents.


author: Jan Safranek <jsafrane@redhat.com> - 1.1.1-1
changelog:
  - Updated to freeipmi-1.1.1:
    - Support new tool ipmi-pet, tool to parse/interpret platform event
      traps.
    - Support new --sdr-cache-file option specify specific SDR cache file
      in all SDR related tools (ipmi-sensors, ipmi-sel, ipmi-fru, etc.).
    - In ipmi-fru, do not consider a busy device a fatal error. 
    - In ipmi-sensors, support 'ignoreauthcode' workaround option.
    - In ipmi-sensors, support Quanta QSSC-S4R/Appro GB812X-CN OEM SDRs
      and sensors.
    - In ipmi-sel, support Quanta QSSC-S4R/Appro GB812X-CN OEM SEL events.
    - In ipmi-sel, fix several OEM specific event output bugs.
    - In ipmi-pef-config, fix configuration bug for
      Enable_PEF_Event_Messages.
    - In ipmi-raw, for file/stdin input, output line number when there is
      an error.
    - Update libfreeipmi for DCMI 1.5 additions.
    - Update libfreeipmi fru-parse sub-library to support FRU parsing
      without an IPMI connection.
    - In libfreeipmi, support IPMI_FLAGS_NOSESSION flag to open a context
      for IPMI communication w/o establishing a session.
    - In libfreeipmi, support IPMI_FLAGS_NO_LEGAL_CHECK flag, to
      workaround motherboards to may return illegal IPMI packets.
    - In libfreeipmi, support IPMI_FLAGS_IGNORE_AUTHENTICATION_CODE flag,
      to workaround specific situations where motherboards return
      incorrectly generated authentication codes.
    - In libfreeipmi fru-parse sub-library, support
      IPMI_FRU_PARSE_ERR_DEVICE_BUSY error code.
    - In libfreeipmi, add support for IPMI firmware firewall and command
      discovery payloads.
    - In libfreeipmi, support Quanta QSSC-S4R/Appro GB812X-CN OEM SEL
      events.
    - Fix various macro names (typos, invalid naming, etc.)


author: Jan Safranek <jsafrane@redhat.com> - 1.0.10-1
changelog:
  - Updated to freeipmi-1.0.10:
    - Clarify bmc-watchdog error messages.
    - Various documentation updates.


author: Jan Safranek <jsafrane@redhat.com> - 1.0.9-1
changelog:
  - Updated to freeipmi-1.0.9:
    - Support Supermicro OEM sensors on X9SCA-F-O motherboards.
    - Support Supermicro OEM sensors on X9SCM-F motherboards with
      newer firmware.


author: Jan Safranek <jsafrane@redhat.com> - 1.0.8-1
changelog:
  - enable build on all archs, the iopl issue #368541 is fixed
  - Updated to freeipmi-1.0.8:
    - Fix corner case in which invalid SDR entry could be loaded when
      shared sensors exist on event only records.
    - Fix several event output corner cases.
    - Fix 'assumesystemevent' workaround for ipmi-sel.
    - Fix ipmi-raw and ipmi-oem allocation bug on newer systems, such as
      RHEL6.
    - Support Intel Node Manager sensor/SEL events for Intel S2600JF/Appro
        512X.
    - Document workarounds for Intel S2600JF/Appro 512X.
    - Per definition, output GUID w/ lower case characters in bmc-info.
    - Other minor bug fixes.


author: Jan Safranek <jsafrane@redhat.com> - 1.0.7-1
changelog:
  - Updated to freeipmi-1.0.7:
    - Support many new sensor state and sel event interpretations.
    - Fix parsing bugs for freeipmi_interpret_sel.conf.
    - Support 'assumebmcowner' workaround in ipmi-sensors.
    - Support dynamic linking in libfreeipmi.
    - Output pidfile in bmc-watchdog to support easier init script killing.
    - Do not poll stdin in ipmipower when operating in non-interactive mode.
    - Support IGNORE_SCANNING_DISABLED workaround in libipmimonitoring.
    - Support Supermicro OEM sensors on X7DB8, X8DTN, X7SBI-LN4, X8DTL,
      X8DTN+-F, and X8SIE motherboards.
    - Fix handling error codes in optional parts of ipmi-dcmi.
    - Fix various debug dumping bugs.
    - Fix ipmimonitoring script install bug on some systems.
    - Fix symbol global vs. locals in libipmimonitoring.
    - Minor documentation and manpage updates.


author: Jan Safranek <jsafrane@redhat.com> - 1.0.6-1
changelog:
  - Updated to freeipmi-1.0.6:
    - Support 'ignorescanningdisabled' workaround in ipmi-sensors.
    - Support Supermicro X8SIL-F, X9SCL, and X9SCM motherboard OEM sensors.
    - Update bmc-watchdog logrotate script to reduce unnecessary output.
    - Fix ipmi-fru output typo.


author: Jan Safranek <jsafrane@redhat.com> - 1.0.5-1
changelog:
  - Updated to freeipmi-1.0.5:
    - Fix various issues in ipmi-dcmi, including command line parsing
      bugs, asset tag/string identifier overwriting, and fix assumptions
      based on new information in v1.5 errata.
    - Support pkg-config files for libraries.
    - Various documentation updates.


author: Jan Safranek <jsafrane@redhat.com> - 1.0.4-1
changelog:
  - Updated to freeipmi-1.0.4:
    - Support "discretereading" workaround in ipmi-sensors and associated
      libraries.
    - Support "spinpoll" workaround/performance optimization in tools and
      libraries.
    - Support additional sensor/SEL interpretations for Intel motherboards.
    - Add convenience input checking functions to libipmiconsole.
    - Fix bug in libipmimonitoring to allow additional OEM interpretations.


author: Jan Safranek <jsafrane@redhat.com> - 1.0.3-1
changelog:
  - Updated to freeipmi-1.0.3, see announce at
    http://lists.gnu.org/archive/html/freeipmi-users/2011-03/msg00017.html


author: Jan Safranek <jsafrane@redhat.com> - 1.0.2-1
changelog:
  - Updated to freeipmi-1.0.2, see announce at
    http://lists.gnu.org/archive/html/freeipmi-users/2011-02/msg00027.html


author: Jan Safranek <jsafrane@redhat.com> - 1.0.1:1
changelog:
  - Updated to freeipmi-1.0.1, see announce at
    http://lists.gnu.org/archive/html/freeipmi-users/2011-01/msg00006.html
  - Configuration files moved from /etc/ to /etc/freeipmi/. Support legacy config
    files for backwards compatibility.
  - More detailed release information can be found in the NEWS file.


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 1:2.0.1-1
changelog:
  - Update to 2.0.1
  - Versionless jars & javadocs
  - Use maven 3 to build
  - Use apache-commons-parent for BR


author: Caolán McNamara <caolanm@redhat.com> - 1.3.10-1
changelog:
  - Resolves: rhbz#1472290
    CVE-2017-7771 CVE-2017-7772 CVE-2017-7773 CVE-2017-7774
    CVE-2017-7775 CVE-2017-7776 CVE-2017-7777 CVE-2017-7778


author: Till Maas <opensource@till.name> - 1.2.4-4
changelog:
  - Rebuilt for Fedora 23 Change
    https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code


author: Parag Nemade <paragn AT fedoraproject DOT org> - 1.2.0-4
changelog:
  - Drop refman.pdf as its same as manual.html
  - patch install path for cmake files as they are arch dependent


author: Parag Nemade <paragn AT fedoraproject DOT org> - 1.2.0-2
changelog:
  - revert the wrongly committed f18 spec to f19
  - spec file cleanup
  - thanks to jnovy for finding me minimum texlive BR
  - partial multilib fix for manual.html


author: Nicholas van Oudtshoorn <vanoudt@gmail.com> - 1.0.2-2
changelog:
  - Removed dependency on silgraphite-devel
  - Stopped building comparerenderer - the only thing that depended on silgraphite


author: Peter Schiffer <pschiffe@redhat.com> - 2.6.3-6
changelog:
  - resolves: #948695
    fixed double free
  - fixed certain man pages to match options with --help and --usage


author: Peter Schiffer <pschiffe@redhat.com> - 2.6.3-1
changelog:
  - resolves: #858577
    updated to 2.6.3
  - cleaned .spec file
  - resolves: #855632
    fixed SIGABRT crash
  - adds support for man-pages-overrides


author: Peter Schiffer <pschiffe@redhat.com> - 2.6.2-1
changelog:
  - resolves: #833312
    update to 2.6.2
  - resolves: #657409
    fixed warning when invoking col by the mandb program in cron
  - resolves: #829935
    enabled support for man pages compressed with lzip
  - resolves: #821778
    added virtual provides for bundled gnulib library
  - resolves: #824825
    apropos returns correct exit code for invalid man page


author: Peter Schiffer <pschiffe@redhat.com> - 2.6.1-2
changelog:
  - resolves: #677669
    added support for wildcards in path
  - resolves: #693458
    fixed error with .so links


author: Peter Schiffer <pschiffe@redhat.com> - 2.6.1-1
changelog:
  - resolves: #790771
    update to 2.6.1
  - resolves: #806086
    removed hard-dependency on cron, update man db after install or update


author: Peter Schiffer <pschiffe@redhat.com> - 2.6.0.2-3
changelog:
  - resolves: #702904
    fixed double free or corruption issue
  - resolves: #739207
    require groff-base instead of groff
  - rebuilt for gdbm-1.9.1-1


author: Karsten Hopp <karsten@redhat.de> 1.10-24
changelog:
  - added development manpages
  - as there are no manpages for the executables available, added at least
    a FAQ (#172324)


author: Mike A. Harris <mharris@redhat.com> 1.10-13
changelog:
  - Removed %name macro sillyness from package Summary, description text, etc.
  - Removed archaic Prefix: tag
  - lib64 fixes everywhere to use _lib, _libdir, etc
  - Removed deletion of RPM_BUILD_DIR from %clean section
  - Added -q flag to setup macro
  - Severely cleaned up spec file, and removed usage of perl


author: Jakub Jelinek <jakub@redhat.com> 1.10-12
changelog:
  - CFLAGS was using COPTFLAG variable, not COPTFLAGS
  - build with -fpic
  - apply the IA-64 patch everywhere, use capget/capset from glibc,
    not directly as _syscall (as it is broken on IA-32 with -fpic)
  - reenable alpha


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.10-6
changelog:
  - Fix sys/capabilities.h header (#55727)
  - Move to /lib, some applications seem to be using this rather early
    (#55733)


author: Karel Klic <kklic@redhat.com> - 3.0-1
changelog:
  - New upstream version
  - Removed zip23.patch, because ZMEM is not used anyway
  - Removed zip-2.31-install.patch, problem solved in upstream
  - Removed zip23-umask.patch, upstream uses mkstemp which solves the problem
  - Removed zip-2.31-near-4GB.patch, because upstream version
    handles large files well
  - Removed zip-2.31-configure.patch, configure is better in the current version
  - Removed zip-2.3-sf.patch, the error message doesn't exist in upstream anymore
  - Removed zip-2.31-umask_mode.patch, which fixes also removed near-4GB patch
  - Updated zip-2.31-time.patch for zip 3.0
  - Updated exec-shield.patch for zip 3.0
  - Updated zip-2.3-currdir.patch for zip 3.0


author: Ivana Varekova <varekova@redhat.com> - 2.31-4
changelog:
  - fix "zip does not honor umask setting when creating archives"
  - fix "zip segfaults by attempt to archive big file"
  - spec file cleanup


author: Lon Hohberger <lhh@redhat.com> 2.3-24
changelog:
  - Extend max file/archive size to 2^32-8193 (4294959103) bytes
  - Include better debugging output for configure script


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.15-1
changelog:
  - Resolves: rhbz#1470049 - Rebase libtdb to enable samba rebase to
                             version 4.7.x


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.12-2
changelog:
  - Resolves: rhbz#1441231 - The tdb robust mutexes runtime check is not thread safe and ends in a deadlock


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.6-2
changelog:
  - Resolves: rhbz#1241015 - tdb deadlocks if you acquire allrecord_lock
                             and start two traverses


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.10-15
changelog:
  - New upstream release 1.2.10
  - Remove upstreamed patches
  - Provides functionality for the upcoming Samba 4 beta


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.9-1
changelog:
  - New upstream bugfix release
  - Adds a new tdbrestore utility
  - Convert to new WAF build-system
  - Add python bindings in new python-tdb subpackage


author: Ondřej Lysoněk <olysonek@redhat.com> - 0.99.22.4-5
changelog:
  - Fixed CVE-2018-5379 - Double free vulnerability in bgpd when processing
    certain forms of UPDATE message allowing to crash or potentially execute
    arbitrary code
  - Resolves: rhbz#1546015


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.4-4
changelog:
  - fix link to upstream tarball (#1059219)
  - reference pidfiles of quagga daemons in service files (#842309)


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.3-1
changelog:
  - update to 0.99.22.3
  - disable ospfapi and ospfclient
  - fix bogus dates in changelog
  - resolves : #984532


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.1-7
changelog:
  - quagga is service which might implement networking, thus it should not have
    WantedBy=network.target in its systemd configuration
  - resolves: #976883


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.1-6
changelog:
  - obsolete quagga-sysvinit subpackage
  - use macro to specify location where to install tmpfiles configuration file
  - fix rpm scripts handling documentation in info format


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.1-1
changelog:
  - update to 0.99.22.1
  - install tmpfiles dropping configuration to proper location
  - drop sysv subpackage and initscripts support


author: Adam Tkac <atkac redhat com> - 0.99.22-1
changelog:
  - update to 0.99.22
  - quagga-CVE-2012-1820.patch has been merged
  - explicitly enable SMNP AgentX interface


author: Jiri Skala <jskala@redhat.com> - 0.99.19-1
changelog:
  - fixes #741343 - CVE-2011-3323 CVE-2011-3324 CVE-2011-3325 CVE-2011-3326 CVE-2011-3327
  - fixes #741580 - updated to latest upstream version 0.99.19


author: Jiri Skala <jskala@redhat.com> - 0.99.18-1
changelog:
  - fixes #689852 - CVE-2010-1674 CVE-2010-1675 quagga various flaws
  - fixes #690087 - ripd fails to start
  - fixes #689763 - updated to latest upstream version 0.99.18


author: Jiri Skala <jskala@redhat.com> - 0.99.17-3
changelog:
  - fixes #656681 - using %ghost on files in /var/run and /var/lock
  - removed unused script from spec
  - corrected installing /etc/pam.d


author: Jiri Skala <jskala@redhat.com> - 0.99.16-4
changelog:
  - added license text to subpackages
  - fixes #609931 - quagga : does not adhere to Static Library Packaging Guidelines


author: Jiri Skala <jskala@redhat.com> - 0.99.12-3
changelog:
  - fixed #516005 - Errors installing quagga-0.99.11-2.fc11.i586 with --excludedocs
  - fixed #522787 - quagga: build future versions without PAM


author: Jiri Skala <jskala@redhat.com> - 0.99.12-1
changelog:
  - update to latest upstream version
  - fix #499960 - BGPd in Quagga prior to 0.99.12 has a serious assert problem crashing with ASN4's


author: Jiri Skala <jskala@redhat.com> - 0.99.11-3
changelog:
  - fix #498832 - bgpd crashes on as paths containing more 6 digit as numbers
  - corrected release number


author: Martin Nagy <mnagy@redhat.com> - 0.99.9-6
changelog:
  - fix vtysh.conf owner and group (#416121)
  - fix bpgd IPv6 advertisements, patch from upstream (#429448)


author: Martin Bacovsky <mbacovsk@redhat.com> - 0.99.9-2
changelog:
  - resolves: #376821: ospfd init script looks for ospf6 configuration and lock file
  - resolves: #376841: Usage string in ospf6d init script incorrect


author: Martin Bacovsky <mbacovsk@redhat.com> - 0.99.8-1
changelog:
  - upgrade to new upstream version 0.99.8
  - resolves: #249423: scripts in /etc/rc.d/init.d/* are marked as config files in specfile
  - resolves: #247040: Initscript Review
  - resolves: #249538: Inconsistencies in init scripts
  - resolves: #220531: quagga: non-failsafe install-info usage, info files removed from index on update


author: Martin Bacovsky <mbacovsk@redhat.com> - 0.99.6-1
changelog:
  - upgrade to new upstream 0.99.6
  - Resolves: #233909: quagga: unowned directory
  - removed redundant patches (#226352)


author: Jay Fenlason <fenlason@redhat.com> 0:0.98.6-2
changelog:
  - Upgrade to new upstream version, closing security problems:
    bz#191081 CVE-2006-2223 Quagga RIPd information disclosure
    bz#191085 CVE-2006-2224 Quagga RIPd route injection


author: Jay Fenlason <fenlason@redhat.com> 0.98.5-3
changelog:
  - add the -pie patch, to make -fPIE compiling actually work on all platforms.
  - Include -pam patch to close
    bz#170256 ? pam_stack is deprecated
  - Change ucd-snmp to net-snmp to close
    bz#164333 ? quagga 0.98.4-2 requires now obsolete package ucd-snmp-devel
  - also fix duplicate line mentioned in bz#164333


author: Jay Fenlason <fenlason@redhat.com> 0.98.2-2
changelog:
  - New upstream version, inclues my -gcc4 patch, and a patch from
    Vladimir Ivanov <wawa@yandex-team.ru>


author: Jay Fenlason <fenlason@redhat.com> 0.98.0-2
changelog:
  - New upstream version.  This fixes bz#143796
  - --with-rtadv needs to be --enable-rtadv according to configure.
    (but it was enabled by default, so this is a cosmetic change only)
    Change /etc/logrotate.d/* to /etc/logrotate.d/quagga in this spec file.
  - Modify this spec file to move the .so files to the base package
    and close bz#140894
  - Modify this spec file to separate out macro <_includedir>/quagga/ospfd
    from .../*.h and macro <_includedir>/quagga/ospfapi from .../*.h
    Rpmbuild probably shouldn't allow macro <dir> of a plain file.


author: Tim Waugh <twaugh@redhat.com> 0.97.3-3
changelog:
  - Rebuilt for new readline.
  - Don't explicitly require readline.  The correct dependency is automatically
    picked up by linking against it.


author: Jay Fenlason <fenlason@redhat.com> 0.96.5-0
changelog:
  - New upstream version
  - Change includedir
  - Change the pre scriptlet to fail if the useradd command fails.
  - Remove obsolete patches from this .spec file and renumber the two
    remaining ones.


author: Jay Fenlason <fenlason@redhat.com> 0.96.3-1
changelog:
  - Patch a remote DoS attack (#107140)
  - New upstream version
  - Removed the .libcap patch, which was applied upstream
  - Renamed the vty group from quaggavty to quaggavt because quaggavty is
    too long for NIS.
  - Patch the spec file to fix #106857: /etc/quagga/zebra.conf is created with
    the wrong owner.
  - Removed the "med" part of the 0.96.1-warnings patch for . . .
  - Add a new warnings patch with a fix for #106315.  This also updates
    the "med" part of the previous warnings patch.


author: Jay Fenlason <fenlason@redhat.com> 0.96.2-5
changelog:
  - merge sysconfig patch from 3E branch.  This patch is from Kaj J. Niemi
    (kajtzu@basen.net), and puts Quagga configuration options in
    /etc/sysconfig/quagga, and defaults Quagga to listening on 127.0.0.1 only.
    This closes #104376
  - Use /sbin/nologin for the shell of the quagga user.  This closes #103320
  - Update the quagga-0.96.1-warnings.patch patch to kill a couple more
    warnings.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Remove the directory part of paths for PAM modules in quagga.pam, allowing
    libpam to search its default directory (needed if a 64-bit libpam needs to
    look in /lib64/security instead of /lib/security).


author: Jay Fenlason <fenlason@redhat.com> 0.96.1-3
changelog:
  - Merge from quagga-3E-branch, with a fix for #102673 and a couple
    more compiler warnings quashed.


author: Jay Fenlason <fenlason@redhat.com> 0.96-1
changelog:
  - added a patch (libwrap) to allow the generated Makefiles for zebra/
    and lib/ to work on AMD64 systems.  For some reason make there does
    not like a dependency on -lcap
  - added a patch (warnings) to shut up warnings about an undefined
    structure type in some function prototypes and quiet down all the
    warnings about assert(ptr) on x86_64.
  - Modified the upstream quagga-0.96/readhat/quagga.spec to work as an
    official Red Hat package (remove user and group creation and changes
    to services)
  - Trimmed changelog.  See the upstream .spec file for previous
    changelog entries.


author: Richard Hughes <rhughes@redhat.com> - 3.22.7-3
changelog:
  - Never show 'Startup Applications' in the search results
  - Note: the other issue shown in the bug is likely a dupe of #1445651
  - Resolves: #1481145


author: Kalev Lember <klember@redhat.com> - 3.14.7-1
changelog:
  - Update to 3.14.7
  - Show installation progress when installing apps
  - Fix incomplete Japanese translations
  - Show a new notification when security updates remain unapplied
  - Resolves: #1237181, #1055643, #1136954


author: Mike FABIAN <mfabian@redhat.com> - 20180508-1
changelog:
  - Update to upstream snapshot tarball (color emoji font version 2.011)
  - Add patch to build all country flags (Resolves: rhbz#1574195)


author: Peter Oliver <rpm@mavit.org.uk> - 20170928-2
changelog:
  - Prefer zopflipng to optipng, since it should yield smaller files.
  - Use the font we built, rather than the one included with the source.


author: Mike FABIAN <mfabian@redhat.com> - 20170828-1
changelog:
  - Update to upstream snapshot tarball
  - split black-and-white and color fonts into different sub-packages.


author: Mike FABIAN <mfabian@redhat.com> - 20170827-1
changelog:
  - Update to upstream snapshot tarball
  - Update color emoji font to version 2.001, new design.
  - Contains the new emoji added in Unicode 10.0.0.


author: Mike FABIAN <mfabian@redhat.com> - 20170523-1
changelog:
  - Update to upstream snapshot tarball
  - This fixes the skin tones of the light/medium light male cook emoji,
    which had been swapped.


author: Mike FABIAN <mfabian@redhat.com> - 20170426-1
changelog:
  - Update to upstream snapshot tarball
    (fixes the family emoji sequences:
    kiss: woman, man U+1F469 U+200D U+2764 U+FE0F U+200D U+1F48B U+200D U+1F468
    couple with heart: woman, man U+1F469 U+200D U+2764 U+FE0F U+200D U+1F468)


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-8
changelog:
  - SRPM renamed from python-setuptools to python3-setuptools
  - Package prepared to contain only Python 3 version
  Resolves: rhbz#1660563


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-7
changelog:
  - Converting specfile from F28 to RHEL7
  - Tests disabled because the minimal RHEL7 Python 3 stack does not contain test
    dependencies
  - Disabled building of the Python 2 subpackage
  Resolves: rhbz#1660563


author: Miro Hrončok <mhroncok@redhat.com> - 37.0.0-1
changelog:
  - Update to 37.0.0 (fixes #1474126)
  - Removed not needed pip3 patch (upstream included different version of fix)


author: Tomas Orsava <torsava@redhat.com> - 36.2.0-7
changelog:
  - Re-enable tests to finish bootstrapping the platform-python stack
    (https://fedoraproject.org/wiki/Changes/Platform_Python_Stack)


author: Tomas Orsava <torsava@redhat.com> - 36.2.0-6
changelog:
  - Add the platform-python subpackage
  - Disable tests so platform-python stack can be bootstrapped
    (https://fedoraproject.org/wiki/Changes/Platform_Python_Stack)


author: Tomas Orsava <torsava@redhat.com> - 36.2.0-5
changelog:
  - Add Patch 0 that fixes a test suite failure on Python 3 in absence of
    the Python 2 version of pip
  - Move docs to their proper place


author: Tomas Orsava <torsava@redhat.com> - 36.2.0-4
changelog:
  - Switch macros to bcond's and make Python 2 optional to facilitate building
    the Python 2 and Python 3 modules.


author: Michal Cyprian <mcyprian@redhat.com> - 36.2.0-3
changelog:
  - Revert "Add --executable option to easy_install command"
    This enhancement is currently not needed and it can possibly
    collide with `pip --editable`option


author: Kevin Fenzi <kevin@scrye.com> - 34.1.1-1
changelog:
  - Update to 34.1.1. Fixes bug #1412268
  - Fix License tag. Fixes bug #1412268
  - Add Requires for fomerly bundled projects: six, packaging appdirs


author: Kevin Fenzi <kevin@scrye.com> 17.1.1-3
changelog:
  - Drop no longer needed Requires/BuildRequires on python-backports-ssl_match_hostname
  - Fixes bug #1231325


author: Ralph Bean <rbean@redhat.com> - 6.0.2-2
changelog:
  - Modernized python2 macros.
  - Inlined locale environment variables in the %check section.
  - Remove bundled egg-info and .exes.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 2.0-8
changelog:
  - Remove the python-setuptools-devel Virtual Provides as per this Fedora 21
    Change: http://fedoraproject.org/wiki/Changes/Remove_Python-setuptools-devel


author: Toshio Kuratomi <toshio@fedoraproject.org> - 2.0-1
changelog:
  - Update to new upstream release with a few things removed from the API:
    Changelog: https://pypi.python.org/pypi/setuptools#id139


author: Toshio Kuratomi <toshio@fedoraproject.org> - 1.1.7-1
changelog:
  - Update to newer upstream release that has our patch to the unittests
  - Fix for http://bugs.python.org/issue17997#msg194950 which affects us since
    setuptools copies that code. Changed to use
    python-backports-ssl_match_hostname so that future issues can be fixed in
    that package.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 1.1.6-1
changelog:
  - Update to newer upstream release.  Some minor incompatibilities listed but
    they should affect few, if any consumers.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.9.5-1
changelog:
  - Update to 0.9.5
    - package_index can handle hashes other than md5
    - Fix security vulnerability in SSL certificate validation
    - https://bugzilla.redhat.com/show_bug.cgi?id=963260


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.8-1
changelog:
  - Update to upstream 0.8  release.  Codebase now runs on anything from
    python-2.4 to python-3.3 without having to be translated by 2to3.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.6.28-1
changelog:
  - New upstream release:
    - python-3.3 fixes
    - honor umask when setuptools is used to install other modules


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.6.13-5
changelog:
  - Upstream patch for compatibility problem with setuptools
  - Minor spec cleanups
  - Provide python-distribute for those who see an import distribute and need
    to get the proper package.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.6.10-1
changelog:
  - Update the python3 portions but disable for now.
  - Update to 0.6.10
  - Remove %pre scriptlet as the file has a different name than the old
    package's directory


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.6.9-4
changelog:
  - Fix install to make /usr/bin/easy_install the py2 version
  - Don't need python3-tools since the library is now in the python3 package
  - Few other changes to cleanup style


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.6.7-1
changelog:
  - Move easy_install back into the main package as the needed files have been
    moved from python-devel to the main python package.
  - Update to 0.6.7 bugfix.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.6.4-1
changelog:
  - First build from the distribute codebase -- distribute-0.6.4.
  - Remove svn patch as upstream has chosen to go with an easier change for now.


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 0.4.16-3
changelog:
  - Bundle python-keyring
  - Append python-keyring bundled directory to search path where needed

    Resolves: rhbz#1511228


author: Bastien Nocera <bnocera@redhat.com> 1.5.0-1
changelog:
  - Disable vala, as it was disabled upstream:
  http://git.gnome.org/browse/libpeas/commit/?id=1031aaeeef282ab2bb65cb6ae48fa4abff453c4d


author: Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.17-292.0.1.7
changelog:
  - Remove glibc-ora28641867.patch as duplicate of glibc-rh1705899-4.patch
  - Make _IO_funlockfile match __funlockfile and _IO_flockfile match __flockfile
    Both should test
      if ((stream->_flags & _IO_USER_LOCK) == 0)
        _IO_lock_lock (*stream->_lock);
    OraBug 28481550.
    Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
  - Modify glibc-ora28849085.patch so it works with RHCK kernels.
    Orabug 28849085.
  - Reviewed-by: Egeyar Bagcioglu <egeyar.bagcioglu@oracle.com>
  - Use NLM_F_SKIP_STATS in uek2 and RTEXT_FILTER_SKIP_STATS in uek4 in getifaddrs.
  - Orabug 28849085
  - Reviewed-by: Patrick McGehearty <patrick.mcgehearty@oracle.com>
  - Mention CVE numbers in the .spec file for CVE-2015-8983 and CVE-2015-8984.
  - Orabug 25558067.
  - Reviewed-by: Egeyar Bagcioglu <egeyar.bagcioglu@oracle.com>
  - Regenerate plural.c
  - OraBug 28806294.
  - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
  - intl: Port to Bison 3.0
  - Backport of upstream gettext commit 19f23e290a5e4a82b9edf9f5a4f8ab6192871be9
  - OraBug 28806294.
  - Reviewed-by: Patrick McGehearty <patrick.mcgehearty@oracle.com>
  - Fix dbl-64/wordsize-64 remquo (bug 17569).
  - Backport of upstream d9afe48d55a412e76b0dcb28335fd4b390fe07ae
  - OraBug 19570749.
  - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
  - libio: Disable vtable validation in case of interposition.
  - Backport of upstream c402355dfa7807b8e0adb27c009135a7e2b9f1b0.
  - OraBug 28641867.
  - Reviewed-by: Egeyar Bagcioglu <egeyar.bagcioglu@oracle.com>
  - Include-linux-falloc.h-in-bits-fcntl-linux.h
  - Defines FALLOC_FL_PUNSH_HOLE, FALLOC_FL_KEEP_SIZE,
    FALLOC_FL_COLLAPSE_RANGE, and FALLOC_FL_ZERO_RANGE
  - OraBug 28483336
  - Add MAP_SHARED_VALIDATE and MAP_SYNC flags to
  - sysdeps/unix/sysv/linux/x86/bits/mman.h
  - OraBug 28389572
  - Update bits/siginfo.h with Linux hwpoison SIGBUS changes.
  - Adds new SIGBUS error codes for hardware poison signals, syncing with
    the current kernel headers (v3.9).
  - It also adds si_trapno field for alpha.
  - New values: BUS_MCEERR_AR, BUS_MCEERR_AO
  - OraBug 28124569


author: Patsy Franklin <pfrankli@redhat.com> - 2.17-260
changelog:
  - Update glibc-rh1560641.patch to initialize pad outside
    the conditional eliminating an uninitialized byte warning from
    valgrind. (#1560641)


author: Carlos O'Donell <carlos@redhat.com> - 2.17-258
changelog:
  - Fix dynamic string token substitution in DT_RPATH etc. (#1447808, #1540480)
  - Additional robust mutex fixes (#1401665)


author: Carlos O'Donell <carlos@redhat.com> 2.17-256
changelog:
  - CVE-2017-16997: Correctly handle DT_RPATH (#1540480).
  - Correctly process "$ORIGIN" element in DT_RPATH or DT_NEEDED (#1447808).


author: DJ Delorie <dj@redhat.com> - 2.17-237
changelog:
  - Add O_TMPFILE macro (#1471405)
  - Update syscall names list to kernel 4.16 (#1563747)
  - Include <linux/falloc.h> in bits/fcntl-linux.h. (#1476120)
  - Fix netgroup cache keys. (#1505647)
  - Update ptrace constants. (#1457479)


author: Florian Weimer <fweimer@redhat.com> - 2.17-234
changelog:
  - Adjust spec file for compiler warnings cleanup (#1505492)
  - Drop ports add-on
  - Do not attempt to disable warnings-as-errors on s390x


author: Carlos O'Donell <carlos@redhat.com> - 2.17-221
changelog:
  - CVE-2018-1000001: Fix realpath() buffer underflow (#1534635)
  - i386: Fix unwinding for 32-bit C++ application (#1529982)
  - Reduce thread and dynamic loader stack usage (#1527904)
  - x86-64: Use XSAVE/XSAVEC more often during lazy symbol binding (#1528418)


author: Florian Weimer <fweimer@redhat.com> - 2.17-215
changelog:
  - CVE-2017-15670: glob: Fix one-byte overflow with GLOB_TILDE (#1504809)
  - CVE-2017-15804: glob: Fix buffer overflow in GLOB_TILDE unescaping (#1504809)


author: Arjun Shankar <arjun@redhat.com> - 2.17-203
changelog:
  - Fix socket system call selection on s390x (#1498566).
  - Use different construct for protected visibility in IFUNC tests (#1445644)


author: Florian Weimer <fweimer@redhat.com> - 2.17-202
changelog:
  - Rebase the DNS stub resolver and getaddrinfo to the glibc 2.26 version
  - Support an arbitrary number of search domains in the stub resolver (#677316)
  - Detect and apply /etc/resolv.conf changes in libresolv (#1432085)
  - CVE-2017-1213: Fragmentation attacks possible when ENDS0 is enabled
    (#1487063)
  - CVE-2016-3706: Stack (frame) overflow in getaddrinfo when called
    with AF_INET, AF_INET6 (#1329674)
  - CVE-2015-5180: resolv: Fix crash with internal QTYPE (#1497131)
  - CVE-2014-9402: denial of service in getnetbyname function (#1497132)
  - Fix getaddrinfo to handle certain long lines in /etc/hosts (#1452034)
  - Make RES_ROTATE start with a random name server (#1257639)
  - Stricter IPv6 address parser (#1484034)
  - Remove noip6dotint support from the stub resolver (#1482988)
  - Remove partial bitstring label support from the stub resolver
  - Remove unsupported resolver hook functions from the API
  - Remove outdated RR type classification macros from the API
  - hesiod: Always use TLS resolver state
  - hesiod: Avoid non-trust-boundary crossing heap overflow in get_txt_records


author: DJ Delorie <dj@redhat.com> - 2.17-197
changelog:
  - Fix compile warnings in malloc (#1347277)
  - Fix occasional tst-malloc-usable failures (#1348000)
  - Additional chunk hardening in malloc (#1447556)
  - Pointer alignment fix in nss group merge (#1463692)
  - Fix SIGSEGV when LD_LIBRARY_PATH only has non-existing paths (#1443236)


author: Carlos O'Donell <carlos@redhat.com> - 2.17-192
changelog:
  - Exclude lock elision support for older Intel hardware with
    Intel TSX that has hardware errata (#841653).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-191
changelog:
  - Add transparent lock elision for default POSIX mutexes on
    IBM POWER hardware with support for IBM POWER HTM (#731835).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-190
changelog:
  - Add transparent lock elision for default POSIX mutexes on
    Intel hardware with support for Intel TSX (#841653).
  - Update dynamic loader trampoline for Intel Skylake server (#1421155).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-188
changelog:
  - Improve exp() and pow() performance in libm (#1409611)
  - Add optimized strcmp and strncmp for IBM POWER9 hardware (#1320947)


author: Patsy Franklin <pfrankl@redhat.com> - 2.17-186
changelog:
  - Update patch for glibc-rh1288613.patch to include tst-res_hconf_reorder
    in the list of tests to be built and run. (#1367804)


author: Martin Sebor <msebor@redhat.com> - 2.17-183
changelog:
  - Fix CVE-2015-8776 glibc: Segmentation fault caused by passing
    out-of-range data to strftime() (#1374658)


author: Florian Weimer <fweimer@redhat.com> - 2.17-165
changelog:
  - Fix use of uninitialized data in getaddrinfo with nscd (#1324568)
  - Remove the "power8" AT_PLATFORM directory (#1404435)
  - Fix profil on aarch64 (#1144516)


author: Florian Weimer <fweimer@redhat.com> - 2.17-162
changelog:
  - Backport support/ subdirectory from upstream (#1418978)
  - Fix deadlock between fork, malloc, flush (NULL) (#906468)


author: Patsy Franklin <pfrankl@redhat.com> - 2.17-161
changelog:
  - Fix tst-cancel17/tst-cancelx17 was sometimes segfaulting.
    Wait for the read to finish before returning. (#1337242)


author: Carlos O'Donell <carlos@redhat.com> - 2.17-158
changelog:
  - Do not set initgroups in default nsswitch.conf (#1366569)
  - nss_db: Request larger buffers for long group entries (#1318890)
  - nss_db: Fix get*ent crash without preceding set*ent (#1213603)
  - nss_db: Fix endless loop in services database processing (#1370630)


author: Carlos O'Donell <carlso@redhat.com> - 2.17-146
changelog:
  - s390: Restore signal mask on setcontext/swapcontext (#1249114).
  - s390: Fix backtrace in the presence of makecontext (#1249115).


author: Florian Weimer <fweimer@redhat.com> - 2.17-131
changelog:
  - Remove PER_THREAD preprocessor macro from malloc
  - Use final upstream patch for arena free list fix (#1276753)


author: Martin Sebor <msebor@redhat.com> - 2.17-130
changelog:
  - Prevent the compiler from clobbering floating point and vector
    registers in S390 symbol resolution functions (#1324427).
  - Improve posix_fallocate behavior with NFS file descriptors (#1140250).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-122
changelog:
  - Reorganize POWER7 and POWER8 support (#1213267).
    - Only build POWER7 runtime for ppc64p7.
    - Only build POWER8 runtime for ppc64le.
    - Configure with --with-cpu=power8 for ppc64le.
    - Configure with --with-cpu=power8 for ppc.
    - Configure with --with-cpu=power7 for ppc64 default runtime.


author: DJ Delorie <dj@redhat.com> - 2.17-121
changelog:
  - Build require gcc-c++ for the C++ tests.
  - Add --with/--without controls for building glibc (#1255847)
    - Support --without testsuite option to disable testing after build.
    - Support --without benchtests option to disable microbenchmarks
      (placeholder for upstream compatibility only)
    - Update --with bootstrap to disable valgrind, documentation,
      selinux, and nss-crypt during bootstrap.
    - Support --without werror to disable building with -Werror.
    - Support --without docs to disable build requirement on texinfo.
    - Support --with valgrind to enable testing with valgrind.


author: Martin Sebor <msebor@redhat.com> - 2.17-115
changelog:
  - Configure --with-cpu=power8 on powerpc64 to generate POWER8
    instructions for POWER8 runtime (#1183088, #1213267).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-111
changelog:
  - Fix NULL pointer dereference in stub resolver with unconnectable name
    server addresses (#1320596).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-108
changelog:
  - Fix CVE-2015-7547: getaddrinfo() stack-based buffer overflow (#1296031).
  - Fix madvise performance issues (#1284959).
  - Avoid "monstartup: out of memory" error on powerpc64le (#1249102).
  - Update malloc testing for 32-bit POWER (#1293976).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-102
changelog:
  - Remove workaround for kernel netlink bug (#1089836).
  - Use only 32-bit instructions in optimized 32-bit POWER functions (#1240796).


author: Martin Sebor <msebor@redhat.com> - 2.17-100
changelog:
  - Prevent tst-rec-dlopen from intermittently failing in parallel
    builds due to a missing makefile dependency (#1225959).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-96
changelog:
  - Rebase microbenchmarks from upstream for performance testing (#1214326)
  - Fix running microbenchmark script bench.pl from source (#1084395)


author: Martin Sebor <msebor@redhat.com> - 2.17-93
changelog:
  - Backport fixes and enhancements for ppc64 and ppc64le (#1162895).
    - Correct DT_PPC64_NUM in elf/elf.h.
    - Correct IBM long double frexpl.
    - Correct IBM long double nextafterl.


author: Martin Sebor <msebor@redhat.com> - 2.17-92
changelog:
  - Backport fixes for various security flaws (#1209107):
    - Prevent heap buffer overflow in swscanf (CVE-2015-1472, CVE-2015-1473,
        - Prevent integer overflow in _IO_wstr_overflow (#1195762).
    - Prevent potential denial of service in internal_fnmatch (#1197730).
    - Prevent buffer overflow in gethostbyname_r and related functions
      with misaligned buffer (CVE-2015-1781, #1199525).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.17-90
changelog:
  - Work around kernel netlink bug on some specialized hardware setup (#1089836).
  - Fix invalid file descriptor reuse when sending DNS query
    (CVE-2013-7423, #1194143).
  - Sync netinet/tcp.h with the kernel (#1219891).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.17-89
changelog:
  - Avoid deadlock in malloc on backtrace (#1207032).
  - Actually test iconv modules (#1176906).
  - Use calloc to allocate xports (#1159169).
  - Return EAI_AGAIN for AF_UNSPEC when herrno is TRY_AGAIN (#1098042).


author: Marek Polacek <polacek@redhat.com> - 2.17-85
changelog:
  - Skip logging for DNSSEC responses (#1186620).
  - Also apply the RHEL6.7 Makerules patch (#1189278).


author: Martin Sebor <msebor@redhat.com> - 2.17-82
changelog:
  - Backport an alternate implementation of strstr and strcasestr for
    x86 that doesn't use the stack for temporaries requiring 16-byte
    alignment (#1150282).


author: Martin Sebor <msebor@redhat.com> - 2.17-79
changelog:
  - Restructure spec file to unconditionally apply ppc64le support (#1182355).
  - Fix test failure in test-ildoubl on ppc64 (#1186491).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-76
changelog:
  - Fix application crashes during calls to gettimeofday on ppc64
    when kernel exports gettimeofday via VDSO (#1077389).
  - Prevent NSS-based file backend from entering infinite loop
    when different APIs request the same service (CVE-2014-8121, #1182272).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-75
changelog:
  - Fix permission of debuginfo source files to allow multiarch
    debuginfo packages to be installed and upgraded (#1170110).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-65
changelog:
  - PowerPC 32-bit and 64-bit optimized function support using STT_GNU_IFUNC
    (#731837).
  - Support running Intel MPX-enabled applications (#1132518).
  - Support running Intel AVX-512-enabled applications (#1140272).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.17-63
changelog:
  - Build build-locale-archive statically (#1070611).
  - Return failure in getnetgrent only when all netgroups have been searched
    (#1085313).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.17-62
changelog:
  - Don't use alloca in addgetnetgrentX (#1138520).
  - Adjust pointers to triplets in netgroup query data (#1138520).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.17-61
changelog:
  - Set CS_PATH to just /use/bin (#1124453).
  - Add systemtap probe in lll_futex_wake for ppc and s390 (#1084089).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.17-60
changelog:
  - Add mmap usage to malloc_info output (#1103856).
  - Fix nscd lookup for innetgr when netgroup has wildcards (#1080766).
  - Fix memory order when reading libgcc handle (#1103874).
  - Fix typo in nscd/selinux.c (#1125306).
  - Do not fail if one of the two responses to AF_UNSPEC fails (#1098047).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.17-59
changelog:
  - Provide correct buffer length to netgroup queries in nscd (#1083647).
  - Return NULL for wildcard values in getnetgrent from nscd (#1085290).
  - Avoid overlapping addresses to stpcpy calls in nscd (#1083644).
  - Initialize all of datahead structure in nscd (#1083646).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.17-58
changelog:
  - Remove gconv transliteration loadable modules support (CVE-2014-5119,
    - _nl_find_locale: Improve handling of crafted locale names (CVE-2014-0475,


author: Carlos O'Donell <carlos@redhat.com> - 2.17-57
changelog:
  - Merge 64-bit ARM (AArch64) support (#1027179).
  - Fix build failure for rtkaio/tst-aiod2.c and rtkaio/tst-aiod3.c.


author: Carlos O'Donell <carlos@redhat.com> - 2.17-55.4
changelog:
  - Fix tst-cancel4, tst-cancelx4, tst-cancel5, and tst-cancelx5 for all targets.
  - Fix tst-ildoubl, and tst-ldouble for POWER.
  - Allow LE 64-bit POWER to build with VSX if enabled (#1124048).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.17-53
changelog:
  - Fix offset caching for streams and use it for ftell (#1074410).
  - Change offset in fdopen only if setting O_APPEND (#1074410).
  - Fix up return codes for tests in tst-ftell-active-handler (#1074410).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.17-45
changelog:
  - Revert to flushing buffer for ftell if output buffer does not have sufficient
    space for conversion (#1048036).
  - Use first name entry for address in /etc/hosts as the canonical name in
    getaddrinfo (#1047983).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.17-37
changelog:
  - Fix stack overflow due to large AF_INET6 requests (CVE-2013-4458, #1025612).
  - Fix reads for sizes larger than INT_MAX in AF_INET lookup (#1032435).


author: Carlos O'Donell <carlos@readhat.com> - 2.17-35
changelog:
  - Add support for installing the dynmic loader in an alternate location.
    This is required for AArch64 support (#1023790).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-34
changelog:
  - Temporarily generate POWER6 code for the 32-bit POWER7 and POWER8
    runtimes to work around bug 1019549 (#1018072).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-32
changelog:
  - The default runtime is now POWER7 with an additional POWER8-tuned
    runtime. No other runtimes are provided by default. (#731833)


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.17-20
changelog:
  - Use tmpfilesdir macro instead of hard coding /usr/lib/tmpfiles.d.
  - Backport GLIBC sched_getcpu and gettimeofday vDSO functions for ppc
    (#977110).
  - Backport additional patches from upstream for
    -ftree-loop-distribute-patterns (#911307).
  - Add HW_CAP2 support and add POWER8 enablement code (#731833).
  - Remove useless .eh_frame to prevent gold linker bug (#731833).
  - Add vDSO support or time function (#731833).
  - Add PowerPC platform-specific inlines for shared resource hints (#731833).
  - Reserve TCB space for EBB framework (#731833).
  - Use _dl_static_init to set GLRO(gl_pagesize) (#731833).
  - Rename __kernel_vdso_get_tbfreq to __kernel_get_tbfreq (#731833).
  - Consolidate copies of PowerPC mp code (#731833).
  - Unify math_ldbl.h implementations (#731833).
  - Fix ABI issue for sqrtl and llroundl (#731833).
  - Remove branch prediction from rint implementation (#731833).
  - Optimize modf for PowerPC (#731833).
  - Fix hypot/hypotf check for -INF on PowerPC (#731833).
  - Use __ieee754_sqrl in acoshl for lbdl-128ibm (#731833).
  - Add benchmark framework (#992727).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.17-16
changelog:
  - Add __glibc_likely as alias for __builtin_expect.
  - Fix strcoll() various flaws (#989861, #989862, CVE-2012-4412, CVE-2012-4424).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.17-15
changelog:
  - Correctly name the 240-bit slow path sytemtap probe slowpow_p10 for slowpow (#742035).
  - Fix handling of netgroup cache in nscd (#966633).
  - Fix loading of audit libraries when TLS is in use (#970791)


author: Patsy Franklin <pfrankli@redhat.com> - 2.17-14
changelog:
  - Disable the use of pt_chown(Bugzilla #15755).  Distributions can re-enable
    building and using pt_chown with`--enable-pt_chown'.  (#984828i, CVE-2013-2207).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-13
changelog:
  - Add build requirement on static libstdc++ library to fix testsuite failures
    for static C++ tests.


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.17-12
changelog:
  - Fix stack overflow in getaddrinfo with many results (#980323, CVE-2013-1914).
  - Correct fix to return failure on libio function error (#979363).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.17-10
changelog:
  - Preserve errno across _PC_CHOWN_RESTRICTED call on XFS (#977870).
  - Remove PIPE_BUF Linux-specific code (#977872).
  - Fix FPE in memusagestat when malloc utilization is zero (#977874).
  - Accept leading and trailing spaces in getdate input string (#977875).


author: Patsy Franklin <pfrankli@redhat.com> - 2.17-5
changelog:
  - Increase limits on xdr name and record requests (#892777).
  - Consistently MANGLE/DEMANGLE init_fct, end_fct and btow_fct (#952799).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-3
changelog:
  - Renamed release engineering directory to `releng' (#903754).
  - Fix building with gcc 4.8.0 (#911307).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-2
changelog:
  - Fix ownership of /usr/lib[64]/audit (#894307).
  - Support unmarked ARM objects in ld.so.cache and aux cache (#905184).


author: Jeff Law <law@redhat.com> - 2.16.90-37
changelog:
  - Resync with master
  - Patch for 697421 has been submitted upstream.
  - Drop local patch for 691912 that is no longer needed.


author: Jeff Law <law@redhat.com> - 2.16.90-36
changelog:
  - Resync with master
  - Drop local patch for 657588 that is no longer needed.
  - Drop local patch for 740682 that is no longer needed.
  - Drop local patch for 770439 that is no longer needed.
  - Drop local patch for 789209 that is no longer needed.
  - Drop local patch for nss-files-overflow that seems useless.
  - Drop localedata-locales-fixes as they were rejected upstream.
  - Drop test-debug-gnuc-hack.patch that seems useless now.
  - Repack patchlist.


author: Jeff Law <law@redhat.com> - 2.16.90-35
changelog:
  - Resync with master (#882137).
  - Remove local patch for strict-aliasing warnings that
    is no longer needed.
  - Remove local patch for 730856 that is no longer needed.
  - Repack patchlist.


author: Jeff Law <law@redhat.com> - 2.16.90-34
changelog:
  - Remove local patch which "temporarily" re-added currences
    obsoleted by the Euro.
  - Remove hunks from strict-aliasing patch that are no longer
    needed.


author: Jeff Law <law@redhat.com> - 2.16.90-32
changelog:
  - Resync with master.
  - Drop local patch for 878913.
  - Drop local patch for 880666.
  - Drop local patch for 767693.
  - Repack patchlist.


author: Jeff Law <law@redhat.com> - 2.16.90-27
changelog:
  - Resync with upstream sources.
  - Don't use distinct patches for 770869, 787201 and 688948
    as they all modify stuff under fedora/
  - Repack patchlist


author: Jeff Law <law@redhat.com> - 2.16.90-25
changelog:
  - Rsync with upstream sources
  - Drop 864820 patch as now that it's upstream.
  - Add sss to /etc/nsswitch.conf (#867473)


author: Jeff Law <law@redhat.com> - 2.16.90-24
changelog:
  - Rsync with upstream sources
  - Drop local 552960-2 patch now that it's upstream.
  - Drop local 858274 patch now that the root problem is fixed upstream.
  - Repack patchlist.


author: Jeff Law <law@redhat.com> - 2.16.90-22
changelog:
  - Resync with upstream sources
  - Drop local 552960 patch now that it's upstream
  - Drop local stap patch now obsolete
  - Drop local s390 patch which avoided problems with old assemblers
  - Drop old fortify source patch to deal with old compilers


author: Jeff Law <law@redhat.com> - 2.16.90-18
changelog:
  - Resync with upstream sources.
  - Drop fedora-cdefs-gnuc.patch, it's not needed anymore.
  - Drop fedora-gai-rfc1918.patch, it's upstream now.
  - Drop fedora-localedata-no_NO.patch, it was supposed to be
    temporary -- that was back in 2003.   This should have been
    sorted out long ago.  We'll just have to deal with the
    fallout.
  - Drop fedora-vfprintf-sw6530.patch, it's upstream now.
  - Drop rh769421.patch; Siddhesh has fixed this properly with 552960.


author: Jeff Law <law@redhat.com> - 2.16.90-15
changelog:
  - Remove most of fedora-nscd patch as we no longer use the
    old init files, but systemd instead.
  - Remove path-to-vi patch.  With the usr-move changes that
    patch is totally unnecessary.
  - Remove i686-nopl patch.  Gas was changed back in 2011 to
    avoid nopl.
  - Move gai-rfc1918 patch to submitted upstream status


author: Jeff Law <law@redhat.com> - 2.16.90-12
changelog:
  - Revert recent upstream strstr changes (#858274)
  - Demangle function pointers before testing them (#816647)
  - Remove handling of /etc/localtime and /var/spool/postfix/etc/localtime
    as systemd will be handling them from now on (#858735).


author: Jeff Law <law@redhat.com> - 2.16.90-4
changelog:
  - Move /etc/localtime into glibc-common package since glibc-common
    owns the scriptlets which update it.


author: Jeff Law <law@redhat.com> - 2.16.90-3
changelog:
  - Remove obsolete patches from glibc-fedora.patch.  Explode
    remaining patches into distinct patchfiles.  Thanks to
    Dmitry V. Levin for identifying them!
    Drop ia64 specific patches and specfile fragments


author: Jeff Law <law@redhat.com> - 2.16.90-1
changelog:
  - Resync with upstream sources, drop obsolete patches.
  - Drop glibc-ports bits as they're part of the master
    sources now.


author: Jeff Law <law@redhat.com> - 2.16-7
changelog:
  - Pack IPv4 servers at the start of nsaddr_list and
    only track the number of IPV4 servers in EXT(statp->nscounti (#808147)
  - Mark set*uid, set*gid as __wur (warn unused result) (#845960)


author: Jeff Law <law@redhat.com> - 2.16-6
changelog:
  - Revert patch for BZ696143, it made it impossible to use IPV6
    addresses explicitly in getaddrinfo, which in turn broke
    ssh, apache and other code. (#808147)
  - Avoid another unbound alloca in vfprintf (#841318)
  - Remove /etc/localtime.tzupdate in lua scriptlets
  - Revert back to using posix.symlink as posix.link with a 3rd
    argument isn't supported in the lua version embedded in rpm.
  - Revert recent changes to res_send (804630, 835090).
  - Fix memcpy args in res_send (#841787).


author: Jeff Law <law@redhat.com> - 2.15.90-13
changelog:
  - Delay setting DECIDED field in locale file structure until
    we have read the file's data (#827510).


author: Dennis Gilmore <dennis@ausil.us> - 2.15.90-11
changelog:
  - only deal with the arm linker compat hack on armhfp arches
  - armsfp arches do not have a linker change
  - Backward compat hack for armhf binaries.


author: Jeff Law <law@redhat.com> - 2.15.90-9
changelog:
  - Resync with upstream sources, drop unnecessary patches.
  - Fix DoS in RPC implementation (#767693)
  - Remove deprecated alpha support.
  - Remove redundant hunk from patch. (#823905)


author: Patsy Franklin <patsy@redhat.com> - 2.15.90-8
changelog:
  - Fix iconv() segfault when the invalid multibyte character 0xffff is input
    when converting from IBM930 (#823905)


author: Jeff Law <law@redhat.com> - 2.15.90-3
changelog:
  - Work around RPM dropping the contents of /etc/localtime
    when it turns into a symlink with %post common script (#825159).


author: Jeff Law <law@redhat.com> - 2.15.90-2
changelog:
  - Fix option rotate when one IPV6 server is enabled (#804630)
  - Reenable slow/uberslow path taps slowpow/slowexp.


author: Patsy Franklin <pfrankli@redhat.com> - 2.15-41
changelog:
  - Fix tzdata trigger (#822200)
  - Make the symlink relative rather than linking into the buildroot (#822200).
  - Changed /etc/localtime to a symlink. 8222000 (#822200)


author: Jeff Law <law@redhat.com> - 2.15-28
changelog:
  - Add doi_IN, sat_IN and mni_IN to SUPPORTED locals (#803286)
  - Add stap probes in slowpow and slowexp.


author: Jeff Law <law@redhat.com> - 2.15-26
changelog:
  - Set errno properly in vfprintf (#794797)
  - Don't kill application when LD_PROFILE is set. (#800224)


author: Jeff Law <law@redhat.com> - 2.15-24
changelog:
  - Fix bogus underflow (#760935)
  - Correctly handle dns request where large numbers of A and AAA records
    are returned (#795498)
  - Fix nscd crash when group has many members (#788989)


author: Jeff Law <law@redhat.com> - 2.15-21
changelog:
  - Correctly identify all 127.x.y.z addresses (#739743)
  - Don't assign native result if result has no associated interface (#739743)


author: Jeff Law <law@redhat.com> - 2.15-18
changelog:
  - Revert 552960/769421 changes again, still causing problems.
  - Add doi_IN (#791161)
  - Add sat_IN (#790292)
  - Add mni_IN (#790298)


author: Jeff Law <law@redhat.com> - 2.15-17
changelog:
  - Fix lost wakeups in pthread_cond_*.  (#552960, #769421)
  - Clarify info page for snprintf (#564528)
  - Fix first_weekday and first_workday for ru_UA (#624296)


author: Jeff Law <law@redhat.com> - 2.15-12
changelog:
  - Add fedfs to /etc/rpc (#691912)
  - Run nscd in the foreground w/ syslogging, fix systemd config (#770869)
  - Avoid mapping past end of shared object (#741105)
  - Turn off -mno-minimal-toc on PPC (#787201)
  - Remove hunk from glibc-rh657588.patch that didn't belong


author: Jeff Law <law@redhat.com> - 2.15-8
changelog:
  - Prevent erroneous inline optimization of initfini.s on PowerPC64 (#783979)
  - Use upstream variant of fix for 740506.
  - Fix month abbreviations for zh_CN (#657588)


author: Jeff Law <law@redhat.com> - 2.15-4
changelog:
  - Update ports from master.
  - Fix first workday/weekday for it_IT (#622499)
  - Fix type to uint16_t based on upstream comments (729661)
  - Do not cache negative results in nscd if these are transient (#784402)


author: Jeff Law <law@redhat.com> - 2.15-3
changelog:
  - Fix cycle detection (#729661)
  - Fix first workday/weekday for it_IT (#446078)
  - Fix first workday/weekday for ca_ES (#454629)


author: Jeff Law <law@redhat.com> - 2.14.90-26.fc17
changelog:
  - Update from master (16c6f99)
  - Fix typo in recent tzfile change (#769476)
  - Make MALLOC_ARENA_MAX and MALLOC_ARENA_TEST match documentation (#740506)
  - Revert "fix" to pthread_cond_wait (#769421)
  - Extract patch for 730856 from fedora-patch into a distinct patchfile


author: Jeff Law <law@redhat.com> - 2.14.90-24.fc16.3
changelog:
  - Check values from TZ file header (#767696)
  - Handle EAGAIN from FUTEX_WAIT_REQUEUE_PI (#552960)
  - Add {dist}.#
  - Correct return value from pthread_create when stack alloction fails.
    (#767746)


author: Jeff Law <law@redhat.com> - 2.14.90-23
changelog:
  - Fix a wrong constant in powerpc hypot implementation (#750811)
      - Truncate time values in Linux futimes when falling back to utime


author: Jeff Law <law@redhat.com> - 2.14.90-21
changelog:
  - Don't fail in makedb if SELinux is disabled (#750858)
  - Fix access after end of search string in regex matcher (#757887)


author: Jeff Law <law@redhat.com> - 2.14.90-19
changelog:
  - Check malloc arena atomically  (BZ#13071)
  - Don't call reused_arena when _int_new_arena failed (#753601)


author: Jeff Law <law@redhat.com> - 2.14.90-17
changelog:
  - Revert bogus commits/rebasing of Nov 14, Nov 11 and Nov 8.  Sources
    should be equivalent to Fedora 16's initial release.


author: Jim Meyering <meyering@redhat.com> - 2.14.90-14
changelog:
  - Revert the upstream patch that added the leaf attribute, since it
    caused gcc -O2 to move code past thread primitives and sometimes
    even out of critical sections.  See http://bugzilla.redhat.com/747377


author: Andreas Schwab <schwab@redhat.com> - 2.14.90-13
changelog:
  - Update from master
    - Fix linkage conflict with feraiseexcept (#746753)
    - More libm optimisations


author: Andreas Schwab <schwab@redhat.com> - 2.14.90-12
changelog:
  - Update from master
    - Correctly handle missing initgroups database (#745675)
    - Optimize many libm functions
    - Optimize access to isXYZ and toXYZ tables
    - Optimized memcmp and wmemcmp for x86-64 and x86-32
    - Add parameter annotation to modf (BZ#13268)
    - Support optimized isXXX functions in C++ code
    - Check for zero size in memrchr for x86_64 (#745739)
    - Optimized memchr, memrchr, rawmemchr for x86-32


author: Andreas Schwab <schwab@redhat.com> - 2.14.90-11
changelog:
  - Update from master
    - Clean up locarchive mmap reservation code
    - Fix netname2host (BZ#13179)
    - Fix remainder (NaN, 0) (BZ#6779, BZ#6783)
    - S/390: Fix longlong.h inline asms for zarch
    - Improve 64 bit memchr, memrchr, rawmemchr with SSE2
    - Update translations
    - Implement caching of netgroups in nscd
    - Handle OOM in NSS
    - Don't call ifunc functions in trace mode
  - Convert tzdata-update to lua (#729796)
  - Horrible workaround for horribly broken software (#737223)


author: Andreas Schwab <schwab@redhat.com> - 2.14.90-10
changelog:
  - Update from master
    - Correctly reparse group line after enlarging the buffer (#739360)
    - Fix parse error in bits/mathinline.h with --std=c99 (#740235)
  - Update nscd service file (#740284)
  - Drop nscd init file (#740196)


author: Andreas Schwab <schwab@redhat.com> - 2.14.90-9
changelog:
  - Update from master
    - Define IP_MULTICAST_ALL (BZ#13192)
    - Add fmax and fmin inlines for x86-64
    - Avoid race between {,__de}allocate_stack and __reclaim_stacks
      during fork (#737387)
    - Optimized lrint and llrint for x86-64
    - Also relocate in dependency order when doing symbol dependency
      testing (#737459)
    - Optimize logb code for 64-bit machines
    - Fix jn precision (BZ#11589)
    - Fix boundary conditions in scanf (BZ#13138)
    - Don't lock string streams in stream cleanup code (BZ#12847)
    - Define ELFOSABI_GNU
    - Fix lround loss of precision
    - Add range checking for FD_SET, FD_CLR, and FD_ISSET
  - Make sure AVC thread has capabilities


author: Andreas Schwab <schwab@redhat.com> - 2.14.90-8
changelog:
  - Update from master
    - Use O_CLOEXEC when loading objects and cache in ld.so (BZ#13068)
    - Fix memory leak in case of failed dlopen (BZ#13123)
    - Optimizations for POWER
    - Prefer real syscalls instead of vsyscalls on x86-64 outside libc.so
    - Add Atom-optimized strchr and strrchr for x86-64
    - Try shell in posix_spawn* only in compat mode (BZ#13134)
    - Fix glob.h header by removing gcc 1.x support (BZ#13150)
    - Optimized strchr and strrchr with SSE2 on x86-32
    - Add optimized x86 wcscmp
    - Fixes and optimizations for 32-bit sparc fabs
    - Fix nptl semaphore cleanup invocation
    - Sanitize HWCAP_SPARC_* defines/usage, and add new entries


author: Andreas Schwab <schwab@redhat.com> - 2.14.90-7
changelog:
  - Update from master
    - Relocate objects in dependency order (#733462)
  - Avoid assertion failure when first DNS answer was empty (#730856)
  - Don't treat tls_offset == 1 as forced dynamic (#731228)


author: Andreas Schwab <schwab@redhat.com> - 2.14.90-6
changelog:
  - Update from master
    - Correct cycle detection during dependency sorting
    - Use ifuncs for time and gettimeofday on x86-64
    - Fix fopen (non-existing-file, "re") errno
    - Fix CFI info in x86-64 trampolines for non-AVX code
    - Build libresolv with SSP flags
    - Avoid executable stack in makedb (#731063)
    - Align x86 TCB to 64 bytes (cache line size), important for Atom


author: Andreas Schwab <schwab@redhat.com> - 2.14.90-5
changelog:
  - Update from master
    - Implement LD_DEBUG=scopes
    - Locale-independent parsing in libintl (#726536)
    - Fix stack alignment on x86_64 (#728762)
    - Implement scandirat function


author: Andreas Schwab <schwab@redhat.com> - 2.14.90-4
changelog:
  - Update from master
    - Properly tokenize nameserver line for servers with IPv6 address
    - Fix encoding name for IDN in getaddrinfo (#725755)
    - Fix inline strncat/strncmp on x86
    - Define SEEK_DATA and SEEK_HOLE
    - Define AF_NFC and PF_NFC
    - Update ptrace constants
    - Add read barriers in cancellation initialization
    - Add read barrier protecting DES initialization
    - Fix overflow bug in optimized strncat for x86-64
    - Check for overflows in expressions (BZ#12852)
    - Fix check for AVX enablement (#720176, BZ#13007)
    - Force La_x86_64_ymm to be 16-byte aligned
    - Add const attr to gnu_dev_{major,minor,makedev}
  - Filter out GLIBC_PRIVATE symbols again


author: Andreas Schwab <schwab@redhat.com> - 2.14.90-3
changelog:
  - Update from master
    - S/390: Don't use r11 in INTERNAL_VSYSCALL_NCS macro
    - Avoid warning in nscd config file parsing code
    - Improve 64 bit strcat functions with SSE2/SSSE3
    - Fix alloca accounting in strxfrm
    - Avoid possible crashes in anormal nscd exits
    - Updated Swedish and Dutch translations


author: Andreas Schwab <schwab@redhat.com> - 2.14.90-2
changelog:
  - Update from master
    - Generalize framework to register monitoring of files in nscd
    - Handle ext4 in {,f}pathconf
    - Handle Lustre filesystem (BZ#12868)
    - Handle W; without long options in getopt (BZ#12922)
    - Change error code for underflows in strtod (BZ#9696)
    - Fix handling of chained netgroups
    - Optimize long-word additions in SHA implementation
    - Handle nscd negtimeout==0
    - nss_compat: query NIS domain only when needed
    - Fix robust mutex handling after fork
    - Make sure RES_USE_INET6 is always restored
  - Add systemd configuration for nscd
  - Be more careful running build-locale-archive


author: Andreas Schwab <schwab@redhat.com> - 2.14.90-1
changelog:
  - Update from master
    - Fix quoting in some installed shell scripts (BZ#12935)
    - Fix missing .ctors/.dtors lead word in soinit
    - Improved st{r,p}{,n}cpy for SSE2 and SSSE3 on x86
    - Avoid __check_pf calls in getaddrinfo unless really needed
      (BZ#12907)
    - Rate limit expensive _SC_NPROCESSORS_ONLN computation
    - Add initgroups lookup support to getent
    - Reenable nss_db with a completely new implementation
    - Rewrite makedb to avoid using db library
    - Add pldd program
  - Obsolete nss_db
  - Don't build tzdata-update and build-locale-archive statically


author: Andreas Schwab <schwab@redhat.com> - 2.14-4
changelog:
  - Update from 2.14 branch
    - Fix crash in GB18030 encoder (#712901)
  - Fix more bugs in GB18030 charmap
  - Don't use gethostbyaddr to determine canonical name


author: Andreas Schwab <schwab@redhat.com> - 2.14-3
changelog:
  - Update from 2.14 branch
    - Fix typo in recent resolver change which causes segvs (#710279)
    - Fix memory leak in getaddrinfo (#712178)
    - Fix <bits/mqueue2.h> for C++ (BZ#12841)
    - Assume Intel Core i3/i5/i7 processor if AVX is available
  - Filter results from gethostbyname4_r according to request flags
    (#711827)
  - Repair GB18030 charmap (#712901)
  - Revert "Use .machine to prevent AS from complaining about z9-109
    instructions in iconv modules" (#711330)


author: Andreas Schwab <schwab@redhat.com> - 2.14-1
changelog:
  - Update to 2.14 release
    - Handle DNS server failures in case of AF_UNSPEC lookups correctly
      (BZ#12684)
    - Prevent loader from loading itself
    - Restore _res correctly (BZ#12350)
    - Interpret numeric values in shadow file as signed (BZ#11099)
    - Recognize use-vc option in resolv.conf (BZ#11558)
    - Mark malloc hook variables as deprecated
    - Declare malloc hook variables as volatile (BZ#11781)
    - Don't document si_code used for raise (BZ#11799)
    - Fix unnecessary overallocation due to incomplete character (BZ#12811)
    - Handle failure of _nl_explode_name in all cases
    - Add support for time syscall in vDSO (BZ#12813)
    - Add sendmmsg and setns syscalls
    - Use getcpu definition from vDSO on x86-64 (BZ#12813)
  - Don't free non-malloced memory and fix memory leak (#709267)


author: Andreas Schwab <schwab@redhat.com> - 2.13.90-14
changelog:
  - Update from master
    - Fix conversion to ISO-2022-JP-2 with ISO-8859-7 designation
      (BZ#12814)
    - Undo accidental change in x86-64 user.h
    - Update Japanese translation
    - Define RLIMIT_RTTIME (BZ#12795)
    - Update longlong.h from GCC
    - Add a few more alloca size checks (BZ#12671)
    - Fix flags parameter value passed to pltenter and pltexit
    - Define CLOCK_REALTIME_ALARM and CLOCK_BOOTTIME_ALARM
    - Always fill output buffer in XPG strerror function (BZ#12782)
    - Nicer output for negative error numbers in strerror_r
    - Fix CP1258 conversion (BZ#12777)
    - Fix handling of LC_CTYPE in locale name handling (BZ#12788)
    - Set stream errors in more cases (BZ#12792)
    - Don't unconditionally use alloca in gaih_inet (BZ#11869)
    - Update documentation in regex.h (BZ#11857)
    - Prevent Altivec and VSX insns on PowerPC64 when no FPRs or VRs are
      available
    - Fix typo in x86-64 powl (BZ#12775)
  - Avoid overriding CFLAGS (#703880)


author: Andreas Schwab <schwab@redhat.com> - 2.13.90-13
changelog:
  - Update from master
    - Update GB18030 to 2005 version (BZ#11837)
    - Update RE_SYNTAX*_AWK constants in regex.h
    - Handle long variable names in putenv (BZ#11892)
    - Fix test for error_one_per_line mode in error (BZ#12766)
    - Cleanup x86-64 sys/user.h (BZ#11820)
    - Several locale data updates (BZ#11987, BZ#9732, BZ#9730, BZ#4357,
      BZ#12582)
    - Avoid potential deadlock in mtrace (BZ#6420)
    - Fix a few problems in fopen and freopen
    - Provide more helpful error message in getopt (BZ#7101)
    - Make stack canary value harder to read through read overflow (BZ#10149)
    - Use mmap for allocation of buffers used for __abort_msg (BZ#11901)
    - Fix handling of static TLS in dlopen'ed objects (BZ#12453)
    - Fix initialization of optimization values for AIO (BZ#12083)
    - Fix handling of conversion problem in CP932 module (BZ#12601)
    - Fix potential problem with out-of-scope buffer (BZ#12626)
    - Handle recursive calls in backtrace better (BZ#12432)
    - Fix handling of incomplete character storage in state
    - Fix file descriptor position after fclose (BZ#12724)
  - Reinstall NIS RPC headers


author: Andreas Schwab <schwab@redhat.com> - 2.13.90-12
changelog:
  - Update from master
    - Fix resizing table for unique symbols when adding symbol for copy
      relocation (BZ#12511)
    - Fix sched_setscheduler call in spawn implementation (BZ#12052)
    - Report write error in addmnt even for cached streams (BZ#12625)
    - Translate kernel error into what pthread_create should return
      (BZ#386)
    - More configurability for secondary group lookup (BZ#11257)
    - Several locale data updates (BZ#11258, BZ#11487, BZ#11532,
      BZ#11578, BZ#11653, BZ#11668, BZ#11945, BZ#11947, BZ#12158,
      BZ#12200, BZ#12178, BZ#12178, BZ#12346, BZ#12449, BZ#12545,
      BZ#12551, BZ#12611, BZ#12660, BZ#12681, BZ#12541, BZ#12711,
      BZ#12738)
    - Fix Linux getcwd for long paths (BZ#12713)
    - static tls memory leak on TLS_DTV_AT_TP archs
    - Actually undefine ARG_MAX from <linux/limits.h>
    - Backport BIND code to query name as TLD (BZ#12734)
    - Allow $ORIGIN to reference trusted directoreis in SUID binaries
      (BZ #12393)
    - Add missing {__BEGIN,__END}_DECLS to sys/sysmacros.h
    - Report if no record is found by initgroups in nss_files
  - Never leave $ORIGIN unexpanded
  - Revert "Ignore origin of privileged program"
  - Reexport RPC interface


author: Andreas Schwab <schwab@redhat.com> - 2.13.90-10
changelog:
  - Update from master
    - ldconfig: don't crash on empty path in config file (#699784)
    - getaddrinfo(AF_INET6) does not return scope_id info provided by
      NSS modules (BZ#12714)
    - Fix pathconf(_PC_BUF_SIZE) (BZ#12723)
    - Fix getnameinfo flags parameter type (BZ#12717)
    - Add finer grained control for initgroups lookups to NSS
    - Use all possible bytes from fopen mode string (BZ#12685, #698025)
    - Define initgroups callback for nss_files
    - elf.h: Define R_ARM_IRELATIVE reloc type
    - Fix static linking with checking x86/x86-64 memcpy (BZ#12653)
    - Fix POWER4/POWER7 optimized strncmp to not read past differing bytes
    - Fix FPU context handling in getcontext on x86-64 (BZ#12420)
    - Skip extra zeroes when searching auxv on s390
    - Obsolete RPC implementation in libc
    - Fix memory leak in TLS of loaded objects (BZ#12650)
    - Don't leave empty element in rpath when skipping an element
    - Make ppc sync_file_range cancelable
    - Maintain stack alignment in ____longjmp_chk on x86_64


author: Andreas Schwab <schwab@redhat.com> - 2.13.90-9
changelog:
  - Update from master
    - Fix typo in cache information table for x86-{32,64}
    - Define CLOCK_BOOTTIME, O_PATH, AT_EMPTY_PATH
    - Work around old buggy program which cannot cope with memcpy
      semantics (BZ#12518)
    - Fix visibility of declarations of wcpcpy and wcpncpy (BZ#12631)
    - Add clock_adjtime, name_to_handle_at, open_by_handle_at, syncfs
      syscalls
    - Really implement fallocate{,64} and sync_file_range as
      cancellation points
  - Enable systemtap support (#690281)


author: Andreas Schwab <schwab@redhat.com> - 2.13.90-7
changelog:
  - Update from master
    - Handle page boundaries in x86 SSE4.2 strncmp (BZ#12597)
    - Implement x86 cpuid handling of leaf4 for cache information (BZ#12587)
    - Check size of pattern in wide character representation in fnmatch
      (BZ #12583)
    - Remove __restrict quals from wmemcmp prototype
    - Fix copy relocations handling of unique objects (BZ#12510)
  - ldd: never run file directly
  - Ignore rpath elements containing non-isolated use of $ORIGIN when
    privileged
  - Don't leave empty element in rpath when skipping the first element
  - Revert "Don't crash when dependencies are missing" (#688990)


author: Andreas Schwab <schwab@redhat.com> - 2.13.90-6
changelog:
  - Update from master
    - Fix loading first object along a path when tracing
    - Enable SSE2 memset for AMD'supcoming Orochi processor
    - Don't read past end of buffer in fmemopen
  - Revert broken changes (#682307)


author: Andreas Schwab <schwab@redhat.com> - 2.13.90-5
changelog:
  - Update from master
    - Fix memory leak in dlopen with RTLD_NOLOAD (BZ#12509)
    - Don't crash when dependencies are missing (BZ#12454)
    - Fix allocation when handling positional parameters in printf
      (BZ#12445)
    - Fix two printf handler issues
  - Fix false assertion (BZ#12454, #673014)


author: Andreas Schwab <schwab@redhat.com> - 2.13.90-4
changelog:
  - Update from master
    - Update sysdeps/unix/sysv/linux/sparc/bits/socket.h
    - Synchronize generic bits/sched.h cpu_set_t with Linux implementation
    - Schedule nscd cache pruning more accurately from re-added values
    - Fix passing symbol value to pltexit callbacks when ld.so auditing
    - Fix range error handling in sgetspent
  - Revert "Fix ordering of DSO constructors and destructors" (#673014)
  - Create debuginfo-common on biarch archs
  - Reinstall assembler workaround.
  - Replace setuid by file capabilities (#646469)


author: Andreas Schwab <schwab@redhat.com> - 2.13.90-1
changelog:
  - Update from master
    - Fix ordering of DSO constructors and destructors (BZ#11724)
  - Remove no longer needed assembler workaround


author: Andreas Schwab <schwab@redhat.com> - 2.13-1
changelog:
  - Update to 2.13 release
    - Define AT_NO_AUTOMOUNT
    - Define MADV_HUGEPAGE and MADV_NOHUGEPAGE
    - Add definitions for new socket protocols
    - Signal temporary host lookup errors in nscd as such to the
      requester (BZ#6812)
    - Change setgroups to affect all the threads in the process
      (BZ#10563)
    - FIx handling of unterminated [ expression in fnmatch (BZ#12378)
    - Relax requirement on close in child created by posix_spawn
    - Fix handling of missing syscall in Linux mkdirat (BZ#12397)
    - Handle long lines in host lookups in the right place (BZ#10484)
    - Fix assertion when handling DSTs during auditing
    - Fix alignment in x86 destructor calls
    - Fix grouping when rounding increases number of integer digits
      (BZ#12394)
    - Update Japanese translations
    - Fix infloop on persistent failing calloc in regex (BZ#12348)
    - Use prlimit64 for 32-bit [gs]etrlimit64 implementation (BZ#12201)
    - Change XPG-compliant strerror_r function to return error code
      (BZ#12204)
    - Always allow overwriting printf modifiers etc.
    - Make PowerPC64 default to nonexecutable stack


author: Andreas Schwab <schwab@redhat.com> - 2.12.90-20
changelog:
  - Update from master
    - Declare wcpcpy and wcpncpy only under _GNU_SOURCE
    - Fix use of restrict in wchar.h and string.h
    - Fix race in qsort_r initialization (BZ#11655)
    - Don't ignore zero TTL in DNS answers
    - Allow aux_cache_file open()ing to fail silently even in the chroot
      mode (BZ#11149)
    - Fix multiple nss_compat initgroups() bugs (BZ#10085)
    - Define MAP_HUGETLB and SWAP_FLAG_DISCARD
  - Remove .UTF-8 suffix from locale names when it is the only supported
    codeset (#657556)
  - Don't ignore $ORIGIN in libraries


author: Andreas Schwab <schwab@redhat.com> - 2.12.90-19
changelog:
  - Update from master
    - Fix memory leak in fnmatch
    - Support Intel processor model 6 and model 0x2c
    - Fix comparison in sqrtl for IBM long double
    - Fix one exit path in x86-64 SSE4.2 str{,n}casecmp (BZ#12205, #651638)
    - Fix warnings in __bswap_16 (BZ#12194)
    - Use IFUNC on x86-64 memset
    - Power7-optimized mempcpy
    - Handle uneven cache size in 32bit SSE2 memset (BZ#12191)
    - Verify in ttyname that the symlink is valid (BZ#12167)
    - Update Danish translations
    - Fix concurrency problem between dl_open and dl_iterate_phdr
    - Fix x86-64 strchr propagation of search byte into all bytes of SSE
      register (BZ#12159)
    - Fix perturbing in malloc on free (BZ#12140)
    - PPC/A2 optimized memcpy function
    - Add C99 FP_FAST_FMA{,F,L} macros to <math.h>
  - Check that the running kernel is new enough (#649589)


author: Andreas Schwab <schwab@redhat.com> - 2.12.90-17
changelog:
  - Update from master
    - Fix some fma issues, implement fmal (BZ#3268, #43358)
    - Expect PLT call to _Unwind_Find_FDE on s390*-linux
  - Never expand $ORIGIN in privileged programs (#643306, CVE-2010-3847)


author: Andreas Schwab <schwab@redhat.com> - 2.12.90-16
changelog:
  - Update from master
    - Implement accurate fma (BZ#3268, #43358)
    - Fix alignment of AVX save area on x86-64 (BZ#12113)
    - Fix regex memory leaks (BZ#12078)
    - Improve output of psiginfo (BZ#12107, BZ#12108)
    - Don't return NULL address in getifaddrs (BZ#12093)
    - Fix strstr and memmem algorithm (BZ#12092, #641124)
  - Don't discard result of decoding ACE if AI_CANONIDN (#636642)
  - Remove /etc/gai.conf from glibc-common and mark it %ghost in glibc
  - Require exact glibc version in nscd


author: Andreas Schwab <schwab@redhat.com> - 2.12.90-15
changelog:
  - Update from master
    - Handle large requests in debugging hooks for malloc (BZ#12005)
    - Fix handling of remaining bytes in buffer for strncmp and
      strncasecmp (BZ#12077)
    - Handle cgroup and btrfs filesystems in statvfs
    - S/390: Fix highgprs check in startup code (BZ#12067)
    - Properly convert f_fsid in statvfs (BZ#11611)


author: Andreas Schwab <schwab@redhat.com> - 2.12.90-13
changelog:
  - Update from master
    - Add two forgotten licence exceptions
    - getdents64 fallback d_type support
    - Move freeres function from ld.so to libc.so
    - Undo feature selection for ftruncate (BZ#12037)
    - Fix namespace pollution in pthread_cleanup_push
    - Fix limit detection in x86-64 SSE2 strncasecmp (#632560)
    - Add support for fanotify_mark on sparc32 and s390
    - Fix register conflict in s390 ____longjmp_chk (#629970)
    - Don't try to free rpath strings allocated during startup (#629976)
    - Actually make it possible to user the default name server
  - Fix memory leak on init/fini dependency list (#632936)
  - Fix handling of collating symbols in regexps (BZ#11561)
  - Don't parse %s format argument as multibyte string (BZ#6530)
  - Fix overflow in nss files parser
  - Fix spurious nop at start of __strspn_ia32


author: Andreas Schwab <schwab@redhat.com> - 2.12.90-11
changelog:
  - Update from master
    - Fix _FORITY_SOURCE version of longjmp for Linux/x86-64 (BZ#11968)
  - Work around shortest-stem feature in make 3.82+


author: Andreas Schwab <schwab@redhat.com> - 2.12.90-10
changelog:
  - Update from master
    - Remove invalid iconv aliases (BZ#11979)
    - Update x86-64 mpn routines from GMP 5.0.1
    - Fix array overflow in floating point parser (BZ#7066)
    - Support fanotify_mark syscall on powerpc32
    - Unroll x86-64 strlen
    - Unroll 32bit SSE strlen and handle slow bsf
    - Missing server address again leads to localhost being used (BZ#10851)
  - Revert last change
  - Remove or don't install unpackaged files for auxarches


author: Andreas Schwab <schwab@redhat.com> - 2.12.90-8
changelog:
  - Update from master
    - Fix static strspn on x86 (#624852)
    - Various POWER7 optimized string functions
    - Fix x86 pthread_cond_signal() FUTEX_WAKE_OP fallback
    - Add optimized strncasecmp versions for x86-64
    - PowerPC64 ABI fixes
    - Properly quote output of locale (BZ#11904)
    - f_flags in statfs implementation
    - Add support for fanotify_init and fanotify_mask syscalls
    - Add support for prlimit and prlimit64
    - Fix IPTOS_CLASS definition (BZ#11903)
    - Avoid too much stack use in fnmatch (BZ#11883)
    - x86: Add support for frame pointer less mcount
  - Disable asynchronous-unwind-tables during configure run


author: Andreas Schwab <schwab@redhat.com> - 2.12.90-7
changelog:
  - Update from master
    - Add optimized x86-64 implementation of strnlen and strcaecmp
    - Document M_PERTURB
    - Fix vDSO synthetic hwcap handling so they are not masked out from
      ld.so.cache matching
    - POWER6/7 optimizations for copysign
  - Build with ports addon on alpha and armv5tel
  - Add conflict with kernel < 2.6.32 (#619538)
  - Switch to xz compressed tar files
  - build-locale-archive: process only directories matching *_*


author: Andreas Schwab <schwab@redhat.com> - 2.12.90-5
changelog:
  - Update from master
    - Don't pass NULL occation to dl_signal_cerror
    - Implement _PC_PIPE_BUF.
  - Add glibc-ports tarball


author: Andreas Schwab <schwab@redhat.com> - 2.12.90-4
changelog:
  - Update from master
    - Work around kernel rejecting valid absolute timestamps
    - Improve 64bit memcpy/memmove for Atom, Core 2 and Core i7
    - Fix error handling in Linux getlogin*
  - Workaround assembler bug sneaking in nopl (#579838)
  - Fix scope handling during dl_close
  - Fix setxid race handling exiting threads


author: Andreas Schwab <schwab@redhat.com> - 2.12.90-3
changelog:
  - Update from master
    - Power7 string compare optimizations
    - Properly resize buffer in NIS initgroups
    - Define F_SETPIPE_SZ and F_GETPIPE_SZ
    - Fix more C++ incompatibility problems in headers
  - Properly set __libc_multiple_libcs
  - Don't assume AT_PAGESIZE is always available (#597578)
  - Don't call uname or getrlimit in libpthread init function (#579086)
  - Mark /etc/rpc as %config (#587050)


author: Andreas Schwab <schwab@redhat.com> - 2.12.90-2
changelog:
  - Update from master
    - Small fix to POWER7 32-bit memcpy
    - Correct x86 CPU family and model check (BZ#11640, #596554)
    - Fix iov size in SH register_dump
    - Don't crash on unresolved weak symbol reference
    - Implement recvmmsg also as socketcall
    - sunrpc: Fix spurious fall-through
    - Make <sys/timex.h> compatible with C++ (#593762)
  - Fix users and groups creation in nscd %post script


author: Andreas Schwab <schwab@redhat.com> - 2.12.90-1
changelog:
  - Update from master
    - POWER7 optimized memset
    - Fix typo in es_CR locale
    - Enable IDN support in getent
    - Fix race in free sanity check
    - Fix lookup of collation sequence value during regexp matching
    - Fix name of tt_RU.UTF-8@iqtelif locale (#589138)
    - Handle too-small buffers in Linux getlogin_r (BZ#11571, #589946)


author: Roland McGrath <roland@redhat.com> - 2.12-1
changelog:
  - Update to 2.12 release.
    - Fix ldconfig chroot handling.
    - Don't deadlock in __dl_iterate_phdr while (un)loading objects.
    - Fix handling of newline in addmntent.
    - Fix AIO when thread creation failed.


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-20
changelog:
  - Update from master
    - Fix bugs in x86-32 strcmp-sse4.S and strcmp-ssse3.S
    - Add x86-32 FMA support
    - Don't crash in trace mode when dependencies are missing
    - x86-64 SSE4 optimized memcmp
    - Fix makecontext on s390/s390x


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-18
changelog:
  - Update from master
    - Implement interfaces to set and get names of threads (BZ#11390)
    - Locale data updates (BZ#10824, BZ#10936, BZ#11470, BZ#11471)
    - Print reload count in nscd statistics (BZ#10915)
    - Fix reading loginuid file in getlogin{,_r}
    - Fix fallocate error return on i386
    - Fix cproj implmentation (BZ#10401)
    - Fix getopt handing (BZ#11039, BZ#11040, BZ#11041)
    - Implement new mode for NIS passwd.adjunct.byname table (BZ#11134)
    - Obey LD_HWCAP_MASK in ld.so.cache lookups


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-17
changelog:
  - Update from master
    - Locale data updates (BZ#11007, BZ#11258, BZ#11272, BZ#10554)
    - Handle DNS timeouts in old-style lookup code (BZ#11010)
    - Fix aux cache handling in ldconfig with chroot (BZ#11149)
    - Fix printing error messages in getopt (BZ#11043)
    - Declare iruserok and iruserok_af (BZ#11070)
    - Fix option aliasing in argp (BZ#11254)
    - Handle POSIX-compliant errno value of unlink in remove (BZ#11276)
    - Fix definition and testing of S_ISSOCK (BZ#11279)
    - Fix retrieving of kernel header version (BZ#11287)
    - Fix concurrent handling of __cpu_features (BZ#11292)
    - Handle unnecessary padding in getdents64 (BZ#11333)
    - Fix changes to interface list during getifaddrs calls (BZ#11387)
    - Missing memory barrier in DES initialization (BZ#11449)
    - Fix spurious UNAVAIL status is getaddrinfo
    - Add support for new clocks (BZ#11389)
    - Fix Linux getlogin{_r,} implementation
    - Fix missing zero-termination in cuserid (BZ#11397)
    - Fix glob with empty pattern
    - Fix handling of STB_GNU_UNIQUE in LD_TRACE_PRELINKING
    - Unify wint_t handling in wchar.h and wctype.h (BZ#11410)
    - Implement handling of libc ABI in ELF header
    - Don't underestimate length of DST substitution in rpath
    - Power7-optimized 64-bit and 32-bit memcpy
  - Assign global scope to RFC 1918 addresses (#577626)


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-15
changelog:
  - Update from master
    - sparc64: Fix handling of R_SPARC_TLS_LE_* relocations (#571551)
    - Handle ext4 and logfs in statvfs functions
    - Fix setxid race with thread creation
    - Pass -mtune=i686 to assembler when compiling for i686
    - Fix R_X86_64_PC32 overflow detection
    - Fix msgrcv on sparc64
    - Fix unwind info in x86 strcmp-sse4.S (BZ#11332)
    - sparc: Add multiarch support for memset/bzero/memcpy
  - Remove directories owned by filesystem (#569414)
  - Add %ghost /etc/gai.conf to glibc-common (#567748)


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-13
changelog:
  - Update from master
    - Use CPUID_OFFSET instead of FEATURE_OFFSET
    - Add 32bit memcmp/strcmp/strncmp optimized for SSSE3/SSS4.2
    - Fix file descriotor leak in nftw with FTW_CHDIR (BZ#11271)
    - Add Sparc STT_GNU_IFUNC support
    - Add power7-optimized classification functions
  - Reapply "Optimize 32bit memset/memcpy with SSE2/SSSE3."
  - Use unsigned comparison in sse memcpy/memset


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-12
changelog:
  - Update from master
    - Update constants in <sys/mount.h> for current kernels (#11235)
    - Fix endless loop with invalid /etc/shells file (#11242)
    - Fix sorting of malayalam letter 'na' (#10414)
    - Add kok_IN locale
    - Use common collation data in as_IN locale
    - Avoid alloca in setenv for long strings
  - Use shared mapping to reserve memory when creating locale archive (#10855)
  - Fix fstat on Linux/sparc64 (#11155)


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-11
changelog:
  - Update from master
    - Fix error checking in iconv (#558053)
    - Don't map U00DF to U1E9E in toupper table
    - _nl_load_locale() incorrectly handles mmap() failures (BZ#11200)
    - Fix various issues in regex matcher (BZ#11183, BZ#11184, BZ#11185,
      BZ#11186, BZ#11187, BZ#11188, BZ#11189, BZ#11190, BZ#11191,
      BZ#11192, BZ#11193)


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-10
changelog:
  - Update from master
    - Fix ____longjmp_chk for s390/s390x
    - Remove duplicate definitions of O_DSYNC and O_RSYNC for Linux/sparc
    - Ignore negative dynamic entry types (#546890)
    - Fix pthread_cond_*wait with requeue-PI on i386 (#548989)
    - Fix _XOPEN_SOURCE_EXTENDED handling
  - Revert "Optimize 32bit memset/memcpy with SSE2/SSSE3."


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-9
changelog:
  - Update from master.
    - Define IPTOS_CLASS_* macros according to RFC 2474 (BZ#11027)
    - Always use IPv4 sockets for IPv4 addresses (BZ#11141)
    - regcomp.c: do not ignore memory allocation failure (BZ#11127)
    - Fix malloc_info without prior allocations (BZ#11126)
    - Optimize 32bit memset/memcpy with SSE2/SSSE3
    - Relax feature tests in headers


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-5
changelog:
  - Update from master.
    - Additional setcontext(), etc. conformance tests (BZ#11115).
    - Handle AT_FDCWD in futimens (BZ#10992).
    - Update poll.h header for POSIX 2008 (BZ#11093).
    - Avoid ELF lookup race.


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-4
changelog:
  - Update from master.
    - Add Requeue-PI support for x86 arch.
    - Redefine O_SYNC and O_DSYNC to match 2.6.33+ kernels.
    - Fix a few error cases in *name4_r lookup handling (BZ#11000).
    - Fix kernel version check in recent ptsname change (BZ#11046).
    - Add more warnings to exec functions (BZ#11056).
    - Add recvmmsg interface.
    - Define SCHED_IDLE and SCHED_RESET_ON_FORK for Linux.


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-3
changelog:
  - Update from master.
    - Fix infloop in __pthread_disable_asynccancel on x86_64 (#537690).
    - Prevent unintended file desriptor leak in grantpt (#530558).
    - Fix startup to security-relevant statically linked binaries (#528631).
  - Re-install CFI in x86/x86_64 clone (#491542).


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-2
changelog:
  - Update from master.
    - Define week, first_weekday, and first_workday for en_DK locale (#525126).
    - Use struct timespec for timestamps in struct stat also if
      __USE_XOPEN2K8 (#539870).
    - Fix week information for nl_NL locale (#499748).
    - Update ntp_gettime for Linux (#479558).
    - Fix getwc* and putwc* on non-wide streams (BZ#10958).
    - Avoid warnings in CPU_* macros when using const bitsets (BZ#10918).
    - Handle LC_GLOBAL_LOCALE in duplocale (BZ#10969).
    - Fix _NC_LOCALE_NAME definition (BZ#10968).
    - Add missing Linux MADV_* definitions (BZ#10972).
    - Add support for new Linux error ERFKILL (BZ#10939).
  - Enable multi-arch support on ppc and ppc64.


author: Andreas Schwab <schwab@redhat.com> - 2.11-2
changelog:
  - Fix readahead on powerpc32.
  - Fix R_PPC64_{JMP_IREL,IRELATIVE} handling.
  - Fix preadv, pwritev and fallocate for -D_FILE_OFFSET_BITS=64 (#533063).


author: Andreas Schwab <schwab@redhat.com> - 2.11-1
changelog:
  - Update to 2.11 release.
  - Disable multi-arch support on PowerPC again since binutils is too old.
  - Fix crash in tzdata-update due to use of multi-arch symbol (#532128).


author: Andreas Schwab <schwab@redhat.com> - 2.10.90-27
changelog:
  - Update from master.
    - Fix races in setXid implementation (BZ#3270).
    - Implement IFUNC for PPC and enable multi-arch support.
    - Implement mkstemps/mkstemps64 and mkostemps/mkostemps64 (BZ#10349).
    - Fix IA-64 and S390 sigevent definitions (BZ#10446).
    - Fix memory leak in NIS grp database handling (BZ#10713).
    - Print timestamp in nscd debug messages (BZ#10742).
    - Fix mixing IPv4 and IPv6 name server in resolv.conf.
    - Fix range checks in coshl.
    - Implement SSE4.2 optimized strchr and strrchr.
    - Handle IFUNC symbols in dlsym (#529965).
    - Misc fixes (BZ#10312, BZ#10315, BZ#10319, BZ#10391, BZ#10425,
      BZ#10540, BZ#10553, BZ#10564, BZ#10609, BZ#10692, BZ#10780,
      BZ#10717, BZ#10784, BZ#10789, BZ#10847
  - No longer build with -fno-var-tracking-assignments.


author: Andreas Schwab <schwab@redhat.com> - 2.10.90-26
changelog:
  - Update from master.
    - Add ____longjmp_chk for sparc.
  - Avoid installing the same libraries twice.


author: Andreas Schwab <schwab@redhat.com> - 2.10.90-25
changelog:
  - Update from master
    - Fix descriptor leak when calling dlopen with RTLD_NOLOAD (#527409).
    - Fix week-1stday in C locale.
    - Check for integer overflows in formatting functions.
    - Fix locale program error handling (#525363).


author: Andreas Schwab <schwab@redhat.com> - 2.10.90-22
changelog:
  - Update from master.
    - Fix endless loop in localedef.
    - Fix __longjmp_chk on s390/s390x.
  - Fix exit codes in nscd start script (#521848).
  - Build with -fno-var-tracking-assignments for now (#523172).


author: Andreas Schwab <schwab@redhat.com> - 2.10.90-20
changelog:
  - Update from master.
    - Fix strstr/strcasestr/fma/fmaf on x86_64 (#519226).
    - Fix lookup of group names in hesiod initgroups (#520472).


author: Andreas Schwab <schwab@redhat.com> - 2.10.90-15
changelog:
  - Update from master.
    - fix fortify failure with longjmp from alternate stack (#512103).
  - Add conflict with prelink (#509655).


author: Andreas Schwab <schwab@redhat.com> - 2.10.90-13
changelog:
  - Update from master.
    - fix rehashing of unique symbols (#515677)
  - Fix spurious messages with --excludedocs (#515948)


author: Andreas Schwab <schwab@redhat.com> - 2.10.90-10
changelog:
  - Update from master.
    * fix memory ordering in pthread_mutex_unlock (BZ#10418)
    * implement RES_USE_DNSSEC option in resolver (#205842)
    * fix hang in ldd -r (#513945)


author: Andreas Schwab <aschwab@redhat.com> 2.10.90-1
changelog:
  - Update from master.
  - Enable multi-arch support on x86/x86-64.
  - Add requires glibc-headers to glibc-devel (#476295).
  - Implement second fallback mode for DNS requests (#505105).
  - Don't generate invalid POSIX TZ string for Asia/Dhaka timezone (#506941).
  - Allow backtrace through __longjmp_chk on powerpc.


author: Jakub Jelinek <jakub@redhat.com> 2.10.1-2
changelog:
  - fix accept4 on architectures other than i?86/x86_64
  - robustify nscd client code during server GC
  - fix up nscd segfaults during daemon shutdown
  - fix memchr on ia64 (BZ#10162)
  - replace the Sun RPC license with the BSD license, with the explicit
    permission of Sun Microsystems
  - fix up powerpc long double errno reporting


author: Jakub Jelinek <jakub@redhat.com> 2.9.90-21
changelog:
  - update from trunk
    - fix localedef
    - fix SHIFT_JIS iconv EILSEQ handling (#497267)
    - misc fixes (BZ#10093, BZ#10100)


author: Jakub Jelinek <jakub@redhat.com> 2.9.90-17
changelog:
  - update from trunk
    - if threads have very small stack sizes, use much smaller buffer
      in __get_nprocs when called from within malloc (#494631)


author: Jakub Jelinek <jakub@redhat.com> 2.9.90-15
changelog:
  - rebuilt with fixed gcc to avoid miscompilation of i586 memmove
  - reenable experimental malloc again


author: Jakub Jelinek <jakub@redhat.com> 2.9.90-11
changelog:
  - update from trunk
    - POSIX 2008 prototype adjustments for scandir{,64}, alphasort{,64} and
      versionsort{,64}
    - fix libthread_db (#491197)


author: Jakub Jelinek <jakub@redhat.com> 2.9.90-9
changelog:
  - update from trunk
    - POSIX 2008 support: -D_XOPEN_SOURCE=700 and -D_POSIX_C_SOURCE=200809L
  - move libnldbl_nonshared.a on ppc*/s390*/sparc* back to glibc-devel


author: Jakub Jelinek <jakub@redhat.com> 2.9.90-7
changelog:
  - update from trunk
  - adjust for i586 + i686 from i386 + i686 build
  - split static libraries into glibc-static subpackage
  - ld -r the whole libpthread.a together to avoid endless issues with
    -static ... -lpthread
  - require 2.6.18 and later kernel


author: Jakub Jelinek <jakub@redhat.com> 2.9-3
changelog:
  - temporarily disable _nss_dns_gethostbyname4_r (#459756)
  - NIS hostname lookup fixes (#473073, #474800, BZ#7058)
  - fix unsetenv (#472941)


author: Jakub Jelinek <jakub@redhat.com> 2.8.90-17
changelog:
  - update from trunk
    - don't abort on broken DNS replies (#469299, BZ#7009)
    - misc fixes (BZ#6966, BZ#7008, BZ#6955, BZ#6843)


author: Jakub Jelinek <jakub@redhat.com> 2.8.90-16
changelog:
  - update from trunk
    - further resolver fixes
    - another dynamic TLS handling fix (#469263)
    - misc fixes (BZ#6867, BZ#6875, BZ#6919, BZ#6920, BZ#6942, BZ#6947,
  		BZ#6968, BZ#6974, BZ#6980, BZ#6995)
  - rebuild with newer rpm to avoid stripping
    shared libraries when they shouldn't be (#468129)


author: Jakub Jelinek <jakub@redhat.com> 2.8.90-14
changelog:
  - update from trunk
    - fix dynamic TLS handling (#467309)
    - fix sys/signalfd.h for C++ (#467172)
    - fix sprof (#458861)
    - fix _mcount and socket syscalls on s390x (#464146)
    - try harder to allocate memory in valloc and pvalloc (#461481)
  - fix power6 32-bit libs (#467311)


author: Jakub Jelinek <jakub@redhat.com> 2.8.90-12
changelog:
  - update from trunk
    - revert origin changes (#457849)
    - use MAP_STACK for thread stacks
    - misc fixes (BZ#6845, BZ#6544, BZ#6634, BZ#6589, BZ#6790, BZ#6791,
      BZ#6824)
    - power7 bits (BZ#6817)
    - fix expm1 on i?86/x86_64 (#43354, BZ#5794)


author: Jakub Jelinek <jakub@redhat.com> 2.8.90-11
changelog:
  - update from trunk
    - fix non-absolute $ORIGIN handling (#457560)
    - exported some further libresolv APIs (#453325)
    - misc fixes


author: Jakub Jelinek <jakub@redhat.com> 2.8.90-10
changelog:
  - update from trunk
    - resolver fixes
    - misc fixes (BZ#6771, BZ#6763, BZ#6698, BZ#6712)
    - s390{,x} utmp/utmpx bi-arch support (BZ#6724)
    - popen "e" flag
  - fr_FR locale changes reenabled


author: Jakub Jelinek <jakub@redhat.com> 2.8.90-9
changelog:
  - update from trunk
    - fix unbuffered vfprintf if writing to the stream fails (#455360)
    - remove useless "malloc: using debugging hooks" message (#455355)
    - nscd fixes
    - fix resolver alignment issues (#454500)
    - fix setvbuf (BZ#6719)


author: Jakub Jelinek <jakub@redhat.com> 2.8.90-7
changelog:
  - update from trunk
    - avoid *lround* on ppc* clobbering cr3/cr4 registers (#450790)
    - further nscd fixes (#450704)
    - use inotify in nscd to watch files


author: Jakub Jelinek <jakub@redhat.com> 2.8.90-6
changelog:
  - update from trunk
    - nscd fixes (#450704)
    - fix getservbyport (#449358)
    - fix regexp.h (#446406)
    - avoid crashing on T_DNAME in DNS responses (#450766)


author: Jakub Jelinek <jakub@redhat.com> 2.8.90-1
changelog:
  - update to trunk
    - O(n) memmem/strstr/strcasestr
    - i386/x86_64 TLS descriptors support
    - concurrent IPv4 and IPv6 DNS lookups by getaddrinfo


author: Jakub Jelinek <jakub@redhat.com> 2.8-3
changelog:
  - don't run telinit u in %post if both /dev/initctl and
    /sbin/initctl exist (#444978)
  - workaround GCC ppc64 miscompilation of c{log{,10},acosh,atan}l
    (#444996)


author: Jakub Jelinek <jakub@redhat.com> 2.8-2
changelog:
  - fix nscd races during GC (BZ#5381)
  - rebuilt with fixed GCC to fix regex miscompilation on power6
  - SPARC fixes


author: Jakub Jelinek <jakub@redhat.com> 2.7.90-16
changelog:
  - update to trunk
    - misc fixes (BZ#4997, BZ#5741)
    - make sure all users of __libc_setlocale_lock know it is
      now a rwlock
    - fix ppc/ppc64 compatibility _sys_errlist and _sys_siglist
      symbols


author: Jakub Jelinek <jakub@redhat.com> 2.7.90-15
changelog:
  - update to trunk
    - misc fixes (BZ#4314, BZ#4407, BZ#5209, BZ#5436, BZ#5768, BZ#5998,
  		BZ#6024)
  - restart sshd in %post when upstart is used - it doesn't have
    /dev/initctl (#441763)
  - disable assert checking again


author: Jakub Jelinek <jakub@redhat.com> 2.7.90-14
changelog:
  - update to trunk
    - misc fixes (BZ#5443, BZ#5475, BZ#5478, BZ#5939, BZ#5979, BZ#5995,
  		BZ#6004, BZ#6007, BZ#6020, BZ#6021, BZ#6042)
    - change mtrace to keep perl 5.10 quiet (#441082)
    - don't share conversion state between mbtowc and wctomb (#438687)
    - if st_blksize is too large and malloc fails, retry with smaller
      buffer in opendir (#430768)
    - correct *printf overflow test (#358111)


author: Jakub Jelinek <jakub@redhat.com> 2.7.90-13
changelog:
  - update to trunk
    - don't define ARG_MAX in <limits.h>, as it is no longer
      constant - use sysconf (_SC_ARG_MAX) to get the current
      argument size limit
    - fix build on sparc64
  - only service sshd condrestart if /etc/rc.d/init.d/sshd exists
    (#428859)


author: Jakub Jelinek <jakub@redhat.com> 2.7.90-12
changelog:
  - update to trunk
    - new CLONE_* flags in <sched.h> (#438542)
    - nis+ errno clobbering fix (#437945)
    - fix adjtime (#437974)


author: Jakub Jelinek <jakub@redhat.com> 2.7.90-8
changelog:
  - update to trunk
    - {,v}{as,d}printf and obstack_{,v}printf fortification (#435905)
    - fix getnameinfo/gethostbyaddr (#428067, BZ#5790)
    - fix yp_order (#435519, BZ#5854)
    - misc fixes (BZ#5779, BZ#5736, BZ#5627, BZ#5818, BZ#5012)
  - merge review cleanup (Tom Callaway, #225806)


author: Jakub Jelinek <jakub@redhat.com> 2.7.90-7
changelog:
  - update to trunk
    - make NI_MAXHOST and NI_MAXSERV available even in BSDish
      namespaces (BZ#5737)
    - timerfd_* syscalls


author: Jakub Jelinek <jakub@redhat.com> 2.7.90-4
changelog:
  - update to trunk
    - misc fixes (BZ#5541, BZ#5545, BZ#5553, BZ#5112, BZ#5520)
    - getaddrinfo fixes
    - signalize EOVERFLOW from sem_post instead of overflowing
      the counter
    - fix i?86 makecontext
    - fix iconv for iso-2022-jp//translit (#397021)


author: Jakub Jelinek <jakub@redhat.com> 2.7.90-3
changelog:
  - update to trunk
    - fix recognition of interface family (#425768)
    - add __THROW to __ctype_{b,tolower,toupper}_loc prototypes


author: Jakub Jelinek <jakub@redhat.com> 2.7-1
changelog:
  - glibc 2.7 release
  - fix tzfile.c for times after last transition (#333561)
  - fix sem_post@GLIBC_2.0 on i?86
  - appease valgrind in libpthread.so initialization
  - misc fixes (BZ#3425, BZ#5184, BZ#5186)


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-20
changelog:
  - install <bits/error.h> (#330031)
  - disable -D_FORTIFY_SOURCE{,=2} support (with a warning) for
    GCC 3.4.x and earlier(#327641)
  - pl_PL locale changes (BZ#4098, #242296)
  - misc fixes (BZ#1140, BZ#3195, BZ#3242, BZ#4359)


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-18
changelog:
  - add signalfd, eventfd, eventfd_read, eventfd_write
  - qsort speedups
  - workaround for cpuid bugs (#324081)
  - make sure gettext's conversion_lock is initialized even if
    program isn't linked against libpthread.so.0, only dlopens it (#321761)
  - misc fixes (BZ#5112, BZ#5113, BZ#5104, BZ#5063, BZ#5010, BZ#4407,
    BZ#3924, BZ#5103, BZ#2633, BZ#181, BZ#73, #321901)


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-17
changelog:
  - fix {,v}swprintf with -D_FORTIFY_SOURCE=1 -mlong-double-64 on ppc*/s390*/sparc*
  - strcoll fixes
  - misc fixes (BZ#645, BZ#5071)
  - locale fixes (BZ#4941, #299321, #203364, #196711, #236212)


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-16
changelog:
  - misc fixes (BZ#4963, BZ#4972, BZ#5028, BZ#5043, BZ#5058)
  - improve -D_FORTIFY_SOURCE{,=2} diagnostic through warning/error
    attributes
  - fix wcscpy, wcpcpy, fgetws, fgetws_unlocked, swprintf and vswprintf
    fortification inlines
  - fix a scalability issue with lazy binding in heavily multithreaded
    programs


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-14
changelog:
  - -D_FORTIFY_SOURCE{,=2} support for C++
  - fortification of fread{,_unlocked}
  - support *scanf m allocation modifier (%ms, %mls, %mc, ...)
  - in -std=c99 or -D_XOPEN_SOURCE=600 mode don't recognize
    %as, %aS and %a[ as a GNU extension for *scanf
  - fix splice, vmsplice, tee return value, make them cancellation
    points
  - mq_open checking
  - use inline function rather than function-like macro
    for open{,at}{,64} checking
  - IFA_F_OPTIMISTIC handling in getaddrinfo (#259681)
  - fix an ABBA deadlock in ld.so (#284171)
  - remove sparc{32,64} unwind info from _start and clone


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-12
changelog:
  - readd x86_64 gettimeofday stuff, initialize it earlier
  - nis_list fix (#254115)
  - workaround for bugs in ia64 silly /emul/ia32-linux hack (#253961)
  - misc fixes (BZ#3924, BZ#4566, BZ#4582, BZ#4588, BZ#4726, BZ#4946,
    BZ#4905, BZ#4814, BZ#4925, BZ#4936, BZ#4896, BZ#4937, BZ#3842,
    BZ#4554, BZ#4557, BZ#4938)


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-11
changelog:
  - remove __strtold_internal and __wcstold_internal from ppc*/s390*/sparc*
    *-ldbl.h headers
  - temporarily backout x86_64 gettimeofday.S changes (#252453)
  - some further sparc, sparc64 and alpha fixes


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-10
changelog:
  - don't open /etc/ld.so.{cache,preload} with O_NOATIME (#252146)
  - s390{,x}, alpha and sparc fixes
  - sparcv9 is no longer an aux arch, as we expect
    to not build sparc.rpm glibc any longer, only sparcv9.rpm,
    sparc64.rpm and new two aux arches sparcv9v.rpm and sparc64v.rpm


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-9
changelog:
  - private futex even for mutexes and condvars
  - some further O_CLOEXEC changes
  - use vDSO on x86_64 if available
  - ia64 build fixes (#251983)


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-3
changelog:
  - fix open{,at}{,64} macro for -pedantic (#250897)
  - add transliteration for l with stroke (#250492)
  - fix strtod ("-0", NULL)
  - update License tag


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-2
changelog:
  - make aux-cache purely optional performance optimization in ldconfig,
    don't issue any errors if it can't be created (#250430)
  - remove override_headers hack, BuildRequire >= 2.6.22 kernel-headers
    and rely on its content


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-1
changelog:
  - update to trunk
    - private futex optimizations
    - open{,at}{,64} argument checking
  - ldconfig speedups


author: Jakub Jelinek <jakub@redhat.com> 2.6-4
changelog:
  - filter <built-in> pseudo-files from debuginfo source lists (#245714)
  - fix sscanf when errno is EINTR before the call (BZ#4745)
  - save/restore errno around reading /etc/default/nss (BZ#4702)
  - fix LD_HWCAP_MASK handling
  - disable workaround for #210748, instead backport
    ld.so locking fixes from the trunk (#235026)
  - new x86_64 memcpy
  - don't write uninitialized padding bytes to nscd socket
  - fix dl{,v}sym, dl_iterate_phdr and dlopen if some library is
    mapped into ld.so's inter-segment hole on x86_64 (#245035, #244545)
  - fix LD_AUDIT=a:b program (#180432)
  - don't crash on pseudo-zero long double values passed to
    *printf on i?86/x86_64/ia64 (BZ#4586)
  - fix *printf %La and strtold with some hexadecimal floating point
    constants on ppc/ppc64
  - fix nextafterl on ppc/ppc64
  - fix sem_timedwait on i?86 and x86_64


author: Jakub Jelinek <jakub@redhat.com> 2.6-3
changelog:
  - don't use %config(missingok) for locale-archive.tmpl,
    instead of removing it altogether truncate it to zero
    size (#240697)
  - add a workaround for #210748


author: Jakub Jelinek <jakub@redhat.com> 2.6-2
changelog:
  - restore malloc_set_state backwards compatibility (#239344)
  - fix epoll_pwait (BZ#4525)
  - fix printf with unknown format spec or positional arguments
    and large width and/or precision (BZ#4514)
  - robust mutexes fix (BZ#4512)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-23
changelog:
  - use madvise MADV_DONTNEED in malloc
  - fix ia64 feraiseexcept
  - fix s390{,x} feholdexcept (BZ#3427)
  - ppc fenv fixes
  - make fdatasync a cancellation point (BZ#4465)
  - fix *printf for huge precisions with wide char code and multi-byte
    strings
  - fix dladdr (#232224, BZ#4131)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-22
changelog:
  - add transliteration for <U2044> (BZ#3213)
  - fix *scanf with %f on hexadecimal floats without exponent (BZ#4342)
  - fix *printf with very large precisions for %s (#238406, BZ#4438)
  - fix inet_ntop size checking for AF_INET (BZ#4439)
  - for *printf %e avoid 1.000e-00, for exponent 0 always use + sign (#238431)
  - fix a regression introduced in #223467 changes
  - gethostby*_r alignment fixes (BZ#4381)
  - fix ifaddrs error handling


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-21
changelog:
  - don't include individual locale files in glibc-common,
    rather include prepared locale-archive template and let
    build-locale-archive create locale-archive from the template
    and any user supplied /usr/lib/locale/*_* directories,
    then unlink the locale-archive template - this should save
    > 80MB of glibc-common occupied disk space
  - fix _XOPEN_VERSION (BZ#4364)
  - fix printf with %g and values tiny bit smaller than 1.e-4 (#235864,
    BZ#4362)
  - fix NIS+ __nisfind_server (#235229)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-20
changelog:
  - assorted NIS+ speedups (#223467)
  - fix HAVE_LIBCAP configure detection (#178934)
  - remove %{_prefix}/sbin/rpcinfo from glibc-common (#228894)
  - nexttoward*/nextafter* fixes (BZ#3306)
  - feholdexcept/feupdateenv fixes (BZ#3427)
  - speed up fnmatch with two or more * in the pattern


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-19
changelog:
  - fix power6 libm compat symbols on ppc32 (#232633)
  - fix child refcntr in NPTL fork (#230198)
  - fix ifaddrs with many net devices on > 4KB page size arches (#230151)
  - fix pthread_mutex_timedlock on x86_64 (#228103)
  - various fixes (BZ#3919, BZ#4101, BZ#4130, BZ#4181, BZ#4069, BZ#3458)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-18
changelog:
  - fix nftw with FTW_CHDIR on / (BZ#4076)
  - nscd fixes (BZ#4074)
  - fix fmod{,f,l} on i?86 (BZ#3325)
  - support localized digits for fp values in *scanf (BZ#2211)
  - namespaces fixes (BZ#2633)
  - fix euidaccess (BZ#3842)
  - glob fixes (BZ#3996)
  - assorted locale data fixes (BZ#1430, BZ#672, BZ#58, BZ#3156,
    BZ#2692, BZ#2648, BZ#3363, BZ#3334, BZ#3326, BZ#3322, BZ#3995,
    BZ#3885, BZ#3884, BZ#3851)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-17
changelog:
  - RFC2671 support in resolver (#205842)
  - fix strptime (BZ#3944)
  - fix regcomp with REG_NEWLINE (BZ#3957)
  - fix pthread_mutex_timedlock on x86_64 (#228103)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-16
changelog:
  - add strerror_l
  - fix application crashes when doing NSS lookups through nscd
    mmapped databases and nscd decides to start garbage collection
    during the lookups (#219145, #225315)
  - fix %0lld printing of 0LL on 32-bit architectures (BZ#3902)
  - ignore errors from install-info in glibc-devel scriptlets
    (#223691)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-15
changelog:
  - fix NIS getservbyname when proto is NULL
  - fix nss_compat +group handling (#220658)
  - cache services in nscd
  - fix double free in fts_close (#222089)
  - fix vfork+execvp memory leak (#221187)
  - soft-fp fixes (BZ#2749)
  - further strtod fixes (BZ#3855)
  - make sure pthread_kill doesn't return EINVAL even if
    the target thread exits in between pthread_kill ESRCH check
    and the actual tgkill syscall (#220420)
  - fix ABBA deadlock possibility in ld.so scope locking code


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-14
changelog:
  - fix {j,m}rand48{,_r} on 64-bit arches (BZ#3747)
  - handle power6x AT_PLATFORM (#216970)
  - fix a race condition in getXXbyYY_r (#219145)
  - fix tst-pselect testcase


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-13
changelog:
  - fix setcontext on ppc32 (#219107)
  - fix wide stdio after setvbuf (#217064, BZ#2337)
  - handle relatime mount option in statvfs
  - revert i?86/x86_64 clone CFI temporarily


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-12
changelog:
  - fix hasmntopt (#218802)
  - fix setusershell and getusershell (#218782)
  - strtod fixes (BZ#3664, BZ#3673, BZ#3674)
  - fix memusage with realloc (x, 0)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-11
changelog:
  - allow suid apps to setenv NIS_PATH and influence through that
    nis_list and nis_lookup (#209155)
  - fix ttyname and ttyname_r with invalid file descriptor (#218276)
  - cs_CZ LC_TIME fixes (#218438)
  - fix build with 2.6.19+ headers (#217723)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-9
changelog:
  - fix last svc_run change (#217850)
  - on ppc64 build __libc_start_main without unwind info,
    as it breaks MD_FROB_UPDATE_CONTEXT (#217729, #217775; in the
    future that could be fixable just by providing .cfi_undefined r2
    in __libc_start_main instead)
  - add unwind info for x86-64 restore_rt signal return landing pad
    (#217087)
  - add power6x subdir to /%{_lib}/ and /%{_lib}/rtkaio/,
    link all libs from ../power6/* into them


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-8
changelog:
  - fix svc_run (#216834, BZ#3559)
  - add -fasynchronous-unwind-tables to CFLAGS (#216518)
  - make sure there is consistent timestamp for /etc/ld.so.conf,
    /etc/localtime and /etc/rpc between multilib glibc rpms


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-7
changelog:
  - handle IPv6 addresses in /etc/hosts that are mappable to
    IPv4 addresses in IPv4 host lookups (#215283)
  - fix :include: /etc/alias handling (#215572)
  - handle new tzdata format to cope with year > 2037 transitions
    on 64-bit architectures


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-5
changelog:
  - fix sysconf (_SC_LEVEL{2,3}_CACHE_SIZE) on Intel Core Duo
    CPUs
  - fix libthread_db.so on TLS_DTV_AT_TP architectures
  - fix --inhibit-rpath (#214569)
  - fix _r_debug content when prelinked ld.so executes
    a program as its argument
  - fix strxfrm
  - powerpc-cpu add-on updates


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-4
changelog:
  - fix atexit backwards compatibility (#213388)
  - add mai_IN locale (#213415)
  - remove bogus %{_libdir}/librt.so.1 symlink (#213555)
  - fix memusage (#213656)
  - change libc.info category (#209493)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-2
changelog:
  - fix ia64 build
  - don't call _dl_close outside of dl_load_lock critical section
    if dlopen failed (BZ#3426)
  - add rtld scope locking (#211133)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-1
changelog:
  - fix i?86 6 argument syscalls (e.g. splice)
  - fix rtld minimal realloc (BZ#3352)
  - fix RFC3484 getaddrinfo sorting according to rules 4 and 7 (BZ#3369)
  - fix xdrmem_setpos (#211452)
  - bump __GLIBC_MINOR__
  - increase PTHREAD_STACK_MIN on ppc{,64} to 128K to allow
    64K pagesize kernels (#209877)
  - speed up initgroups on NIS+ (#208203)


author: Jakub Jelinek <jakub@redhat.com> 2.5-2
changelog:
  - fix nscd database growing (#207928)
  - bypass prelinking when LD_DYNAMIC_WEAK=1 is in the environment


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-35
changelog:
  - fix glob with large number of matches (BZ#3253)
  - fix fchownat on kernels that don't support that syscall (BZ#3252)
  - fix lrintl on s390{,64}


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-34
changelog:
  - fix ppc{32,64} longjmp (BZ#3225)
  - fix user visible spelling errors (BZ#3137)
  - fix l{,l}rint{,f,l} around zero (BZ#2592)
  - avoid stack trampoline in s390{,x} makecontext


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-33
changelog:
  - fix dlclose (#206639)
  - don't load platform optimized libraries if kernel doesn't set
    AT_PLATFORM
  - fix ppc{32,64} libSegFault.so
  - use -mtune=generic even for glibc-devel.i386 (#206437)
  - fix /%{_lib}/librt.so.1 symlink


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-32
changelog:
  - on ppc* use just AT_PLATFORM and altivec AT_HWCAP bit for library selection
  - fix lrintl and lroundl on ppc{,64}
  - use hidden visibility on fstatat{,64} and mknodat in libc_nonshared.a


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-31
changelog:
  - fix pthread_cond_{,timed}wait cancellation (BZ#3123)
  - fix lrint on ppc32 (BZ#3155)
  - fix malloc allocating more than half of address space (BZ#2775)
  - fix mktime on 32-bit arches a few years after 2038 (BZ#2821)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-30
changelog:
  - add librtkaio, to use it add /%{lib}/rtkaio to your
    LD_LIBRARY_PATH or /etc/ld.so.conf
  - fix or_IN February name (#204730)
  - fix pthread_create called from cancellation handlers (BZ#3124)
  - fix regex case insensitive searches with characters where upper
    and lower case multibyte representations have different length
    (e.g. I and dotless i, #202991)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-29
changelog:
  - randomize resolver query ids before use instead after use (#205113)
  - fix resolver symver checking with DT_GNU_HASH (#204909)
  - put .hash section in glibc libraries at the end of RO segment
    when .gnu.hash is present


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-27
changelog:
  - allow $LIB and $PLATFORM in dlopen parameters even in suid/sgid (#204399)
  - handle $LIB/$PLATFORM in LD_LIBRARY_PATH
  - fix splice prototype (#204530)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-26
changelog:
  - real fix for the doubly linked list corruption problem
  - try harder in realloc to allocate memory (BZ#2684)
  - fix getnameinfo error reporting (#204122)
  - make localedef more robust on invalid input (#203728)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-25
changelog:
  - temporarily back out code to limit number of unsorted block
    sort iterations (#203735, #204027)
  - handle PLT symbols in dladdr properly (BZ#2683)
  - avoid malloc infinite looping for allocations larger than
    the system can allocate (#203915)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-23
changelog:
  - malloc fixes, especially for 32-bit arches (#202309)
  - further *_IN locale fixes (#200230)
  - fix get{serv,rpc}ent{,_r} if NIS map is empty (#203237)
  - fix /usr/bin/iconv (#203400)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-21
changelog:
  - if some test gets stuck, kill the tee process after make check
    finishes
  - build with -mtune=generic on i686 and x86_64


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-19
changelog:
  - adaptive malloc brk/mmap threshold
  - fix fchownat to use kernel syscall (if available) on many arches (#201870)
  - only define O_DIRECT with -D_GNU_SOURCE on ia64 to match all
    other arches (#201748)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-18
changelog:
  - NIS+ fixes
  - fix memusage and xtrace scripts (#200736)
  - redirect /sbin/service sshd condrestart std{out,err} to /dev/null
    when executed from glibc_post_upgrade


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-16
changelog:
  - fix dladdr on binaries/libraries with only DT_GNU_HASH and no
    DT_HASH (#200635)
  - fix early timeout of initgroups data in nscd (#173019)
  - add am/pm display to es_PE and es_NI locales (#167101)
  - fix nss_compat failures when nis/nis+ unavailable (#192072)


author: Roland McGrath <roland@redhat.com> 2.4.90-15
changelog:
  - fix missing destructor calls in dlclose (#197932)
  - enable transliteration support in all locales (#196713)
  - disallow RTLD_GLOBAL flag for dlmopen in secondary namespaces (#197462)
  - PI mutex support


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-12
changelog:
  - buildrequire gettext
  - enable fstatat64/newfstatat syscalls even on ppc*/s390*/ia64 (#196494)
  - fix out of memory behavior in gettext (#194321)
  - fix regex on multi-byte non-UTF-8 charsets (#193873)
  - minor NIS+ fixes (#190803)
  - don't use cancellable calls in posix_spawn* and only set{u,g}id
    current thread if requested (#193631)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-11
changelog:
  - don't exit from nscd -i <database> before the database is
    actually invalidated, add locking to prune_cache (#191464)
  - build glibc-devel.i386 static libraries with
    -mno-tls-direct-seg-refs -DNO_TLS_DIRECT_SEG_REFS
  - RFC3542 support (advanced API for IPv6; #191001, BZ##2693)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-8
changelog:
  - update from CVS
    - fix nss_compat when SETENT_BATCH_READ=TRUE is in /etc/default/nss
    - fix RFC3484 precedence table for site-local and ULA addresses (#188364)
    - fix a sunrpc memory leak


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-5
changelog:
  - update from CVS
    - some NIS+ fixes
    - allow overriding rfc3484 address sorting tables for getaddrinfo
      through /etc/gai.conf (sample config file included in %doc directory)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-4
changelog:
  - update from CVS
    - SETENT_BATCH_READ /etc/default/nss option for speeding up
      some usages of NIS+ (#188246)
    - move debug state change notification (#179208)
    - fix ldd script if one of the dynamic linkers is not installed (#190259)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-3
changelog:
  - update from CVS
    - fix a typo in nscd.conf (#190085)
    - fix handling of SIGHUP in nscd when some caches are disabled (#189978)
    - make nscd paranoia mode working with non-root server-user (#189779)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-2
changelog:
  - update from CVS
    - fix getaddrinfo (#190002)
    - add auto-propagate nscd.conf options (#177154)
    - fix nscd auditing (#169148)


author: Jakub Jelinek <jakub@redhat.com> 2.4-6
changelog:
  - update from CVS
    - NIS+ fixes
    - don't segfault on too large argp key values (#189545)
    - getaddrinfo fixes for RFC3484 (#188364)


author: Jakub Jelinek <jakub@redhat.com> 2.4-5
changelog:
  - update from CVS
    - pshared robust mutex support
    - fix btowc and bwtoc in C++ (#186410)
    - fix NIS+ (#186592)
    - don't declare __wcsto*l_internal for non-GCC or if not -O1+ (#185667)
  - don't mention nscd failures on 2.0 kernels (#185335)


author: Jakub Jelinek <jakub@redhat.com> 2.4-2
changelog:
  - accurate unwind info for lowlevellock.h stubs on %{ix86}
  - fix ppc/ppc64 ceill, floorl, rintl, roundl and truncl (BZ#2423)


author: Jakub Jelinek <jakub@redhat.com> 2.3.91-2
changelog:
  - update from CVS
    - fix sYSMALLOc for MALLOC_ALIGNMENT > 2 * SIZE_SZ (#183895)
    - revert ppc32 malloc alignment patch, it breaks malloc_set_state
      and needs some further thoughts and time (#183894)
  - provide accurate unwind info for lowlevellock.h stubs on x86_64


author: Jakub Jelinek <jakub@redhat.com> 2.3.91-1
changelog:
  - update from CVS
    - fixes for various arches
  - ensure malloc returns pointers aligned to at least
    MIN (2 * sizeof (size_t), __alignof__ (long double))
    (only on ppc32 this has not been the case lately with addition
     of 128-bit long double, #182742)


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-36
changelog:
  - update from CVS
    - fix frequency setting for ITIMER_PROF (#179938, BZ#2268)
    - fix powerpc inline fegetround ()
    - fix nptl_db (#179946)


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-35
changelog:
  - update from CVS
    - handle futimesat (fd, NULL, tvp) as futimes (fd, tvp)
  - fix <stdlib.h> q{e,f,g}cvt{,_r} for -mlong-double-64


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-34
changelog:
  - fix <math.h> with C++ and -mlong-double-64 (#179742)
  - add nexttowardl redirect for -mlong-double-64


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-32
changelog:
  - update from CVS
    - 128-bit long double fixes for ppc{,64}, s390{,x} and sparc{,v9},
      alpha 128-bit long double support
  - add inotify syscall numbers to the override <asm/unistd.h> headers
    (#179366)


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-31
changelog:
  - update from CVS
    - 128-bit long double on ppc, ppc64, s390, s390x and sparc{,v9}
  - add some new syscall numbers to the override <asm/unistd.h>
    headers


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-30
changelog:
  - update from CVS
    - <pthread.h> initializer fixes for -std=c{8,9}9 on 32-bit
      arches
  - avoid writable .rodata (#177121)


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-29
changelog:
  - update from CVS
    - make pthread_mutex_t an unnamed union again, as it affects
      libstdc++ ABI mangling


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-26
changelog:
  - update from CVS
    - for newly linked lio_listio* callers, send per request
      notifications (#170116)
    - fixup nscd -S option removal changes (#176860)
    - remove nonnull attribute from ctermid (#176753)
    - fix PTHREAD_*_INITIALIZER{,_NP} on 64-bit arches
    - SPARC NPTL support for pre-v9 CPUs
  - drop support for 2.4.xx and < 2.6.9 kernels


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-25
changelog:
  - update from CVS
    - s390{,x} and sparc{,64} pointer mangling fixes
  - install a sanitized LinuxThreads <bits/libc-lock.h>


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-23
changelog:
  - update from CVS
    - robust mutexes
  - fix transliteration segfaults (#176573, #176583)
  - ignore prelink temporaries in ldconfig (#176570)


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-22
changelog:
  - update from CVS
    - minor fts fixes
  - revert broken _Pragma () workaround
  - fix ldconfig on bi-arch architectures (#176316)


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-20
changelog:
  - update from CVS
    - time ((void *) 1) should segfault, not return -EFAULT (#174856, BZ#1952)
    - fix errlist generation
  - update ulps for GCC 4.1 on IA-64


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-19
changelog:
  - update from CVS
    - sysdeps/generic reorg
    - setjmp/longjmp jump pointer mangling
  - rebuilt with GCC 4.1-RH prerelease, worked around broken _Pragma ()
    handling in it
  - remove glibc-profile subpackage
  - use non-PLT calls for malloc/free/realloc/memalign invocations in
    mtrace and mcheck hooks (#175261)
  - setjmp/longjmp jump pointer mangling on ppc{,64}/ia64/s390{,x}


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-18
changelog:
  - update from CVS
    - change <sys/stat.h> for broken apps that #define const /**/,
      handle non-GCC compilers
    - fix ppc{32,64} strncmp (BZ#1877, #173643, IT#83510)
    - provide shmatt_t typedef in ia64 <sys/shm.h (#173680)
    - support 2nd arg to futimesat being NULL (#173581)


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-17
changelog:
  - update from CVS
    - fix <sys/stat.h> in C++
    - {fstat,fchown,rename,unlink}at fixes
    - epoll_wait is now a cancellation point


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-15
changelog:
  - update from CVS
    - be permissive in %n check because of kernel bug #165351 (#171240)
    - don't misalign stack in pthread_once on x86_64 (#170786, IT#81521)
    - many locale fixes


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-14
changelog:
  - update from CVS
    - fix malloc bug after fork introduced in the last update
    - fix getent hosts IP for IPv4 IPs (#169831)


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-13
changelog:
  - update from CVS
    - fix setuid etc. hangs if some thread exits during the call (#167766)
    - fix innetgr memory leak (#169051)
    - support > 2GB nscd log files (#168851)
    - too many other changes to list here
  - include errno in nscd message if audit_open failed (#169148)


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-12
changelog:
  - update from CVS
    - netgrp handling fixes (#167728)
    - fix memory leak in setlocale (BZ#1318)
    - fix hwcaps computation
    - several regex portability improvements (#167019)
    - hypotf fix
    - fix *printf return code if underlying write fails (BZ#1146)
    - PPC64 dl{,v}sym fixes for new ABI .opd symbols
  - fix calloc with MALLOC_PERTURB_ in environment on 64-bit architectures
    (#166719)
  - source /etc/sysconfig/nscd (if it exists) in /etc/rc.d/init.d/nscd
    (#167083)
  - add %triggerin for tzdata to glibc-common, so that tzdata updates
    update /etc/localtime and /var/spool/postfix/etc/localtime if they
    exist (#167787)


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-10
changelog:
  - update from CVS
    - fix growing of nscd persistent database (BZ#1204)
    - fix _FORTIFY_SOURCE mbstowcs and wcstombs if destination size
      is known at compile time, but length argument is not


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-9
changelog:
  - update from CVS
    - fix resolving over TCP (#161181, #165802)
    - on ia64 don't abort on unhandled math function exception codes
      (#165693)


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-8
changelog:
  - update from CVS
    - nscd persistent database verifier (#164001)
    - cleanup _FORTIFY_SOURCE bits/*.h headers (#165000)
    - handle EINTR in sigwait properly
  - make sure poor man's stack guard randomization keeps first
    byte 0 even on big-endian 32-bit arches
  - fix {elf,nptl}/tst-stackguard1
  - obsolete linuxthreads-devel in glibc-devel


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-7
changelog:
  - update from CVS
  - do some poor man's stack guard randomization even without
    the costly --enable-stackguard-randomization
  - rebuilt with new GCC to make it use -msecure-plt on PPC32


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-6
changelog:
  - update from CVS
    - fix execvp if PATH is not in environment and the call is going
      to fail (BZ#1125)
    - another bits/wchar2.h fix (#163990)


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-4
changelog:
  - update from CVS
    - make sure bits/wchar2.h header is installed
    - fix __getgroups_chk return type


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-3
changelog:
  - update from CVS
    - make sure nscd cmsg buffers aren't misaligned, handle EINTR from
      poll when contacting nscd more gracefully
    - remove malloc attribute from posix_memalign
    - correctly size nscd buffer for grpcache key (#163538)
    - fix atan2f
    - fix error memory leaks
    - some more _FORTIFY_SOURCE protection


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-2
changelog:
  - update from CVS
    - ia64 stack protector support
    - handle DNS referral results as server errors (#162625)
    - ctan{,h}{,f,l} fixes (#160759)
    - pass argc, argv and envp also to executable's *ni_array
      functions (BZ#974)
    - add ellipsis to clone prototype (#161593)
    - fix glibc-profile (#162601)
    - nss_compat fixes
  - use sysdeps/generic version of <bits/stdio-lock.h> in installed
    headers instead of NPTL version (#162634)


author: Jakub Jelinek <jakub@redhat.com> 2.3.90-1
changelog:
  - update from CVS
    - stack protector support
    - fix xdr_{,u_}{longlong_t,hyper} on 64-bit arches (#161583)
  - enable @GLIBC_2.4 symbols
  - remove linuxthreads


author: Jakub Jelinek <jakub@redhat.com> 2.3.5-11
changelog:
  - update from CVS
    - PPC32 -msecure-plt support
    - support classes keyword in /etc/hesiod.conf (#150350)
    - add RLIMIT_NICE and RLIMIT_RTPRIO to <sys/resources.h> (#157049)
    - decrease number of .plt relocations in libc.so
    - use -laudit in nscd (#159217)
    - handle big amounts of networking interfaces in getifaddrs/if_nameindex
      (#159399)
    - fix pa_IN locale's am_pm (#158715, BZ#622)
    - fix debugging of PIEs


author: Jakub Jelinek <jakub@redhat.com> 2.3.5-10
changelog:
  - fix LD_ASSUME_KERNEL (since 2.3.5-8 GLRO(dl_osversion)
    has been always overwritten with the version of currently
    running kernel)
  - remove linuxthreads man pages other than those covered in
    3p section, as 3p man pages are far better quality and describe
    POSIX behaviour that NPTL implements (#159084)


author: Jakub Jelinek <jakub@redhat.com> 2.3.5-9
changelog:
  - update from CVS
    - increase bindresvport's LOWPORT to 512, apparently some
      broken daemons don't think 0 .. 511 ports are reserved


author: Jakub Jelinek <jakub@redhat.com> 2.3.5-8
changelog:
  - update from CVS
    - fix kernel version check in ld.so
  - fix sendfile{,64} prototypes (BZ#961)
  - try more ports in bindresvport if all 600..1023 are
    used, don't use priviledged ports when talking to portmap
    (#141773)


author: Jakub Jelinek <jakub@redhat.com> 2.3.5-7
changelog:
  - update from CVS
    - make regexec thread safe (BZ#934)
  - fix statically linked programs on i?86, x86_64, s390* and
    sparc* (#158027)
  - fix IBM939 iconv module (BZ#955)


author: Jakub Jelinek <jakub@redhat.com> 2.3.5-5
changelog:
  - update from CVS
    - add some more UTF-8 locales (#156115)
  - clean up /lib64/tls instead of /lib/tls on x86-64, s390x and
    ppc64 in glibc_post_upgrade (#156656)
  - fix posix_fallocate{,64} (#156289)


author: Jakub Jelinek <jakub@redhat.com> 2.3.5-3
changelog:
  - update from CVS
    - fix linuxthreads clocks
  - put xen libs into the glibc-2*.i686 package instead of a separate one
  - fix librt.so symlink in linuxthreads-devel
  - do not include linuxthreads-devel on %{auxarches},
    just on the base architectures


author: Jakub Jelinek <jakub@redhat.com> 2.3.5-2
changelog:
  - update from CVS
    - with MALLOC_CHECK_=N N>0 (#153003)
    - fix recursive dlclose (#154641)
    - handle %z in strptime (#154804)
    - automatically append /%{_lib}/obsolete/linuxthreads/
      to standard library search path if LD_ASSUME_KERNEL=N N <= 2.4.19
      or for glibc 2.0 binaries (or broken ones that don't use errno/h_errno
      properly).  Warning: all those will stop working when LinuxThreads
      is finally nuked, which is not very far away
    - remove nonnull attribute from acct prototype (BZ#877)
    - kernel CPU clocks support
    - fix *scanf in locales with multi-byte decimal point


author: Roland McGrath <roland@redhat.com> 2.3.5-1
changelog:
  - update from CVS
    - fix execvp regression (BZ#851)
    - ia64 libm updates
    - sparc updates
    - fix initstate{,_r}/strfry (#154504)
    - grok PT_NOTE in vDSO for kernel version and extra hwcap dirs,
      support "hwcap" keyword in ld.so.conf files


author: Jakub Jelinek <jakub@redhat.com> 2.3.4-21
changelog:
  - update from CVS
    - fix xdr_rmtcall_args on 64-bit arches (#151686)
  - fix <pthread.h> and <bits/libc-lock.h> with -std=c89 -fexceptions (#153774)


author: Jakub Jelinek <jakub@redhat.com> 2.3.4-20
changelog:
  - move LinuxThreads libraries to /%{_lib}/obsolete/linuxthreads/
    and NPTL libraries to /%{_lib}.  To run a program against LinuxThreads,
    LD_ASSUME_KERNEL=2.4.xx LD_LIBRARY_PATH=/%{_lib}/obsolete/linuxthreads/
    is now needed
  - bzip2 ChangeLog* files instead of gzipping them


author: Jakub Jelinek <jakub@redhat.com> 2.3.4-19
changelog:
  - update from CVS
    - fix nextafterl and several other libm routines on ia64
    - fix initgroups (BZ#661)
  - kill nptl-devel subpackage, add linuxthreads-devel,
    compile and link by default against NPTL and only with
    -I/usr/include/linuxthreads -L/usr/%{_lib}/linuxthreads
    against LinuxThreads
  - package /usr/lib/debug/%{_lib}/tls/i{5,6}86 symlinks in
    i386 glibc-debuginfo
  - limit number of ChangeLog* files in glibc-common %doc
    to last 2.5 years of changes only to save space


author: Jakub Jelinek <jakub@redhat.com> 2.3.4-17
changelog:
  - update from CVS
    - fix LD_AUDIT in LinuxThreads ld.so
    - fix calloc with M_PERTURB
    - fix error handling in pthread_create with PTHREAD_EXPLICIT_SCHED
      on ppc*/ia64/alpha/mips (BZ#801)
    - fix a typo in WINDOWS-31J charmap (#151739)
    - fix NIS ypprot_err (#151469)


author: Jakub Jelinek <jakub@redhat.com> 2.3.4-15
changelog:
  - update from CVS
    - better fix for the dlclose bug (#145810, #150414)
    - fix regex crash on case insensitive search in zh_CN locale
      (#151215)
    - fix malloc_trim (BZ#779)
    - with -D_FORTIFY_SOURCE=*, avoid defining read and a bunch of others
      as function-like macros, there are too many broken programs
      out there
  - add %dir %{_prefix}/%{_lib}/gconv to glibc's file list (#151372)


author: Jakub Jelinek <jakub@redhat.com> 2.3.4-12
changelog:
  - fix tst-chk{2,3}
  - fix up AS_NEEDED directive in /usr/%{_lib}/libc.so
  - BuildReq binutils >= 2.15.94.0.2-1 for AS_NEEDED, in
    glibc-devel Conflict with binutils < 2.15.94.0.2-1


author: Jakub Jelinek <jakub@redhat.com> 2.3.4-11
changelog:
  - update from CVS
    - fix execvp (#149290)
    - fix dlclose (#145810)
    - clear padding in gconv-modules.cache (#146614, BZ#776)
  - rebuilt with GCC4
  - changed __GLIBC_MINOR__ for now back to 3
  - back out the newly added GLIBC_2.4 *_chk routines, instead
    do the checking in macros


author: Jakub Jelinek <jakub@redhat.com> 2.3.4-8
changelog:
  - update from CVS
    - bi-arch <gnu/lib-names.h> (BZ#632)
    - fix libdl on s390 and maybe other platforms
    - fix initstate{,_r} (BZ#710)
    - fix <gnu/stubs.h> generation (BZ#157)
  - define CMSPAR in bits/termios.h (#147533)


author: Jakub Jelinek <jakub@redhat.com> 2.3.4-6
changelog:
  - update from CVS
    - ld.so auditing
    - fix segfault if chrooted app attempts to dlopen a library
      and no standard library directory exists at all (#147067, #144303)
    - fix initgroups when nscd is running, but has group caching disabled
      (#146588)
    - fix pthread_key_{create,destroy} in LinuxThreads when pthread_create
      has not been called yet (#146710)
    - fix ppc64 swapcontext and setcontext (#146736, BZ#700)
    - service nscd cosmetic fixes (#146776)
    - fix IA-32 and x86-64 stack alignment in DSO constructors (#145689)
    - fix zdump -v segfaults on x86-64 (#146210)
    - avoid calling sigaction (SIGPIPE, ...) inside syslog (#146021, IT#56686)
    - fix errno values for futimes (BZ#633)
    - unconditionally include <features.h> in malloc.h (BZ#650)
    - change regex \B handling to match old GNU regex as well as perl/grep's dfa
      (from empty string inside of word to empty string not at a word boundary,
       BZ#693)
    - slightly optimize i686 TLS accesses, use direct TLS %gs access in sem_*
      and allow building -mno-tls-direct-seg-refs glibc that is free of direct TLS
      %gs access with negative offsets
    - fix addseverity
    - fix fmemopen
    - fix rewinddir
    - increase svc{tcp,unix}_create listen backlog


author: Jakub Jelinek <jakub@redhat.com> 2.3.4-5
changelog:
  - update from CVS
    - add some warn_unused_result marking
    - make ftruncate available even for just -D_POSIX_C_SOURCE=200112L
      (BZ#640)


author: Jakub Jelinek <jakub@redhat.com> 2.3.4-4
changelog:
  - update from CVS
    - fix IA-32 stack alignment for LinuxThreads thread functions
      and functions passed to clone(2) directly
    - fix ecvt{,_r} on denormals (#143279)
    - fix __tls_get_addr typo
    - fix rounding in IA-64 alarm (#143710)
    - don't reinitialize __environ in __libc_start_main, so that
      effects of setenv/putenv done in DSO initializers are preserved
      (#144037, IT#57403)
    - fix fmemopen
    - fix vDSO l_map_end and l_text_end values
    - IA64 libm update (#142494)
  - fix ppc rint/ceil etc. (BZ#602)


author: Jakub Jelinek <jakub@redhat.com> 2.3.4-1
changelog:
  - update from CVS
    - glibc 2.3.4 release
    - add -o and --nostdlib options to iconvconfig
  - if /sbin/ldconfig doesn't exist when running
    glibc_post_upgrade.%{_target_cpu}, just don't attempt to run it.
    This can happen during first install of bi-arch glibc and the
    other arch glibc's %post wil run /sbin/ldconfig (#143326)
  - use -o and --nostdlib options to create all needed
    gconv-modules.cache files on bi-arch setups


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-98
changelog:
  - add .%{_target_cpu} to glibc_post_upgrade, only run telinit u
    if /sbin/init is the same ELF class and machine as
    glibc_post_upgrade.%{_target_cpu} and similarly with
    condrestarting sshd (#143046)


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-96
changelog:
  - update from CVS
    - fix i686 __USE_STRING_INLINES strncat
    - make sure ppc/ppc64 maintain correct stack alignment
      across clone


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-93
changelog:
  - update from CVS
    - ppc/ppc64 clone without CLONE_THREAD getpid () adjustement
    - fix MALLOC_CHECK_={1,2,3} for non-contiguous main arena
      (BZ#457)
    - fix sysconf (_POSIX_V6_*) for other ABI environments in
      bi-arch setups
  - s390/s390x clone without CLONE_THREAD getpid () adjustement


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-91
changelog:
  - update from CVS
    - double buffer size in getXXbyYY or getXXent on ERANGE
      instead of adding BUFLEN (#142617)
    - avoid busy loop in malloc if another thread is doing fork
      (#142214)
    - some more realloc corruption checks
    - fix getconf _POSIX_V6_WIDTH_RESTRICTED_ENVS output,
      tweak %{_prefix}/libexec/getconf/ filenames


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-90
changelog:
  - update from CVS
    - regex speedups
    - use | cat in ldd if running under bash3+ to allow running
      it on binaries that are not through SELinux allowed to access
      console or tty
  - add __NR_waitid defines for alpha and ia64


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-89
changelog:
  - update from CVS
    - fix clone2 on ia64
    - avoid tst-timer5 failing with linuxthreads implementation
  - if __libc_enable_secure, disallow mode != normal
  - change ldd script to imply -r when -u is used, properly
    propagate return value and handle suid binaries


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-88
changelog:
  - update from CVS
    - disregard LD_SHOW_AUXV and LD_DYNAMIC_WEAK if __libc_enable_secure
    - disregard LD_DEBUG if __libc_enable_secure in normal mode
      if /suid-debug doesn't exist
    - fix fseekpos after ungetc
    - avoid reading bytes before start of buffers in regex's
      check_dst_limits_calc_pos_1 (#142060)
    - make getpid () working with clone/clone2 without CLONE_THREAD
      (so far on i386/x86_64/ia64 only)
  - move %{_prefix}/libexec/getconf/* to glibc from glibc-common
  - make %{_prefix}/libexec/getconf directory owned by glibc package


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-87
changelog:
  - update from CVS
    - build libpthread_nonshared.a objects with -fPIC on s390/s390x
    - fix mktime with < 0 or > 59 tm_sec on entry
    - remove nonnull attribute for realpath
    - add $(make-target-directory) for errlist-compat.c rule
      (hopefully fix #141404)
  - add testcase for ungetc bug
  - define _POSIX_{,THREAD_}CPUTIME to 0 on all Linux arches


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-86
changelog:
  - update from CVS
    - some posix_opt.h fixes
  - fix strtold use of unitialized memory (#141000)
  - some more bugfixes for bugs detected by valgrind
  - rebuilt with GCC >= 3.4.3-5 to avoid packed stack layout
    on s390{,x} (#139678)


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-85
changelog:
  - update from CVS
    - support -v specification in getconf
    - fix sysconf (_SC_LFS64_CFLAGS) etc.
    - avoid thread stack aliasing issues on EM64T (#140803)
  - move %{_prefix}/include/nptl headers from nptl-devel
    to glibc-headers, so that even NPTL specific programs
    can be built bi-arch without problems


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-84
changelog:
  - update from CVS
    - fix memory leak in getaddrinfo if using nscd (#139559)
    - handle large lines in /etc/hosts and /etc/networks
      (#140378)
    - add nonnull attributes to selected dirent.h and dlfcn.h
      functions


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-83
changelog:
  - update from CVS
    - add deprecated and/or nonnull attribute to some signal.h
      functions
    - speed up tzset () by only using stat instead of open/fstat
      when calling tzset for the second and following time if
      /etc/localtime has not changed
  - fix tgamma (BZ #552)


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-82
changelog:
  - update from CVS
    - some malloc () checking
    - libpthread.a object dependency cleanups (#115157)
    - <bits/socket.h> fix for -std=c89 -pedantic-errors (#140132)


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-80
changelog:
  - update from CVS
    - with -D_FORTIFY_SOURCE=2, prevent missing %N$ formats
    - for -D_FORTIFY_SOURCE=2 and %n in writable format string,
      issue special error message instead of using the buffer overflow
      detected one
    - speedup regex searching with REG_NOSUB, add RE_NO_SUB,
      speedup searching with nested subexps (BZ #544)
    - block SIGCANCEL in NPTL timer_* helper thread
  - further free () checking


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-79
changelog:
  - update from CVS
  - fix free () checking
  - move /etc/default/nss into glibc-common (hopefully fix #132392)


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-78
changelog:
  - update from CVS
    - fix LD_DEBUG=statistics
    - issue error message before aborting in __chk_fail ()
  - some more free () checking


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-77
changelog:
  - update from CVS
    - speedup regex on palindromes (BZ #429)
    - fix NPTL set{,e,re,res}[ug]id, so that even if making process
      less priviledged all threads change their credentials successfully


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-76
changelog:
  - update from CVS
    - fix regcomp crash (#138439)
    - fix ftell{,o,o64} (#137885)
    - robustification of nscd to cope with corrupt databases (#137140)
    - fix NPTL with pthread_exit immediately after pthread_create (BZ #530)
    - some regex optimizations


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-75
changelog:
  - update from CVS
    - mktime cleanups (BZ #487, #473)
    - unique comments in free(3) check error messages
  - adjust some x86_64 headers for -m32 (#129712)
  - object size checking support even with GCC-3.4.2-RH >= 3.4.2-8


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-74
changelog:
  - fix <netinet/udp.h> header
  - fix globfree (#137176)
  - fix exiting if there are dlmopened libraries in namespaces
    other than main one not closed yet
  - export again _res_opcodes and __p_{class,type}_syms from
    libresolv.so that were lost in -69


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-72
changelog:
  - back out setaltroot and key{_add,_request,ctl} addition
  - fix severe x86-64 symbol versioning regressions that breaks
    e.g. java binaries


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-71
changelog:
  - update from CVS
    - fix minor catchsegv temp file handling vulnerability
      (CAN-2004-0968, #136319)
    - add 4 new errno codes
    - setaltroot, key{_add,_request,ctl} syscalls on some arches
    - export _dl_debug_state@GLIBC_PRIVATE from ld.so again for
      gdb purpose
    - use inet_pton to decide what is address and what is hostname
      in getent (#135422)
    - change dladdr/dladdr1, so that dli_saddr is the same kind
      of value as dlsym/dlvsym return (makes difference on ia64/hppa only)
    - fix catchsegv script so that it works with both 32-bit and 64-bit
      programs on multi-arch platforms


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-70
changelog:
  - update from CVS
  - require newer selinux-policy (#135978)
  - add %dir for /var/run/nscd and /var/db/nscd and %ghost
    files in it
  - conflict with gcc4 4.0.0-0.6 and earlier (needs __builtin_object_size)


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-68
changelog:
  - update from CVS
    - support for namespaces in the dynamic linker
    - fix dlclose (BZ #77)
    - libSegFault.so uses now backtrace() to work on IA-64, x86-64
      and s390 (#130254)


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-67
changelog:
  - update from CVS
    - use non-blocking sockets in resolver (#135234)
    - reset pd->res options on thread exit, so that threads
      reusing cached stacks get resolver state properly initialized
      (BZ #434)


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-66
changelog:
  - update from CVS
  - avoid using perl in the spec file, buildrequire sed >= 3.95
    (#127671)
  - export TIMEOUTFACTOR=16
  - fix _JMPBUF_CFA_UNWINDS_ADJ on s390{,x}


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-65
changelog:
  - update from CVS
    - define _POSIX_THREAD_PROCESS_SHARED and _POSIX_CLOCK_SELECTION
      to -1 in LinuxThreads
    - define _POSIX_CPUTIME and _POSIX_THREAD_CPUTIME to 0
      on i?86/ia64 and make sure sysconf (_SC_{,THREAD_}CPUTIME)
      returns correct value
  - if _POSIX_CLOCK_SELECTION == -1 in nscd, still try
    sysconf (_SC_CLOCK_SELECTION) and if it returns true,
    dlopen libpthread.so and dlsym pthread_condattr_setclock
  - build nscd with -z relro and -z now


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-64
changelog:
  - update from CVS
    - stop using __builtin_expect in assert and assert_perror
      (#127606)
    - try to avoid too much VA fragmentation with malloc
      on flexmap layout (#118574)
    - nscd robustification
    - change valloc to use debugging hooks (#134385)
  - make glibc_post_upgrade more verbose on errors (Fergal Daly,


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-61
changelog:
  - update from CVS
    - some nscd fixes (#134193)
    - cache initgroups in nscd (#132850)
    - reread /etc/localtime in tzset () even if just mtime changed
      (#133481)
    - fix glob (#126460)
    - another get_myaddress fix


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-60
changelog:
  - update from CVS
    - fix get_myaddress (#133982)
    - remove nonnull attribute from second utime argument (#133866)
    - handle SIGSETXID the same way as SIGCANCEL in
      sigaction/pthread_kill/sigwait/sigwaitinfo etc.
    - add __extension__ to long long types in NPTL <bits/pthreadtypes.h>


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-58
changelog:
  - update from CVS
    - vasprintf fix (BZ #346)
    - gettext locking (BZ #322)
  - change linuxthreads useldt.h inclusion login again, the last
    one failed all linuxthreads FLOATING_STACKS tests


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-57
changelog:
  - update from CVS
    - fix setuid in LD_ASSUME_KERNEL=2.2.5 libc (#133558)
    - fix nis locking (#132204)
    - RTLD_DEEPBIND support
    - fix pthread_create bugs (BZ #401, #405)


author: Roland McGrath <roland@redhat.com> 2.3.3-56
changelog:
  - migrated CVS to fedora-branch in sources.redhat.com glibc repository
    - source tarballs renamed
    - redhat/ moved to fedora/, some old cruft removed
  - update from trunk
    - some __nonnull annotations


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-55
changelog:
  - update from CVS
    - set{re,e,res}[ug]id now affect the whole process in NPTL
    - return EAGAIN instead of ENOMEM when not enough memory
      in pthread_create


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-52
changelog:
  - update from CVS
    - nscd bi-arch fix
    - remove all uses of __P()/__PMT() from glibc headers
  - update and reenable nscd SELinux patch
  - remove libnss1* and libnss*.so.1 compatibility NSS modules
    on IA-32, SPARC and Alpha


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-51
changelog:
  - update from CVS
    - disable one of the malloc double free checks for non-contiguous
      arenas where it doesn't have to be true even for non-broken
      apps


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-50
changelog:
  - update from CVS
    - pwd/grp/host loops with nscd speed up by sharing the
      nscd cache r/o with applications
    - inexpensive double free check in free(3)
    - make NPTL pthread.h initializers usable even from C++
      (BZ #375)
  - use atomic instructions even in i386 nscd on i486+ CPUs
    (conditionally)


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-48
changelog:
  - update from CVS
    - fix pthread_cond_destroy (BZ #342)
    - fix fnmatch without FNM_NOESCAPE (BZ #361)
    - fix ppc32 setcontext (BZ #357)
  - add NPTL support for i386 glibc (only if run on i486 or higher CPU)
  - add __NR_waitid defines for i386, x86_64 and sparc*


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-47
changelog:
  - update from CVS
    - persistent nscd caching
    - ppc64 32-bit atomicity fix
    - fix x86-64 nptl-devel headers for -m32 compilation
  - %ghost /etc/ld.so.cache (#130597)
  - edit /etc/ld.so.conf in glibc_post_upgrade if
    include ld.so.conf.d/*.conf line is missing (#120588)
  - ugly hacks for the IA-64 /emul braindamage (#124996, #128267)


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-45
changelog:
  - update from CVS
    - fix nss_compat's initgroups handling (#130363)
    - fix getaddrinfo ai_canonname setting


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-44
changelog:
  - update from CVS
    - add ip6-dotint resolv.conf option, make
      no-ip6-dotint the default
  - BuildPrereq libselinux-devel (#129946)
  - on ppc64, build without dot symbols


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-43
changelog:
  - update from CVS
    - remove debugging printout (#129747)
    - make <sys/shm.h> usable in C++ (IT#45148)
  - update RLIMIT_* constants in <bits/resource.h>, make
    <sys/resource.h> POSIX compliant (#129740)


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-42
changelog:
  - fix last tzset () fixes, disable rereading of /etc/localtime
    every time for now
  - really enable SELinux support for NSCD


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-41
changelog:
  - update from CVS
    - fread_unlocked/fwrite_unlocked macro fixes (BZ #309, #316)
    - tzset () fixes (BZ #154)
  - speed up pthread_rwlock_unlock on arches other than i386 and
    x86_64 (#129455)
  - fix compilation with -ansi (resp. -std=c89 or -std=c99) and
    -D_XOPEN_SOURCE=[56]00 but no -D_POSIX_SOURCE* or -D_POSIX_C_SOURCE*
    (BZ #284)
  - add SELinux support for NSCD


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-40
changelog:
  - update from CVS
    - change res_init to force all threads to re-initialize
      resolver before they use it next time (#125712)
    - various getaddrinfo and related fixes (BZ #295, #296)
    - fix IBM{932,943} iconv modules (#128674)
    - some nscd fixes (e.g. BZ #292)
    - RFC 3678 support (Multicast Source Filters)
  - handle /lib/i686/librtkaio-* in i386 glibc_post_upgrade
    the same as /lib/i686/librt-*


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-39
changelog:
  - update from CVS
    - conformance related changes in headers
  - remove -finline-limit=2000 for GCC 3.4.x+


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-38
changelog:
  - update from CVS
    - fix res_init leaks
    - fix newlocale races
    - fix ppc64 setjmp
  - fix strtold (BZ #274)


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-37
changelog:
  - update from CVS
    - allow pthread_cancel in DSO destructors run at exit time
  - fix pow{f,,l} on IA-32 and powl on x86-64
  - allow PIEs on IA-32 to have main in a shared library they depend on


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-34
changelog:
  - update from CVS
    - if_nameindex using preferably netlink
    - printf_parsemb initialization fix
    - NPTL version is now the same as glibc version


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-33
changelog:
  - update from CVS
    - reread resolv.conf for nscd --invalidate=hosts
    - fix F_GETLK/F_SETLK/F_SETLKW constants on x86_64 for
      -m32 -D_FILE_OFFSET_BITS=64 compilations
    - avoid calling non-existing fcntl64 syscall on ppc64


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-32
changelog:
  - update from CVS
    - FUTEX_CMP_REQUEUE support (fix pthread_cond_* deadlocks)
    - fix backtrace in statically linked programs
  - rebuilt with GCC 3.4, adjusted ulps and i386 <bits/string.h>


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-31
changelog:
  - update from CVS
  - <bits/string2.h> and <bits/mathinline.h> changes for GCC 3.{2,4,5}+
  - make c_stubs buildable even with GCC 3.2.x (#123042)


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-28
changelog:
  - update from CVS
    - FUTEX_REQUEUE fixes (#115349)
    - SPARC GCC 3.4 build fix
    - fix handling of undefined TLS symbols on IA32 (RELA only),
      SPARC and SH
    - regex translate fix
    - speed up sprintf
    - x86_64 makecontext alignment fix
    - make POSIX sigpause the default sigpause, unless BSD sigpause
      requested


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-27
changelog:
  - remove /lib64/tls/librtkaio-2.3.[23].so in glibc_post_upgrade
    on x86-64, s390x and ppc64 instead of /lib/tls/librtkaio-2.3.[23].so
  - build mq_{send,receive} with -fexceptions


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-26
changelog:
  - update from CVS
    - fix <tgmath.h>
    - fix memory leaks in nis, getifaddrs, etc. caused by incorrect
      use of realloc
  - remove /lib/{tls,i686}/librtkaio-2.3.[23].so in glibc_post_upgrade
    and rerun ldconfig if needed, otherwise after glibc upgrade librt.so.1
    might be a stale symlink


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-24
changelog:
  - update from CVS
    - define S_ISSOCK in -D_XOPEN_SOURCE=600 and S_I[FS]SOCK
      plus F_[SG]ETOWN also in -D_XOPEN_SOURCE=500 (both
      included already in XNS5)
    - reorder dlopen checks, so that dlopening ET_REL objects
      complains about != ET_DYN != ET_EXEC, not about phentsize
      (#121606)
    - fix strpbrk macro for GCC 3.4+ (BZ #130)
    - fix <sys/sysctl.h> (BZ #140)
    - sched_[gs]etaffinity documentation fix (BZ #131)
    - fix sparc64 build (BZ #139)
    - change linuxthreads back to use non-cancellable writes
      to manager pipes etc.
    - fix sem_timedwait return value in linuxthreads (BZ #133)
    - ia64 unnecessary PLT relocs removal


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-23
changelog:
  - update from CVS
    - fix *scanf
    - fix shm_unlink, sem_unlink and mq_unlink errno values
    - avoid memory leaks in error
    - execstack fixes on s390


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-22
changelog:
  - update from CVS
    - mq and timer fixes
  - rebuilt with binutils >= 2.15.90.0.3-2 to fix IA-64 statically
    linked binaries
  - fix linuxthreads librt.so on s390{,x}, so it is no longer DT_TEXTREL


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-21
changelog:
  - disable rtkaio
  - update from CVS
    - POSIX message passing support
    - fixed SIGEV_THREAD support for POSIX timers
    - fix free on non-malloced memory in syslog
    - fix ffsl on some 64-bit arches
    - fix sched_setaffinity on x86-64, ia64
    - fix ppc64 umount
    - NETID_AUTHORITATIVE, SERVICES_AUTHORITATIVE support
    - various NIS speedups
    - fix fwrite with > 2GB sizes on 64-bit arches
    - fix pthread_getattr_np guardsize reporting in NPTL
  - report PLT relocations in ld.so and libc.so during the build


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-20
changelog:
  - update from CVS
    - change NPTL PTHREAD_MUTEX_ADAPTIVE_NP mutexes to spin on SMP
    - strtol speed optimization
    - don't try to use certainly unimplemented syscalls on ppc64
  - kill -debug subpackage, move the libs to glibc-debuginfo{,-common}
    into /usr/lib/debug/usr/%{_lib}/ directory
  - fix c_stubs with gcc 3.4
  - move all the up to 3 builds into %build scriptlet and
    leave only installation in the %install scriptlet


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-18
changelog:
  - update from CVS
    - fix ia64 iopl (#118591)
    - add support for /etc/ld.so.conf.d/*.conf
    - fix x86-64 LD_DEBUG=statistics
  - fix hwcap handling when using ld.so.cache (#118518)


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-15
changelog:
  - update from CVS
    - special section for compatibility code
    - make getpid () work even in vfork () child
  - configure with --enable-bind-now to avoid lazy binding in ld.so
    and libc.so


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-14
changelog:
  - update from CVS
    - fix iconv -c (#117021)
    - fix PIEs on sparc/sparc64
    - fix posix_fadvise on 64-bit architectures
  - add locale-archive as %ghost file (#117014)


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-7
changelog:
  - update from CVS
    - dl_iterate_phdr extension to signal number of added/removed
      libraries
  - fix PT_GNU_RELRO support on ppc* with prelinking


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-4
changelog:
  - update from CVS
    - some further regex speedups
    - fix re.translate handling in regex (#112869)
    - change regfree to match old regex behaviour (what is freed
      and clearing of freed pointers)
    - fix accesses to unitialized memory in regex (#113507, #113425,
        - PT_GNU_RELRO support


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-3
changelog:
  - update from CVS
    - fix pmap_set fd and memory leak (#112726)
  - fix backreference handling in regex
  - rebuilt under glibc without the above bug to fix
    libc.so linker script (#112738)


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-2
changelog:
  - update from CVS
    - faster getpid () in NPTL builds
    - fix to make pthread_setcancelstate (PTHREAD_CANCEL_DISABLE, )
      really disable cancellation (#112512)
    - more regex fixes and speedups
    - fix nextafter*/nexttoward*
    - handle 6th syscall(3) argument on AMD64
    - handle memalign/posix_memalign in mtrace
    - fix linuxthreads memory leak (#112208)
    - remove throw () from cancellation points in linuxthreads (#112602)
    - fix NPTL unregister_atfork
    - fix unwinding through alternate signal stacks


author: Jakub Jelinek <jakub@redhat.com> 2.3.3-1
changelog:
  - update from CVS
    - 2.3.3 release
    - lots of regex fixes and speedups (#110401)
    - fix atan2
    - fix pshared condvars in NPTL
    - fix pthread_attr_destroy for attributes created with
      pthread_attr_init@GLIBC_2.0
  - for the time being, include both nb_NO* and no_NO* as locales
    so that the distribution can catch up with the no_NO->nb_NO
    transition
  - add BuildPrereq texinfo (#110252)


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-102
changelog:
  - update from CVS
    - fix getifaddrs (CAN-2003-0859)
    - fix ftw fd leak
    - fix linuxthreads sigaction (#108634)
    - fix glibc 2.0 stdio compatibility
    - fix uselocale (LC_GLOBAL_LOCALE)
    - speed up stdio locking in non-threaded programs on IA-32
    - try to maintain correct order of cleanups between those
      registered with __attribute__((cleanup))
      and with LinuxThreads style pthread_cleanup_push/pop (#108631)
    - fix segfault in regex (#109606)
    - fix RE_ICASE multi-byte handling in regex
    - fix pthread_exit in libpthread.a (#109790)
    - FTW_ACTIONRETVAL support
    - lots of regex fixes and speedups
    - fix ceill/floorl on AMD64


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-100
changelog:
  - update from CVS
    - fix sprof (#103727)
    - avoid infinite loops in {,f}statvfs{,64} with hosed mounts file
    - prevent dlopening of executables
    - fix glob with GLOB_BRACE and without GLOB_NOESCAPE
    - fix locale printing of word values on 64-bit big-endian arches
      (#107846)
    - fix getnameinfo and getaddrinfo with reverse IPv6 lookups
      (#101261)


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-99
changelog:
  - update from CVS
    - dl_iterate_phdr in libc.a on arches other than IA-64
    - LD_DEBUG=statistics prints number of relative relocations
    - fix hwcap computation
  - NPTL is now part of upstream glibc CVS
  - include {st,xh,zu}_ZA{,.UTF-8} locales


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-98
changelog:
  - update from CVS
    - fix close, pause and fsync (#105348)
    - fix pthread_once on IA-32
  - implement backtrace () on IA-64, handle -fomit-frame-pointer
    in AMD64 backtrace () (#90402)


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-97
changelog:
  - update from CVS
    - fix <sys/sysmacros.h> with C++ or -ansi or -pedantic C
    - fix mknod/ustat return value when given bogus device number (#105768)


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-94
changelog:
  - update from CVS
  - fix syslog with non-C non-en_* locales (#61296, #104979)
  - filter GLIBC_PRIVATE symbols from glibc provides
  - fix NIS+


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-93
changelog:
  - update from CVS
  - assume 2.4.21 kernel features on RHEL/ppc*, so that
    {make,set,get,swap}context works
  - backout execstack support for RHEL
  - build rtkaio on amd64 too


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-92
changelog:
  - update from CVS
    - execstack/noexecstack support
    - build nscd as PIE
  - move __libc_stack_end back to @GLIBC_2.1
  - build against elfutils >= 0.86 to fix stripping on s390x


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-88
changelog:
  - update from CVS
    - retrieve affinity in pthread_getattr_np
    - fix pthread_attr_[gs]etaffinity_np
    - handle hex and octal in wordexp


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-87
changelog:
  - update from CVS
    - truncate instead of round in utimes when utimes syscall is not available
    - don't align stack in every glibc function unnecessarily on IA-32
    - make sure threads have their stack 16 byte aligned on IA-32
    - move sched_[sg]etaffinity to GLIBC_2.3.3 symbol version (#103231)
    - fix pthread_getattr_np for the initial thread (#102683)
    - avoid linuxthreads signal race (#104368)
  - ensure all gzip invocations are done with -n option


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-86
changelog:
  - update from CVS
  - avoid linking in libgcc_eh.a unnecessarily
  - change ssize_t back to long int on s390 -m31, unless
    gcc 2.95.x is used


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-83
changelog:
  - update from CVS
  - change *nlink_t, *ssize_t and *intptr_t types on s390 -m31 to
    {unsigned,} int
  - change *u_quad_t, *quad_t, *qaddr_t, *dev_t, *ino64_t, *loff_t,
    *off64_t, *rlim64_t, *blkcnt64_t, *fsblkcnt64_t, *fsfilcnt64_t
    on 64-bit arches from {unsigned,} long long int {,*} to
    {unsigned,} long int {,*} to restore binary compatibility
    for C++ functions using these types as arguments


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-80
changelog:
  - update from CVS
    - fix IA-64 cancellation when mixing __attribute__((cleanup ()))
      and old-style pthread_cleanup_push cleanups


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-79
changelog:
  - updated from CVS
    - lots of cancellation fixes
    - fix posix_fadvise* on ppc32
    - TLS layout fix
    - optimize stdio cleanups (#103354)
    - sparcv9 NPTL
    - include sigset, sighold, sigrelse, sigpause and sigignore prototypes
      in signal.h even if -D_XOPEN_SOURCE_EXTENDED (#103269)
    - fix svc_getreqset on 64-bit big-endian arches
    - return ENOSYS in linuxthreads pthread_barrierattr_setpshared for
      PTHREAD_PROCESS_SHARED
    - add pthread_cond_timedwait stubs to libc.so (#102709)
  - split glibc-devel into glibc-devel and glibc-headers to ensure
    amd64 /usr/include always wins on amd64/i386 bi-arch installs
  - increase PTHREAD_STACK_MIN on alpha, ia64 and sparc*
  - get rid of __syscall_* prototypes and stubs in sysdeps/unix/sysv/linux
  - run make check also with linuxthreads (on IA-32 non-FLOATING_STACKS)
    ld.so and NPTL (on IA-32 also FLOATING_STACKS linuxthreads) libraries
    and tests


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-77
changelog:
  - update from CVS
    - fix glibc 2.0 libio compatibility (#101385)
    - fix ldconfig with /usr/lib/lib*.so symlinks (#102853)
    - fix assert.h (#102916, #103017)
    - make ld.so.cache identical between IA-32 and AMD64 (#102887)
    - fix static linking of large IA-64 binaries (#102586)
  - avoid using floating point regs in lazy binding code on ppc64 (#102763)


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-72
changelog:
  - update from CVS
    - fix rtkaio aio_fsync{,64}
    - update rtkaio for !BROKEN_THREAD_SIGNALS
    - fix assert macro when used on pointers


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-70
changelog:
  - update from CVS
  - disable CLONE_STOPPED for now until it is resolved
  - strip crt files
  - fix libio on arches with no < GLIBC_2.2 support (#102102, #102105)
  - fix glibc-debuginfo to include all nptl and nptl_db sources


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-69
changelog:
  - update from CVS
    - fix pthread_create@GLIBC_2.0 (#101767)
  - __ASSUME_CLONE_STOPPED on all arches but s390* in RHEL


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-68
changelog:
  - update from CVS
    - only use CLONE_STOPPED if kernel supports it, fix setting of thread
      explicit scheduling (#101457)


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-67
changelog:
  - update from CVS
    - fix utimes and futimes if kernel doesn't support utimes syscall
    - fix s390 ssize_t type
    - fix dlerror when called before any dlopen/dlsym
    - update IA-64 bits/sigcontext.h (#101344)
    - various warning fixes
    - fix pthread.h comment typos (#101363)


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-65
changelog:
  - update from CVS
    - fix timer_create
    - use __extension__ before long long typedefs in <bits/types.h> (#100718)


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-64
changelog:
  - update from CVS
    - fix wcpncpy (#99462)
    - export _res@GLIBC_2.0 even from NPTL libc.so (__res_state ()
      unlike __errno_location () or __h_errno_location () was introduced
      in glibc 2.2)
    - fix zic bug on 64-bit platforms
    - some TLS handling fixes
    - make ldconfig look into alternate ABI dirs by default (#99402)
  - move %{_datadir}/zoneinfo to tzdata package, so that it can be
    errataed separately from glibc
  - new add-on - rtkaio
  - prereq libgcc, as glibc now relies on libgcc_s.so.1 for pthread_cancel


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-61
changelog:
  - update from CVS
    - build libc_nonshared.a with -fPIC instead of -fpic
  - fix ppc64 PIE support
  - add cfi directives to NPTL sysdep-cancel.h on ppc/ppc64/s390/s390x


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-59
changelog:
  - update from CVS
  - on IA-64 use different symbols for cancellation portion of syscall
    handlers to make gdb happier


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-56
changelog:
  - fix condvars and semaphores in ppc* NPTL
  - fix test-skeleton.c reporting of timed-out tests (#91269)
  - increase timeouts for tests during make check


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-55
changelog:
  - make ldconfig default to both /lib+/usr/lib and /lib64+/usr/lib64
    on bi-ABI architectures (#97557)
  - disable FUTEX_REQUEUE on ppc* temporarily


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-49
changelog:
  - update from CVS
    - fix pthread_cond_signal on IA-32 (#92080, #92253)
    - fix setegid (#91567)
  - don't prelink -R libc.so on any architecture, it prohibits
    address randomization


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-47
changelog:
  - update from CVS
  - PT_GNU_STACK segment in binaries/executables and .note.GNU-stack
    section in *.[oa]


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-44
changelog:
  - update from CVS
  - enable NPTL on s390 and s390x
  - make __init_array_start etc. symbols in elf-init.oS hidden undefined


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-41
changelog:
  - update from CVS
  - use NPTL libs if uname -r contains nptl substring or is >= 2.5.69
    or set_tid_address syscall is available instead of checking
    AT_SYSINFO dynamic tag


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-31
changelog:
  - update from CVS
    - nscd fixes
    - fix Bahrain spelling (#56298)
    - fix Ukrainian collation (#83973)
    - accept trailing spaces in /etc/ld.so.conf (#86032)
    - perror fix (#85994)
    - fix localedef (#88978)
    - fix getifaddrs (#89026)
    - fix strxfrm (#88409)
  - fix ppc TLS
  - fix getaddrinfo (#89448)
  - don't print warning about errno, h_errno or _res if
    LD_ASSUME_KERNEL=2.4.1 or earlier


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-30
changelog:
  - update from CVS
  - fix prelink on ppc32
  - add TLS support on ppc32 and ppc64
  - make sure on -m64 arches all helper binaries are built with this
    option


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-29
changelog:
  - update from CVS
    - fix strxfrm (#88409)
  - use -m64 -mno-minimal-toc on ppc64
  - conflict with kernels < 2.4.20 on ppc64 and < 2.4.0 on x86_64
  - link glibc_post_upgrade against newly built libc.a


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-28
changelog:
  - update from CVS
    - fix NPTL pthread_detach and already terminated, but not yet
      joined thread (#88219)
    - fix bug-regex4 testcase (#88118)
    - reenable prelink support broken in 2.3.2-13
    - fix register_printf_function (#88052)
    - fix double free with fopen using ccs= (#88056)
    - fix potential access below $esp in {set,swap}context (#88093)
    - fix buffer underrun in gencat -H (#88099)
    - avoid using unitialized variable in tst-tgmath (#88101)
    - fix gammal (#88104)
    - fix iconv -c
    - fix xdr_string (PR libc/4999)
    - fix /usr/lib/nptl/librt.so symlink
    - avoid running NPTL cleanups twice in some cases
    - unblock __pthread_signal_cancel in linuxthreads, so that
      linuxthreads threaded programs work correctly if spawned
      from NPTL threaded programs
    - fix sysconf _SC_{NPROCESSORS_{CONF,ONLN},{,AV}PHYS_PAGES}
  - remove /lib/i686 directory before running ldconfig in glibc post
    during i686 -> i386 glibc "upgrades" (#88456)


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-20
changelog:
  - update from CVS
  - if kernel >= 2.4.1 doesn't support NPTL, fall back to
    /lib/i686 libs on i686, not stright to /lib


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-18
changelog:
  - update from CVS
  - fix NPTL pthread_cond_timedwait
  - fix sysconf (_SC_MONOTONIC_CLOCK)
  - use /%{_lib}/tls instead of /lib/tls on x86-64
  - add /%{_lib}/tls/librt*so* and /%{_lib}/i686/librt*so*
  - display content of .out files for all make check failures


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-16
changelog:
  - update from CVS
    - export __fork from glibc again
  - fix glibc-compat build in NPTL
  - fix c_stubs
  - fix some more atomic.h problems
  - don't check abi in glibc-compat libs


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-15
changelog:
  - update from CVS
  - build glibc-compat (for glibc 2.0 compatibility) and c_stubs add-ons
  - condrestart sshd in glibc_post_upgrade so that the user can
    log in remotely and handle the rest (#86339)
  - fix a typo in glibc_post_upgrade on sparc


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-9
changelog:
  - update from CVS
  - fix glibc-debug description (#85111)
  - make librt.so a symlink again, not linker script


author: Jakub Jelinek <jakub@redhat.com> 2.3.2-3
changelog:
  - update from CVS
  - only warn about errno, h_errno or _res for binaries, never
    libraries
  - rebuilt with gcc-3.2.2-4 to use direct %gs TLS access insn sequences


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-45
changelog:
  - update from CVS
  - include also linuxthreads FLOATING_STACKS libs on i686 and athlon:
    LD_ASSUME_KERNEL=2.2.5 to LD_ASSUME_KERNEL=2.4.0 is non-FLOATING_STACKS lt,
    LD_ASSUME_KERNEL=2.4.1 to LD_ASSUME_KERNEL=2.4.19 is FLOATING_STACKS lt,
    later is NPTL
  - enable TLS on alpha/alphaev6
  - add BuildPreReq: /usr/bin/readlink


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-43
changelog:
  - update from CVS
  - vfork fix on s390
  - rebuilt with binutils 2.13.90.0.18-5 so that accesses to errno
    don't bind locally (#83325)


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-38
changelog:
  - update from CVS
  - initialize __environ in glibc_post_upgrade to empty array,
    so that it is not NULL
  - compat symlink for s390x /lib/ld64.so.1
  - enable glibc-profile on x86-64
  - only include libNoVersion.so on IA-32, Alpha and Sparc 32-bit


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-37
changelog:
  - update from CVS
    - nscd fixes, *scanf fix
  - fix %nptlarches noarch build (#81909)
  - IA-64 TLS fixes


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-36
changelog:
  - update from CVS
  - rework -debuginfo subpackage, add -debuginfo-common
    subpackage on IA-32, Alpha and Sparc (ie. auxiliary arches)
  - fix vfork in libc.a on PPC32, Alpha, Sparc
  - fix libio locks in linuxthreads libc.so if libpthread.so
    is dlopened later (#81374)


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-35
changelog:
  - update from CVS
    - dlclose bugfixes
  - fix NPTL libpthread.a
  - fix glibc_post_upgrade on several arches


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-32
changelog:
  - update from CVS
  - don't use TLS libs if kernel doesn't set AT_SYSINFO
    (#80921, #81212)
  - add ntp_adjtime on alpha (#79996)
  - fix nptl_db (#81116)


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-30
changelog:
  - fix condvar compatibility wrappers
  - add ugly hack to use non-TLS libs if a binary is seen
    to have errno, h_errno or _res symbols in .dynsym


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-27
changelog:
  - update from CVS
  - fix #include <sys/stat.h> with -D_BSD_SOURCE or without
    feature set macros
  - make *sigaction, sigwait and raise the same between
    -lpthread -lc and -lc -lpthread in linuxthreads builds


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-21
changelog:
  - system(3) fix for linuxthreads
  - don't segfault in pthread_attr_init from libc.so
  - add cancellation tests from nptl to linuxthreads


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-18
changelog:
  - update from CVS
    - fix NPTL hanging mozilla
    - initialize malloc in mALLOPt (fixes problems with squid, #79957)
    - make linuxthreads work with dl_dynamic_weak 0
    - clear dl_dynamic_weak everywhere


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-17
changelog:
  - update from CVS
    - NPTL socket fixes, flockfile/ftrylockfile/funlockfile fix
    - kill -debug sub-package, rename -debug-static to -debug
    - clear dl_dynamic_weak for NPTL


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-16
changelog:
  - fix <bits/mathinline.h> and <bits/nan.h> for C++
  - automatically generate NPTL libpthread wrappers


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-15
changelog:
  - update from CVS
    - all functions which need cancellation should now be cancellable
      both in libpthread.so and libc.so
    - removed @@GLIBC_2.3.2 cancellation wrappers


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-14
changelog:
  - update from CVS
    - replace __libc_lock_needed@GOTOFF(%ebx) with
      %gs:offsetof(tcbhead_t, multiple_threads)
    - start of new NPTL cancellation wrappers


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-10
changelog:
  - update from CVS
  - non-nptl --with-tls --without-__thread FLOATING_STACKS libpthread
    should work now
  - faster libc locking when using nptl
  - add OUTPUT_FORMAT to linker scripts
  - fix x86_64 sendfile (#79111)


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-9
changelog:
  - update from CVS
    - RUSCII support (#78906)
  - for nptl builds add BuildRequires
  - fix byteswap.h for non-gcc (#77689)
  - add nptl-devel package


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-8
changelog:
  - update from CVS
    - make --enable-kernel=2.2.5 --with-tls --without-__thread
      ld.so load nptl and other --with-__thread libs
  - disable nptl by default for now


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-7
changelog:
  - update from CVS
  - restructured redhat/Makefile and spec, so that src.rpm contains
    glibc-<date>.tar.bz2, glibc-redhat-<date>.tar.bz2 and glibc-redhat.patch
  - added nptl


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-3
changelog:
  - update from CVS
    - some more regex fixes
  - fix libpthread.a (#76484)
  - fix locale-archive enlarging


author: Jakub Jelinek <jakub@redhat.com> 2.3.1-2
changelog:
  - update from CVS
    - don't need to use 128K of stacks for DNS lookups
    - regex fixes
    - updated timezone data e.g. for this year's Brasil DST
      changes
    - expand ${LIB} in RPATH/RUNPATH/dlopen filenames


author: Jakub Jelinek <jakub@redhat.com> 2.2.94-3
changelog:
  - don't prelink -r libc.so on ppc/x86-64/sparc*, it doesn't
    speed things up, because they are neither REL arches, nor
    ELF_MACHINE_REL_RELATIVE
  - fix sparc64 build


author: Jakub Jelinek <jakub@redhat.com> 2.2.94-1
changelog:
  - update from CVS
  - prelink on ppc and x86-64 too
  - don't remove ppc memset
  - instead of listing on which arches to remove glibc-compat
    list where it should stay


author: Jakub Jelinek <jakub@redhat.com> 2.2.93-5
changelog:
  - fix wcsmbs functions with invalid character sets (or malloc
    failures)
  - make sure __ctype_b etc. compat vars are updated even if
    they are copy relocs in the main program


author: Jakub Jelinek <jakub@redhat.com> 2.2.93-4
changelog:
  - fix /lib/libnss1_dns.so.1 (missing __set_h_errno definition
    leading to unresolved __set_h_errno symbol)


author: Jakub Jelinek <jakub@redhat.com> 2.2.93-3
changelog:
  - security fix - increase dns-network.c MAXPACKET to at least
    65536 to avoid buffer overrun. Likewise glibc-compat
    dns-{host,network}.c.


author: Jakub Jelinek <jakub@redhat.com> 2.2.93-2
changelog:
  - temporarily add back __ctype_b, __ctype_tolower and __ctype_toupper to
    libc.a and export them as @@GLIBC_2.0 symbols, not @GLIBC_2.0
    from libc.so - we have still lots of .a libraries referencing
    __ctype_{b,tolower,toupper} out there...


author: Jakub Jelinek <jakub@redhat.com> 2.2.93-1
changelog:
  - update from CVS
    - 2.2.93 release
    - use double instead of single indirection in isXXX macros
    - per-locale wcsmbs conversion state


author: Jakub Jelinek <jakub@redhat.com> 2.2.92-1
changelog:
  - update from CVS
    - 2.2.92 release
    - fix gettext after uselocale
    - fix locales in statically linked threaded programs
    - fix NSS


author: Jakub Jelinek <jakub@redhat.com> 2.2.91-1
changelog:
  - update from CVS
    - 2.2.91 release
    - fix fd leaks in locale-archive reader (#72043)
  - handle EROFS in build-locale-archive gracefully (#71665)


author: Jakub Jelinek <jakub@redhat.com> 2.2.90-25
changelog:
  - update from CVS
    - fix locale-archive loading hang on some (non-primary) locales
      (#72122, #71878)
    - fix umount problems with locale-archives when /usr is a separate
      partition (#72043)
  - add LICENSES file


author: Jakub Jelinek <jakub@redhat.com> 2.2.90-24
changelog:
  - update from CVS
    - only mmap up to 2MB of locale-archive on 32-bit machines
      initially
    - fix fseek past end + fread segfault with mmaped stdio
  - include <sys/debugreg.h> which is mistakenly not included
    in glibc-devel on IA-32


author: Jakub Jelinek <jakub@redhat.com> 2.2.90-21
changelog:
  - fix path to locale-archive in libc reader
  - build locale archive at glibc-common %post time
  - export __strtold_internal and __wcstold_internal on Alpha again
  - workaround some localedata problems


author: Jakub Jelinek <jakub@redhat.com> 2.2.90-19
changelog:
  - update from CVS
  - GB18030 patch from Yu Shao
  - applied Debian patch for getaddrinfo IPv4 vs. IPv6
  - fix regcomp (#71039)


author: Jakub Jelinek <jakub@redhat.com> 2.2.90-16
changelog:
  - update from CVS
    - ungetc fix (#69586)
    - fseek errno fix (#69589)
    - change *etrlimit prototypes for C++ (#68588)
  - use --without-tls instead of --disable-tls


author: Jakub Jelinek <jakub@redhat.com> 2.2.90-15
changelog:
  - set nscd user's shell to /sbin/nologin (#68369)
  - fix glibc-compat buffer overflows (security)
  - buildrequire prelink, don't build glibc's own copy of it (#67567)
  - update from CVS
    - regex fix (#67734)
    - fix unused warnings (#67706)
    - fix freopen with mmap stdio (#67552)
    - fix realloc (#68499)


author: Jakub Jelinek <jakub@redhat.com> 2.2.90-12
changelog:
  - update from CVS
    - don't use __thread in headers
  - fix system(3) in threaded apps
  - update prelink, so that it is possible to prelink -u libc.so.6.1
    on Alpha


author: Jakub Jelinek <jakub@redhat.com> 2.2.90-11
changelog:
  - update from CVS
    - fix __moddi3 (#65612, #65695)
    - fix ether_line (#64427)
  - fix setvbuf with mmap stdio (#65864)
  - --disable-tls for now, waiting for kernel
  - avoid duplication of __divtf3 etc. on IA-64
  - make sure get*ent_r and _IO_wfile_jumps are exported (#62278)


author: Jakub Jelinek <jakub@redhat.com> 2.2.5-34
changelog:
  - add relocation dependencies even for weak symbols (#63422)
  - stricter check_fds check for suid/sgid binaries
  - run make check at %install time


author: Jakub Jelinek <jakub@redhat.com> 2.2.5-33
changelog:
  - handle Dec 31 1969 in mktime for timezones west of GMT (#63369)
  - back out do-lookup.h change (#63261, #63305)
  - use "memory" clobber instead all the fancy stuff in i386/i686/bits/string.h
    since lots of compilers break on it
  - fix sparc build with gcc 3.1
  - fix spec file for athlon


author: Jakub Jelinek <jakub@redhat.com> 2.2.5-32
changelog:
  - fix debugging of threaded apps (#62804)
  - fix DST for Estonia (#61494)
  - document that pthread_mutexattr_?etkind_np are deprecated
    and pthread_mutexattr_?ettype should be used instead in man
    pages (#61485)
  - fix libSegFault.so undefined externals


author: Jakub Jelinek <jakub@redhat.com> 2.2.5-31
changelog:
  - temporarily disable prelinking ld.so, as some statically linked
    binaries linked against debugging versions of old glibcs die on it
    (#62352)
  - fix <semaphore.h> for -std=c99 (#62516)
  - fix ether_ntohost segfault (#62397)
  - remove in glibc_post_upgrade on i386 all /lib/i686/libc-*.so,
    /lib/i686/libm-*.so and /lib/i686/libpthread-*.so, not just current
    version (#61633)
  - prelink -r on alpha too


author: Jakub Jelinek <jakub@redhat.com> 2.2.5-28
changelog:
  - update from CVS
    - fix nscd with huge groups
    - fix nis to not close fds it shouldn't
  - rebuilt against newer glibc-kernheaders to use the correct
    PATH_MAX
  - handle .athlon.rpm glibc the same way as .i686.rpm
  - add a couple of .ISO-8859-15 locales (#61908)
  - readd temporarily currencies which were superceeded by Euro
    into the list of accepted currencies by localedef to make
    standard conformance testsuites happy
  - temporarily moved __libc_waitpid back to make Sun JDK happy
  - use old malloc code
  - prelink i686/athlon ld.so and prelink -r i686/athlon libc.so


author: Jakub Jelinek <jakub@redhat.com> 2.2.5-27
changelog:
  - update from CVS
    - fix DST handling for southern hemisphere (#60747)
    - fix daylight setting for tzset (#59951)
    - fix ftime (#60350)
    - fix nice return value
    - fix a malloc segfault
  - temporarily moved __libc_wait, __libc_fork and __libc_stack_end
    back to what they used to be exported at
  - censorship (#60758)


author: Jakub Jelinek <jakub@redhat.com> 2.2.5-26
changelog:
  - update from CVS
  - use __attribute__((visibility(...))) if supported, use _rtld_local
    for ld.so only objects
  - provide libc's own __{,u}{div,mod}di3


author: Jakub Jelinek <jakub@redhat.com> 2.2.90-6
changelog:
  - fix mmap stdio bug (seen on ld as File truncated error, #60043)
  - apply Andreas Schwab's fix for pthread sigwait
  - remove /lib/i686/ libraries in glibc_post_upgrade when
    performing i386 glibc install


author: Jakub Jelinek <jakub@redhat.com> 2.2.90-5
changelog:
  - update to CVS
  - added glibc-utils subpackage
  - disable autoreq in glibc-debug
  - readd %lang() to locale files


author: Jakub Jelinek <jakub@redhat.com> 2.2.90-1
changelog:
  - update from CVS
  - remove -D__USE_STRING_INLINES
  - add debug subpackage to trim glibc and glibc-devel size


author: Jakub Jelinek <jakub@redhat.com> 2.2.4-18
changelog:
  - fix a ld.so bug with duplicate searchlists in l_scope
  - fix erfcl(-inf)
  - turn /usr/lib/librt.so into linker script


author: Jakub Jelinek <jakub@redhat.com> 2.2.4-17
changelog:
  - fix a ld.so lookup bug after lots of dlopen calls
  - fix CMSG_DATA for non-gcc non-ISOC99 compilers (#53984)
  - prelinking support for Sparc64


author: Jakub Jelinek <jakub@redhat.com> 2.2.4-15
changelog:
  - update from CVS
    - linuxthreads now retries if -1/EINTR is returned from
      reading or writing to thread manager pipe (#43742)
  - use DT_FILTER in librt.so (#53394)
    - update glibc prelink patch so that it handles filters
  - fix timer_* with SIGEV_NONE (#53494)
  - make glibc_post_upgrade work on PPC (patch from Franz Sirl)


author: Jakub Jelinek <jakub@redhat.com> 2.2.4-8
changelog:
  - kill stale library symlinks in ldconfig (#52350)
  - fix inttypes.h for G++ < 3.0
  - use DT_REL*COUNT


author: Jakub Jelinek <jakub@redhat.com> 2.2.4-4
changelog:
  - don't crash on catclose(-1)
  - fix wscanf %[] handling
  - fix return value from swprintf
  - handle year + %U/%W week + week day in strptime


author: Jakub Jelinek <jakub@redhat.com> 2.2.4-3
changelog:
  - update from CVS to
    - fix strcoll (#50548)
    - fix seekdir (#51132)
    - fix memusage (#50606)
  - don't make gconv-modules.cache %config file, just don't verify
    its content.


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - update from CVS
    - fix iconv cache handling
  - glibc should not own %{_infodir}, %{_mandir} nor %{_mandir}/man3 (#50673)
  - add gconv-modules.cache as emtpy config file (#50699)
  - only run iconvconfig if /usr is mounted read-write (#50667)


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - move iconvconfig from glibc-common into glibc subpackage,
    call it from glibc_post_upgrade instead of common's post.


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - adjust prelinking DT_* and SHT_* values in elf.h
  - update from CVS
    - iconv cache
    - make iconv work in SUID/SGID programs (#34611)


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - update from CVS
    - kill non-pic code in libm.so
    - fix getdate
    - fix some locales (#49402)
  - rebuilt with binutils-2.11.90.0.8-5 to place .interp section
    properly in libBrokenLocale.so, libNoVersion.so and libanl.so
  - add floating stacks on IA-64, Alpha, Sparc (#49308)


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - fix a bunch of math bugs (#43210, #43345, #43346, #43347, #43348, #43355)
  - make rpc headers -ansi compilable (#42390)
  - remove alphaev6 optimized memcpy, since there are still far too many
    broken apps which call memcpy where they should call memmove
  - update from CVS to (among other things):
    - fix tanhl bug (#43352)


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - fix #include <signal.h> with -D_XOPEN_SOURCE=500 on ia64 (#35968)
  - fix a dlclose reldeps handling bug
  - some more profiling fixes
  - fix tgmath.h


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - fix the hardlink program, so that it really catches all files with
    identical content
  - add a s390x clone fix


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - fix rpc for non-threaded apps using svc_fdset and similar variables (#40409)
  - fix nss compatibility DSO versions for alphaev6
  - add a hardlink program instead of the shell 3x for plus cmp -s/link
    which takes a lot of time during build
  - rework BuildPreReq and Conflicts with gcc, so that
    it applies only where it has to


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - fix locale name of ja_JP in UTF-8 (#39783)
  - fix re_search_2 (#40244)
  - fix memusage script (#39138, #39823)
  - fix dlsym(RTLD_NEXT, ) from main program (#39803)
  - fix xtrace script (#39609)
  - make glibc conflict with glibc-devel 2.2.2 and below (to make sure
    libc_nonshared.a has atexit)
  - fix getconf LFS_CFLAGS on 64bitters
  - recompile with gcc-2.96-84 or above to fix binary compatibility problem
    with __frame_state_for function (#37933)


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - support even 2.4.0 kernels on ia64, sparc64 and s390x
  - include UTF-8 locales
  - make gconv-modules %config(noreplace)


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - update from CVS
    - run atexit() registered functions at dlclose time if they are in shared
      libraries (#28625)
    - add pthread_getattr_np API to make JVM folks happy


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - require 2.4.1 instead of 2.4.0 on platforms where it required 2.4 kernel
  - fix ldd behaviour on unresolved symbols
  - remove nonsensical ldconfig warning, update osversion for the most
    recent library with the same soname in the same directory instead (#31703)
  - apply selected patches from CVS
  - s390x spec file changes from Florian La Roche


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - update from CVS
  - make pthread_attr_setstacksize consistent before and after pthread manager
    is started (#28194)
  - pass back struct sigcontext from pthread signal wrapper (on ia32 only so
    far, #28493)
  - on i686 ship both --enable-kernel 2.2.5 and 2.4.0 libc/libm/libpthread,
    make ld.so pick the right one


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - update from CVS
    - fix ia64 build with gnupro
    - make regex 64bit clean
    - fix tgmath make check failures on alpha


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - build all auxiliary arches with --enablekernel 2.4.0, those wanting
    to run 2.2 kernels can downgrade to the base architecture glibc.


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - update to 2.2.1 final
    - fix a pthread_kill_other_threads_np breakage (#23966)
    - make static binaries using dlopen work on ia64 again
  - fix a typo in glibc-common group


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - some more security fixes:
    - don't look up LD_PRELOAD libs in cache for SUID apps
      (because that bypasses SUID bit checking on the library)
    - place output files for profiling SUID apps into /var/profile,
      use O_NOFOLLOW for them
    - add checks for $MEMUSAGE_OUTPUT and $SEGFAULT_OUTPUT_NAME
  - hardlink identical locale files together
  - add %lang() tags to locale stuff
  - remove ko_KR.utf8 for now, it is provided by locale-utf8 package


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - add glibc-common subpackage
  - fix alphaev6 memcpy (#22494)
  - fix sys/cdefs.h (#22908)
  - don't define stdin/stdout/stderr as macros for -traditional (#22913)
  - work around a bug in IBM JDK (#22932, #23012)
  - fix pmap_unset when network is down (#23176)
  - move nscd in rc.d before netfs on shutdown
  - fix $RESOLV_HOST_CONF in SUID apps (#23562)


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - update to CVS to:
    - fix getnameinfo (#21934)
    - don't stomp on memory in rpath handling (#21544)
    - fix setlocale (#21507)
  - fix libNoVersion.so.1 loading code (#21579)
  - use auxarches define in spec file for auxiliary
    architectures (#21219)
  - remove /usr/share directory from filelist (#21218)


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - update to CVS, including:
    - fix WORD_BIT/LONG_BIT definition in limits.h (#19088)
    - fix hesiod (#19375)
    - set LC_MESSAGES in zic/zdump for proper error message output (#19495)
    - fix LFS fcntl when used with non-LFS aware kernels (#19730)


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - fix alpha semctl (#19199)
  - update to CVS, including:
    - fix glibc headers for Compaq non-gcc compilers
    - fix locale alias handling code (#18832)
    - fix rexec on little endian machines (#18886)
  - started writing changelog again


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-23
changelog:
  - api: disallow virDomainSaveImageGetXMLDesc on read-only connections (CVE-2019-10161)
  - api: disallow virDomainManagedSaveDefineXML on read-only connections (CVE-2019-10166)
  - api: disallow virConnectGetDomainCapabilities on read-only connections (CVE-2019-10167)
  - api: disallow virConnect*HypervisorCPU on read-only connections (CVE-2019-10168)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-22
changelog:
  - qemu: Drop cleanup label from qemuProcessInitCpuAffinity() (rhbz#1718172)
  - qemu: Fix NULL pointer access in qemuProcessInitCpuAffinity() (rhbz#1718172)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-20
changelog:
  - util: alloc: add macros for implementing automatic cleanup functionality (rhbz#1703661)
  - util: bitmap: define cleanup function using VIR_DEFINE_AUTOPTR_FUNC (rhbz#1703661)
  - util: Introduce virBitmapUnion() (rhbz#1703661)
  - util: Introduce virNumaNodesetToCPUset() (rhbz#1703661)
  - qemu: Fix qemuProcessInitCpuAffinity() (rhbz#1703661)
  - qemu: Fix leak in qemuProcessInitCpuAffinity() (rhbz#1703661)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-19
changelog:
  - virfile: added GPFS as shared fs (rhbz#1710728)
  - util: file: introduce VIR_AUTOCLOSE macro to close fd of the file automatically (rhbz#1641702)
  - vircpuhost: Add support for reading MSRs (rhbz#1641702)
  - virhostcpu: Make virHostCPUGetMSR() work only on x86 (rhbz#1641702)
  - qemu: Make virQEMUCapsProbeHostCPUForEmulator more generic (rhbz#1641702)
  - qemuargv2xmltest: Use mocked virQEMUCapsProbeHostCPU (rhbz#1641702)
  - util: Add virHostCPUGetTscInfo (rhbz#1641702)
  - conf: Report TSC frequency in host CPU capabilities (rhbz#1641702)
  - cpu_x86: Fix placement of *CheckFeature functions (rhbz#1641702)
  - cpu_x86: Probe TSC frequency and scaling support (rhbz#1641702)
  - qemu: Check TSC frequency before starting QEMU (rhbz#1641702)
  - util: Propagate numad failures correctly (rhbz#1716387)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-18
changelog:
  - admin: reject clients unless their UID matches the current UID (CVE-2019-10132)
  - locking: restrict sockets to mode 0600 (CVE-2019-10132)
  - logging: restrict sockets to mode 0600 (CVE-2019-10132)
  - util: require command args to be non-NULL (rhbz#1672957)
  - qemu: use line breaks in command line args written to log (rhbz#1672957)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-17
changelog:
  - cpu_map: Add support for cldemote CPU feature (rhbz#1537777)
  - cputest: Add data for Intel(R) Xeon(R) CPU E3-1225 v5 (CVE-2018-12126, CVE-2018-12127, CVE-2019-11091, CVE-2018-12130)
  - cpu_map: Define md-clear CPUID bit (CVE-2018-12126, CVE-2018-12127, CVE-2019-11091, CVE-2018-12130)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-16
changelog:
  - Handle copying bitmaps to larger data buffers (rhbz#1703159)
  - nwfilter: fix adding std MAC and IP values to filter binding (rhbz#1691358)
  - util: suppress unimportant ovs-vsctl errors when getting interface stats (rhbz#1683175)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-14
changelog:
  - cpu_map: Add features for Icelake CPUs (rhbz#1527659, rhbz#1526624)
  - cpu_map: Add Icelake CPU models (rhbz#1526624)
  - cpu_x86: Do not cache microcode version (rhbz#1576369)
  - qemu: Don't cache microcode version (rhbz#1576369)
  - util: Rename some functions of virresctrl (rhbz#1468650)
  - util: Refactor virResctrlGetInfo in virresctrl (rhbz#1468650)
  - util: Refactor virResctrlAllocFormat of virresctrl (rhbz#1468650)
  - util: Add MBA capability information query to resctrl (rhbz#1468650)
  - util: Add MBA check to virResctrlInfoGetCache (rhbz#1468650)
  - util: Add MBA allocation to virresctrl (rhbz#1468650)
  - util: Add MBA schemata parse and format methods (rhbz#1468650)
  - util: Add support to calculate MBA utilization (rhbz#1468650)
  - util: Introduce virResctrlAllocForeachMemory (rhbz#1468650)
  - util: Introduce virResctrlAllocSetMemoryBandwidth (rhbz#1468650)
  - conf: Rename cachetune to resctrl (rhbz#1468650)
  - conf: Factor out vcpus parsing part from virDomainCachetuneDefParse (rhbz#1468650)
  - conf: Factor out vcpus overlapping from virDomainCachetuneDefParse (rhbz#1468650)
  - conf: Factor out virDomainResctrlDef update from virDomainCachetuneDefParse (rhbz#1468650)
  - conf: Add support for memorytune XML processing for resctrl MBA (rhbz#1468650)
  - conf: Add return value check to virResctrlAllocForeachCache (rhbz#1468650)
  - conf: Add memory bandwidth allocation capability of host (rhbz#1468650)
  - conf: Fix bug in finding alloc through matching vcpus (rhbz#1468650)
  - resctrl: Do not calculate free bandwidth for MBA (rhbz#1468650)
  - resctrl: Set MBA defaults properly (rhbz#1468650)
  - resctrl: Fix testing line (rhbz#1468650)
  - virresctrl: fix MBA memory leak (rhbz#1468650)
  - test: caps: Add capabilities for QEMU 3.1.0 (rhbz#1628892)
  - util: Introduce virHostGetDRMRenderNode helper (rhbz#1628892)
  - conf: Introduce virDomainGraphics-related helpers (rhbz#1628892)
  - qemu: process: spice: Pick the first available DRM render node (rhbz#1628892)
  - qemu: command: Introduce qemuBuildGraphicsEGLHeadlessCommandLine helper (rhbz#1628892)
  - qemu: caps: Introduce QEMU_EGL_HEADLESS_RENDERNODE capability (rhbz#1628892)
  - conf: gfx: Add egl-headless as a member to virDomainGraphicsDef struct (rhbz#1628892)
  - conf: gfx: egl-headless: Introduce a new <gl> subelement (rhbz#1628892)
  - qemu: domain: egl-headless: Add the DRI device into the namespace (rhbz#1628892)
  - qemu: cgroup: gfx: egl-headless: Add the DRI device into the cgroup list (rhbz#1628892)
  - security: dac: gfx: egl-headless: Relabel the DRI device (rhbz#1628892)
  - qemu: command: gfx: egl-headless: Add 'rendernode' option to the cmdline (rhbz#1628892)
  - domain: conf: graphics: Fix picking DRI renderer automatically for SPICE (rhbz#1628892)
  - qemu: domain: gfx: Fix shadowing of a function argument in validation (rhbz#1628892)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-13
changelog:
  - storage: Extract out mount command creation for FS Backend (rhbz#1584663)
  - storage: Move FS backend mount creation command helper (rhbz#1584663)
  - storage: Move virStorageBackendFileSystemGetPoolSource (rhbz#1584663)
  - tests: Introduce tests for storage pool xml to argv checks (rhbz#1584663)
  - tests: Add storagepool xml test for netfs-auto (rhbz#1584663)
  - storage: Rework virStorageBackendFileSystemMountCmd (rhbz#1584663)
  - storage: Add default mount options for fs/netfs storage pools (rhbz#1584663)
  - conf: Add optional NFS Source Pool <protocol ver='n'/> option (rhbz#1584663)
  - storage: Add the nfsvers to the command line (rhbz#1584663)
  - virsh: Add source-protocol-ver for pool commands (rhbz#1584663)
  - RHEL: conf: storage: Fix a memory leak in virStoragePoolDefParseSource (rhbz#1584663)
  - tests: Reuse qemucapabilities data for qemucaps2xml (rhbz#1628469)
  - tests: Add more tests to qemucaps2xml (rhbz#1628469)
  - qemu: Drop QEMU_CAPS_ENABLE_KVM (rhbz#1628469)
  - qemu: Avoid probing non-native binaries all the time (rhbz#1628469)
  - qemu: Clarify QEMU_CAPS_KVM (rhbz#1628469)
  - qemu: Don't check for /dev/kvm presence (rhbz#1628469)
  - tests: Follow up on qemucaps2xmldata rename (rhbz#1628469)
  - qemu: hotplug: Don't generate alias when detaching disk (rhbz#1658198)
  - qemu: hotplug: Don't generate alias when detaching controllers (rhbz#1658198)
  - tests: add channel-unix-guestfwd (rhbz#1658198)
  - qemu: Use @tmpChr in qemuDomainDetachChrDevice to build device string (rhbz#1658198)
  - qemuL: Drop "user-" prefix for guestfwd netdev (rhbz#1658198)
  - qemu_hotplug: Attach guestfwd using netdev_add (rhbz#1658198)
  - qemu_hotplug: Detach guestfwd using netdev_del (rhbz#1658198)
  - qemuhotplugtest: Test guestfwd attach and detach (rhbz#1658198)
  - qemu_hotplug: Don't build device string in qemuDomainDetachChrDevice (rhbz#1658198)
  - qemu_hotplug: Assume chardev alias always exists in qemuDomainDetachChrDevice (rhbz#1658198)
  - qemu: fix device name passed to error report (rhbz#1658198)
  - qemu_hotplug: Properly check for qemuMonitorDelDevice retval (rhbz#1658198)
  - qemu_hotplug: Introduce and use qemuDomainDeleteDevice (rhbz#1658198)
  - qemu: hotplug: Remove 'ret' variable in qemuDomainDetachDeviceDiskLive (rhbz#1658198)
  - qemu: hotplug: Use typecasted enum in qemuDomainDetachDeviceDiskLive (rhbz#1658198)
  - qemu: hotplug: Use switch statement for selecting disk bus function (rhbz#1658198)
  - qemu: hotplug: Merge virtio and non-virtio disk unplug code (rhbz#1658198)
  - qemu_hotplug: remove unnecessary check for valid PCI address (rhbz#1658198)
  - qemu_hotplug: rename a virDomainDeviceInfoPtr to avoid confusion (rhbz#1658198)
  - qemu_hotplug: eliminate multiple identical qemuDomainDetachHost*Device() functions (rhbz#1658198)
  - qemu_hotplug: eliminate unnecessary call to qemuDomainDetachNetDevice() (rhbz#1658198)
  - qemu_hotplug: refactor qemuDomainDetachDiskLive and qemuDomainDetachDiskDevice (rhbz#1658198)
  - qemu_hotplug: don't call DetachThisHostDevice for hostdev network devices (rhbz#1658198)
  - qemu_hotplug: merge qemuDomainDetachThisHostDevice into qemuDomainDetachHostDevice (rhbz#1658198)
  - qemu_hotplug: move qemuDomainChangeGraphicsPasswords() (rhbz#1658198)
  - qemu_hotplug: move (almost) all qemuDomainDetach*() functions together (rhbz#1658198)
  - qemu_hotplug: move (Attach|Detach)Lease functions with others of same type (rhbz#1658198)
  - qemu_hotplug: move qemuDomainDetachDeviceLive() to qemu_hotplug.c (rhbz#1658198)
  - qemu_hotplug: remove extra function in middle of DetachController call chain (rhbz#1658198)
  - qemu_hotplug: pull qemuDomainUpdateDeviceList out of qemuDomainDetachDeviceLive (rhbz#1658198)
  - test: replace calls to individual detach functions with one call to main detach (rhbz#1658198)
  - qemu_hotplug: make Detach functions called only from qemu_hotplug.c static (rhbz#1658198)
  - qemu_hotplug: rename dev to match in qemuDomainDetachDeviceLive (rhbz#1658198)
  - qemu_hotplug: separate Chr|Lease from other devices in DetachDevice switch (rhbz#1658198)
  - qemu_hotplug: standardize the names/args/calling of qemuDomainDetach*() (rhbz#1658198)
  - qemu_hotplug: rename Chr and Lease Detach functions (rhbz#1658198)
  - qemu_hotplug: new function qemuDomainRemoveAuditDevice() (rhbz#1658198)
  - qemu_hotplug: audit *all* auditable device types in qemuDomainRemoveAuditDevice (rhbz#1658198)
  - qemu_hotplug: consolidate all common detach code in qemuDomainDetachDeviceLive (rhbz#1658198)
  - qemu_hotplug: don't shutdown net device until the guest has released it (rhbz#1658198)
  - qemu_hotplug: delay sending DEVICE_REMOVED event until after *all* teardown (rhbz#1658198)
  - conf: Expose virDomainSCSIDriveAddressIsUsed (rhbz#1692296)
  - qemuhotplugtest: Don't plug a SCSI disk at unit 7 (rhbz#1692296)
  - qemu_hotplug: Check for duplicate drive addresses (rhbz#1692296)
  - qemu: Rework setting process affinity (rhbz#1695434)
  - qemu: Set up EMULATOR thread and cpuset.mems before exec()-ing qemu (rhbz#1695434)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-12
changelog:
  - src: Document autostart for session demon (rhbz#1501450)
  - nwfilter: Add extra verbiage for binding create/delete (rhbz#1609454)
  - qemu: Remove duplicated qemuAgentCheckError (rhbz#1663051, CVE-2019-3840)
  - qemu: require reply from guest agent in qemuAgentGetInterfaces (rhbz#1663051, CVE-2019-3840)
  - virsh: Add missed fields to pool-define-as item entry (rhbz#1615680)
  - qemu: Add entry for balloon stat stat-disk-caches (rhbz#1690122)
  - qemu: Set identity for the reconnect all thread (rhbz#1631622)
  - docs: schemas: Fix missing timestamp inside backingStore (rhbz#1594266)
  - storage: Remove secretPath from _virStorageBackendQemuImgInfo (rhbz#1613737)
  - storage: Allow for inputvol to have any format for encryption (rhbz#1613737)
  - storage: Allow inputvol to be encrypted (rhbz#1613737)
  - virsh: man: Document quirks of device-detach and friends (rhbz#1688961)
  - virsh: man: Document asynchronous behaviour of detach-device-alias (rhbz#1688961)
  - access: Modify the VIR_ERR_ACCESS_DENIED to include driverName (rhbz#1631606)
  - qemu: Put format=raw onto cmd line for SCSI passthrough (rhbz#1632833)
  - virnwfilterbindingobj: Introduce and use virNWFilterBindingObjStealDef (rhbz#1686927)
  - logging: ensure pending I/O is drained before reading position (rhbz#1660531)
  - conf: Fix check for chardev source path (rhbz#1609720)
  - util: skip RDMA detection for non-PCI network devices (rhbz#1639258)
  - qemu: Set job statsType for external memory snapshot (rhbz#1690703)
  - virsh: Strip XML declaration when extracting CPU XMLs (rhbz#1592737)
  - virsh: Require explicit --domain for domxml-to-native (rhbz#1633077)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-11
changelog:
  - security: dac: also label listen UNIX sockets (rhbz#1633389)
  - qemu: fix up permissions for pre-created UNIX sockets (rhbz#1633389)
  - virFileIsSharedFSType: Check for fuse.glusterfs too (rhbz#1632711)
  - virfile: fix cast-align error (rhbz#1632711)
  - virfiletest: Fix test name prefix for virFileInData test (rhbz#1632711)
  - virfiletst: Test virFileIsSharedFS (rhbz#1632711)
  - virFileIsSharedFSType: Detect direct mount points (rhbz#1632711)
  - virfile: Rework virFileIsSharedFixFUSE (rhbz#1632711)
  - virfile: Take symlink into account in virFileIsSharedFixFUSE (rhbz#1640465)
  - qemu: Properly report VIR_DOMAIN_EVENT_RESUMED_FROM_SNAPSHOT (rhbz#1612943)
  - qemu: Report more appropriate running reasons (rhbz#1612943)
  - qemu: Pass running reason to RESUME event handler (rhbz#1612943)
  - qemu: Map running reason to resume event detail (rhbz#1612943)
  - qemu: Avoid duplicate resume events and state changes (rhbz#1612943)
  - qemu: Don't ignore resume events (rhbz#1612943)
  - qemu: Fix post-copy migration on the source (rhbz#1647365)
  - RHEL: cpu_map: Mark arch-facilities feature as non-migratable (rhbz#1658406)
  - virfile: Detect ceph as shared FS (rhbz#1665553)
  - util: Don't overflow in virRandomBits (rhbz#1652894)
  - virrandom: Avoid undefined behaviour in virRandomBits (rhbz#1652894)
  - RHEL: spec: Require new enough librbd1 (rhbz#1658652)
  - cputest: Add data for Intel(R) Xeon(R) CPU E5-2630 v4 (rhbz#1558558)
  - cputest: Add data for Intel(R) Core(TM) i7-7600U (rhbz#1558558)
  - cputest: Add data for Intel(R) Xeon(R) CPU E7540 (rhbz#1558558)
  - cputest: Add data for Intel(R) Xeon(R) CPU E5-2650 (rhbz#1558558)
  - cputest: Add data for Intel(R) Core(TM) i7-8700 (rhbz#1558558)
  - cpu_x86: Separate signature parsing from x86ModelParse (rhbz#1558558)
  - cpu_x86: Add x86ModelCopySignatures helper (rhbz#1558558)
  - cpu_x86: Store CPU signature in an array (rhbz#1558558)
  - cpu_x86: Allow multiple signatures for a CPU model (rhbz#1558558)
  - cpu_map: Add hex representation of signatures (rhbz#1558558)
  - cpu_map: Add more signatures for Conroe CPU model (rhbz#1558558)
  - cpu_map: Add more signatures for Penryn CPU model (rhbz#1558558)
  - cpu_map: Add more signatures for Nehalem CPU models (rhbz#1558558)
  - cpu_map: Add more signatures for Westmere CPU model (rhbz#1558558)
  - cpu_map: Add more signatures for SandyBridge CPU models (rhbz#1558558)
  - cpu_map: Add more signatures for IvyBridge CPU models (rhbz#1558558)
  - cpu_map: Add more signatures for Haswell CPU models (rhbz#1558558)
  - cpu_map: Add more signatures for Broadwell CPU models (rhbz#1558558)
  - cpu_map: Add more signatures for Skylake-Client CPU models (rhbz#1558558)
  - cpu: Don't access invalid memory in virCPUx86Translate (rhbz#1558558)
  - cpu_x86: Log decoded CPU model and signatures (rhbz#1558558)
  - util: Modify virStorageFileGetSCSIKey return (rhbz#1657468)
  - storage: Rework virStorageBackendSCSISerial (rhbz#1657468)
  - util: Introduce virStorageFileGetNPIVKey (rhbz#1657468)
  - storage: Fetch a unique key for vHBA/NPIV LUNs (rhbz#1657468)
  - RHEL: qemu: Alter @val usage in qemuSetUnprivSGIO (rhbz#1656360)
  - RHEL: qemu: Alter qemuSetUnprivSGIO hostdev shareable logic (rhbz#1656360)
  - qemu: Filter non SCSI hostdevs in qemuHostdevPrepareSCSIDevices (rhbz#1665474)
  - qemu: Fix logic error in qemuSetUnprivSGIO (rhbz#1669581)
  - qemu: Fix crash trying to use iSCSI hostdev (rhbz#1669586)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-9
changelog:
  - virDomainDefCompatibleDevice: Relax alias change check (rhbz#1621910)
  - virDomainDetachDeviceFlags: Clarify update semantics (rhbz#1621910)
  - virDomainNetDefCheckABIStability: Check for MTU change too (rhbz#1623157)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-8
changelog:
  - storage: Add --shrink to qemu-img command when shrinking vol (rhbz#1613746)
  - access: Fix nwfilter-binding ACL access API name generation (rhbz#1611320)
  - qemu: mdev: Use vfio-pci 'display' property only with vfio-pci mdevs (rhbz#1624735)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-7
changelog:
  - qemu_migration: Avoid writing to freed memory (rhbz#1593137)
  - qemu: hotplug: Fix asynchronous unplug of 'shmem' (rhbz#1618622)
  - tests: rename hugepages to hugepages-default (rhbz#1591235)
  - tests: extract hugepages-numa-default-dimm out of hugepages-numa (rhbz#1591235)
  - tests: rename hugepages-numa into hugepages-numa-default (rhbz#1591235)
  - tests: remove unnecessary XML elements from hugepages-numa-default (rhbz#1591235)
  - tests: extract pages-discard out of hugepages-pages (rhbz#1591235)
  - tests: rename hugepages-pages into hugepages-numa-nodeset (rhbz#1591235)
  - tests: rename hugepages-pages2 into hugepages-numa-default-2M (rhbz#1591235)
  - tests: extract pages-discard-hugepages out of hugepages-pages3 (rhbz#1591235)
  - tests: rename hugepages-pages3 into hugepages-numa-nodeset-part (rhbz#1591235)
  - tests: rename hugepages-pages4 into hugepages-numa-nodeset-nonexist (rhbz#1591235)
  - tests: rename hugepages-pages5 into hugepages-default-2M (rhbz#1591235)
  - tests: rename hugepages-pages6 into hugepages-default-system-size (rhbz#1591235)
  - tests: rename hugepages-pages7 into pages-dimm-discard (rhbz#1591235)
  - tests: rename hugepages-pages8 into hugepages-nodeset-nonexist (rhbz#1591235)
  - tests: introduce hugepages-default-1G-nodeset-2M (rhbz#1591235)
  - tests: introduce hugepages-nodeset (rhbz#1591235)
  - conf: Move hugepage XML validation check out of qemu_command (rhbz#1591235)
  - conf: Move hugepages validation out of XML parser (rhbz#1591235)
  - conf: Introduce virDomainDefPostParseMemtune (rhbz#1591235)
  - tests: sev: Test launch-security with specific QEMU version (rhbz#1612009)
  - qemu: Fix probing of AMD SEV support (rhbz#1612009)
  - qemu: caps: Format SEV platform data into qemuCaps cache (rhbz#1612009)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-6
changelog:
  - qemu: Exempt video model 'none' from getting a PCI address on Q35 (rhbz#1609087)
  - conf: Fix a error msg typo in virDomainVideoDefValidate (rhbz#1607825)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-5
changelog:
  - esx storage: Fix typo lsilogic -> lsiLogic (rhbz#1571759)
  - networkGetDHCPLeases: Don't always report error if unable to read leases file (rhbz#1600468)
  - nwfilter: Resolve SEGV for NWFilter Snoop processing (rhbz#1599973)
  - qemu: Remove unused bypassSecurityDriver from qemuOpenFileAs (rhbz#1589115)
  - qemuDomainSaveMemory: Don't enforce dynamicOwnership (rhbz#1589115)
  - domain_nwfilter: Return early if net has no name in virDomainConfNWFilterTeardownImpl (rhbz#1607831)
  - examples: Add clean-traffic-gateway into nwfilters (rhbz#1603115)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-4
changelog:
  - qemu: hotplug: don't overwrite error message in qemuDomainAttachNetDevice (rhbz#1598311)
  - qemu: hotplug: report error when changing rom enabled attr for net iface (rhbz#1599513)
  - qemu: Fix setting global_period cputune element (rhbz#1600427)
  - tests: qemucaps: Add test data for upcoming qemu 3.0.0 (rhbz#1475770)
  - qemu: capabilities: Add capability for werror/rerror for 'usb-device' frontend (rhbz#1475770)
  - qemu: command: Move graphics iteration to its own function (rhbz#1475770)
  - qemu: address: Handle all the video devices within a single loop (rhbz#1475770)
  - conf: Introduce virDomainVideoDefClear helper (rhbz#1475770)
  - conf: Introduce virDomainDefPostParseVideo helper (rhbz#1475770)
  - qemu: validate: Enforce compile time switch type checking for videos (rhbz#1475770)
  - tests: Add capabilities data for QEMU 2.11 x86_64 (rhbz#1475770)
  - tests: Update capabilities data for QEMU 3.0.0 x86_64 (rhbz#1475770)
  - qemu: qemuBuildHostdevCommandLine: Use a helper variable mdevsrc (rhbz#1475770)
  - qemu: caps: Introduce a capability for egl-headless (rhbz#1475770)
  - qemu: Introduce a new graphics display type 'headless' (rhbz#1475770)
  - qemu: caps: Add vfio-pci.display capability (rhbz#1475770)
  - conf: Introduce virDomainGraphicsDefHasOpenGL helper (rhbz#1475770)
  - conf: Replace 'error' with 'cleanup' in virDomainHostdevDefParseXMLSubsys (rhbz#1475770)
  - conf: Introduce new <hostdev> attribute 'display' (rhbz#1475770)
  - qemu: command: Enable formatting vfio-pci.display option onto cmdline (rhbz#1475770)
  - docs: Rephrase the mediated devices hostdev section a bit (rhbz#1475770)
  - conf: Introduce new video type 'none' (rhbz#1475770)
  - virt-xml-validate: Add schema for nwfilterbinding (rhbz#1600330)
  - tools: Fix typo generating adapter_wwpn field (rhbz#1601377)
  - src: Fix memory leak in virNWFilterBindingDispose (rhbz#1603025)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-3
changelog:
  - qemu: hotplug: Do not try to add secret object for TLS if it does not exist (rhbz#1598015)
  - qemu: monitor: Make qemuMonitorAddObject more robust against programming errors (rhbz#1598015)
  - spec: Explicitly require matching libvirt-libs (rhbz#1600122)
  - virDomainConfNWFilterInstantiate: initialize @xml to avoid random crash (rhbz#1599545)
  - qemuProcessStartPRDaemonHook: Try to set NS iff domain was started with one (rhbz#1470007)
  - qemuDomainValidateStorageSource: Relax PR validation (rhbz#1470007)
  - virStoragePRDefFormat: Suppress path formatting for migratable XML (rhbz#1470007)
  - qemu: Wire up PR_MANAGER_STATUS_CHANGED event (rhbz#1470007)
  - qemu_monitor: Introduce qemuMonitorJSONGetPRManagerInfo (rhbz#1470007)
  - qemu: Fetch pr-helper process info on reconnect (rhbz#1470007)
  - qemu: Fix ATTRIBUTE_NONNULL for qemuMonitorAddObject (rhbz#1598015)
  - virsh.pod: Fix a command name typo in nwfilter-binding-undefine (rhbz#1600329)
  - docs: schema: Add missing <alias> to vsock device (rhbz#1600345)
  - virnetdevtap: Don't crash on !ifname in virNetDevTapInterfaceStats (rhbz#1595184)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-2
changelog:
  - qemu: Add capability for the HTM pSeries feature (rhbz#1525599)
  - conf: Parse and format the HTM pSeries feature (rhbz#1525599)
  - qemu: Format the HTM pSeries feature (rhbz#1525599)
  - qemu: hotplug: Don't access srcPriv when it's not allocated (rhbz#1597550)
  - qemuDomainNestedJobAllowed: Allow QEMU_JOB_NONE (rhbz#1598084)
  - src: Mention DEVICE_REMOVAL_FAILED event in virDomainDetachDeviceAlias docs (rhbz#1598087)
  - virsh.pod: Drop --persistent for detach-device-alias (rhbz#1598087)
  - qemu: don't use chardev FD passing with standalone args (rhbz#1598281)
  - qemu: remove chardevStdioLogd param from vhostuser code path (rhbz#1597940)
  - qemu: consolidate parameters of qemuBuildChrChardevStr into flags (rhbz#1597940)
  - qemu: don't use chardev FD passing for vhostuser backend (rhbz#1597940)
  - qemu: fix UNIX socket chardevs operating in client mode (rhbz#1598440)
  - qemuDomainDeviceDefValidateNetwork: Check for range only if IP prefix set (rhbz#1515533)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-1
changelog:
  - Rebased to libvirt-4.5.0 (rhbz#1563169)
  - The rebase also fixes the following bugs:
      rhbz#1291851, rhbz#1393106, rhbz#1468422, rhbz#1469338, rhbz#1526382
      rhbz#1529059, rhbz#1541921, rhbz#1544869, rhbz#1552092, rhbz#1568407
      rhbz#1583623, rhbz#1584091, rhbz#1585108, rhbz#1586027, rhbz#1588295
      rhbz#1588336, rhbz#1589730, rhbz#1590214, rhbz#1591017, rhbz#1591561
      rhbz#1591628, rhbz#1591645, rhbz#1593549


author: Jiri Denemark <jdenemar@redhat.com> - 4.4.0-1
changelog:
  - Rebased to libvirt-4.4.0 (rhbz#1563169)
  - The rebase also fixes the following bugs:
      rhbz#1149445, rhbz#1291851, rhbz#1300772, rhbz#1400475, rhbz#1456165
      rhbz#1470007, rhbz#1480668, rhbz#1534418, rhbz#1549531, rhbz#1559284
      rhbz#1559835, rhbz#1560946, rhbz#1566416, rhbz#1569861, rhbz#1572491
      rhbz#1574089, rhbz#1576916, rhbz#1583484, rhbz#1583927, rhbz#1584071
      rhbz#1584073


author: Jiri Denemark <jdenemar@redhat.com> - 4.3.0-1
changelog:
  - Rebased to libvirt-4.3.0 (rhbz#1563169)
  - The rebase also fixes the following bugs:
      rhbz#1509870, rhbz#1530451, rhbz#1577920, rhbz#1283700, rhbz#1425757
      rhbz#1448149, rhbz#1454709, rhbz#1502754, rhbz#1507737, rhbz#1519130
      rhbz#1519146, rhbz#1522706, rhbz#1523564, rhbz#1524399, rhbz#1525496
      rhbz#1527740, rhbz#1550980, rhbz#916061, rhbz#1494454, rhbz#1515533
      rhbz#1532542, rhbz#1538570, rhbz#1544325, rhbz#1544659, rhbz#1546971
      rhbz#1347550, rhbz#1367238, rhbz#1483816, rhbz#1543775, rhbz#1551000
      rhbz#1552127, rhbz#1553075, rhbz#1553085, rhbz#1554876, rhbz#1556828
      rhbz#1558317, rhbz#1425058, rhbz#1490158, rhbz#1492597, rhbz#1520821
      rhbz#1529256, rhbz#1547250, rhbz#1557769, rhbz#1560917, rhbz#1560976
      rhbz#1568148, rhbz#1569678, rhbz#1576464


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-12
changelog:
  - util: Check if kernel-provided info is consistent with itself (rhbz#1540780)
  - qemu: Refresh capabilities when creating resctrl allocation (rhbz#1540780)
  - qemu: Expose rx/tx_queue_size in qemu.conf too (rhbz#1541960)
  - util: bitmap: Fix value of 'map_alloc' when shrinking bitmap (rhbz#1540817)
  - qemu: driver: Extract vcpu halted state directly (rhbz#1534585)
  - qemu: Remove unused 'cpuhalted' argument from qemuDomainHelperGetVcpus (rhbz#1534585)
  - qemu: domain: Store vcpu halted state as a tristate (rhbz#1534585)
  - qemu: Limit refresh of CPU halted state to s390 (rhbz#1534585)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-11
changelog:
  - qemu: migration: Refresh device information after transferring state (rhbz#1463168)
  - qemuDomainRemoveMemoryDevice: unlink() memory backing file (rhbz#1461214)
  - util: Fix possible leak in virResctrlAllocMasksAssign (rhbz#1540817)
  - util: Clear unused part of the map in virBitmapShrink (rhbz#1540817)
  - tests: Add test for properly removing cachetune entries (rhbz#1540817)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-10
changelog:
  - storage: util: Properly ignore errors when backing volume is inaccessible (rhbz#1540022)
  - util: json: Add helper to return string or number properties as string (rhbz#1540290)
  - util: storage: Parse 'lun' for iSCSI protocol from JSON as string or number (rhbz#1540290)
  - util: Introduce virFormatIntPretty (rhbz#1289368)
  - util: Make prefix optional in virBitampString (rhbz#1289368)
  - util: Rename virBitmapString to virBitmapToString (rhbz#1289368)
  - util: Rename virBitmapDataToString to virBitmapDataFormat (rhbz#1289368)
  - util: Don't output too many zeros from virBitmapToString (rhbz#1289368)
  - util: Introduce virBitmapNewString (rhbz#1289368)
  - util: Reintroduce virBitmapSubtract (rhbz#1289368)
  - util: Introduce virBitmapShrink (rhbz#1289368)
  - conf: Sort cache banks in capabilities XML (rhbz#1289368)
  - conf: Format cache banks in capabilities with virFormatIntPretty (rhbz#1289368)
  - tests: Remove executable bits on plain data files (rhbz#1289368)
  - tests: Minor adjustments for test data (rhbz#1289368)
  - tests: Add resctrl-skx-twocaches test case to vircaps2xmltest (rhbz#1289368)
  - util: Fix leak in virStringTrimOptionalNewline (rhbz#1289368)
  - Rename virResctrlInfo to virResctrlInfoPerCache (rhbz#1289368)
  - util: Add virResctrlInfo (rhbz#1289368)
  - conf: Use virResctrlInfo in capabilities (rhbz#1289368)
  - util: Remove now-unneeded resctrl functions (rhbz#1289368)
  - fixup_resctrlinfo (rhbz#1289368)
  - resctrl: Add functions to work with resctrl allocations (rhbz#1289368)
  - conf: Add support for cputune/cachetune (rhbz#1289368)
  - tests: Add virresctrltest (rhbz#1289368)
  - qemu: Add support for resctrl (rhbz#1289368)
  - tests: Clean up and modify some vircaps2xmldata (rhbz#1289368)
  - resctl: stub out functions with Linux-only APIs used (rhbz#1289368)
  - util: Check for empty allocation instead of just NULL pointer (rhbz#1289368)
  - util: Use "resctrl" instead of "resctrlfs" spelling (rhbz#1289368)
  - util: Make it possible for virResctrlAllocSetMask to replace existing mask (rhbz#1289368)
  - util: Remove unused variable in virResctrlGetInfo (rhbz#1289368)
  - util: Don't check if entries under /sys/fs/resctrl/(info/) are directories (rhbz#1289368)
  - util: Add helpers for getting resctrl group allocs (rhbz#1289368)
  - util: Use default group's mask for unspecified resctrl allocations (rhbz#1289368)
  - util: Don't overwrite mask in virResctrlAllocFindUnused (rhbz#1289368)
  - qemu: Restore machinename even without cgroups (rhbz#1289368)
  - util: Extract path formatting into virResctrlAllocDeterminePath (rhbz#1289368)
  - qemu: Restore resctrl alloc data after restart (rhbz#1289368)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-9
changelog:
  - qemu: Fix crash in offline migration (rhbz#1536351)
  - Revert "qemu: monitor: do not report error on shutdown" (rhbz#1536461)
  - qemu: Refresh caps cache after booting a different kernel (rhbz#1525182)
  - qemu: Don't initialize struct utsname (rhbz#1525182)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-8
changelog:
  - qemuDomainAttachDeviceMknodHelper: Remove symlink before creating it (rhbz#1528502)
  - RHEL: cpu: Fix EPYC-IBRS CPU model (CVE-2017-5715)
  - cpu_x86: Copy CPU signature from ancestor (rhbz#1533125)
  - qemu: Ignore fallback CPU attribute on reconnect (rhbz#1532980)
  - qemu: Fix type of a completed job (rhbz#1523036)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-7
changelog:
  - conf: Add infrastructure for disk source private data XML (rhbz#1523261)
  - util: storage: Add helpers to parse and format relPath into privateData (rhbz#1523261)
  - qemu: domain: Parse and format relPath into disk source private data (rhbz#1523261)
  - qemu: remove input device after receiving the event (rhbz#1524837)
  - conf: honor maxnames in nodeListDevices API (rhbz#1528572)
  - storage: Fixing missing 'backingStore' tag from volume XML dumps. (rhbz#1529663)
  - util: add virFileReadHeaderQuiet wrapper around virFileReadHeaderFD (CVE-2017-5715)
  - util: introduce virHostCPUGetMicrocodeVersion (CVE-2017-5715)
  - cpu_x86: Rename virCPUx86MapInitialize (CVE-2017-5715)
  - conf: include x86 microcode version in virsh capabiltiies (CVE-2017-5715)
  - qemu: capabilities: force update if the microcode version does not match (CVE-2017-5715)
  - cpu: add CPU features and model for indirect branch prediction protection (CVE-2017-5715)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-6
changelog:
  - security: introduce virSecurityManager(Set|Restore)ChardevLabel (rhbz#1465833)
  - qemu: fix security labeling for attach/detach of char devices (rhbz#1465833)
  - nwfilter: don't crash listing filters in unprivileged daemon (rhbz#1522879)
  - docs: domain: Fix documentation of the 'snapshot' attribute for <disk> (rhbz#1523070)
  - storage: Don't dereference driver object if virStorageSource is not initialized (rhbz#1522682)
  - qemu: blockjob: Reset disk source index after pivot (rhbz#1519745)
  - qemu: Separate fetching CPU definitions from filling qemuCaps (rhbz#1521202)
  - qemu: Make sure host-model uses CPU model supported by QEMU (rhbz#1521202)
  - qemu: Avoid comparing size_t with -1 (rhbz#1521202)
  - migration.html: Clarify configuration file handling docs (rhbz#1514930)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-5
changelog:
  - conf: fix migratable XML for graphics if socket is generated based on config (rhbz#1511407)
  - storage: Extract error reporting for broken chains (rhbz#1509110)
  - qemu: domain: Refactor control flow in qemuDomainDetermineDiskChain (rhbz#1509110)
  - qemu: process: Move handling of non-backing files into qemuDomainDetermineDiskChain (rhbz#1509110)
  - qemu: domain: Fix backing store terminator for non-backing local files (rhbz#1509110)
  - numa: describe siblings distances within cells (rhbz#1454889)
  - xenconfig: add domxml conversions for xen-xl (rhbz#1454889)
  - virDomainNumaGetNodeDistance: Fix input arguments validation (rhbz#1454889)
  - numa: Introduce virDomainNumaNodeDistanceIsUsingDefaults (rhbz#1454889)
  - qemu_capabilities: Introcude QEMU_CAPS_NUMA_DIST (rhbz#1454889)
  - qemu: Support setting NUMA distances (rhbz#1454889)
  - conf: Fix memory leak for distances in virDomainNumaFree (rhbz#1454889)
  - virDomainDiskSourceNetworkParse: Don't leak @tlsCfg or @haveTLS (rhbz#1519759)
  - virDomainDiskBackingStoreParse: Don't leak @idx (rhbz#1519759)
  - qemuStateInitialize: Don't leak @memoryBackingPath (rhbz#1519759)
  - Introduce virDomainDeviceAliasIsUserAlias (rhbz#1518148)
  - qemu: prefer the PCI bus alias from status XML (rhbz#1518148)
  - virQEMUCapsHasPCIMultiBus: use def->os.arch (rhbz#1518148)
  - virQEMUCapsHasPCIMultiBus: assume true if we have no version information (rhbz#1518148)
  - qemu: add vmcoreinfo support (rhbz#1395248)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-4
changelog:
  - nodedev: Restore setting of privileged (rhbz#1517372)
  - spec: Turn on verbose build (rhbz#1335534)
  - spec: Make the build reproducible (rhbz#1335534)
  - Introduce virDomainInputDefGetPath (rhbz#1509866)
  - security: Introduce functions for input device hot(un)plug (rhbz#1509866)
  - qemu: Introduce functions for input device cgroup manipulation (rhbz#1509866)
  - qemu: functions for dealing with input device namespaces and labels (rhbz#1509866)
  - qemu: Properly label and create evdev on input device hotplug (rhbz#1509866)
  - qemu: Add QEMU_CAPS_DEVICE_SPAPR_VTY (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - qemu: rename QEMU_CAPS_SCLP_S390 to QEMU_CAPS_DEVICE_SCLPCONSOLE (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - qemu: add QEMU_CAPS_DEVICE_SCLPLMCONSOLE (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - conf, qemu: Use type-aware switches where possible (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - docs: Improve documentation for serial consoles (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - qemu: Introduce qemuDomainChrDefPostParse() (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - conf: Run devicePostParse() again for the first serial device (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - conf: Introduce VIR_DOMAIN_CHR_SERIAL_TARGET_TYPE_NONE (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - conf: Drop virDomainChrDeviceType.targetTypeAttr (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - conf: Introduce virDomainChrTargetDefFormat() (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - conf: Improve error handling in virDomainChrDefFormat() (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - conf: Check virDomainChrSourceDefFormat() return value (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - conf: Improve virDomainChrTargetDefFormat() (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - conf: Remove ATTRIBUTE_FALLTHROUGH from virDomainChrTargetDefFormat() (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - qemu: Introduce qemuDomainChrTargetDefValidate() (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - qemu: Improve qemuDomainChrTargetDefValidate() (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - conf: Parse and format virDomainChrSerialTargetModel (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - qemu: Set targetModel based on targetType for serial devices (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - qemu: Validate target model for serial devices (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - qemu: Format targetModel for serial devices (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - qemu: Remove redundancy in qemuBuildSerialChrDeviceStr() (rhbz#1449265, rhbz#1512929, rhbz#1511421, rhbz#1512934)
  - conf: Add target type and model for spapr-vty (rhbz#1511421)
  - qemu: Support usb-serial and pci-serial on pSeries (rhbz#1512934)
  - conf: Add target type and model for pl011 (rhbz#1512929)
  - conf: add VIR_DOMAIN_CHR_SERIAL_TARGET_TYPE_SCLP (rhbz#1449265)
  - qemu: switch s390/s390x default console back to serial (rhbz#1449265)
  - qemu: Add QEMU_CAPS_DEVICE_ISA_SERIAL (rhbz#1512929)
  - qemu: Require QEMU_CAPS_DEVICE_ISA_SERIAL for isa-serial (rhbz#1512929)
  - qemu: Add QEMU_CAPS_DEVICE_PL011 (rhbz#1512929)
  - qemu: Require QEMU_CAPS_DEVICE_PL011 for pl011 (rhbz#1512929)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-3
changelog:
  - tests: Rename ppc64le caps to ppc64 (rhbz#1308743)
  - tests: Add caps for QEMU 2.10.0 on ppc64 (rhbz#1308743)
  - qemu: Enable configuration of HPT resizing for pSeries guests (rhbz#1308743)
  - tests: Add tests for configuration of HPT resizing (rhbz#1308743)
  - qemuBuildDriveDevStr: Prefer default aliases for IDE bus (rhbz#1434451)
  - virQEMUCapsHasPCIMultiBus: Fix @def type (rhbz#1434451)
  - qemuBuildDriveDevStr: Prefer default alias for SATA bus (rhbz#1434451)
  - qemuBuildDeviceAddressStr: Prefer default alias for PCI bus (rhbz#1434451)
  - qemu: domain: Don't call namespace setup for storage already accessed by vm (rhbz#1506072)
  - qemu: Properly skip "char device redirected to" in QEMU log (rhbz#1335534)
  - vierror: Define VIR_ERROR_MAX_LENGTH macro (rhbz#1335534)
  - qemu: Use the end of QEMU log for reporting errors (rhbz#1335534)
  - qemu: Move snapshot disk validation functions into one (rhbz#1511480)
  - qemu: domain: Despaghettify qemuDomainDeviceDefValidate (rhbz#1511480)
  - qemu: domain: Move hostdev validation into separate function (rhbz#1511480)
  - qemu: domain: Move video device validation into separate function (rhbz#1511480)
  - qemu: domain: Refactor domain device validation function (rhbz#1511480)
  - qemu: block: Add function to check if storage source allows concurrent access (rhbz#1511480)
  - qemu: domain: Reject shared disk access if backing format does not support it (rhbz#1511480)
  - qemu: snapshot: Disallow snapshot of unsupported shared disks (rhbz#1511480)
  - qemu: Disallow pivot of shared disks to unsupported storage (rhbz#1511480)
  - qemu: caps: Add capability for 'share-rw' disk option (rhbz#1378242)
  - qemu: command: Mark <shared/> disks as such in qemu (rhbz#1378242)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-2
changelog:
  - conf: Don't inline virDomainNetTypeSharesHostView (rhbz#1472263)
  - conf: s/virDomainObjGetShortName/virDomainDefGetShortName/ (rhbz#1461214)
  - qemu: Move memPath generation from memoryBackingDir to a separate function (rhbz#1461214)
  - qemu: Set alias for memory cell in qemuBuildMemoryCellBackendStr (rhbz#1461214)
  - qemu: Rename qemuProcessBuildDestroyHugepagesPath (rhbz#1461214)
  - qemu: Destroy whole memory tree (rhbz#1461214)
  - qemu: Use predictable file names for memory-backend-file (rhbz#1461214)
  - conf: Properly parse <backingStore/> (rhbz#1509110)
  - qemu: parse: Allocate disk definition with private data (rhbz#1510781)
  - qemu: Tolerate storage source private data being NULL (rhbz#1510323)
  - qemu: domain: Don't allocate storage source private data if not needed (rhbz#1510323)
  - conf: Fix message when maximum vCPU count is less than current (rhbz#1509151)
  - Revert "virNetDevSupportBandwidth: Enable QoS for vhostuser" (rhbz#1497410)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-1
changelog:
  - Rebased to libvirt-3.9.0 (rhbz#1472263)
  - The rebase also fixes the following bugs:
      rhbz#1343919, rhbz#1379218, rhbz#1379603, rhbz#1427049, rhbz#1434451
      rhbz#1439991, rhbz#1447169, rhbz#1458630, rhbz#1460143, rhbz#1460602
      rhbz#1460677, rhbz#1460962, rhbz#1463285, rhbz#1464300, rhbz#1464832
      rhbz#1469552, rhbz#1472263, rhbz#1475250, rhbz#1484341, rhbz#1490279
      rhbz#1494400, rhbz#1495171, rhbz#1495511, rhbz#1497396, rhbz#1497410
      rhbz#1501239, rhbz#1501715, rhbz#1504592, rhbz#1506494


author: Jiri Denemark <jdenemar@redhat.com> - 3.8.0-1
changelog:
  - Rebased to libvirt-3.8.0 (rhbz#1472263)
  - The rebase also fixes the following bugs:
      rhbz#1075520, rhbz#1325066, rhbz#1341866, rhbz#1366446, rhbz#1368753
      rhbz#1373783, rhbz#1439991, rhbz#1445600, rhbz#1448268, rhbz#1450317
      rhbz#1454671, rhbz#1455023, rhbz#1455825, rhbz#1457610, rhbz#1460086
      rhbz#1461301, rhbz#1462092, rhbz#1463168, rhbz#1464313, rhbz#1471225
      rhbz#1472263, rhbz#1475227, rhbz#1476775, rhbz#1477880, rhbz#1481252
      rhbz#1481309, rhbz#1485022, rhbz#1490705, rhbz#1490826, rhbz#1491217
      rhbz#1494327


author: Jiri Denemark <jdenemar@redhat.com> - 3.7.0-1
changelog:
  - Rebased to libvirt-3.7.0 (rhbz#1472263)
  - The rebase also fixes the following bugs:
      rhbz#815702, rhbz#1233129, rhbz#1242801, rhbz#1316370, rhbz#1436065
      rhbz#1436574, rhbz#1445325, rhbz#1458146, rhbz#1282859, rhbz#1371892
      rhbz#1419760, rhbz#1430988, rhbz#1431112, rhbz#1447618, rhbz#1448149
      rhbz#1451557, rhbz#1451983, rhbz#1455819, rhbz#1459091, rhbz#1459785
      rhbz#1460962, rhbz#1461270, rhbz#1464975, rhbz#1352529, rhbz#1445596
      rhbz#1445598, rhbz#1452053, rhbz#1452441, rhbz#1458708, rhbz#1459592
      rhbz#1462060, rhbz#1463957, rhbz#1464821, rhbz#1467826, rhbz#1472277
      rhbz#1225339, rhbz#1254971, rhbz#1267191, rhbz#1436042, rhbz#1437797
      rhbz#1442947, rhbz#1443434, rhbz#1448766, rhbz#1449712, rhbz#1449715
      rhbz#1453194, rhbz#1458630, rhbz#1458638, rhbz#1462653, rhbz#1467245
      rhbz#1484230, rhbz#1484234, rhbz#1487705


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-11
changelog:
  - util: storage: Output parsed network backing store string to debug log (rhbz#1461638)
  - util: storage: Add missing return to virStorageSourceParseBackingJSONGluster (rhbz#1461638)
  - util: storage: make virStorageSourceParseBackingJSONGlusterHost universal (rhbz#1461638)
  - util: storage: Add support for type 'inet' in virStorageSourceParseBackingJSONSocketAddress (rhbz#1461638)
  - util: storage: Split out parsing of TCP network host from JSON pseudoprotocol (rhbz#1461638)
  - util: storage: Report errors when source host data is missing (rhbz#1461638)
  - util: storage: Add JSON parser for new options in iSCSI protocol (rhbz#1461638)
  - util: storage: adapt to changes in JSON format for NBD (rhbz#1461638)
  - util: storage: adapt to changes in JSON format for ceph/rbd (rhbz#1461638)
  - util: storage: adapt to changes in JSON format for ssh (rhbz#1461638)
  - util: storage: adapt to changes in JSON format for sheepdog (rhbz#1461638)
  - qemu: Allow live-updates of coalesce settings (rhbz#1414627)
  - qemu: Pass the number of heads even with -vga qxl (rhbz#1283207)
  - util: storage: Export virStorageIsRelative (rhbz#1461303)
  - storage: Add helper to retrieve the backing store string of a storage volume (rhbz#1461303)
  - qemu: snapshot: Load data necessary for relative block commit to work (rhbz#1461303)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-10
changelog:
  - qemu: Set iface MTU on hotplug (rhbz#1408701)
  - Use a separate buffer for <input> subelements (rhbz#1283251)
  - Use a separate buffer for <disk><driver> (rhbz#1283251)
  - Use a separate buffer for <controller><driver> (rhbz#1283251)
  - Use a separate buffer for <filesystem><driver> (rhbz#1283251)
  - conf: introduce virDomainControllerDriverFormat (rhbz#1283251)
  - conf: add iotlb attribute to iommu (rhbz#1283251)
  - qemu: format device-iotlb on intel-iommu command line (rhbz#1283251)
  - qemuxml2xmltest: add virtio-options test (rhbz#1283251)
  - conf: use a leading space in virDomainVirtioNetDriverFormat (rhbz#1283251)
  - Add virtio-related options to interfaces (rhbz#1283251)
  - add virtio-related options to memballoon (rhbz#1283251)
  - Add virtio-related options to disks (rhbz#1283251)
  - Add virtio-related options to controllers (rhbz#1283251)
  - Add virtio-related options to filesystems (rhbz#1283251)
  - Add virtio-related options to rng devices (rhbz#1283251)
  - Add virtio-related options to video (rhbz#1283251)
  - Add virtio-related options to input devices (rhbz#1283251)
  - qemuxml2argvtest: add virtio-options test case (rhbz#1283251)
  - qemu: format virtio-related options on the command line (rhbz#1283251)
  - qemu: Allow memAccess for hugepages again (rhbz#1214369, rhbz#1458638)
  - qemu: Prefer hugepages over mem source='file' (rhbz#1214369)
  - qemu: Don't try to use hugepages if not enabled (rhbz#1214369)
  - qemu: Introduce qemuDomainDefFromXML helper (rhbz#1460952)
  - qemu: Add qemuDomainMigratableDefCheckABIStability (rhbz#1460952)
  - qemu: Add qemuDomainCheckABIStability (rhbz#1460952)
  - qemu: Use qemuDomainCheckABIStability where needed (rhbz#1460952)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-8
changelog:
  - qemu: mkdir memory_backing_dir on startup (rhbz#1214369)
  - qemu: Don't error out if allocation info can't be queried (rhbz#1452045)
  - daemon: Don't initialize SASL context if not necessary (rhbz#1450095)
  - virDomainXMLOption: Introduce virDomainABIStabilityDomain (rhbz#1450349)
  - virQEMUDriverDomainABIStability: Check for memoryBacking (rhbz#1450349)
  - qemu: process: Save vcpu ordering information on reconnect (rhbz#1451251)
  - audit: Fix the output message for shmem (rhbz#1218603)
  - qemu: Set operation on completed migration job (rhbz#1457052)
  - qemu: Conditionally allow block-copy for persistent domains (rhbz#1459113)
  - virsh: Add support for VIR_DOMAIN_BLOCK_COPY_TRANSIENT_JOB (rhbz#1459113)
  - qemu: Fix serial stub console allocation (rhbz#1434278)
  - conf: Make error reporting in virCPUDefIsEqual optional (rhbz#1441662)
  - conf: Refactor virCPUDefParseXML (rhbz#1441662)
  - conf: Make virDomainSnapshotDefFormat easier to read (rhbz#1441662)
  - conf: Pass xmlopt to virDomainSnapshotDefFormat (rhbz#1441662)
  - qemu: Rename xml_len in virQEMUSaveHeader as data_len (rhbz#1441662)
  - qemu: Fix memory leaks in qemuDomainSaveImageOpen (rhbz#1441662)
  - qemu: Introduce virQEMUSaveData{New,Free} (rhbz#1441662)
  - qemu: Introduce virQEMUSaveDataFinish (rhbz#1441662)
  - qemu: Refactor qemuDomainSaveHeader (rhbz#1441662)
  - qemu: Introduce virQEMUSaveData structure (rhbz#1441662)
  - conf: Introduce virSaveCookie (rhbz#1441662)
  - conf: Add save cookie callbacks to xmlopt (rhbz#1441662)
  - qemu: Implement virSaveCookie object and callbacks (rhbz#1441662)
  - qemu: Store save cookie in save images and snapshots (rhbz#1441662)
  - qemu: Remember CPU def from domain start (rhbz#1441662)
  - qemu: Report the original CPU in migratable xml (rhbz#1441662)
  - qemu: Always send persistent XML during migration (rhbz#1441662)
  - qemu: Send updated CPU in migration cookie (rhbz#1441662)
  - qemu: Store updated CPU in save cookie (rhbz#1441662)
  - qemu: Use updated CPU when starting QEMU if possible (rhbz#1441662)
  - docs: correct improper information about domain states in virsh manpage (rhbz#1408778)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-7
changelog:
  - conf: Resolve corner case on fc_host deletion (rhbz#1420740)
  - pci: fix link maximum speed detection (rhbz#1455017)
  - qemu: Use correct variable in qemuDomainSetBlockIoTune (rhbz#1455510)
  - virsh: Track when create pkttyagent (rhbz#1374126)
  - conf: add eim attribute to <iommu><driver> (rhbz#1451282, rhbz#1289153)
  - qemu: format eim on intel-iommu command line (rhbz#1451282, rhbz#1289153)
  - rpc: Double buffer size instead of quadrupling buffer size. (rhbz#1440683)
  - rpc: Allow up to 256K records to be returned per domain from virConnectGetAllDomainStats. (rhbz#1440683)
  - nodedev: Increase the netlink socket buffer size to the one used by udev (rhbz#1450960, rhbz#1442307)
  - util: hostcpu: Correctly report total number of vcpus in virHostCPUGetMap (rhbz#1456793)
  - qemu: Report shutdown event details (rhbz#1384007)
  - qemu: json: Fix daemon crash on handling domain shutdown event (rhbz#1384007)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-6
changelog:
  - util: introduce virStringMatch (rhbz#1446980)
  - util: introduce virBufferEscapeRegex (rhbz#1446980)
  - qemu: improve detection of UNIX path generated by libvirt (rhbz#1446980)
  - Adding POWER9 cpu model to cpu_map.xml (rhbz#1450189)
  - qemu: driver: Allow passing disk target as top image with block commit (rhbz#1451394)
  - qemu: monitor: Don't bother extracting vCPU halted state in text monitor (rhbz#1452106)
  - conf: Don't assign value from ..TypeFromString directly to enum (rhbz#1452454)
  - nodedev: Make use of the compile-time missing enum in switch error (rhbz#1452072)
  - conf: nodedev: Split virNodeDeviceDefFormat into more functions (rhbz#1452072)
  - docs: Provide a nodedev driver stub documentation (rhbz#1452072)
  - mdev: Pass a uuidstr rather than an mdev object to some util functions (rhbz#1452072)
  - nodedev: conf: Split PCI sub-capability parsing to separate methods (rhbz#1452072)
  - nodedev: Introduce new mdev_types and mdev nodedev capabilities (rhbz#1452072)
  - nodedev: Introduce the mdev capability to a PCI parent device (rhbz#1452072)
  - nodedev: Introduce mdev capability for mediated devices (rhbz#1452072)
  - docs: Document the mediated devices within the nodedev driver (rhbz#1452072)
  - Do not release unreserved address in qemuDomainAttachRNGDevice (rhbz#1452581)
  - qemu: process: Clear priv->namespaces on VM shutdown (rhbz#1453142)
  - Revert "qemu: propagate bridge MTU into qemu "host_mtu" option" (rhbz#1449346)
  - qemu: Properly check return value of VIR_STRDUP in qemuDomainGetBlockIoTune (rhbz#1433183)
  - rpc: Bump maximum message size to 32M (rhbz#1440683)
  - Split out virDomainIOMMUDefFormat (rhbz#1427005)
  - qemu: allow conditional device property probing (rhbz#1427005)
  - qemu: refactor qemuBuildIOMMUCommandLine (rhbz#1427005)
  - conf: add <ioapic driver> to <features> (rhbz#1427005)
  - qemu: format kernel_irqchip on the command line (rhbz#1427005)
  - conf: add <driver intremap> to <iommu> (rhbz#1427005)
  - qemu: format intel-iommu, intremap on the command line (rhbz#1427005)
  - conf: add caching_mode attribute to iommu device (rhbz#1427005)
  - qemu: format caching-mode on iommu command line (rhbz#1427005)
  - conf: split out virDomainIOMMUDefCheckABIStability (rhbz#1427005)
  - conf: add ABI stability checks for IOMMU options (rhbz#1427005)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-5
changelog:
  - util: mdev: Use a local variable instead of a direct pointer access (rhbz#1446455)
  - mdev: Fix daemon crash on domain shutdown after reconnect (rhbz#1446455)
  - qemu: Provide a much clearer message on device hot-plug (rhbz#1450072)
  - virsh: Add --tls description for the virsh man page (rhbz#1448806)
  - conf: Check CPU cache for ABI stability (rhbz#1449595)
  - qemuDomainBuildNamespace: Move /dev/* mountpoints later (rhbz#1449510)
  - qemuDomainCreateDeviceRecursive: pass a structure instead of bare path (rhbz#1449510)
  - qemuDomainCreateDeviceRecursive: Don't try to create devices under preserved mount points (rhbz#1449510)
  - qemuDomainAttachDeviceMknodRecursive: Don't try to create devices under preserved mount points (rhbz#1449510)
  - qemuDomainDetachDeviceUnlink: Don't unlink files we haven't created (rhbz#1449510)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-4
changelog:
  - conf: add a new parse flag VIR_DOMAIN_DEF_PARSE_ABI_UPDATE_MIGRATION (rhbz#1373184)
  - qemu_domain: use correct default USB controller on ppc64 (rhbz#1373184)
  - qemu: hotplug: Unexport qemuDomainHotplugDelVcpu (rhbz#1439452)
  - qemu: hotplug: Don't save status XML when monitor is closed (rhbz#1439452)
  - util: check ifa_addr pointer before accessing its elements (rhbz#1444408)
  - util: allow ignoring SIOCSIFHWADDR when errno is EPERM (rhbz#1415609)
  - qemu: Ignore missing query-migrate-parameters (rhbz#1441934)
  - locking: Add support for sanlock_strerror (rhbz#1409511)
  - RHEL: spec: Require sanlock >= 3.5 (rhbz#1409511)
  - qemu: Properly reset non-p2p migration (rhbz#1425003)
  - qemu: Don't fail if physical size can't be updated in qemuDomainGetBlockInfo (rhbz#1442344)
  - qemu: process: Clean automatic NUMA/cpu pinning information on shutdown (rhbz#1445627)
  - qemu: process: Don't leak priv->usbaddrs after VM restart (rhbz#1445627)
  - qemu: process: Clean up priv->migTLSAlias (rhbz#1445627)
  - Add VIR_DOMAIN_JOB_OPERATION typed parameter (rhbz#1441563)
  - qemu: Report VIR_DOMAIN_JOB_OPERATION (rhbz#1441563)
  - conf: Rename mode parameter in virCPUDefParseXML (rhbz#1428952)
  - Add support for CPU cache specification (rhbz#1428952)
  - qemu: Add support for guest CPU cache (rhbz#1428952)
  - qemu: Don't reset "events" migration capability (rhbz#1441165)
  - qemu: Fix persistent migration of transient domains (rhbz#1446205)
  - Fix padding of encrypted data (rhbz#1447297)
  - cpu: Introduce virCPUCopyMigratable (rhbz#1444421)
  - qemu: Move common code in virQEMUCapsInitCPUModel one layer up (rhbz#1444421)
  - qemu: Add migratable parameter to virQEMUCapsInitCPUModel (rhbz#1444421)
  - qemu: Introduce virQEMUCapsSetHostModel (rhbz#1444421)
  - qemu: Move qemuCaps CPU data copying into a separate function (rhbz#1444421)
  - qemu: Introduce virQEMUCapsHostCPUDataClear (rhbz#1444421)
  - qemu: Move qemuCaps host CPU data in a struct (rhbz#1444421)
  - qemu: Prepare qemuCaps for multiple host CPU defs (rhbz#1444421)
  - qemu: Pass migratable host CPU model to virCPUUpdate (rhbz#1444421)
  - cpu: Drop feature filtering from virCPUUpdate (rhbz#1444421)
  - cpu: Introduce virCPUGetHostIsSupported (rhbz#1444421)
  - qemu: Use more data for comparing CPUs (rhbz#1444421)
  - qemu: don't kill qemu process on restart if networkNotify fails (rhbz#1442700)
  - network: better log message when network is inactive during reconnect (rhbz#1442700)
  - disk: Resolve issues with disk partition build/start checks (rhbz#1439132)
  - disk: Force usage of parted when checking disk format for "bsd" (rhbz#1439132)
  - storage: Modify storageBackendWipeLocal to allow zero from end of device (rhbz#1439132)
  - storage: Introduce virStorageBackendZeroPartitionTable (rhbz#1439132)
  - logical: Use virStorageBackendZeroPartitionTable (rhbz#1373711, rhbz#1439132)
  - logical: Increase the size of the data to wipe (rhbz#1373711, rhbz#1439132)
  - disk: Use virStorageBackendZeroPartitionTable (rhbz#1439132)
  - util: Add virNetDevSetCoalesce function (rhbz#1414627)
  - conf, docs: Add support for coalesce setting(s) (rhbz#1414627)
  - Set coalesce settings for domain interfaces (rhbz#1414627)
  - docs: fix typo in closing HTML element (rhbz#1414627)
  - Don't leak str in virDomainNetDefCoalesceParseXML (rhbz#1414627)
  - Remove pointless check for !ret in virDomainNetDefCoalesceParseXML (rhbz#1414627)
  - Define ETHTOOL_[GS]COALESCE when building on older kernels (rhbz#1414627)
  - qemu: change the logic of setting default USB controller (rhbz#1438682)
  - qemu: use nec-usb-xhci as a default controller for aarch64 if available (rhbz#1438682)
  - qemu: introduce QEMU_CAPS_DEVICE_QEMU_XHCI (rhbz#1438682)
  - qemu: add support for qemu-xhci USB controller (rhbz#1438682)
  - qemu: use qemu-xhci USB controller by default for ppc64 and aarch64 (rhbz#1438682)
  - util: make macvtap/macvlan generated name #defines available to other files (rhbz#1335798)
  - conf: don't ignore <target dev='blah'/> for macvtap interfaces (rhbz#1335798)
  - util: rename/move VIR_NET_GENERATED_PREFIX to be consistent (rhbz#1335798)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-3
changelog:
  - qemu: Fix mdev checking for VFIO support (rhbz#1441291)
  - pci: recognize/report GEN4 (PCIe 4.0) card 16GT/s Link speed (rhbz#1442831)
  - qemu: refactor qemuDomainMachine* functions (rhbz#1441964)
  - qemu: report IDE bus in domain capabilities only if it's supported (rhbz#1441964)
  - qemu: do not crash on USB address with no port and invalid bus (rhbz#1441589)
  - spec: Avoid RPM verification errors on nwfilter XMLs (rhbz#1378774)
  - conf: Add check for non scsi_host parent during vport delete (rhbz#1420740)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-2
changelog:
  - storage: Fix capacity value for LUKS encrypted volumes (rhbz#1371892)
  - qemu: Add device id for mediated devices on qemu command line (rhbz#1438431)
  - qemu: hotplug: Iterate over vcpu 0 in individual vcpu hotplug code (rhbz#1437013)
  - qemu: hotplug: Fix formatting strings in qemuDomainFilterHotplugVcpuEntities (rhbz#1437010)
  - qemu: hotplug: Clear vcpu ordering for coldplug of vcpus (rhbz#1437010)
  - qemu: hotplug: Add validation for coldplug of individual vcpus (rhbz#1437010)
  - qemu: hotplug: Validate that vcpu-hotplug does not break config (rhbz#1437010)
  - qemu: Split virQEMUCapsInitArchQMPBasic() (rhbz#1429509)
  - tests: Initialize basic capabilities properly (rhbz#1429509)
  - qemu: Remove redundant capabilities (rhbz#1429509)
  - qemu: Advertise ACPI support for aarch64 guests (rhbz#1429509)
  - qemu: Enforce ACPI, UEFI requirements (rhbz#1429509)
  - tests: Test ACPI, UEFI requirements (rhbz#1429509)
  - qemu: Fix regression when hyperv/vendor_id feature is used (rhbz#1439736)
  - qemu: Fix resource leak in qemuDomainAddChardevTLSObjects error path (rhbz#1300769)
  - qemu: Break endless loop if qemuMigrationResetTLS fails (rhbz#1300769)
  - qemu: Properly reset TLS in qemuProcessRecoverMigrationIn (rhbz#1425003)
  - qemu: Drop resume label in qemuProcessRecoverMigrationOut (rhbz#1425003)
  - qemu: Always reset TLS in qemuProcessRecoverMigrationOut (rhbz#1425003)
  - qemu: Don't reset TLS in qemuMigrationRun (rhbz#1425003)
  - qemu: Don't reset TLS in qemuMigrationCancel (rhbz#1425003)
  - qemu: Introduce qemuMigrationReset (rhbz#1425003)
  - qemu: Simplify qemuMigrationResetTLS (rhbz#1425003)
  - qemu: Properly reset all migration capabilities (rhbz#1425003)
  - qemu: Don't overwrite existing error in qemuMigrationReset (rhbz#1439130)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-1
changelog:
  - Rebased to libvirt-3.2.0 (rhbz#1382640)
  - The rebase also fixes the following bugs:
      rhbz#822148, rhbz#824989, rhbz#1004676, rhbz#1018251, rhbz#1181659
      rhbz#1181899, rhbz#1270403, rhbz#1292451, rhbz#1300769, rhbz#1329090
      rhbz#1366088, rhbz#1371617, rhbz#1372581, rhbz#1389313, rhbz#1398087
      rhbz#1404627, rhbz#1406791, rhbz#1408808, rhbz#1410225, rhbz#1415609
      rhbz#1422318, rhbz#1426176, rhbz#1428209, rhbz#1428893, rhbz#1429551
      rhbz#1430275, rhbz#1430634, rhbz#1430672, rhbz#1430679, rhbz#1431112
      rhbz#1431793, rhbz#1431852, rhbz#1433180, rhbz#1433183, rhbz#1434882
      rhbz#1436119, rhbz#1436999


author: Jiri Denemark <jdenemar@redhat.com> - 3.1.0-2
changelog:
  - qemuDomainSaveImageUpdateDef: Don't overwrite errors from virDomainDefCheckABIStability (rhbz#1379200)
  - qemu_process: don't probe iothreads if it's not supported by QEMU (rhbz#1430258)


author: Jiri Denemark <jdenemar@redhat.com> - 3.1.0-1
changelog:
  - Rebased to libvirt-3.1.0 (rhbz#1382640)
  - The rebase also fixes the following bugs:
      rhbz#1268906, rhbz#1316774, rhbz#1330024, rhbz#1336564, rhbz#1343094
      rhbz#1344897, rhbz#1346566, rhbz#1349441, rhbz#1352529, rhbz#1374128
      rhbz#1375410, rhbz#1375417, rhbz#1378540, rhbz#1382640, rhbz#1383039
      rhbz#1397440, rhbz#1408701, rhbz#1410188, rhbz#1412834, rhbz#1414393
      rhbz#1417203, rhbz#1420205, rhbz#1420668, rhbz#1420718, rhbz#1421036


author: Jiri Denemark <jdenemar@redhat.com> - 3.0.0-2
changelog:
  - Enable use of namespaces by default (rhbz#1382640)
  - virProcessRunInMountNamespace: Report errors from child
  - util: Introduce virFileReadLink
  - qemuDomainPrepareDisk: Fix ordering
  - qemuSecurityRestoreAllLabel: Don't use transactions
  - qemu_security: Use more transactions
  - qemuDomain{Attach,Detach}Device NS helpers: Don't relabel devices
  - qemuDomainCreateDevice: Properly deal with symlinks
  - qemuDomainCreateDevice: Don't loop endlessly
  - qemuDomainAttachDeviceMknod: Deal with symlinks
  - qemuDomainAttachDeviceMknod: Don't loop endlessly
  - qemuDomainAttachSCSIVHostDevice: Prefer qemuSecurity wrappers
  - qemuDomainAttachSCSIVHostDevice: manage /dev entry
  - qemu_security: Drop qemuSecuritySetRestoreAllLabelData struct
  - qemu_domain: Don't pass virDomainDeviceDefPtr to ns helpers
  - qemuDomainNamespaceSetupDisk: Drop useless @src variable
  - qemuDomainNamespace{Setup,Teardown}Disk: Don't pass pointer to full disk
  - qemuDomainDiskChainElement{Prepare,Revoke}: manage /dev entry
  - qemuDomainNamespaceSetupDisk: Simplify disk check
  - qemu_security: Introduce ImageLabel APIs


author: Jiri Denemark <jdenemar@redhat.com> - 3.0.0-1
changelog:
  - Rebased to libvirt-3.0.0 (rhbz#1382640)
  - The rebase also fixes the following bugs:
      rhbz#1191901, rhbz#1257813, rhbz#1292984, rhbz#1300177, rhbz#1302168
      rhbz#1302171, rhbz#1332019, rhbz#1336564, rhbz#1349696, rhbz#1363586
      rhbz#1370357, rhbz#1373711, rhbz#1386466, rhbz#1396040, rhbz#1397940
      rhbz#1402690, rhbz#1402726, rhbz#1403691, rhbz#1404952, rhbz#1405269
      rhbz#1406442


author: Jiri Denemark <jdenemar@redhat.com> - 2.5.0-1
changelog:
  - Rebased to libvirt-2.5.0 (rhbz#1382640)
  - The rebase also fixes the following bugs:
      rhbz#1106416, rhbz#1106419, rhbz#1207095, rhbz#1247005, rhbz#1300776
      rhbz#1343858, rhbz#1347049, rhbz#1349898, rhbz#1354253, rhbz#1356769
      rhbz#1356881, rhbz#1357358, rhbz#1357416, rhbz#1358181, rhbz#1359135
      rhbz#1360533, rhbz#1365779, rhbz#1366108, rhbz#1366460, rhbz#1366505
      rhbz#1368351, rhbz#1368368, rhbz#1369633, rhbz#1370357, rhbz#1370360
      rhbz#1371039, rhbz#1371358, rhbz#1371758, rhbz#1372580, rhbz#1373535
      rhbz#1373783, rhbz#1373849, rhbz#1374718, rhbz#1375268, rhbz#1375424
      rhbz#1375524, rhbz#1375887, rhbz#1375920, rhbz#1375939, rhbz#1376009
      rhbz#1376083, rhbz#1377602, rhbz#1377913, rhbz#1378290, rhbz#1378401
      rhbz#1379196, rhbz#1379212, rhbz#1379895, rhbz#1382079, rhbz#1386976
      rhbz#1387665, rhbz#1387666, rhbz#1393854, rhbz#1396597, rhbz#1399260
      rhbz#1401054


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-9
changelog:
  - Add helper for removing transient definition (rhbz#1368774)
  - qemu: Remove stale transient def when migration fails (rhbz#1368774)
  - qemu: Don't use query-migrate on destination (rhbz#1374613)
  - conf: allow hotplugging "legacy PCI" device to manually addressed PCIe slot (rhbz#1337490)
  - conf: Add support for virtio-net.rx_queue_size (rhbz#1366989)
  - qemu_capabilities: Introduce virtio-net-*.rx_queue_size (rhbz#1366989)
  - qemu: Implement virtio-net rx_queue_size (rhbz#1366989)
  - audit: Audit information about shmem devices (rhbz#1218603)
  - qemu: monitor: Use a more obvious iterator name (rhbz#1375783)
  - qemu: monitor: qemuMonitorGetCPUInfoHotplug: Add iterator 'anycpu' (rhbz#1375783)
  - qemu: monitor: Add vcpu state information to monitor data (rhbz#1375783)
  - qemu: domain: Don't infer vcpu state (rhbz#1375783)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-8
changelog:
  - util: storage: Properly set protocol type when parsing gluster json string (rhbz#1372251)
  - conf: Add IOThread quota and period scheduler/cputune defs (rhbz#1356937)
  - qemu: Add support to get/set IOThread period and quota cgroup values (rhbz#1356937)
  - network: new network forward mode 'open' (rhbz#846810)
  - virtlogd.socket: Tie lifecycle to libvirtd.service (rhbz#1372576)
  - cpu_x86: Fix minimum match custom CPUs on hosts with CMT (rhbz#1365500)
  - qemu: cgroup: Extract temporary relaxing of cgroup setting for vcpu hotplug (rhbz#1097930)
  - qemu: process: Fix start with unpluggable vcpus with NUMA pinning (rhbz#1097930)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-7
changelog:
  - qemu: caps: Always assume QEMU_CAPS_SMP_TOPOLOGY (rhbz#1097930)
  - conf: Extract code formatting vCPU info (rhbz#1097930)
  - conf: Rename virDomainVcpuInfoPtr to virDomainVcpuDefPtr (rhbz#1097930)
  - conf: Don't report errors from virDomainDefGetVcpu (rhbz#1097930)
  - tests: qemuxml2xml: Format status XML header dynamically (rhbz#1097930)
  - conf: convert def->vcpus to a array of pointers (rhbz#1097930)
  - conf: Add private data for virDomainVcpuDef (rhbz#1097930)
  - qemu: domain: Add vcpu private data structure (rhbz#1097930)
  - qemu: domain: Extract formating and parsing of vCPU thread ids (rhbz#1097930)
  - qemu: Add cpu ID to the vCPU pid list in the status XML (rhbz#1097930)
  - qemu: Store vCPU thread ids in vcpu private data objects (rhbz#1097930)
  - Fix logic in qemuDomainObjPrivateXMLParseVcpu (rhbz#1097930)
  - qemu: Add qemuProcessSetupPid() and use it in qemuProcessSetupIOThread() (rhbz#1097930)
  - qemu: Use qemuProcessSetupPid() in qemuProcessSetupEmulator() (rhbz#1097930)
  - qemu: Use qemuProcessSetupPid() in qemuProcessSetupVcpu() (rhbz#1097930)
  - qemuBuildCpuCommandLine: Don't leak @buf (rhbz#1097930)
  - conf: Make really sure we don't access non-existing vCPUs (rhbz#1097930)
  - conf: Make really sure we don't access non-existing vCPUs again (rhbz#1097930)
  - qemu: capabilities: Drop unused function virQEMUCapsGetMachineTypes (rhbz#1097930)
  - qemu: caps: Sanitize storage of machine type related data (rhbz#1097930)
  - qemu: cap: Refactor access to array in virQEMUCapsProbeQMPMachineTypes (rhbz#1097930)
  - qemu: monitor: Add monitor API for device_add supporting JSON objects (rhbz#1097930)
  - qemu: monitor: Add do-while block to QEMU_CHECK_MONITOR_FULL (rhbz#1097930)
  - qemu: Improve error message in virDomainGetVcpus (rhbz#1097930)
  - qemu: domain: Rename qemuDomainDetectVcpuPids to qemuDomainRefreshVcpuInfo (rhbz#1097930)
  - qemu: monitor: Rename qemuMonitor(JSON|Text)GetCPUInfo (rhbz#1097930)
  - qemu: domain: Improve vCPU data checking in qemuDomainRefreshVcpu (rhbz#1097930)
  - qemu: domain: Simplify return values of qemuDomainRefreshVcpuInfo (rhbz#1097930)
  - internal: Introduce macro for stealing pointers (rhbz#1097930)
  - tests: qemucapabilities: Add data for qemu 2.7.0 (rhbz#1097930)
  - qemu: setcpus: Report better errors (rhbz#1097930)
  - qemu: setvcpus: Extract setting of maximum vcpu count (rhbz#1097930)
  - qemu: driver: Extract setting of live vcpu count (rhbz#1097930)
  - qemu: driver: Split out regular vcpu hotplug code into a function (rhbz#1097930)
  - conf: Provide error on undefined vcpusched entry (rhbz#1097930)
  - qemu: monitor: Return structures from qemuMonitorGetCPUInfo (rhbz#1097930)
  - qemu: monitor: Return struct from qemuMonitor(Text|Json)QueryCPUs (rhbz#1097930)
  - qemu: Add capability for query-hotpluggable-cpus command (rhbz#1097930)
  - qemu: Forbid config when topology based cpu count doesn't match the config (rhbz#1097930)
  - qemu: capabilities: Extract availability of new cpu hotplug for machine types (rhbz#1097930)
  - qemu: monitor: Extract QOM path from query-cpus reply (rhbz#1097930)
  - qemu: monitor: Add support for calling query-hotpluggable-cpus (rhbz#1097930)
  - qemu: monitor: Add algorithm for combining query-(hotpluggable-)-cpus data (rhbz#1097930)
  - tests: Add test infrastructure for qemuMonitorGetCPUInfo (rhbz#1097930)
  - tests: cpu-hotplug: Add data for x86 hotplug with 11+ vcpus (rhbz#1097930)
  - tests: cpu-hotplug: Add data for ppc64 platform including hotplug (rhbz#1097930)
  - tests: cpu-hotplug: Add data for ppc64 out-of-order hotplug (rhbz#1097930)
  - tests: cpu-hotplug: Add data for ppc64 without threads enabled (rhbz#1097930)
  - qemu: domain: Extract cpu-hotplug related data (rhbz#1097930)
  - qemu: domain: Prepare for VCPUs vanishing while libvirt is not running (rhbz#1097930)
  - util: Extract and rename qemuDomainDelCgroupForThread to virCgroupDelThread (rhbz#1097930)
  - conf: Add XML for individual vCPU hotplug (rhbz#1097930)
  - qemu: migration: Prepare for non-contiguous vcpu configurations (rhbz#1097930)
  - qemu: command: Add helper to convert vcpu definition to JSON props (rhbz#1097930)
  - qemu: process: Copy final vcpu order information into the vcpu definition (rhbz#1097930)
  - qemu: command: Add support for sparse vcpu topologies (rhbz#1097930)
  - qemu: Use modern vcpu hotplug approach if possible (rhbz#1097930)
  - qemu: hotplug: Allow marking unplugged devices by alias (rhbz#1097930)
  - qemu: hotplug: Add support for VCPU unplug (rhbz#1224341)
  - virsh: vcpuinfo: Report vcpu number from the structure rather than it's position (rhbz#1097930)
  - qemu: driver: Fix qemuDomainHelperGetVcpus for sparse vcpu topologies (rhbz#1097930)
  - doc: clarify documentation for vcpu order (rhbz#1097930)
  - conf: Don't validate vcpu count in XML parser (rhbz#1097930)
  - qemu: driver: Validate configuration when setting maximum vcpu count (rhbz#1370066)
  - conf: Fix build with picky GCC (rhbz#1097930)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-6
changelog:
  - qemu_command: don't modify heads for graphics device (rhbz#1366119)
  - virsh: Fix core for cmdSecretGetValue (rhbz#1366611)
  - conf: report an error message for non-existing USB hubs (rhbz#1367130)
  - conf: free the ports array of a USB hub (rhbz#1366097)
  - utils: storage: Fix JSON field name for uri based storage (rhbz#1367260)
  - qemu: Adjust the cur_ballon on coldplug/unplug of dimms (rhbz#1220702)
  - conf: Provide error on undefined iothreadsched entry (rhbz#1366484)
  - qemu: Fix the command line generation for rbd auth using aes secrets (rhbz#1182074)
  - qemu: Fix crash hot plugging luks volume (rhbz#1367259)
  - Revert "admin: Fix the default uri for session daemon to libvirtd:///session" (rhbz#1367269)
  - libvirt: convert to typesafe virConf accessors (rhbz#1367269)
  - admin: Fix default uri config option name s/admin_uri_default/uri_default (rhbz#1367269)
  - virt-admin: Properly fix the default session daemon URI to admin server (rhbz#1367269)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-5
changelog:
  - qemu: Fix domain state after reset (rhbz#1269575)
  - rpc: virnetserver: Rename ClientSetProcessingControls to ClientSetLimits (rhbz#1357776)
  - rpc: virnetserver: Move virNetServerCheckLimits which is static up in the file (rhbz#1357776)
  - rpc: virnetserver: Add code to CheckLimits to handle suspending of services (rhbz#1357776)
  - admin: rpc: virnetserver: Fix updating of the client limits (rhbz#1357776)
  - rpc: virnetserver: Remove dead code checking the client limits (rhbz#1357776)
  - storage: Fix a NULL ptr dereference in virStorageBackendCreateQemuImg (rhbz#1363636)
  - qemu: Introduce qemuAliasFromHostdev (rhbz#1289391)
  - qemu: Use the hostdev alias in qemuDomainAttachHostSCSIDevice error path (rhbz#1289391)
  - storage: Don't remove the pool for buildPool failure in storagePoolCreate (rhbz#1362349)
  - lxcDomainCreateXMLWithFiles: Avoid crash (rhbz#1363773)
  - admin: Fix the default uri for session daemon to libvirtd:///session (rhbz#1356858)
  - docs: Distribute subsite.xsl (rhbz#1365004)
  - qemuBuildMachineCommandLine: Follow our pattern (rhbz#1304483)
  - Introduce SMM feature (rhbz#1304483)
  - Introduce @secure attribute to os loader element (rhbz#1304483)
  - qemu: Enable secure boot (rhbz#1304483)
  - qemu: Advertise OVMF_CODE.secboot.fd (rhbz#1304483)
  - tests: Fix broken build (rhbz#1304483)
  - cpu_x86: Introduce x86FeatureIsMigratable (rhbz#1365500)
  - cpu_x86: Properly drop non-migratable features (rhbz#1365500)
  - tests: Add a test for host-model CPU with CMT feature (rhbz#1365500)
  - cpu_x86: Fix host-model CPUs on hosts with CMT (rhbz#1365500)
  - virt-admin: Fix the error when an invalid URI has been provided (rhbz#1365903)
  - conf: improve error log when PCI devices don't match requested controller (rhbz#1363627)
  - conf: don't allow connecting upstream-port directly to pce-expander-bus (rhbz#1361172)
  - conf: restrict where dmi-to-pci-bridge can be connected (rhbz#1363648)
  - conf: restrict expander buses to connect only to a root bus (rhbz#1358712)
  - virNetDevMacVLanCreateWithVPortProfile: Don't mask virNetDevMacVLanTapOpen error (rhbz#1240439)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-4
changelog:
  - qemu: hotplug: fix changeable media ejection (rhbz#1359071)
  - lxc: Don't crash by forgetting to ref transient domains (rhbz#1351057)
  - Introduce <iommu> device (rhbz#1235581)
  - Add QEMU_CAPS_DEVICE_INTEL_IOMMU (rhbz#1235581)
  - qemu: format intel-iommu on the command line (rhbz#1235581)
  - qemu_monitor_json: add support to search QOM device path by device alias (rhbz#1358728)
  - hvsupport: Introduce parseSymsFile (rhbz#1286679)
  - hvsupport: use a regex instead of XML::XPath (rhbz#1286679)
  - hvsupport: construct the group regex upfront (rhbz#1286679)
  - hvsupport: skip non-matching lines early (rhbz#1286679)
  - virconf: Fix config file path construction (rhbz#1357364)
  - virDomainHostdevDefFree: Don't leak privateData (rhbz#1357346)
  - virt-admin: Output srv-threadpool-info data as unsigned int rather than signed (rhbz#1356769)
  - util: Introduce virISCSINodeNew (rhbz#1356436)
  - iscsi: Establish connection to target via static target login (rhbz#1356436)
  - storage: Document wiping formatted volume types (rhbz#868771)
  - admin: Retrieve the SASL context for both local and remote connection (rhbz#1361948)
  - daemon: sasl: Don't forget to save SASL username to client's identity (rhbz#1361948)
  - vsh: Make vshInitDebug return int instead of void (rhbz#1357363)
  - tools: Make use of the correct environment variables (rhbz#1357363)
  - util: Add 'usage' for encryption (rhbz#1301021)
  - virStorageEncryptionSecretFree: Don't leak secret lookup definition (rhbz#1301021)
  - encryption: Add luks parsing for storageencryption (rhbz#1301021)
  - encryption: Add <cipher> and <ivgen> to encryption (rhbz#1301021)
  - qemu: Introduce helper qemuDomainSecretDiskCapable (rhbz#1301021)
  - tests: Adjust LUKS tests to use 'volume' secret type (rhbz#1301021)
  - docs: Update docs to reflect LUKS secret changes (rhbz#1301021)
  - qemu: Alter error path cleanup for qemuDomainAttachHostSCSIDevice (rhbz#1301021)
  - qemu: Alter error path cleanup for qemuDomainAttachVirtioDiskDevice (rhbz#1301021)
  - qemu: Alter error path cleanup for qemuDomainAttachSCSIDisk (rhbz#1301021)
  - qemu: Move and rename qemuBufferEscapeComma (rhbz#1301021)
  - storage: Add support to create a luks volume (rhbz#1301021)
  - qemu: Add secinfo for hotplug virtio disk (rhbz#1301021)
  - qemu: Alter the qemuDomainGetSecretAESAlias to add new arg (rhbz#1301021)
  - qemu: Add luks support for domain disk (rhbz#1301021)
  - qemu: Move setting of obj bools for qemuDomainAttachVirtioDiskDevice (rhbz#1301021)
  - qemu: Move setting of encobjAdded for qemuDomainAttachSCSIDisk (rhbz#1301021)
  - storage: Fix error path (rhbz#1301021)
  - qemu: Disallow usage of luks encryption if aes secret not possible (rhbz#1301021)
  - storage: Add extra failure condition for luks volume creation (rhbz#1301021)
  - virstoragefile: refactor virStorageFileMatchesNNN methods (rhbz#1301021)
  - qemu: Make qemuDomainCheckDiskStartupPolicy self-contained (rhbz#1168453)
  - qemu: Remove unnecessary label and its only reference (rhbz#1168453)
  - qemu: Fix support for startupPolicy with volume/pool disks (rhbz#1168453)
  - virsh: Report error when explicit connection fails (rhbz#1356461)
  - tests: Add testing of backing store string parser (rhbz#1134878)
  - util: json: Make first argument of virJSONValueObjectForeachKeyValue const (rhbz#1134878)
  - util: qemu: Add wrapper for JSON -> commandline conversion (rhbz#1134878)
  - util: qemu: Add support for user-passed strings in JSON->commandline (rhbz#1134878)
  - util: qemu: Allow nested objects in JSON -> commandline generator (rhbz#1134878)
  - util: qemu: Allow for different approaches to format JSON arrays (rhbz#1134878)
  - util: qemu: Don't generate any extra commas in virQEMUBuildCommandLineJSON (rhbz#1134878)
  - util: json: Make first argument of virJSONValueCopy const (rhbz#1134878)
  - util: storage: Add parser for qemu's json backing pseudo-protocol (rhbz#1134878)
  - util: storage: Add support for host device backing specified via JSON (rhbz#1134878)
  - util: storage: Add support for URI based backing volumes in qemu's JSON pseudo-protocol (rhbz#1134878)
  - util: storage: Add json pseudo protocol support for gluster volumes (rhbz#1134878)
  - util: storage: Add json pseudo protocol support for iSCSI volumes (rhbz#1134878)
  - util: storage: Add JSON backing volume parser for 'nbd' protocol (rhbz#1134878)
  - util: storage: Add JSON backing store parser for 'sheepdog' protocol (rhbz#1134878)
  - util: storage: Add 'ssh' network storage protocol (rhbz#1134878)
  - util: storage: Add JSON backing volume parser for 'ssh' protocol (rhbz#1134878)
  - qemu: command: Rename qemuBuildNetworkDriveURI to qemuBuildNetworkDriveStr (rhbz#1247521)
  - qemu: command: Split out network disk URI building (rhbz#1247521)
  - qemu: command: Extract drive source command line formatter (rhbz#1247521)
  - qemu: command: Refactor code extracted to qemuBuildDriveSourceStr (rhbz#1247521)
  - storage: gluster: Support multiple hosts in backend functions (rhbz#1247521)
  - util: qemu: Add support for numbered array members (rhbz#1247521)
  - qemu: command: Add infrastructure for object specified disk sources (rhbz#1247521)
  - qemu: command: Add support for multi-host gluster disks (rhbz#1247521)
  - qemu: Need to free fileprops in error path (rhbz#1247521)
  - storage: remove "luks" storage volume type (rhbz#1301021)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-3
changelog:
  - qemu: getAutoDumpPath() return value should be dumpfile not domname. (rhbz#1354238)
  - qemu: Copy complete domain def in qemuDomainDefFormatBuf (rhbz#1320470)
  - qemu: Drop default channel path during migration (rhbz#1320470)
  - qemu: Fix migration from old libvirt (rhbz#1320500)
  - Add USB addresses to qemuhotplug test cases (rhbz#1215968)
  - Introduce virDomainUSBDeviceDefForeach (rhbz#1215968)
  - Allow omitting USB port (rhbz#1215968)
  - Store USB port path as an array of integers (rhbz#1215968)
  - Introduce virDomainUSBAddressSet (rhbz#1215968)
  - Add functions for adding USB controllers to addrs (rhbz#1215968)
  - Add functions for adding USB hubs to addrs (rhbz#1215968)
  - Reserve existing USB addresses (rhbz#1215968)
  - Add tests for USB address assignment (rhbz#1215968)
  - Assign addresses to USB devices (rhbz#1215968)
  - Assign addresses on USB device hotplug (rhbz#1215968)
  - Auto-add one hub if there are too many USB devices (rhbz#1215968)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-2
changelog:
  - qemu: Use bootindex whenever possible (rhbz#1323085)
  - qemu: Properly reset spiceMigration flag (rhbz#1151723)
  - qemu: Drop useless SPICE migration code (rhbz#1151723)
  - qemu: Memory locking is only required for KVM guests on ppc64 (rhbz#1350772)
  - virtlogd: make max file size & number of backups configurable (rhbz#1351209)
  - virtlogd: increase max file size to 2 MB (rhbz#1351209)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-1
changelog:
  - Rebased to libvirt-2.0.0 (rhbz#1286679)
  - The rebase also fixes the following bugs:
      rhbz#735385, rhbz#1004602, rhbz#1046833, rhbz#1180092, rhbz#1216281
      rhbz#1283207, rhbz#1286679, rhbz#1289288, rhbz#1302373, rhbz#1304222
      rhbz#1312188, rhbz#1316370, rhbz#1320893, rhbz#1322210, rhbz#1325072
      rhbz#1325080, rhbz#1332446, rhbz#1333248, rhbz#1333404, rhbz#1334237
      rhbz#1335617, rhbz#1335832, rhbz#1337869, rhbz#1341415, rhbz#1342342
      rhbz#1342874, rhbz#1342962, rhbz#1343442, rhbz#1344892, rhbz#1344897
      rhbz#1345743, rhbz#1346723, rhbz#1346724, rhbz#1346730, rhbz#1350688
      rhbz#1351473


author: Jiri Denemark <jdenemar@redhat.com> - 1.3.5-1
changelog:
  - Rebased to libvirt-1.3.5 (rhbz#1286679)
  - The rebase also fixes the following bugs:
      rhbz#1139766, rhbz#1182074, rhbz#1209802, rhbz#1265694, rhbz#1286679
      rhbz#1286709, rhbz#1318993, rhbz#1319044, rhbz#1320836, rhbz#1326660
      rhbz#1327537, rhbz#1328003, rhbz#1328301, rhbz#1329045, rhbz#1336629
      rhbz#1337073, rhbz#1339900, rhbz#1341460


author: Jiri Denemark <jdenemar@redhat.com> - 1.3.4-1
changelog:
  - Rebased to libvirt-1.3.4 (rhbz#1286679)
  - The rebase also fixes the following bugs:
      rhbz#1002423, rhbz#1004593, rhbz#1038888, rhbz#1103314, rhbz#1220702
      rhbz#1286679, rhbz#1289363, rhbz#1320447, rhbz#1324551, rhbz#1325043
      rhbz#1325075, rhbz#1325757, rhbz#1326270, rhbz#1327499, rhbz#1328401
      rhbz#1329041, rhbz#1329046, rhbz#1329819, rhbz#1331228


author: Jiri Denemark <jdenemar@redhat.com> - 1.3.3-1
changelog:
  - Rebased to libvirt-1.3.3 (rhbz#1286679)
  - The rebase also fixes the following bugs:
      rhbz#830971, rhbz#986365, rhbz#1151723, rhbz#1195176, rhbz#1249441
      rhbz#1260749, rhbz#1264008, rhbz#1269715, rhbz#1278727, rhbz#1281706
      rhbz#1282744, rhbz#1286679, rhbz#1288000, rhbz#1289363, rhbz#1293804
      rhbz#1306556, rhbz#1308317, rhbz#1313264, rhbz#1313314, rhbz#1314594
      rhbz#1315059, rhbz#1316371, rhbz#1316384, rhbz#1316420, rhbz#1316433
      rhbz#1316465, rhbz#1317531, rhbz#1318569, rhbz#1321546


author: Jiri Denemark <jdenemar@redhat.com> - 1.3.2-1
changelog:
  - Rebased to libvirt-1.3.2 (rhbz#1286679)
  - The rebase also fixes the following bugs:
      rhbz#1197592, rhbz#1235180, rhbz#1244128, rhbz#1244567, rhbz#1245013
      rhbz#1250331, rhbz#1265694, rhbz#1267256, rhbz#1275039, rhbz#1282846
      rhbz#1283085, rhbz#1286679, rhbz#1290324, rhbz#1293241, rhbz#1293899
      rhbz#1299696, rhbz#1305922


author: Jiri Denemark <jdenemar@redhat.com> - 1.3.1-1
changelog:
  - Rebased to libvirt-1.3.1 (rhbz#1286679)
  - The rebase also fixes the following bugs:
      rhbz#1207692, rhbz#1233115, rhbz#1245476, rhbz#1298065, rhbz#1026136
      rhbz#1207751, rhbz#1210587, rhbz#1250287, rhbz#1253107, rhbz#1254152
      rhbz#1257486, rhbz#1266078, rhbz#1271107, rhbz#1159219, rhbz#1163091
      rhbz#1196711, rhbz#1263574, rhbz#1270427, rhbz#1245525, rhbz#1247987
      rhbz#1248277, rhbz#1249981, rhbz#1251461, rhbz#1256999, rhbz#1264008
      rhbz#1265049, rhbz#1265114, rhbz#1270715, rhbz#1272301, rhbz#1273686
      rhbz#997561, rhbz#1166452, rhbz#1231114, rhbz#1233003, rhbz#1260576
      rhbz#1261432, rhbz#1273480, rhbz#1273491, rhbz#1277781, rhbz#1278404
      rhbz#1281707, rhbz#1282288, rhbz#1285665, rhbz#1288690, rhbz#1292984
      rhbz#921135, rhbz#1025230, rhbz#1240439, rhbz#1266982, rhbz#1270709
      rhbz#1276198, rhbz#1278068, rhbz#1278421, rhbz#1281710, rhbz#1291035
      rhbz#1297020, rhbz#1297690
  - RHEL: Add rhel machine types to qemuDomainMachineNeedsFDC (rhbz#1227880)
  - RHEL: qemu: Support vhost-user-multiqueue with QEMU 2.3 (rhbz#1207692)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-13
changelog:
  - qemu: Add conditions for qemu-kvm use on ppc64 (rhbz#1267882)
  - qemu: Move simplification variable to begining of the function (rhbz#1266856)
  - qemu: Extract -mem-path building into its own function (rhbz#1266856)
  - qemu: Add -mem-path even with numa (rhbz#1266856)
  - qemu: Use memory-backing-file only when needed (rhbz#1266856)
  - qemu: Always update migration times on destination (rhbz#1265902)
  - qemu: Copy completed migration stats only on success (rhbz#1265902)
  - qemu: Introduce flags in qemuMigrationCompleted (rhbz#1265902)
  - qemu: Make updating stats in qemuMigrationCheckJobStatus optional (rhbz#1265902)
  - qemu: Wait until destination QEMU consumes all migration data (rhbz#1265902)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-10
changelog:
  - virSecuritySELinuxSetSecurityAllLabel: drop useless virFileIsSharedFSType (rhbz#1124841)
  - security_selinux: Replace SELinuxSCSICallbackData with proper struct (rhbz#1124841)
  - virSecurityManager: Track if running as privileged (rhbz#1124841)
  - security_selinux: Take @privileged into account (rhbz#1124841)
  - qemu: Fix using guest architecture as lookup key (rhbz#1260753)
  - virfile: Check for existence of dir in virFileDeleteTree (rhbz#1146886)
  - Revert "qemu: Fix integer/boolean logic in qemuSetUnprivSGIO" (rhbz#1072736)
  - qemu: migration: Relax enforcement of memory hotplug support (rhbz#1252685)
  - conf: Add helper to determine whether memory hotplug is enabled for a vm (rhbz#1252685)
  - qemu: Make memory alignment helper more universal (rhbz#1252685)
  - conf: Drop VIR_DOMAIN_DEF_PARSE_CLOCK_ADJUST flag (rhbz#1252685)
  - conf: Document all VIR_DOMAIN_DEF_PARSE_* flags (rhbz#1252685)
  - conf: Add XML parser flag that will allow us to do incompatible updates (rhbz#1252685)
  - conf: Split memory related post parse stuff into separate function (rhbz#1252685)
  - conf: Rename max_balloon to total_memory (rhbz#1252685)
  - conf: Pre-calculate initial memory size instead of always calculating it (rhbz#1252685)
  - conf: Don't always recalculate initial memory size from NUMA size totals (rhbz#1252685)
  - qemu: command: Align memory sizes only on fresh starts (rhbz#1252685)
  - qemu: ppc64: Align memory sizes to 256MiB blocks (rhbz#1249006)
  - test: Add test to validate that memory sizes don't get updated on migration (rhbz#1252685)
  - qemu: Align memory module sizes to 2MiB (rhbz#1252685)
  - qemu: Refresh memory size only on fresh starts (rhbz#1242940)


