# changelog

author: Tomáš Mráz <tmraz@redhat.com> - 2.0.22-4
changelog:
  - allow import of RSA-E and RSA-S keys (patch by Marcel Kolaja) (#1233182)
  - do not abort when missing hash algorithm in FIPS mode (#1078962)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-9
changelog:
  - Amended fix for FIPS enforcement issue (#1163848)
  - Fixed issue with applications that close all file descriptors (#1165047)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-11
changelog:
  - Applied fix for urandom FD in FIPS140 mode (#1165047)
  - Applied fix for FIPS140-2 related regression (#1110696)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-13
changelog:
  - Corrected reseed and respect of max_number_of_bits_per_request in 
    FIPS140-2 mode. Also enhanced the initial tests. (#1228199)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.24-1
changelog:
  - Addressed issue with DSA public keys smaller than 2^1024 (#1238279)
  - Addressed two-byte buffer overflow in the DTLS-0.9 protocol (#1209365)
  - When writing certificates to smart cards write the CKA_ISSUER and
    CKA_SERIAL_NUMBER fields to allow NSS reading them (#1272179)
  - Use the shared system certificate store (#1110750)
  - Address MD5 transcript collision attacks in TLS key exchange (#1289888, 
    CVE-2015-7575)
  - Allow hashing data over 2^32 bytes (#1306953)
  - Ensure written PKCS#11 public keys are not marked as private (#1339453)
  - Ensure secure_getenv() is called on all uses of environment variables
    (#1344591).
  - Fix issues related to PKCS #11 private key listing on certain HSMs
    (#1351389)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.26-7
changelog:
  - Address interoperability issue with 3.5.x (#1388932)
  - Reject CAs which are both trusted and blacklisted in trust module (#1375303)
  - Added new functions to set issuer and subject ID in certificates (#1378373)
  - Reject connections with less than 1024-bit DH parameters (#1335931)
  - Fix issue that made GnuTLS parse only the first 32 extensions (#1383748)
  - Mention limitations of certtool in manpage (#1375463)
  - Read PKCS#8 files with HMAC-SHA256 -as generated by openssl 1.1 (#1380642)
  - Do not link directly to trousers but instead use dlopen (#1379739)
  - Fix incorrect OCSP validation (#1377569)
  - Added support for pin-value in PKCS#11 URIs (#1379283)
  - Added the --id option to p11tool (#1399232)
  - Improved sanity checks in RSA key generation (#1444780)
  - Addressed CVE-2017-5334, CVE-2017-5335, CVE-2017-5336, CVE-2017-5337,
    CVE-2017-7869


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.26-9
changelog:
  - Address crash in OCSP status request extension, by eliminating the
    unneeded parsing (CVE-2017-7507, #1455828)


author: Anderson Sasaki <ansasaki@redhat.com> 3.3.29-8
changelog:
  - Backported --sni-hostname option which allows overriding the hostname
    advertised to the peer (#1444792)
  - Improved counter-measures in TLS CBC record padding for lucky13 attack
    (CVE-2018-10844, #1589704, CVE-2018-10845, #1589707)
  - Added counter-measures for "Just in Time" PRIME + PROBE cache-based attack
    (CVE-2018-10846, #1589708)
  - Address p11tool issue in object deletion in batch mode (#1375307)
  - Backport PKCS#11 tests from master branch. Some tests were disabled due to
    unsupported features in 3.3.x (--load-pubkey and --test-sign options, ECC key
    generation without login, and certificates do not inherit ID from the private
    key)
  - p11tool explicitly marks certificates and public keys as NOT private objects
    and private keys as private objects
  - Enlarge buffer size to support resumption with large keys (#1542461)
  - Legacy HMAC-SHA384 cipher suites were disabled by default
  - Added DSA key generation to p11tool (#1464896)
  - Address session renegotiation issue using client certificate (#1434091)
  - Address issue when importing private keys into Atos HSM (#1460125)


author: Mike FABIAN <mfabian@redhat.com> - 20170827-1
changelog:
  - Update to upstream snapshot tarball
  - Update color emoji font to version 2.001, new design.
  - Contains the new emoji added in Unicode 10.0.0.


author: Mike FABIAN <mfabian@redhat.com> - 20170828-1
changelog:
  - Update to upstream snapshot tarball
  - split black-and-white and color fonts into different sub-packages.


author: Peter Oliver <rpm@mavit.org.uk> - 20170928-2
changelog:
  - Prefer zopflipng to optipng, since it should yield smaller files.
  - Use the font we built, rather than the one included with the source.


author: Mike FABIAN <mfabian@redhat.com> - 20180508-1
changelog:
  - Update to upstream snapshot tarball (color emoji font version 2.011)
  - Add patch to build all country flags (Resolves: rhbz#1574195)


author: Pravin Satpute <psatpute@redhat.com> - 20141001-1
changelog:
  - Google stops release tarball. Zip file derived from git Download zip.
  - 45 new packages added as follows.
  - kufi-arabic-fonts, naskh-arabic-fonts, naskh-arabic-ui-fonts, sans-balinese-fonts, 
  - sans-bamum-fonts, sans-batak-fonts, sans-buginese-fonts, sans-buhid-fonts, 
  - sans-canadian-aboriginal-fonts, sans-cham-fonts, sans-cuneiform-fonts, sans-cypriot-fonts, 
  - sans-gothic-fonts, sans-gurmukhi-fonts, sans-gurmukhi-ui-fonts, 
  - sans-inscriptional-pahlavi-fonts, sans-inscriptional-parthian-fonts, sans-javanese-fonts, 
  - sans-lepcha-fonts, sans-limbu-fonts, sans-linearb-fonts, sans-mongolian-fonts, 
  - sans-myanmar-fonts, sans-myanmar-ui-fonts, sans-new-tai-lue-fonts, sans-ogham-fonts, 
  - sans-ol-chiki-fonts, sans-old-italic-fonts, sans-old-persian-fonts, sans-phags-pa-fonts, 
  - sans-rejang-fonts, sans-runic-fonts, sans-samaritan-fonts, sans-saurashtra-fonts, 
  - sans-sinhala-fonts, sans-sundanese-fonts, sans-syloti-nagri-fonts, sans-syriac-eastern-fonts, 
  - sans-syriac-estrangela-fonts, sans-syriac-western-fonts, sans-tagbanwa-fonts, 
  - sans-tai-le-fonts, sans-tifinagh-fonts, sans-yi-fonts
  - Resolves #1148413


author: Jens Petersen <petersen@redhat.com> - 20141117-1
changelog:
  - update to latest git (aae16d0cd626)
  - package Japanese, Korean, and CJK fonts
  - add Thaana font
  - add common subpackage for license and doc files
  - order spec subpackages lexically


author: Jens Petersen <petersen@redhat.com> - 20141117-2
changelog:
  - move cjk fonts fontconfig priority from 65-0 to 66
  - generate the appinfo metainfo for the subpackages
  - use a single for-loop to install the font config and appdata files
  - move parent appinfo metainfo to common (Parag Nemade)


author: Pravin Satpute <petersen@redhat.com> - 20141117-5
changelog:
  - Resolves: #1269444: including CJK subpackage
  - Rebase from Fedora 22 - 20141117-5 SRPM
  - improve generated font subpackage descriptions
  - it is Hanunoo not Hanuno!
  - specify font filenames more precisely


author: Miroslav Rezanina <mrezanin@redhat.com> 2.4-2
changelog:
  - gperf-allow-customizing-trace-filename.patch [bz#1232702]
  - Resolves: bz#1232702
    (gperftools: tcmalloc debug version uses hard-coded path /tmp/google.alloc)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.4-8.el7
changelog:
  - gp-Use-initial-exec-tls-for-libunwind-s-recursion-flag.patch [bz#1339710]
  - Resolves: bz#1339710
    (initalization of 'recursive' tls variable in libunwind stack capturer occasionally triggers deadlock in ceph)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.4-8.el7
changelog:
  - Rebase to 2.6.1 [bz#1431240]
  - Removed libunwind usage [bz#1467203]
  - Resolves: bz#1431240 
    (gperftools fails to build on s390x, lacks s390x support)
  - Resolves: bz#1467203
    (Please, remove libunwind from the gperftools-libs (and 389-ds-base) requirements)


author: Simon Lukasik <slukasik@redhat.com> - 1.3.0-6
changelog:
  - Resolve multilib conflict of gpgme-config (#341351)
  - Resolve multilib conflict of gpgme.h (#341351)


author: Tomas Mraz <tmraz@redhat.com> - 1.3.2-1
changelog:
  - new upstream version
  - re-enable gpg tests (original patch by John Morris <john@zultron.com>)
  - quiet configure warning 'could not find g13'
  - there is no libgpgme-pth anymore


author: Jaromir Capik <jcapik@redhat.com> - 1.20.6-29
changelog:
  - Removing OPTFLAGS
  - Introducing full RELRO
  - Missing header dir in Makefile.in / depend
  - Fixing UsrMove for i686 (mv -f says 'directory not empty')


author: Jiri Kucera <jkucera@redhat.com> - 1.20.7-6
changelog:
  - Remove old scriptlets
    Enable PIE and RELRO
    ./autogen.sh runs too early
    Resolves: #1092527, #1095444


author: Till Maas <opensource@till.name> - 1.2.4-4
changelog:
  - Rebuilt for Fedora 23 Change
    https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code


author: Caolán McNamara <caolanm@redhat.com> - 1.3.10-1
changelog:
  - Resolves: rhbz#1472290
    CVE-2017-7771 CVE-2017-7772 CVE-2017-7773 CVE-2017-7774
    CVE-2017-7775 CVE-2017-7776 CVE-2017-7777 CVE-2017-7778


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.30.1-13
changelog:
  - Fixed multilib conflicts
    Rewrote lefty IO lib to use getaddrinfo instead of gethostbyname
    (by lefty-getaddrinfo patch)
    Resolves: rhbz#881173


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.30.1-17
changelog:
  - Prevent possible buffer overflow in yyerror()
    Resolves: CVE-2014-1235
  - Fix possible buffer overflow problem in chkNum of scanner
    Resolves: CVE-2014-1236


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.14-4
changelog:
  - Added group-separator, no-group-separator options decription
  - Aligned output of built-in help
  - Defuzzified gnulib-tests-rm-f patch


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20-2
changelog:
  - Fixed invalid UTF-8 byte sequence error in PCRE mode
    (by pcre-backported-fixes patch)
    Resolves: rhbz#1217080
  - Fixed buffer overrun for grep -F
    Resolves: CVE-2015-1345
  - Fixed \w and \W behaviour in multibyte locales
    Resolves: rhbz#1159012
  - Documented --fixed-regexp option
    Resolves: rhbz#1103259
  - Updated pcre buildrequires to require pcre-devel >= 7.8-7
    Related: rhbz#1217080


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20-3
changelog:
  - Speedup DFA for long patterns and fixed begline/endline matching
    Resolves: rhbz#1413029
  - Added support for GREP_LEGACY_EGREP_FGREP_PS environmental variable which
    controls how egrep, fgrep show in ps output
    Resolves: rhbz#1297441


author: Bastien Nocera <bnocera@redhat.com> 0.2.14-6
changelog:
  - Enable a number of missing plugins
  Related: #1184200
  - Disable blip.tv plugin as service has now closed
  - Add patch to downgrade the gom requirements
  - Port back local-metadata plugin to libmediaart-1.0


author: Bastien Nocera <bnocera@redhat.com> - 0.3.4-3
changelog:
  - Fix size reporting in Apple Trailers source
  - Add compatibility layer to allow building with lua 5.1
  Resolves: #1477129


author: Jan Vcelak <jvcelak@redhat.com> 1.22.1-1
changelog:
  - new upstream release (#890973)
    + various fixes in manual pages
    + various fixes and improvements in macros
    + new gropdf driver for generating PDF files
  - fix: backslash-period escape does not work (#682857)
  - fix: groff ftbfs - patch does not apply (#885225)


author: Peter Jones <pjones@redhat.com> - 2.02-0.57
changelog:
  - Make "grub2" require the grub2-efi-... package on arches where there's no
    legacy build.
    Related: rhbz#1440787


author: Peter Jones <pjones@redhat.com> - 2.02-0.58
changelog:
  - Add Aarch64 FDT #address-cells and #size-cells support
    Resolves: rhbz#1436745
  - Fix ppc64 "grub2.chrp" to be "grub.chrp"
    Resolves: rhbz#1442970


author: Peter Jones <pjones@redhat.com> - 2.02-0.60
changelog:
  - Fix ppc64 deciding /boot/efi might somehow be the CHRP partition if it
    exists.  This is also why the bug we fixed in 0.59 showed up at all.
    Resolves: rhbz#1443809
    Resolves: rhbz#1442970
  - Fix a regexp problem where rpm spec parser un-escapes things that
    don't need escaping, which causes our s/-mcpu=power8/-mcpu=power6/
    to fail.
    Related: rhbz#1443809


author: Peter Jones <pjones@redhat.com> - 2.02-0.61
changelog:
  - Fix some minor ia32 booting bugs
    Related: rhbz#1310763
    Related: rhbz#1411748
    Related: rhbz#1300009
  - Add support for non-Ethernet network cards
    Related: rhbz#1232432
  - Add support for http booting
    Resolves: rhbz#1232432
  - Fix efi module subpackage obsoletes/provides
    Resolves: rhbz#1447723
  - Make ppc modules subpackages use different directories on the filesystem.
    Resolves: rhbz#1455243


author: Livy Ge <livy.ge@oracle.com> - 2.02-0.64.0.1
changelog:
  - Fix comparison in patch for 18504756
  - Remove symlink to grub environment file during uninstall on EFI platforms
    [bug 19231481]
  - replace dynamic EFI boot folder path generation with predefined 'redhat' (Alex Burmashev)
  - update Oracle Linux certificates (Alexey Petrenko)
  - Put "with" in menuentry instead of "using" [bug 18504756]
  - Use different titles for UEK and RHCK kernels [bug 18504756]


author: Peter Jones <pjones@redhat.com> - 2.02-0.65.1
changelog:
  - More precise requires and obsoletes on the -tools* subpackages to avoid
    issues with mixing and matching repos the subpackages are split between.
    Resolves: rhbz#1499669


author: Alex Burmashev <alexander.burmashev@oracle.com> - 2.02-0.65.0.4
changelog:
  - Restore symlink to grub environment file, that was removed during grub2-efi update
    if grub2 package is also installed on UEFI machines
    [27345750]
  - fix symlink removal scriptlet, to be executed only on removal
    [bug 19231481]


author: Jacob Wang <jacob.wang@oracle.com> - 2.02-0.65.0.6
changelog:
  - Add one parameter of GRUB_MULTI_DTB to support multiple device tree's in ARM Raspberry Pi Images. [bug 27877875]


author: Peter Jones <pjones@redhat.com> - 2.02-0.68
changelog:
  - More work on /boot/efi/... permissions
    Resolves: rhbz#1496952
  - Rework grubenv symlinks and handle them on upgrades
    Resolves: rhbz#1497918
  - Make grub2-setpassword -o work
    Resolves: rhbz#1512749


author: Peter Jones <pjones@redhat.com> - 2.02-0.71
changelog:
  - The change from 2.02-0.65.el7_4.2 never made it onto the main branch,
    so one more build to avoid the regression.
    Related: rhbz#1340893


author: Peter Jones <pjones@redhat.com> - 2.02-0.74
changelog:
  - Fix symlink issues with grubenv
    Resolves: rhbz#1602773
    Related: rhbz#1497918
  - Make the common subpackage only build on x86_64 to avoid timestamp
    mismatches.
    Related: rhbz#1602773
    Related: rhbz#1497918


author: Natalya Naumova <natalya.naumova@oracle.com> - 2.02.0.76.0.1
changelog:
  - Restore symlink to grub environment file, that was removed during grub2-efi update
    if grub2 package is also installed on UEFI machines [27345750]
  - fix symlink removal scriptlet, to be executed only on removal [bug 19231481]
  - Pack files in efidir with disabled rpm verification [27166026]
  - Fix comparison in patch for 18504756
  - Remove symlink to grub environment file during uninstall on EFI platforms [bug 19231481]
  - replace dynamic EFI boot folder path generation with predefined 'redhat' (Alex Burmashev)
  - update Oracle Linux certificates (Alexey Petrenko)
  - Put "with" in menuentry instead of "using" [bug 18504756]
  - Use different titles for UEK and RHCK kernels [bug 18504756]
  - changed efidir with 0700 access rights, redhat chose another approach in rhbz#1496952, orabug [28622344]
  - revert orabug [27166026] changes


author: Natalya Naumova <natalya.naumova@oracle.com> - 2.02.0.76.0.2
changelog:
  - Enable common subpackage build for aarch64
  - Disable RHEL patch 0183-efinet-retransmit-if-our-device-is-busy.patch to comply with UEFI spec
  - increase timeout to 10ms in efinet.c, orabug [27982684]


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 2.02-0.76.0.3.1
changelog:
  - build with the updated Oracle certificate
  - Restore symlink to grub environment file, that was removed during grub2-efi update
    if grub2 package is also installed on UEFI machines [27345750]
  - fix symlink removal scriptlet, to be executed only on removal [bug 19231481]
  - Pack files in efidir with disabled rpm verification [27166026]
  - Fix comparison in patch for 18504756
  - Remove symlink to grub environment file during uninstall on EFI platforms [bug 19231481]
  - replace dynamic EFI boot folder path generation with predefined 'redhat' (Alex Burmashev)
  - update Oracle Linux certificates (Alexey Petrenko)
  - Put "with" in menuentry instead of "using" [bug 18504756]
  - Use different titles for UEK and RHCK kernels [bug 18504756]
  - changed efidir with 0700 access rights, redhat chose another approach in rhbz#1496952, orabug [28622344]
  - revert orabug [27166026] changes


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.78
changelog:
  - Prevent errors from diskfilter scan of removable drives
    Resolves: rhbz#1446418
  - Avoid grub2-efi package to overwrite existing /boot/grub2/grubenv file
    Resolves: rhbz#1497918
  - Remove glibc32 and glibc-static(x86-32) BuildRequires
    Resolves: rhbz#1614259


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.79
changelog:
  - Ignore the modification time when doing RPM verification of /boot/efi files
    Resolves: rhbz#1496952


author: Edward Leung <edward.leung@oracle.com> - 2.02-0.80.0.1
changelog:
  - build with the updated Oracle certificate
  - Restore symlink to grub environment file, that was removed during grub2-efi update
    if grub2 package is also installed on UEFI machines [Orabug: 27345750]
  - fix symlink removal scriptlet, to be executed only on removal [Orabug: 19231481]
  - Pack files in efidir with disabled rpm verification [Orabug: 27166026]
  - Fix comparison in patch for [Orabug: 18504756]
  - Remove symlink to grub environment file during uninstall on EFI platforms [Orabug: 19231481]
  - replace dynamic EFI boot folder path generation with predefined 'redhat' (Alex Burmashev)
  - update Oracle Linux certificates (Alexey Petrenko)
  - Put "with" in menuentry instead of "using" [Orabug: 18504756]
  - Use different titles for UEK and RHCK kernels [Orabug: 18504756]
  - changed efidir with 0700 access rights, redhat chose another approach in rhbz#1496952, [Orabug: 28622344]
  - revert orabug [Orabug: 27166026] changes


author: John Mcwalters <john.mcwalters@oracle.com> - 2.02-0.80.0.4
changelog:
  - Enable common subpackage build for aarch64
  - Disable RHEL patch 0183-efinet-retransmit-if-our-device-is-busy.patch to comply with UEFI spec
  - increase timeout to 10ms in efinet.c, [Orabug: 27982684]


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 2.02-0.81.0.1
changelog:
  - Update upstream references [Orabug: 30138841]
  - build with the updated Oracle certificate
  - Restore symlink to grub environment file, that was removed during grub2-efi update
    if grub2 package is also installed on UEFI machines [Orabug: 27345750]
  - fix symlink removal scriptlet, to be executed only on removal [Orabug: 19231481]
  - Pack files in efidir with disabled rpm verification [Orabug: 27166026]
  - Fix comparison in patch for [Orabug: 18504756]
  - Remove symlink to grub environment file during uninstall on EFI platforms [Orabug: 19231481]
  - replace dynamic EFI boot folder path generation with predefined 'redhat' (Alex Burmashev)
  - update Oracle Linux certificates (Alexey Petrenko)
  - Put "with" in menuentry instead of "using" [Orabug: 18504756]
  - Use different titles for UEK and RHCK kernels [Orabug: 18504756]
  - changed efidir with 0700 access rights, redhat chose another approach in rhbz#1496952, [Orabug: 28622344]
  - revert orabug [Orabug: 27166026] changes


author: Alex Burmashev <alexander.burmashev@oracle.com> - 2.02-81.0.4
changelog:
  - Fix CVE-2020-10713, CVE-2020-14308, CVE-2020-14309, CVE-2020-14310, CVE-2020-14311,
    CVE-2020-15705, CVE-2020-15706, CVE-2020-15707 [Orabug: 31225072]
  - Update signing certificate for efi binaries


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.87.e7.2
changelog:
  - Fix another batch of CVEs
    Resolves: CVE-2020-14372
    Resolves: CVE-2020-25632
    Resolves: CVE-2020-25647
    Resolves: CVE-2020-27749
    Resolves: CVE-2020-27779
    Resolves: CVE-2021-20225
    Resolves: CVE-2021-20233


author: David Kubat <david.kubat@oracle.com> - 2.02-0.87.0.9.e7.6
changelog:
  - xfs: Don't attempt to iterate over empty directory [Orabug: 32584717]
  - add SBAT metadata for Oracle Linux grub2
  - Use similar format for menu entry in grub environment block
  - config file. [Orabug: 32172943]
  - Fix degradation in multiboot2 code [Orabug: 32069510]
  - Update signing certificate for efi binaries
  - Update upstream references [Orabug: 30138841]
  - Restore symlink to grub environment file, that was removed during grub2-efi update
    if grub2 package is also installed on UEFI machines [Orabug: 27345750]
  - fix symlink removal scriptlet, to be executed only on removal [Orabug: 19231481]
  - Fix comparison in patch for [Orabug: 18504756]
  - Remove symlink to grub environment file during uninstall on EFI platforms [Orabug: 19231481]
  - replace dynamic EFI boot folder path generation with predefined 'redhat' (Alex Burmashev)
  - Put "with" in menuentry instead of "using" [Orabug: 18504756]
  - Use different titles for UEK and RHCK kernels [Orabug: 18504756]


author: Alex Burmnashev <alexander.burmashev@oracle.com> - 2.02-0.87.0.10.e7.6
changelog:
  - Enable common subpackage for aarch64
  - Disable RHEL patch 0183-efinet-retransmit-if-our-device-is-busy.patch to comply with UEFI spec [Orabug: 27982684]
  - Do not sign aarch64 efi binaries [Orabug: 32670043]
  - Remove aarch64 deps on shim [Orabug: 32670043]


author: EL Errata <el-errata_ww@oracle.com> - 2.02-0.87.0.12.el7_9.7
changelog:
  - Restore versioned certificate provide for aarch64 package to satisfy shim [Orabug: 32670043]
  - Enable common subpackage for aarch64
  - Disable RHEL patch 0183-efinet-retransmit-if-our-device-is-busy.patch to comply with UEFI spec [Orabug: 27982684]
  - Do not sign aarch64 efi binaries [Orabug: 32670043]
  - Remove aarch64 deps on shim [Orabug: 32670043]
  - xfs: Don't attempt to iterate over empty directory [Orabug: 32584717]
  - add SBAT metadata for Oracle Linux grub2
  - Use similar format for menu entry in grub environment block
  - config file. [Orabug: 32172943]
  - Fix degradation in multiboot2 code [Orabug: 32069510]
  - Update signing certificate for efi binaries
  - Update upstream references [Orabug: 30138841]
  - Restore symlink to grub environment file, that was removed during grub2-efi update
    if grub2 package is also installed on UEFI machines [Orabug: 27345750]
  - fix symlink removal scriptlet, to be executed only on removal [Orabug: 19231481]
  - Fix comparison in patch for [Orabug: 18504756]
  - Remove symlink to grub environment file during uninstall on EFI platforms [Orabug: 19231481]
  - replace dynamic EFI boot folder path generation with predefined 'redhat' (Alex Burmashev)
  - Put "with" in menuentry instead of "using" [Orabug: 18504756]
  - Use different titles for UEK and RHCK kernels [Orabug: 18504756]


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.82
changelog:
  - Prepend prefix when HTTP path is relative
  - efi/http: Export {fw,http}_path variables to make them global
    Resolves: rhbz#1616395
  - efi/http: Enclose literal IPv6 addresses in square brackets
  - efi/net: Allow to specify a port number in addresses
  - efi/ip4_config: Improve check to detect literal IPv6 addresses
  - efi/net: Print a debug message if parsing the address fails
    Resolves: rhbz#1732765


author: Peter Jones <pjones@redhat.com> - 2.02-0.83
changelog:
  - Fix several CVEs:
    Resolves: CVE-2020-10713
    Resolves: CVE-2020-14308
    Resolves: CVE-2020-14309
    Resolves: CVE-2020-14310
    Resolves: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 2.02-0.84
changelog:
  - Couple more late fixes.
    Resolves: CVE-2020-10713
    Resolves: CVE-2020-14308
    Resolves: CVE-2020-14309
    Resolves: CVE-2020-14310
    Resolves: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 2.02-0.85
changelog:
  - Couple more late fixes.
    Resolves: CVE-2020-10713
    Resolves: CVE-2020-14308
    Resolves: CVE-2020-14309
    Resolves: CVE-2020-14310
    Resolves: CVE-2020-14311
    Resolves: CVE-2020-15705


author: Alex Burmashev <alexander.burmashev@oracle.com> - 2.02-0.87.0.2
changelog:
  - Enable common subpackage build for aarch64
  - Disable RHEL patch 0183-efinet-retransmit-if-our-device-is-busy.patch to comply with UEFI spec
  - increase timeout to 10ms in efinet.c, [Orabug: 27982684]
  - Update signing certificate for efi binaries
  - Update upstream references [Orabug: 30138841]
  - Restore symlink to grub environment file, that was removed during grub2-efi update
    if grub2 package is also installed on UEFI machines [Orabug: 27345750]
  - fix symlink removal scriptlet, to be executed only on removal [Orabug: 19231481]
  - Fix comparison in patch for [Orabug: 18504756]
  - Remove symlink to grub environment file during uninstall on EFI platforms [Orabug: 19231481]
  - replace dynamic EFI boot folder path generation with predefined 'redhat' (Alex Burmashev)
  - Put "with" in menuentry instead of "using" [Orabug: 18504756]
  - Use different titles for UEK and RHCK kernels [Orabug: 18504756]


author: Tianyue Lan <tianyue.lan@oracle.com> - 2.02-0.87.0.17.el7_9.9
changelog:
  - Cleanup XEN shell script (Alex Burmashev) [Orabug: 33851417]
  - Update SBAT data (Alex Burmashev) [Orabug: 33851417]
  - efinet: change SNP open call (Alex Burmashev) [Orabug: 32646964]
  - disable buggy 0183-efinet-retransmit-if-our-device-is-busy.patch [Orabug: 27982684]
  - Patch multiboot2 to the recent state [Orabug: 32950597]
  - Enable multiboot2 for UEFI ( non Secureboot ) mode [Orabug: 32950597]
  - Update signing certificate [Orabug: 32670043]
  - Update shim and certificates dependencies [Orabug: 32670043]
  - xfs: Don't attempt to iterate over empty directory [Orabug: 32584717]
  - add SBAT metadata for Oracle Linux grub2
  - Use similar format for menu entry in grub environment block
  - config file. [Orabug: 32172943]
  - Fix degradation in multiboot2 code [Orabug: 32069510]
  - Update signing certificate for efi binaries
  - Update upstream references [Orabug: 30138841]
  - Restore symlink to grub environment file, that was removed during grub2-efi update
    if grub2 package is also installed on UEFI machines [Orabug: 27345750]
  - fix symlink removal scriptlet, to be executed only on removal [Orabug: 19231481]
  - Fix comparison in patch for [Orabug: 18504756]
  - Remove symlink to grub environment file during uninstall on EFI platforms [Orabug: 19231481]
  - replace dynamic EFI boot folder path generation with predefined 'redhat' (Alex Burmashev)
  - Put "with" in menuentry instead of "using" [Orabug: 18504756]
  - Use different titles for UEK and RHCK kernels [Orabug: 18504756]


author: Alex Burmashev <alexander.burmashev@oracle.com> - 2.02-0.87.0.19.el7_9.9
changelog:
  - Fix: CVE-2021-3695, CVE-2021-3696, CVE-2021-3697,
    CVE-2022-28733, CVE-2022-28734, CVE-2022-28735 [JIRA: OLDIS-16371]
  - Various coverity fixes [JIRA: OLDIS-16371]
  - bump SBAT generation [JIRA: OLDIS-16371]


author: Alex Burmashev <alexander.burmashev@oracle.com> - 2.02-0.87.0.26.el7_9.9
changelog:
  - Enable common subpackage for aarch64
  - Do not sign aarch64 efi binaries [Orabug: 32670043]
  - Remove aarch64 deps on shim [Orabug: 32670043]
  - Restore versioned certificate provide for aarch64 package to satisfy shim [Orabug: 32670043]


author: Alex Burmashev <alexander.burmashev@oracle.com> - 2.02-0.87.0.1
changelog:
  - Update signing certificate for efi binaries
  - Update upstream references [Orabug: 30138841]
  - Restore symlink to grub environment file, that was removed during grub2-efi update
    if grub2 package is also installed on UEFI machines [Orabug: 27345750]
  - fix symlink removal scriptlet, to be executed only on removal [Orabug: 19231481]
  - Fix comparison in patch for [Orabug: 18504756]
  - Remove symlink to grub environment file during uninstall on EFI platforms [Orabug: 19231481]
  - replace dynamic EFI boot folder path generation with predefined 'redhat' (Alex Burmashev)
  - Put "with" in menuentry instead of "using" [Orabug: 18504756]
  - Use different titles for UEK and RHCK kernels [Orabug: 18504756]


author: Alex Burmashev <alexander.burmashev@oracle.com> - 2.02-0.87.0.7
changelog:
  - Fix CVE-2020-14372 CVE-2020-25632 CVE-2020-25647 CVE-2020-27749
    CVE-2020-27779 CVE-2021-20225 CVE-2021-20233 [Orabug: 32530657]
  - Fix various coverity issues [Orabug: 32530657]
  - Add SBAT metadata to grubx64.efi [Orabug: 32530657]


author: EL Errata <el-errata_ww@oracle.com> - 2.02-0.87.0.8.e7.2
changelog:
  - Enable common subpackage for aarch64
  - Disable RHEL patch 0183-efinet-retransmit-if-our-device-is-busy.patch to comply with UEFI spec
  - add SBAT metadata for Oracle Linux grub2
  - Use similar format for menu entry in grub environment block
  - config file. [Orabug: 32172943]
  - Fix degradation in multiboot2 code [Orabug: 32069510]
  - Update signing certificate for efi binaries
  - Update upstream references [Orabug: 30138841]
  - Restore symlink to grub environment file, that was removed during grub2-efi update
    if grub2 package is also installed on UEFI machines [Orabug: 27345750]
  - fix symlink removal scriptlet, to be executed only on removal [Orabug: 19231481]
  - Fix comparison in patch for [Orabug: 18504756]
  - Remove symlink to grub environment file during uninstall on EFI platforms [Orabug: 19231481]
  - replace dynamic EFI boot folder path generation with predefined 'redhat' (Alex Burmashev)
  - Put "with" in menuentry instead of "using" [Orabug: 18504756]
  - Use different titles for UEK and RHCK kernels [Orabug: 18504756]


author: Peter Jones <pjones@redhat.com> - 8.28-17
changelog:
  - Fix the ordering of creating the debug entries, so they don't get picked
    when we're choosing kernel command line defaults on upgrades.
    Related: rhbz#1212128


author: rmarshall@redhat.com - 8.28-18
changelog:
  - Patched new-kernel-pkg so that kernel installations when MAKEDEBUG is
    set would put the debugging entries after the non-debugging entries.
    Resolves: #1285601
  - Re-numbered the last set of patches to go with the flow. No actual
    changes to the patches; just a git mv to rename.
  - Re-organized and updated the grubby man page contents to include some
    features that were not documented as well as correct typos and
    re-write some entries for better clarity.
    Resolves: #1232168


author: rmarshall@redhat.com - 8.28-21
changelog:
  - Resolve issues with the recent grubby logic patches that
    appeared on the ppc platform. Fix a problem that occurred
    on systems where no kernel update had ever been installed.
    Resolves: rhbz#1285601
  - Specify the actual prune_debug file in sources.
    Resolves: rhbz#1285601


author: rmarshall@redhat.com - 8.28-23
changelog:
  - Fixes --info flag on s390/s390x.
    Related: rhbz#1285601
  - Fixes --set-default-index on s390/s390x.
    Related: rhbz#1285601
  - Allows prune_debug to run on s390/s390x.
    Resolves: rhbz#1285601


author: EL Errata <el-errata_ww@oracle.com> - 8.28-23.0.1
changelog:
  - Handle cleanup of modules.* for RHCK and UEK [bug 18493431]
  - Pick a suitable default kernel to boot if the current option is removed [bug 22738301]
  - Set whatever entry before saved entry
  - Set different titles for RHCK and UEK [bug 18504756] (Kevin Lyons)


author: Peter Jones <pjones@redhat.com> - 8.35-7
changelog:
  - Revert "debug" image creation for now
    Resolves: rhbz#1153410
  - Fix minor quoting errors in dtbdir code
    Resolves: rhbz#1088933


author: Peter Jones <pjones@redhat.com> - 8.35-9
changelog:
  - Disable "make check" on arm builds; right now the test suite is broken
    there and raises false positives constantly.


author: Peter Jones <pjones@redhat.com> - 8.38-1
changelog:
  - Update to 8.38
  - Fix title extraction with some config file types
    Resolves: rhbz#1204353
    Resolves: rhbz#1204888
    Resolves: rhbz#1206943


author: Peter Jones <pjones@redhat.com> - 8.39-1
changelog:
  - Update to 8.39
  - Fix title extraction with some config file types
    Resolves: rhbz#1204353
    Resolves: rhbz#1204888
    Resolves: rhbz#1206943


author: Yanko Kaneti <yaneti@declera.com> - 1.0.0-2
changelog:
  - Initial spec for review - 0.98.0-0.1.a648648
  - Additional patch + references + using %autopatch - 0.98.0-0.2.a648648
  - Update to 1.0.0. drop upstreamed paches - 1.0.0-1
  - Own some more directories as per review (#1167482) - 1.0.0-2


author: Robbie Harwood <rharwood@redhat.com> 0.6.2-1
changelog:
  - Rebase to latest version since we have krb5-1.15
  - Resolves: #1379836
  - Resolves: #1344518
  - Resolves: #1366782
  - Resolves: #1379005
  - Resolves: #1379482
  - Resolves: #1379616
  - Resolves: #1380490
  - Resolves: #1378600
  - Resolves: #1285012
  - Resolves: #1333813


author: Colin Walters <walters@verbum.org> 0.10.23-17
changelog:
  - Hack the gtk-doc to remove plugin docs that are not shipped
  - Drop mythtv, opencv sources that are no longer buildable


author: Wim Taymans <wtaymans@redhat.com> - 0.10.23-21
changelog:
  - Remove insecure NSF plugin
  - vmncdec: Sanity-check width/height before using it
  Resolves: rhbz#1400839


author: Wim Taymans <wtaymans@redhat.com> - 0.10.23-22
changelog:
  - h264parse: Ensure codec_data has the required size when reading number of SPS
  Resolves: rhbz#1400839


author: Wim Taymans <wtaymans@redhat.com> - 0.10.23-24
changelog:
  - Patch CVE-2023-44446: MXF demuxer use-after-free
  - Disable gtk-doc to fix the build
  - Resolves: RHEL-16792


author: Wim Taymans <wtaymans@redhat.com> - 1.4.5-6
changelog:
  - Fix h264 and h265 buffer size checks
  - Fix mpegts pat parsing and add more size checks
  Resolves: rhbz#1400898


author: Wim Taymans <wtaymans@redhat.com> - 1.10.4-4
changelog:
  - Patch CVE-2023-44446: MXF demuxer use-after-free
  - Disable gtk-doc to fix build
  - Resolves: RHEL-16793


author: Daniel P. Berrange <berrange@redhat.com> - 0.7.0-1
changelog:
  - Update to 0.7.0 release (rhbz #1416783)
  - Release held keys when loosing focus (rhbz #921008)
  - Avoid warnings when disconnecting (rhbz #1126825)
  - Workaround to avoid hang connecting to SPICE guest (rhbz #921330)
  - CVE-2017-5884 - fix bounds checking for RRE, hextile and
    copyrect encodings (rhbz #1425367)
  - CVE-2017-5885 - fix color map index bounds checking (rhbz #1425367)


author: Daniel P. Berrange <berrange@redhat.com> - 0.7.0-2
changelog:
  - Fix reserved data size (rhbz #1416783)
  - Fix inverted args in tests (rhbz #1416783)	  
  - Avoid sign extension problems (rhbz #1416783)
  - Fix crash with opening via GSocketAddress (rhbz #1416783)
  - Fix crash & error reporting during connection timeout (rhbz #1441120)
  - Fix incompatibility with libvncserver websockets (rhbz #921330)


author: Matthias Clasen <mclasen@redhat.com> - 3.8.4-5
changelog:
  - Avoid losing -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches  
  - Related: #881175


author: Matthias Clasen <mclasen@redhat.com> - 3.8.4-5
changelog:
  - Avoid losing -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic
  - Related: #881175


author: Kalev Lember <kalevlember@gmail.com> - 2.24.2-1
changelog:
  - Update to 2.24.2
  - Removed mm-common buildrequire which is no longer needed for tarball builds
  - Cleaned up the spec file for modern rpmbuild


author: Matthew Barnes <mbarnes@redhat.com> - 2.0.16-1.fc13
changelog:
  - Update to 2.0.16
  - No need to run libtoolize and autoreconf.
  - Remove language comparison patch (fixed upstream).


author: Peter Robinson <pbrobinson@fedoraproject.org> 0.10.2-1
changelog:
  - 0.10.2 release
  - http://ftp.gnome.org/pub/GNOME/sources/gupnp-dlna/0.10/gupnp-dlna-0.10.2.news

   * Wed Apr 10 2013 Peter Robinson <pbrobinson@fedoraproject.org> 0.10.1-1
  - 0.10.1 release
  - http://ftp.gnome.org/pub/GNOME/sources/gupnp-dlna/0.10/gupnp-dlna-0.10.1.news


author: Tim Waugh <twaugh@redhat.com> - 5.2.9-17
changelog:
  - More fixes for bug #948967:
    - Supply man page for gutenprint-foomaticupdate.
    - Link to cups-genppd(8) man page from cups-genppd.5.2(8).


author: Ondrej Holy <oholy@redhat.com> - 1.30.3-1
changelog:
  - Update to 1.30.3
  - Disable nfs support (#1387270)
  - Revert desktop database scriplets
  - Resolves: #1386993, #1399343, #1306146, #1259746, #1344317


author: Ondrej Holy <oholy@redhat.com> - 1.36.2-2
changelog:
  - Prevent spawning new daemons if outgoing operation exists (#1632960)
  - CVE-2019-3827: Prevent access if any authentication agent isn't available (#1673887)


author: Petr Stodulka <pstodulk@redhat.com> - 1.5-8
changelog:
  - Gzip overwrite existing files when user choose "no" on yes/no question.
    It's due to wrong dupicit declaration of yesno() function in gzip.h
    which is compiled wrong with -O2 option.
    Resolves: rhbz#1201689


author: Jakub Martisko <jamartis@redhat.com> - 1.5-10
changelog:
  - doc change: missing grep options are now mentioned in the zgrep 
    man pages/help message
    Resolves: #1437002


author: Michal Luscon <mluscon@redhat.com> 1.5-1
changelog:
  - New upstream version
  - Removed gzip-1.3.9-stderr.patch
  - Removed gzip-1.3.10-zgreppipe.patch
  - Removed gzip-1.3.13-noemptysuffix.patch


author: Jindrich Novy <jnovy@redhat.com> - 1:1.0-11
changelog:
  - don't use mmap(2) to avoid failures on i386 with 1GB files and larger (#672917)
  - fix package URL (#676962)


author: Jindrich Novy <jnovy@redhat.com> - 1:1.0-12
changelog:
  - fix possible buffer overflows, integer overflows (CVE-2011-3630 CVE-2011-3631 CVE-2011-3632)
  - update man page


author: Jindrich Novy <jnovy@redhat.com> - 1:1.0-14
changelog:
  - do not allow to hardlink files across filesystems by default (#786719)
    (use -f option to override)


author: Michal Luscon <mluscon@redhat.com> 0.5.4-1
changelog:
  - setup tito to bump version in VERSION.cmake (Michal Luscon)
  - initialize to use tito (Michal Luscon)
  - prepare repo for tito build system (Michal Luscon)
  - New version 0.5.4 (Michal Luscon)
  - goal: implement methods for optional installation (RhBug:1167881) (Michal Luscon)
  - setup tito to bump version in VERSION.cmake (Michal Luscon)
  - initialize to use tito (Michal Luscon)
  - prepare repo for tito build system (Michal Luscon)
  - New version 0.5.4 (Michal Luscon)
  - goal: implement methods for optional installation (RhBug:1167881) (Michal Luscon)


author: Michal Luscon <mluscon@redhat.com> 0.5.5-1
changelog:
  - get rid of yum references (Jan Silhan)
  - sack: force recomputing excludes (Jan Silhan)
  - doc: cosmetic: made Sack headline more readable (Jan Silhan)
  - doc: sack: warning about using excludes, includes, disabling and enabling
    repos (Jan Silhan)
  - cosmetic: removed commented code (Jan Silhan)
  - sack: calls reinitiate provides after changing considered map (RhBug:1099342)
    (Jan Silhan)
  - fixed memleak from d8f2ca7 (Jan Silhan)
  - doc: add to CMDLINE_REPO_NAME and SYSTEM_REPO_NAME the Python API reference
    manual. (Radek Holy)
  - doc: add Repo to the Python API reference manual. (Radek Holy)
  - updated load_test_repo() to be able to load non-standard system repo (Michael
    Mraka)
  - python tests for goal.run(verify=True) (Michael Mraka)
  - test for HY_VERIFY flag (Michael Mraka)
  - introduced verify option for goal.run() (Michael Mraka)
  - AUTHORS: fixed name (Michael Mraka)
  - AUTHORS: added 3 Michaels (Jan Silhan)
  - Build for x86_64, correction for C++ (Michal Ruprich)


author: Michal Luscon <mluscon@redhat.com> 0.5.7-1
changelog:
  - spec: add a %{snapshot} macro for easier snapshot building (Radek Holy)
  - doc: sack: deep copy added to warning section (Jan Silhan)
  - doc: sack: warning about multiple Sack usage (Jan Silhan)
  - doc: sack: len(sack) -> method __len__ (Jan Silhan)
  - Package.files returns list of Unicode objects (Jan Silhan)


author: Jan Silhan <jsilhan@redhat.com> 0.5.8-1
changelog:
  - added implicit-function-declaration compile flag (Jan Silhan)
  - subject: Fix compiler warning introduced by previous commit (Colin Walters)
  - python: Verify that nosetest actually ran any tests (Colin Walters)
  - AUTHORS: updated (Jan Silhan)
  - subject: Remove internal header includes from public header (Colin Walters)
  - maintain result map in query (RhBug:1049205) (Jan Silhan)
  - AUTHORS: updated (Jan Silhan)
  - package: Don't assume the same pool in hy_package_cmp() (Matthew Barnes)


author: Jan Silhan <jsilhan@redhat.com> 0.5.8-2
changelog:
  - tito: change vesiontagger to releasetagger (Jan Silhan)
  - don't require python3 in rhel (Jan Silhan)


author: Nalin Dahyabhai <nalin@fedoraproject.org> - 3.1.0-18
changelog:
  - adjust buildroot location (guidelines)
  - disable static libraries (guidelines)
  - tweak default payload attributes (guidelines)


author: Nalin Dahyabhai <nalin@fedoraproject.org> - 3.1.0-19
changelog:
  - fix the release number noted for the previous changelog entry (#225884)
  - remove unapplied "classes" patch (#225884)


author: Nalin Dahyabhai <nalin@fedoraproject.org> - 3.2.1-1
changelog:
  - update to 3.2.1
    - merged all patches or equivalents
    - re-merged hesinfo, so we obsolete it now
    - adds a pkgconfig configuration file for libhesiod
  - correct inconsistent changelog dates, assuming day-of-week is correct
  - add build requirement on libidn-devel
  - package the license


author: Ville Skyttä <ville.skytta@iki.fi> - 1.2.13-2
changelog:
  - Bring back config patch to fix -debuginfo, it hasn't been upstreamed yet.
  - Drop empty TODO from docs.


author: Richard W.M. Jones <rjones@redhat.com> - 1.3.10-5.7
changelog:
  - Fix: "Argument list too long" when using virt-v2v on Windows guest
    with French copy of Citrix installed
    related: rhbz#1145056


author: Richard W.M. Jones <rjones@redhat.com> - 1.3.10-5.8
changelog:
  - Tolerate corruption in some hives
    resolves: rhbz#1423436
  - Switch to using git to manage patches.


author: Nalin Dahyabhai <nalin@redhat.com> - 0.9.13-1
changelog:
  - treat unexpected command-line arguments as an error to avoid setting
    incorrect expectations, and warn when a check file doesn't appear to
    contain anything for us to check (#1016706)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.9.13-4
changelog:
  - only BuildRequire: prelink on the arches on which we know it runs (currently
    %{ix86}, x86_64, ppc, ppc64, s390, s390x), so that it can be built on the
    rest (#1061889)


author: Jiri Popelka <jpopelka@redhat.com> - 3.11-3
changelog:
  - remove some rh-specific bits from rh.patch as they are no longer valid (#881913)
  - remove outdated de & pt man pages
  - /usr move: use _bindir macro


author: Tim Waugh <twaugh@redhat.com> - 3.13.7-2
changelog:
  - Applied patch to avoid unix-process authorization subject when using
    polkit as it is racy (CVE-2013-4325).


author: Zdenek Dohnal <zdohnal@redhat.com> - 3.15.9-2
changelog:
  - 1069619 - Rebase to version 3.15.9 extension - solving bug 1346196 (/usr/lib/cups/filter/hpps uses python -B which is unknown), which is duplicate of bug 1202451


author: Lyude Paul <cpaul@redhat.com> - 1.0.0-7
changelog:
  - Initial port from Fedora to RHEL 7.3
  - Add patch for building with gcc4
  - Call autoreconf before starting build
  Resolves: rhbz#1311004


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 1:1.8.1.3-14
changelog:
  - Remove dependency on initscripts
  - Add After=network.target to systemd service
  - Resolves: rhbz#1283893, rhbz#1269717


author: Fabiano Fidêncio <fidencio@redhat.com> - 2.7.1-5
changelog:
  - Bump http-parser release number to avoid people pulling EPEL package instead
    of RHEL package
    Resolves: rhbz#1480321


author: Fabiano Fidêncio <fidencio@redhat.com> - 2.7.1-5
changelog:
  - Bump http-parser release number to avoid people pulling EPEL package instead
    of RHEL package
    Resolves: rhbz#1479471


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.1-6
changelog:
  - Resolves: rhbz#1666381 - CVE-2018-12121 http-parser: nodejs: Denial of
                             Service with large HTTP headers [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.1-7
changelog:
  - Resolves: rhbz#1666024 - CVE-2018-7159 http-parser: nodejs: HTTP parser
                             allowed for spaces inside Content-Length header
                             values [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.1-8
changelog:
  - Backport needed test fixes
  - Related: rhbz#1666024 - CVE-2018-7159 http-parser: nodejs: HTTP parser
                            allowed for spaces inside Content-Length header
                            values [rhel-7]


author: Sergio Correia <scorreia@redhat.com> - 2.7.1-8.1
changelog:
  - Resolves: CVE-2019-15605 http-parser: nodejs: HTTP request
                             smuggling using malformed Transfer-Encoding header


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-59
changelog:
  - Resolves: #1378946 - Backport of apache bug 55910: Continuation lines
    are broken during buffer resize


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-60
changelog:
  - Resolves: #1414258 - Crash during restart or at startup in mod_ssl,
    in certinfo_free() function registered by ssl_stapling_ex_init()


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-61
changelog:
  - Related: #1414258 - Crash during restart or at startup in mod_ssl,
    in certinfo_free() function registered by ssl_stapling_ex_init()


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-62
changelog:
  - Resolves: #1397241 - Backport Apache Bug 53098 - mod_proxy_ajp:
    patch to set worker secret passed to tomcat


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-64
changelog:
  - Resolves: #1442872 - apache user is not created during httpd installation
    when apache group already exist with GID other than 48


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-67.2
changelog:
  - Resolves: #1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw()
    authentication bypass
  - Resolves: #1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer dereference
  - Resolves: #1463207 - CVE-2017-7679 httpd: mod_mime buffer overread
  - Resolves: #1463205 - CVE-2017-7668 httpd: ap_find_token() buffer overread
  - Resolves: #1470748 - CVE-2017-9788 httpd: Uninitialized memory reflection
    in mod_auth_digest


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-73
changelog:
  - Resolves: #1499253 - ProxyRemote with HTTPS backend sends requests
    with absoluteURI instead of abs_path


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-74
changelog:
  - Resolves: #1430640 - "ProxyAddHeaders Off" does not become effective
    when it's defined outside <Proxy> setting


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-75
changelog:
  - Resolves: #1448892 - Cannot override LD_LIBARY_PATH in Apache HTTPD
    using SetEnv or PassEnv. Needs documentation.


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-80.1
changelog:
  - Resolves: #1560609 - httpd: active connections being terminated when httpd
    gets gracefully stopped/restarted, GracefulShutdownTimeout is not being
    honored


author: Lubos Uhliarik <luhliari@redhat.com>
changelog:
  - Resolves: #1566317 - CVE-2018-1312 httpd: Weak Digest auth nonce generation
    in mod_auth_digest
  - Resolves: #1696141 - CVE-2019-0217 httpd: mod_auth_digest: access control
    bypass due to race condition
  - Resolves: #1696096 - CVE-2019-0220 httpd: URL normalization inconsistency


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-91
changelog:
  - Resolves: #1630886 - scriptlet can fail if hostname is not installed
  - Resolves: #1565465 - CVE-2017-15710 httpd: Out of bound write in
    mod_authnz_ldap when using too small Accept-Language values
  - Resolves: #1568298 - CVE-2018-1301 httpd: Out of bounds access after
    failure in reading the HTTP request
  - Resolves: #1673457 - Apache child process crashes because ScriptAliasMatch
    directive
  - Resolves: #1633152 - mod_session missing apr-util-openssl
  - Resolves: #1649470 - httpd response contains garbage in Content-Type header
  - Resolves: #1724034 - Unexpected OCSP in proxy SSL connection


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-94
changelog:
  - Resolves: #1565491 - CVE-2017-15715 httpd: <FilesMatch> bypass with a trailing
    newline in the file name
  - Resolves: #1747283 - CVE-2019-10098 httpd: mod_rewrite potential open redirect
  - Resolves: #1724879 - httpd terminates all SSL connections using an abortive
    shutdown
  - Resolves: #1715981 - Backport of SessionExpiryUpdateInterval directive
  - Resolves: #1565457 - CVE-2018-1303 httpd: Out of bounds read in
    mod_cache_socache can allow a remote attacker to cause a denial of service
  - Resolves: #1566531 - CVE-2018-1283 httpd: Improper handling of headers in 
    mod_session can allow a remote user to modify session data for CGI applications


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-97
changelog:
  - Resolves: #1852350 - httpd/mod_proxy_http/mod_ssl aborted when sending
    a client cert to backend server
  - Resolves: #1785100 - mod_cgid takes CGIDScriptTimeout x 2 seconds for timeout
  - Resolves: #1862499 - Intermittent Segfault in Apache httpd due to pool
    concurrency issues


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.1
changelog:
  - Resolves: #2011729 - CVE-2021-40438 httpd: mod_proxy: SSRF via a crafted
    request uri-path containing "unix:"


author: David Kubat <david.kubat@oracle.com> - 2.4.6-97.0.3.2
changelog:
  - mod_session: save one apr_strtok() [Orabug: 33338149][CVE-2021-26690]
  - replace index.html with Oracle's index page oracle_index.html


author: Kaylin Devchand <kaylin.devchand@oracle.com> - 2.4.6-97.0.5.2
changelog:
  - scoreboard: fix null pointer deference [Orabug: 33561206][CVE-2021-34798]
  - fix ap_escape_quote logic [Orabug: 33617690][CVE-2021-39275]


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.3
changelog:
  - Resolves: #2035058 - CVE-2021-44790 httpd: mod_lua: possible buffer overflow
    when parsing multipart content


author: Luboš Uhliarik <luhliari@redhat.com>
changelog:
  - Resolves: #2031072 - CVE-2021-34798 httpd: NULL pointer dereference via
    malformed requests
  - Resolves: #2031074 - CVE-2021-39275 httpd: out-of-bounds write in
    ap_escape_quotes() via malicious input
  - Resolves: #1969226 - CVE-2021-26691 httpd: Heap overflow in mod_session


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.5
changelog:
  - Resolves: #2065243 - CVE-2022-22720 httpd: HTTP request smuggling
    vulnerability in Apache HTTP Server 2.4.52 and earlier


author: Kaylin Devchand <kaylin.devchand@oracle.com> - 2.4.6-97.0.7.5
changelog:
  - mod_proxy: ap_proxy_http_request() to clear hop-by-hop first and
    fixup last [CVE-2022-31813][Orabug: 34381850]


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.6
changelog:
  - Resolves: #2101997 - HEAD request with a 404 and custom ErrorPage causes
    corrupt and mixed-up responses


author: John Mcwalters <john.mcwalters@oracle.com> 2.4.6-98.0.3
changelog:
  - mod_proxy: ap_proxy_http_request() to clear hop-by-hop first and
    fixup last [CVE-2022-31813][Orabug: 34381850]
  - mod_session: save one apr_strtok() [Orabug: 33338149][CVE-2021-26690]


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.7
changelog:
  - Resolves: #2177742 - CVE-2023-25690 httpd: HTTP request splitting with
    mod_rewrite and mod_proxy


author: John Mcwalters <john.mcwalters@oracle.com> - 2.4.6-99.1.0.1
changelog:
  - mod_proxy: ap_proxy_http_request() to clear hop-by-hop first and
    fixup last [CVE-2022-31813][Orabug: 34381850]
  - mod_session: save one apr_strtok() [Orabug: 33338149][CVE-2021-26690]
  - replace index.html with Oracle's index page oracle_index.html


author: Caolán McNamara <caolanm@redhat.com> - 1.3.2-6
changelog:
  - Resolves: rhbz#573516 have hunspell require hunspell-en to ensure
    at least one dictionary exists


author: Caolan McNamara <caolanm@redhat.com> - 2.4-0.4.20070901
changelog:
  - it_IT_README.1st says GPLv2+, but it_IT_README.txt says GPLv3+ -> 
    change license field to GPLv3+


author: Parag <pnemade AT redhat DOT com> - 20080425-7
changelog:
  - Resolves:rh#959987: Error message: “0 is wrong flag id” occurs when using hunspell-ne
  - Resolves:rh#967638: ne_NP.dic contains both CRLF and LF line terminators


author: Parag Nemade <pnemade AT redhat.com> - 0.2.1-2
changelog:
  - Resolves: rh#571710: Fix license tag in spec file with new upstream release
  - Removed CREDITS file as upstream provides now README and LICENSE files.


author: Parag <pnemade@redhat.com> - 0.20050929-3
changelog:
  - Use aspell source instead to pull source as BR:aspell-te
  - Resolves:rh#511262 buildrequires aspell-te


author: Michal Minar <miminar@redhat.com> 0.252-8.1
changelog:
  - Updated pci, usb and vendor ids.
  - Resolves: rhbz#1236458
  - Resolves: rhbz#1256004
  - Resolves: rhbz#1266217
  - Resolves: rhbz#1271797


author: Michal Minar <miminar@redhat.com> 0.252-8.2
changelog:
  - Updated pci, usb and vendor ids.
  - Resolves: rhbz#1292382
  - Resolves: rhbz#1291614
  - Resolves: rhbz#1324198


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 0.252-8.5
changelog:
  - Updated pci, usb and vendor ids
    Resolves: #1386133 #1424763
  - Removed module nx_crypto from blacklist on PowerPCs
    Resolves: #1264326


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 0.252-8.9
changelog:
  - Updated pci, usb, vendor ids and hwdb files
    Resolves: #1560493
  - Blacklisted sha{256,512}-mb modules
    Resolves: #1562114


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 0.252-9.5
changelog:
  - Fix URL for downloading hwdb files
  - Updated pci, usb, vendor ids and hwdb files
    Resolves: #1721908


author: Jay Fenlason <fenlason@redhat.com> - 1.7-1.1
changelog:
  - Remove build dependencies on libXNVCtrl-devel and w3m because RHEL
    does not have them (w3m is available on x86_64, but not s390).
    Resolves: rhbz978752


author: Jay Fenlason <fenlason@redhat.com> - 1.7-1.2
changelog:
  - Split out lstopo into a -gui subpackage, so the hwloc base package
    does not pull in all of X.
    Resolves: rhbz910165


author: Don Zickus <dzickus@redhat.com> - 1.7-4
changelog:
  - Fix dangling symlink for hwloc-ls manpage
    Resolves: rhbz1081236
    Add desktop entry for lstopo
    Resolves: rhbz1229313


author: Michal Schmidt <mschmidt@redhat.com> - 1.11.8-4
changelog:
  - Rebase to 1.11.8.
  - Deal with rpaths using the method from Packaging Guidelines.
  - BuildRequire rdma-core-devel on s390(x).
  - Fix scriptlets related to hwloc-dump-hwdata.service.
  - Configure with /run as runstatedir.
  - Spec file cleanup.
  - Related: rhbz1482585


author: Caolán McNamara <caolanm@redhat.com> - 2.8.3-4
changelog:
  - Resolves: rhbz#813481 x86_64 valgrind spews, see rhbz#813780
  - Related: rhbz#813481 dump valgrind failure log


author: Jaromir Capik <jcapik@redhat.com> - 3.1.0-5
changelog:
  - Introducing man pages for binaries in the eepromer subpackage
  - Introducing -r switch in the i2cset help


author: Zdenek Dohnal <zdohnal@redhat.com> - 3.1.0-11
changelog:
  - 1071397 - Load i2c-dev module when i2cdetect is executed
  - 1195285 - Ship modprobe.d files in /usr/lib/modprobe.d


author: Michal Schmidt <mschmidt@redhat.com> - 1.0.10-0.1.20150717git825da3ccd2
changelog:
  - Update to pre-release git snapshot of 1.0.10.
  - Adds libibacmp shared library.
  - Rebase coverity patch.
  - Minor spec file cleanup.
  - Resolves: bz1169952


author: Michal Schmidt <mschmidt@redhat.com> - 1.0.10-0.3.20150717git825da3ccd2
changelog:
  - Put libibacmp.so in the main package, it's needed at runtime.
  - No need to run ldconfig, the .so is not in the linker path.
  - Filter the plugin from RPM provides.
  - Related: bz1169952


author: Jarod Wilson <jarod@redhat.com> - 12-3
changelog:
  - Take libi40iw out of tech-preview state (rhbz 1428930)
  - Add ibv_*_pingpong man pages (rhbz 1416541)


author: Jarod Wilson <jarod@redhat.com> - 12-4
changelog:
  - Clean up devel files list
  - Fix up a few dependencies rpmdiff complained about (rhbz 1404035)
  - Add Requires: pciutils for dracut to behave in minimalist cases (rhbz 1429046)
  - Adjust Conflicts: on infiniband-diags to match RHEL packaging (rhbz 1428785)


author: Jarod Wilson <jarod@redhat.com> - 13-1
changelog:
  - Update to rdma-core v13 release (rhbz 1404035)
  - Mellanox mlx5 Direct Verbs support (rhbz 1426430)
  - Get build working on s390x, less mlx5 (rhbz 1434029)


author: Jarod Wilson <jarod@redhat.com> 13-6
changelog:
  - Clean up htonll/ntohll handling for opa-ff/infiniband-diags compile
  - Add necessary Provides/Obsoletes for old -static packages
  - Remove ibverbs providers that we aren't currently able to support
  - Resolves: rhbz#1453096, rhbz#1451607


author: Jarod Wilson <jarod@redhat.com> 15-2
changelog:
  - Fix ibacm segfault and improper multicast handling
  - Resolves: rhbz#1502745
  - Resolves: rhbz#1502759


author: Honggang Li <honli@redhat.com> 15-3
changelog:
  - srp_daemon: Don't create async_ev_thread if only run once
  - srp_daemon: Remove unsupported systemd configurations
  - srp_daemon: Start srp_daemon service after network target
  - Resolves: bz1525193
  - Resolves: bz1528671


author: Jarod Wilson <jarod@redhat.com> 15-4
changelog:
  - Add support for extended join multicast API in librdmacm
  - Add support for striding RQ on mlx5
  - Resolves: rhbz#1515487, rhbz#1516571


author: Jarod Wilson <jarod@redhat.com> 15-5
changelog:
  - libmlx4: report RSS caps for improved DPDK support
  - Fix double mutex unlock in iwpmd
  - Resolves: rhbz#1527350
  - Resolves: rhbz#1542362


author: Jarod Wilson <jarod@redhat.com> 15-7
changelog:
  - i40iw: revoke systemd udev rules auto-load on i40e hardware, due to
    causing problems with suspend and resume, and fall back to load via
    systemd rdma initscript.
  - Resolves: rhbz#1568325


author: Jarod Wilson <jarod@redhat.com> 15-7
changelog:
  - i40iw: revoke systemd udev rules auto-load on i40e hardware, due to
    causing problems with suspend and resume, and fall back to load via
    systemd rdma initscript.
  - Resolves: rhbz#1561566


author: Jarod Wilson <jarod@redhat.com> 17.1-1
changelog:
  - Rebase to upstream rdma-core v17.1 stable release
  - No more libibcm or ib sysv initscripts
  - Resolves: rhbz#1515647
  - Resolves: rhbz#1517208
  - Resolves: rhbz#1523201
  - Resolves: rhbz#1541751


author: Jarod Wilson <jarod@redhat.com> 17.1-3
changelog:
  - Grab latest stable-v17 fixes from upstream
  - Fix Provides/Obsoletes on removed libibcm
  - Fix Provides/Obsoletes on removed libehca
  - Straighten out SW parsing feature support for DPDK
  - Fix mlx5 rate-limiting support
  - Resolves: rhbz#1588096
  - Resovles: rhbz#1534856
  - Resolves: rhbz#1589525


author: Jarod Wilson <jarod@redhat.com> 17.2-2
changelog:
  - Restore SysV Initscripts ib ifup and ifdown helpers
  - Adjust MTU limit for IPoIB in datagram mode via ifup-ib
  - Resolves: rhbz#1593426
  - Resolves: rhbz#1593334


author: Jarod Wilson <jarod@redhat.com> 22-1
changelog:
  - Rebase to upstream rdma-core v22
  - Resolves: rhbz#1641921
  - Add mlx5 IB Device Memory support (MEMIC)
  - Resolves: rhbz#1644697
  - Add mlx5 Tunnel protocol RX decap/encap offload
  - Resolves: rhbz#1644709
  - Add mlx5 Tunnel protocol TX decap/encap offload
  - Resolves: rhbz#1644778
  - Add support for mlx5 infiniband flow counters
  - Resolves: rhbz#1644714
  - Add mlx5 DEVX interface
  - Resolves: rhbz#1644722
  - Add libbnxt_re support for SRQ
  - Resolves: rhbz#1570393


author: Jarod Wilson <jarod@redhat.com> 22.1-1
changelog:
  - Update to upstream v22.1 release with stable-v22 branch fixes
  - Add support for Broadcom 57500 RoCE adapter
  - Resolves: rhbz#1678274


author: Jarod Wilson <jarod@redhat.com> 22.4-1
changelog:
  - Update to v22.4 stable release
  - Support mlx5 scatter to CQE over DCT QP
  - Fix ibacm segfault on non-IB hardware
  - Resolves: rhbz#1715489
  - Resolves: rhbz#1712296


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.3-12
changelog:
  - Resolves: #1183909 - programs using "PreeditType: OverTheSpot" is stalled
  - Resolves: #1191825 - gtk2's immodules.cache won't be updated in some cases


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.3-1
changelog:
  - Bumped to 1.5.3
  - Deleted ibus-xx-g-s-disable-preedit.patch as EOL.
  - Deleted ibus-gjs as EOL.
  - Removed imsettings-gnome, im-chooser, libgnomekbd dependencies.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.3-6
changelog:
  - Resolves: #1051389, #1051391, #1051408, #1051397, #1051398, #1051415,
                Updated ibus-HEAD.patch for upstream
  - Resolves: #1050813
    Deleted notify-python in Requires


author: Ding-Yi Chen <dchen at redhat.com> - 1.4.4-1
changelog:
  - Resolves Bug 842856 - ibus-chewing 1.4.3-1 not built with $RPM_OPT_FLAGS
  - Resolves Bug 1027030 - CVE-2013-4509 ibus-chewing: ibus: visible 
    password entry flaw [fedora-all]
    Thanks czchen for the GitHub pull request 39.
  - Added translations: fr_FR, ja_JP, ko_KR
  - Adopt cmake-fedora-1.2.0


author: Ding-Yi Chen <dchen at redhat.com> - 1.4.4-7
changelog:
  - Target "translation" is built separately with all, 
    in order to tame multiple job make.
  - Resolves Bug 1013977 - ibus-chewing needs to have ibus write-cache --system in %post and %postun
  - Resolves Bug 1027031 - CVE-2013-4509 ibus-chewing: ibus: visible password entry flaw [rhel-7.0]
  - Resolves Bug 1028911 - [zh_TW]'Chinese<->English' switch does not work when clicking on the Chewing menu list.
  - Resolves Bug 1045868 - ibus-chewing *again* not built with $RPM_OPT_FLAGS
  - Option "Sync between caps lock and IM":
    + Default of  is changed to "disable",  because the previous default
      "keyboard" cause bug 1028911 for GNOME Shell.
    + Now Sync from "input method" can control Caps LED in GNOME shell.
  - Translation added: de_DE, es_ES, it_IT, pt_BR, uk_UA
  - Set environment IBUS_CHEWING_LOGFILE for ibus-chewing log.


author: Ding-Yi Chen <dchen at redhat.com> - 1.4.4-9
changelog:
  - Resolves Bug 1119963 - Slow focus change with ibus-chewing
  - Resolves Bug 1062133 - ibus-chewing may not handle key event after focus change
  - Resolves Bug 1073797 - Cannot identify input mode for Chinese IME (ibus-chewing)


author: Daiki Ueno <dueno@redhat.com> - 1.4.2-3
changelog:
  - Remove have_bridge_hotkey and need_pygobject3 macros which does no
    longer make sense after F17
  - Add ibus-hangul-dconf-prefix.patch
  - Fix bug 909509 - Hangul Keybaord doesn't be changed in IBusHangul Setup


author: Daiki Ueno <dueno@redhat.com> - 1.4.2-7
changelog:
  - Invoke ibus-setup-hangul with the absolute path.
  - Fix bug 1012732 - Click ibus hangul setup on gnome-shell top bar's
    ibus -> No Response


author: Daiki Ueno <dueno@redhat.com> - 1.4.2-10
changelog:
  - Add ibus-hangul-hangul-toggle.patch
  - Fix bug 1071351 - Cannot switch English input mode and Hangul
    (Korean) input mode by Hangul key


author: Daiki Ueno <dueno@redhat.com> - 1.5.18-6
changelog:
  - add ibus-kkc-16th-candidate.patch (Closes: #1251882)
  - add ibus-kkc-page-settings.patch (Closes: #1251891)
  - add ibus-kkc-ignore-annotations.patch (Closes: #1251896)


author: Peng Wu <pwu@redhat.com> - 1.6.91-4
changelog:
  - Resolves: rhbz#1068338, rhbz#1068448
  - Add patch ibus-libpinyin-update-gnome-shell-indicatior.patch
  - Add patch ibus-libpinyin-drop-xdg-depends.patch


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-4
changelog:
  - Add ibus-m17n-translit-layout.patch
  - Fix bug 847495 - For non-US keyboard layout Ibus-m17n adds English
    (US) to the list of input methods and other input methods use US
    layout
  - Require eekboard-service instead of eekboard
  - Fix bug 847500 - Don't install Eekboard by default in the desktop spin


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-6
changelog:
  - Add ibus-m17n-desktop-file.patch
    Fix bug 860955 - ibus-m17n setup is not enabled in
    gnome-control-center region, .desktop file is missing


author: Daiki Ueno <deno@redhat.com> - 1.3.4-8
changelog:
  - Update ibus-m17n-HEAD.patch to the latest upstream master
  - Remove unnecessary and not upstreamable patches
  - Use gtk3 always
  - Fix bug 912592 - ibus-m17n should use default keyboard in most cases


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-9
changelog:
  - Update ibus-m17n-xkb-options.patch to set XKB option for Inscript2
  - Fix bug 957993 - ibus-m17n doesn't automatically map Alt_R to AltGr
    when Inscript2 maps are used


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-10
changelog:
  - Add ibus-m17n-fix-data-location.patch
  - Fix bug 962144 [abrt] ibus-m17n-1.3.4-9.fc19:
    setup_dialog_load_config: Process /usr/libexec/ibus-setup-m17n was
    killed by signal 11 (SIGSEGV)


author: Mike FABIAN <mfabian@redhat.com> - 1.4.99.20120907-3
changelog:
  - Resolves: #856903
  - Fix ipa-x-sampa table and phrases containing spaces in emoji-table
    Currently there is a regular expression which filters out several
    lines defining valid phrases. The emoji-table for example has phrases
    containing spaces which are currently filtered out and the ipa-x-sampa
    table has trailing comments which are filtered out as well.


author: Mike FABIAN <mfabian@redhat.com> - 1.4.99.20121113-1
changelog:
  - update to latest upstream 1.4.99.20121113 from Caius ‘kaio’ Chance’s repository, using rel20121101 git tag
  - remove ibus-table-1.4.99.20120907-improve-chinese-category-check.patch (included upstream)
  - remove fix-ipa-x-sampa-table-and-phrases-containing-spaces.patch (included upstream)
  - Fix marking of translatable strings for gettext
  - update zh_??.po files
  - Add German translation
  - Do not fail if the ~/.ibus/byo-tables/ directory does not exist


author: Mike FABIAN <mfabian@redhat.com> - 1.4.99.20130108-1
changelog:
  - update to latest upstream 1.4.99.20130108 from Caius ‘kaio’ Chance’s repository, 1.5.0 branch
  - includes port to GObjectIntrospection now


author: Mike FABIAN <mfabian@redhat.com> - 1.4.99.20130110-1
changelog:
  - Resolves: #513901 ibus-table setup does not store config settings
  - update to latest upstream 1.4.99.20130110 from Caius ‘kaio’ Chance’s repository, 1.5.0 branch
  - When detecting the Chinese mode from the environment, also check LC_ALL
  - Fix typo in self._chinese_mode variable (The typo broke the SC/TC property)
  - Make cursor in lookup table always visible (became invisible after the port to GObjectIntrospection)
  - apply changes in values of dconf keys immediately


author: Mike FABIAN <mfabian@redhat.com> - 1.5.0-1
changelog:
  - update to latest upstream 1.5.0  from Caius ‘kaio’ Chance’s repository
  - add patches for better simplified/traditional Chinese detection
  - Resolves: #857967 - simplified/traditional Chinese detection in ibus-table does not work well


author: Mike FABIAN <mfabian@redhat.com> - 1.5.0-2
changelog:
  - Resolves: #911487 - Non-Chinese tables from the ibus-table-other package do not work
  - Add auto_select functionality to select the first phrase when typing.
    Useful for Cyrillic transliteration
  - Update cmode property in chinese mode only
  - Fall back to auto_select = False if neither dconf nor the table
    have a value for auto_select
  - Preedit needs to be updated on page-up and page-down


author: Mike FABIAN <mfabian@redhat.com> - 1.5.0-5
changelog:
  - Resolves: rhbz#1049760 - [ALL LANG] Traceback produced when run ibus-table-createdb from terminal.
  - When tabcreatedb.py is called without any options, print a usage message. Do not just show a cryptic backtrace.


author: Ding-Yi Chen <dchen@redhat.com> - 1.3.0.20110114-1
changelog:
  - Fix Bug 667877: ibus-table-yinma and ibus-table-xingma have been obsoleted.
  - Now depends on cmake-fedora


author: Ding-Yi Chen <dchen@redhat.com> - 1.3.4-1
changelog:
  - Fixed Bug 715707 - FTBFS ibus-table-chinese-1.3.0.20110114-2.fc15
  - Fixed Bug 629212 - bad candidate orders in ibus-table-quick
  - Merged patch from sagara @ github, which address IBus issue 787
  - Make it compatible with cmake-fedora-0.7.994
  - Move the cmake policies to the front
  - Suppress the misleading warning from rpm -V


author: Ding-Yi Chen <dchen@redhat.com> - 1.4.0-1
changelog:
  - Table build scripts has been refactored.
  - cmake-fedora is added as submodule.
  - Fixed Bug 855250 - Change the default filtering for Quick and Cangjie by
    merging maxiaojun's repository
  - Fixed Google Issue 1405: failed to build ibus-table-chinese due to missing db files


author: Ding-Yi Chen <dchen@redhat.com> - 1.4.5-1
changelog:
  - Table build scripts has been refactored.
  - cmake-fedora is added as submodule.
  - Fixed Bug 855250 - Change the default filtering for Quick and Cangjie by
    merging maxiaojun's repository
  - Fixed Google Issue 1405: failed to build ibus-table-chinese due to missing db files
  - Fixed Google issue 1507: Add CJKV Extension C/D support for Array30
  - Merge GitHub Pull request 3: Added the inter punct
  - Merge GitHub Pull request 4: Give Cangjie and Quick users 9 candidates per page


author: Ding-Yi Chen <dchen@redhat.com> - 1.4.6-1
changelog:
  - Fixed IBus Google issue 1126: An error in ChineseTableLicenseAuditing
  - Complete LICENSE tag for all of the tables.


author: Mike FABIAN <mfabian@redhat.com> - 1.0.3-1
changelog:
  - Update to 1.0.3 upstream version
  - Don’t output page_size in “/usr/libexec/ibus-engine-typing-booster --xml” (Resolves: rhbz#975449 - ibus-daemon prints warnings because “/usr/libexec/ibus-engine-typing-booster --xml” prints the invalid element “page_size”)
  - Use ~/.local/share/ibus-typing-booster/ to store user data and log files (Resolves: rhbz#949035 - don't use a hidden directory under .local/share)


author: Mike FABIAN <mfabian@redhat.com> - 1.1.0-1
changelog:
  - Update to 1.1.0 upstream version
  - Add a commit=True parameter to check_phrase_and_update_frequency()
  - Fix that the page_size is shown as 0 in the setup tool if it has not been set before
  - Do not use AUTOINCREMENT
  - Make it possible to exit the setup tool by typing Control-C in the terminal
  - Add feature to read a text file for training the user database
  - Update German translations and .pot file
  - Fix error when the hunspell dictionary for an engine is missing


author: Mike FABIAN <mfabian@redhat.com> - 1.2.0-1
changelog:
  - Update to 1.2.0 upstream version
  - Make TAB when used to enable/disable the lookup table work as a toogle
  - Create a VIEW for “LIKE input_phrase%” in select_words() and use that
    in the following SELECT statements (Makes candidate calculation more
    than 10 times faster)


author: Mike FABIAN <mfabian@redhat.com> - 1.2.1-1
changelog:
  - Update to 1.2.1 upstream version
  - Pop up a message box when a file has been read to train the database, indicating success or failure (Resolves: rhbz#979933)
  - Update German translation
  - Ignore most punctuation characters and mathematical symbols when tokenizing (Resolves: rhbz#979939)


author: Mike FABIAN <mfabian@redhat.com> - 1.2.2-1
changelog:
  - Update to 1.2.2 upstream version
  - Commit immediately when certain punctuation characters are typed and transliteration is not used (Resolves: rhbz#981179)
  - Add an option to try completion only when a minimum number of characters has been typed


author: Mike FABIAN <mfabian@redhat.com> - 1.2.3-1
changelog:
  - Update to 1.2.3 upstream version
  - Fix exception handling when trying to install a rpm package (Resolves: rhbz#986178)


author: Jay Fenlason <fenlason@redhat.com> 1.5.7-8
changelog:
  - Add the -output patch to have programs use /var/cache/ibutils
    instead of /tmp
    Resolves: bz958569


author: Doug Ledford <dledford@redhat.com> - 1.5.7-12
changelog:
  - Change ExclusiveArch to ExcludeArch instead so we don't have
    the same problem again in the future
  - Update to the git repo tarball that we shipped in rhel6.6
  - Related: bz1123998


author: Jiri Vanek <jvanek@redhat.com> 1.6.1-4
changelog:
  - added and and applied patch2 fileLogInitializationError-1.6.patch to prevent 
  consequences 1268909
  - Resolves: rhbz#1217153


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-1
changelog:
  - updated to 1.6.2
  - fixed also rhbz#1303437 - package owns /etc/bash_completion.d but it should not own it 
  - generated maven metadata (isntalled but not used. 
  set -e 
     _pompart="need" 
     _jarpart="tobe" 
  _filelist=".mfiles" 
  install -dm 755 /builddir/build/BUILDROOT/icedtea-web-1.7.1-1.el7.aarch64/usr/share/maven-fragments 
  for _dir in /usr/lib/java %{_javajnidir} /usr/share/java; do 
      if [ -f /builddir/build/BUILDROOT/icedtea-web-1.7.1-1.el7.aarch64$_dir/$_jarpart ]; then 
  	_jpath="/builddir/build/BUILDROOT/icedtea-web-1.7.1-1.el7.aarch64$_dir/$_jarpart" 
      fi 
  done 
  python -m /usr/share/java-utils/maven_depmap   \
            -p "/usr" -n "" \
            /builddir/build/BUILDROOT/icedtea-web-1.7.1-1.el7.aarch64/usr/share/maven-fragments/icedtea-web \
            /builddir/build/BUILDROOT/icedtea-web-1.7.1-1.el7.aarch64/usr/share/maven-poms/$_pompart \
          >> ${_filelist} 
  sed -i 's:/builddir/build/BUILDROOT/icedtea-web-1.7.1-1.el7.aarch64::' ${_filelist} 
  sort -u -o ${_filelist} ${_filelist} 


  - Resolves: rhbz#1299537


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-3
changelog:
  - added --family to make it part of javas alternatives alignment
  - java-javaver-openjdk collected into preffered_java 
  - Resolves: rhbz#1299537


author: Jiri Vanek <jvanek@redhat.com> 1.7-1
changelog:
  - updated to itw 1.7 and sync from fedora
  - added forgotten slaves of itweb-settings policyeditor
  - Own %{_datadir}/%{name} dir
  - Mark non-English man pages with %lang
  - Install COPYING as %license
  - last three by Ville Skytta <ville.skytta@iki.fi> via 1481270
  - for sake of rpms added patch0, bashCompDirHardcodedAgain.patch to hardcode bashcompletion dir
  - removed maven macros in favour of manual handling (bug)
  - Resolves: rhbz#1475411


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-1
changelog:
  - updated to 1.6.2
  - fixed also rhbz#1303437 - package owns /etc/bash_completion.d but it should not own it 
  - generated maven metadata (isntalled but not used. %add_maven_depmap need tobe fixed)
  - Resolves: rhbz#1299537


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-1
changelog:
  - updated to 1.6.2
  - fixed also rhbz#1303437 - package owns /etc/bash_completion.d but it should not own it 
  - generated maven metadata (isntalled but not used. 
  set -e 
     _pompart="need" 
     _jarpart="tobe" 
  _filelist=".mfiles" 
  install -dm 755 /builddir/build/BUILDROOT/icedtea-web-1.7.1-2.0.1.el7_6.aarch64/usr/share/maven-fragments 
  for _dir in /usr/lib/java %{_javajnidir} /usr/share/java; do 
      if [ -f /builddir/build/BUILDROOT/icedtea-web-1.7.1-2.0.1.el7_6.aarch64$_dir/$_jarpart ]; then 
  	_jpath="/builddir/build/BUILDROOT/icedtea-web-1.7.1-2.0.1.el7_6.aarch64$_dir/$_jarpart" 
      fi 
  done 
  python -m /usr/share/java-utils/maven_depmap   \
            -p "/usr" -n "" \
            /builddir/build/BUILDROOT/icedtea-web-1.7.1-2.0.1.el7_6.aarch64/usr/share/maven-fragments/icedtea-web \
            /builddir/build/BUILDROOT/icedtea-web-1.7.1-2.0.1.el7_6.aarch64/usr/share/maven-poms/$_pompart \
          >> ${_filelist} 
  sed -i 's:/builddir/build/BUILDROOT/icedtea-web-1.7.1-2.0.1.el7_6.aarch64::' ${_filelist} 
  sort -u -o ${_filelist} ${_filelist} 


  - Resolves: rhbz#1299537


author: Jiri Vanek <jvanek@redhat.com> 1.7.2-16
changelog:
  - added patch1, patch4 and patch11 to fix CVE-2019-10182
  - added patch2 to fix CVE-2019-10181
  - added patch3 and patch33 to fix CVE-2019-10185
  - Resolves: rhbz#1724958 
  - Resolves: rhbz#1725928 
  - Resolves: rhbz#1724989


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-1
changelog:
  - updated to 1.6.2
  - fixed also rhbz#1303437 - package owns /etc/bash_completion.d but it should not own it 
  - generated maven metadata (isntalled but not used. 
  set -e 
     _pompart="need" 
     _jarpart="tobe" 
  _filelist=".mfiles" 
  install -dm 755 /builddir/build/BUILDROOT/icedtea-web-1.7.1-2.el7_6.aarch64/usr/share/maven-fragments 
  for _dir in /usr/lib/java %{_javajnidir} /usr/share/java; do 
      if [ -f /builddir/build/BUILDROOT/icedtea-web-1.7.1-2.el7_6.aarch64$_dir/$_jarpart ]; then 
  	_jpath="/builddir/build/BUILDROOT/icedtea-web-1.7.1-2.el7_6.aarch64$_dir/$_jarpart" 
      fi 
  done 
  python -m /usr/share/java-utils/maven_depmap   \
            -p "/usr" -n "" \
            /builddir/build/BUILDROOT/icedtea-web-1.7.1-2.el7_6.aarch64/usr/share/maven-fragments/icedtea-web \
            /builddir/build/BUILDROOT/icedtea-web-1.7.1-2.el7_6.aarch64/usr/share/maven-poms/$_pompart \
          >> ${_filelist} 
  sed -i 's:/builddir/build/BUILDROOT/icedtea-web-1.7.1-2.el7_6.aarch64::' ${_filelist} 
  sort -u -o ${_filelist} ${_filelist} 


  - Resolves: rhbz#1299537


author: Martin Gieseking <martin.gieseking@uos.de> 0.30.0-1
changelog:
  - updated to release 0.30.0
  - dropped patch as it has been applied upstream
  - removed old buildroot stuff


author: Richard W.M. Jones <rjones@redhat.com> - 0.31.3-1
changelog:
  - Rebase to upstream version 0.31.3.
  - This version includes multiple security fixes
    CVE-2017-5208, CVE-2017-5333, CVE-2017-5332, CVE-2017-6009,
    CVE-2017-6010, CVE-2017-6011
    resolves: rhbz#1430610


author: Eike Rathke <erack@redhat.com> - 50.1.2-6
changelog:
  - Resolves: rhbz#966141 various flaws in Layout Engine font processing
  - Resolves: rhbz#966077 aarch64 support for icu-config.sh wrapper


author: Mike FABIAN <mfabian@redhat.com> - 50.2-1
changelog:
  - Update to 50.2 maintenance release including support for new Japanese era Reiwa (令和).
  - Resolves: rhbz#1677092


author: Mike FABIAN <mfabian@redhat.com> - 50.2-2
changelog:
  - Fix rpmdiff failure: File /usr/src/debug/icu/source/i18n/unicode/selfmt.h
    relaxed permissions from 0644 to 0755 on all architectures
  - Related: rhbz#1677092


author: Mike FABIAN <mfabian@redhat.com> - 50.2-4
changelog:
  - Apply ICU-13634-Adding-integer-overflow-logic-to-ICU4C-num.patch
  - Apply ICU-20958-Prevent-SEGV_MAPERR-in-append.patch
  - Resolves: rhbz#1808235


author: Rex Dieter <rdieter@fedoraproject.org> - 1.0.3-3
changelog:
  - IlmBase.pc: +Requires.private: gl glu
  - -devel: drop hard-coded libGL/pkgconfig deps, let rpm autodetect now


author: Akira TAGOH <tagoh@redhat.com> - 1.6.2-1
changelog:
  - New upstream release.
  - the spec file cleanup.
  - Correct License field
  - Add Provides: bundled(egglib) to im-chooser-common since
    it actually contains things in libimchooseui.so.0


author: Akira TAGOH <tagoh@redhat.com> - 1.6.3-1
changelog:
  - New upstream release.
    - Add a link to the log file in the error dialog (#950488)
    - Fix a crash issue (#859624)


author: Akira TAGOH <tagoh@redhat.com> - 1.6.4-6
changelog:
  - Bring up gnome-control-center region if current desktop is GNOME.
  - Hide application from menu. (#1657016)


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> - 1.0-1
changelog:
  - New upstream release
  - Remove libtool files
  - Run ldconfig after un/installation to update *.so files
  - Add -devel subpackage to handle include files and examples


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> - 1.1-1
changelog:
  - New upstream release
  - Adjusted docbook xsl path to match the correct stylesheet
  - Remove only *.la files, considering there aren't any *.a files


author: Akira TAGOH <tagoh@redhat.com> - 1.6.3-10
changelog:
  - Fix a regression imsettings can't detect GNOME running caused by GNOME rebase. (#1533772)
  - Fix unbound variable issue (#1533050)


author: Akira TAGOH <tagoh@redhat.com> - 1.6.3-11
changelog:
  - Don't set environment variables on GNOME. (#1673284)
  - Fix another unbound variable issue (#1533050)


author: Doug Ledford <dledford@redhat.com> - 1.6.2-1
changelog:
  - Update to latest upstream release (resolves bz998816)
  - Revive all_hcas patch (otherwise would be a regression)
  - Fix ibnodes -h output (another regression, bz1054545)
  - Resolves: bz998816, bz1054545


author: Michal Schmidt <mschmidt@redhat.com> - 1.6.5-1
changelog:
  - Update to latest upstream release. Adds rdma-ndd daemon.
  - Rebase patches, cherry-pick fixes from upstream git.
  - Enable build on s390(x).
  - Fixed bogus changelog dates.
  - Add Conflicts with old rdma. It needs to be aware of rdma-ndd.
  - Resolves: bz1169968


author: Honggang Li <honli@redhat.com> - 1.6.7-1
changelog:
  - Rebase to latest upstream release 1.6.7.
  - Remove patches merged into upstream release.
  - Remove sub-package rdma-ndd as it merged into rdma-core.
  - Resolves: bz1382809


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 5.1-5
changelog:
  - Fix upstream test failure in Pod-Simple-Texinfo
    Resolves: #970986
  - Fix @enumerate does not support start numbers greater than nine
    Resolves: #1134160


author: Martin Kolman <mkolman@redhat.com> - 0.3.9.32-1
changelog:
  - Fix reconfiguration service name (mkolman)
    Related: rhbz#1257624
  - Fix installation path for a reconfiguration related script (mkolman)
    Related: rhbz#1257624
  - Use the environs flag when setting the environment (mkolman)
    Related: rhbz#1270354
  - Some typo fixes and logging improvements (mkolman)
    Related: rhbz#1257624
  - Add a systemd service that enables Initial Setup if /.unconfigured exists (#1257624) (mkolman)
    Resolves: rhbz#1257624
  - Initialize Thread Manager as early as possible (#1249598) (mkolman)
    Related: rhbz#1249598
  - Adapt to addon execute() signature change (mkolman)
    Related: rhbz#1288636
  - Suppress an error message about missing initial-setup-graphical.unit (#1249598) (mkolman)
    Related: rhbz#1249598


author: Martin Kolman <mkolman@redhat.com> - 0.3.9.34-1
changelog:
  - Suppress logging to stdout when TUI is started by s390 startup scripts (mkolman)
    Related: rhbz#1366776
  - Fix path to TUI executable in the s390 startup scripts (#1366776) (mkolman)
    Resolves: rhbz#1366776
  - Canonicalize symlinks returned by readlink (mkolman)
    Related: rhbz#1360343


author: Martin Kolman <mkolman@redhat.com> - 0.3.9.35-1
changelog:
  - Change how Initial Setup reconfig mode is started (#1342536) (mkolman)
    Related: rhbz#1342536
  - Add systemd scriptlets for initial-setup-reconfigure.service (#1342536) (mkolman)
    Related: rhbz#1342536


author: Martin Kolman <mkolman@redhat.com> - 0.3.9.39-1
changelog:
  - Run GUI on the s390 if possible (#1378082) (mkolman)
    Resolves: rhbz#1378082
  - Make it possible to set stdout log verbosity level (mkolman)
    Related: rhbz#1378082
  - Make it possible to show window header (mkolman)
    Related: rhbz#1378082


author: EL Errata <el-errata_ww@oracle.com> - 0.3.9.40-1.0.1
changelog:
  - add initial-setup-oracle.patch to change EULA location
    and bugzilla URL to http://linux.oracle.com


author: Martin Kolman <mkolman@redhat.com> - 0.3.9.42-1
changelog:
  - Use constant+offset when turning systemd console logging on/off (#1479787) (mkolman)
    Resolves: rhbz#1479787


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.49.31-1
changelog:
  - ipv6: wait for all global IPv6 addresses to leave the "tentative" state
  - source_config: tell NetworkManger to load ifcfg file even for NM_CONTROLLED=no
  - ifup-aliases: inherit ARPCHECK from parent device
  - rhel-dmesg: don't start in containers
  - ifup-eth: fix typo in error message (#1038776)
  - sysctl.conf: steal comments about /usr,/etc,... from fedora's sysctl.conf
  - rwtab: /var/lib/nfs needs to copy the files
  - functions: improve killing loops
  - ipcalc: detect invalid mask
  - ifup: set valid_lft and preferred_lft to forever for static ip
  - service: use systemd mangle for given service
  - ifup-post: check resolve.conf also with DNS2
  - ifdown-post: remove resolv.conf only in specific cases
  - spec: ghost /var/log/dmesg
  - network-functions: is_available_wait should wait even in the case that is_available returns 2
  - autorelabel: turn quota off before relabeling
  - autorelabel: call dracut-initramfs-restore before forced reboot


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.38-1
changelog:
  - ifdown-eth: we need to flush global scope as well
  - killproc/status: add missing '-b <binary>' option
  - specfile: mark 'rwtab' and 'statetab' as config files
  - spec: we need newer lvm
  - rwtab: add /var/lib/systemd/timers
  - ifup-eth: remove quote marks
  - 9.70-sync: Move everything to github
  - 9.70-sync: rwtab updated
  - 9.70-sync: service file updated
  - 9.70-sync: syconfig.txt updated
  - 9.70-sync: systemd/rhel-import-state updated
  - 9.70-sync: sysconfig/network-scripts/* updated - part 2
  - 9.70-sync: sysconfig/network-scripts/* updated - part 1
  - 9.70-sync: rc.d/init.d/network updated
  - 9.70-sync: rc.d/init.d/netconsole updated
  - 9.70-sync: rc.d/init.d/functions updated
  - 9.70-sync: ipv6-6to4.howto example updated
  - 9.70-sync: examples/networking/ifcfg-bridge updated
  - network: load NetworkManager connection via dbus
  - network: check for running NetworkManager via dbus


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.39-1
changelog:
  - sysconfig.txt: mention previously introduced NO_DHCP_HOSTNAME option
  - DHCP_FQDN and DHCP_SEND_HOSTNAME introduced
  - re-add missing $HOSTNAME initialization
  - ifup: add support for VLAN_EGRESS_PRIORITY_MAP
  - rhel-autorelabel: synchronize cached writes before reboot


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.40-1
changelog:
  - require 'redhat-release' instead of /etc/system-release & conflict with older versions
  - ifup-post: always update 'nameserver' & 'search' entries in /etc/resolv.conf
  - systemd/system: symlinks for initscripts' services removed
  - *.old extension added to list of ignored files
  - ifup-eth: wait for STP to complete setup on bridge if $DELAY is not set
  - init.d/functions: convert2sec() function added
  - init.d/functions: is_true() & is_false() extended by ON/OFF support
  - usleep(1) calls replaced with sleep(1) calls
  - network-scripts: DBus calls forwarded to /dev/null
  - network-scripts: firewall-cmd replaced with DBus calls
  - ARPUDATE option introduced


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.41-1
changelog:
  - ifdown-post: fix logical error in commit 5d61564
  - network-functions: use POSIX forwarding instead of bash-ism


author: EL Errata <kevin.x.lyons@oracle.com> - 9.49.41-1.0.2
changelog:
  - Restore requirement for /etc/system-release to ensure that
    oraclelinux-release is pulled in [bug 27882831]


author: EL Errata <kevin.x.lyons@oracle.com> - 9.49.41-1.0.3
changelog:
  - Require the 7u5 package oraclelinux-release instead of the file
    /etc/system-release to ensure all upgrade scenarios are covered
    [bug 27882831]


author: EL Errata <el-errata_ww@oracle.com> - 9.49.41-1.0.4
changelog:
  - Set net.rdmaip.trigger_active_bonding on service start and stop
  - set net.rdmaip.active_bonding.patch [Orabug 27741130]
  - Require the 7u5 package oraclelinux-release instead of the file
    /etc/system-release to ensure all upgrade scenarios are covered
    [bug 27882831]
  - Restore requirement for /etc/system-release to ensure that
    oraclelinux-release is pulled in [bug 27882831]
  - modify SUBSCRIPTION_MSG


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.42-1
changelog:
  - rhel-autorelabel: set UEFI boot order (BootNext) same as BootCurrent
  - network-functions: use tr to upper case strings rather than awk
  - sysconfig/readonly-root: Clarify the usage of readonly-root
  - network-functions: add error messages for bonding installation
  - sysctl.conf.s390: drop SHMALL and SHMMAX
  - network.service: 'reload' removed
  - rhel-readonly.service: target name for random seed fixed
  - init.d/functions: fix sourcing for ksh


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.45-1
changelog:
  - network: parsing of /proc/mounts returned (bug #1572659)
  - netconsole: LSB header added (bug #1508489)
  - ifdown-eth: no longer needed 'pidof -x dhclient' condition removed (bug #1559384)


author: EL Errata <el-errata_ww@oracle.com> - 9.49.46-1.0.1
changelog:
  - Set net.rds.ib.trigger_active_bonding on service start and stop
  - set net.rds.ib.active_bonding.patch [Orabug 28731178]
  - Set net.rdmaip.trigger_active_bonding on service start and stop
  - set net.rdmaip.active_bonding.patch [Orabug 27741130]
  - Require the 7u5 package oraclelinux-release instead of the file
    /etc/system-release to ensure all upgrade scenarios are covered
    [bug 27882831]
  - Restore requirement for /etc/system-release to ensure that
    oraclelinux-release is pulled in [bug 27882831]
  - modify SUBSCRIPTION_MSG


author: Edward Leung <edward.leung@oracle.com> - 9.49.47-1.0.1
changelog:
  - Backport Bug 24610000 - Bonds configured as round-robin with
    active-backup mode configured for bonding patch to OL7
    [Orabug 28783727,28529729]
  - Set net.rds.ib.trigger_active_bonding on service start and stop
  - set net.rds.ib.active_bonding.patch [Orabug: 28731178]
  - Set net.rdmaip.trigger_active_bonding on service start and stop
  - set net.rdmaip.active_bonding.patch [Orabug: 27741130]
  - Require the 7u5 package oraclelinux-release instead of the file
    /etc/system-release to ensure all upgrade scenarios are covered
    [Orabug: 27882831]
  - Restore requirement for /etc/system-release to ensure that
    oraclelinux-release is pulled in [Orabug: 27882831]
  - modify SUBSCRIPTION_MSG


author: Jan Macku <jamacku@redhat.com> - 9.49.48-1
changelog:
  - network: don't fail with IFDOWN_ON_SHUTDOWN (bug #1693977)
  - Configure autorelabel service to output to journal and to console if set (bug #1634661)
  - Fix changelog typo


author: Jan Macku <jamacku@redhat.com> - 9.49.49-1
changelog:
  - ifup-eth: Check that device name is set (bug #1741830)
  - Add option for IPv6 GRE tunnel (bug #1691552)


author: Edward Leung <edward.leung@oracle.com> - 9.49.49-1.0.5
changelog:
  - Bypass net_failover slaves for udev 60-net.rules [Orabug: 30474872]
  - systemd-udevd: failed to execute '/lib/udev/detect_failover' was 
    seen while NIC module loading [Orabug: 31127650]


author: EL Errata <el-errata_ww@oracle.com> - 9.49.53-1.0.1
changelog:
  - fix scriptlet typo in postscripts [Orabug: 31135807]
  - Bypass net_failover slaves for udev 60-net.rules [Orabug: 30474872]
  - systemd-udevd: failed to execute '/lib/udev/detect_failover' was 
    seen while NIC module loading [Orabug: 31127650]
  - Add a warning to logs for slow serial consoles [Orabug: 30953934]
  - Backport Bug 24610000 - Bonds configured as round-robin with
    active-backup mode configured for bonding patch to OL7
    [Orabug 28783727,28529729]
  - Set net.rds.ib.trigger_active_bonding on service start and stop
  - set net.rds.ib.active_bonding.patch [Orabug: 28731178]
  - Set net.rdmaip.trigger_active_bonding on service start and stop
  - set net.rdmaip.active_bonding.patch [Orabug: 27741130]
  - Require the 7u5 package oraclelinux-release instead of the file
    /etc/system-release to ensure all upgrade scenarios are covered
    [Orabug: 27882831]
  - Restore requirement for /etc/system-release to ensure that
    oraclelinux-release is pulled in [Orabug: 27882831]
  - modify SUBSCRIPTION_MSG


author: Alon Levy <alevy@redhat.com>
changelog:
  - Update to 0.50.0
  - Drop patch carried for bz#568845 (schemas-merge) per last comment
    in that bug.


author: Jon Ciesla <limburgher@gmail.com> - 0.50.2-1
changelog:
  - Latest stable release.
  - Merge review BZ 225902 fixes:
  - Removed Obsoletes/Provides for xml-i18n-tools.
  - Swapped gettext/gettext-devel Requires, BuildRequires.
  - Added %check section.


author: Andrew Price <anprice@redhat.com> - 0.0-1.20130117git26d4e95
changelog:
  - Further improve the versioning
  - Preserve timestamp on man page
  - Remove BuildRoot, the clean and defattr sections and don't clean buildroot
  - Install to DESTDIR
  - Update Source and add a comment on how the tarball was generated
  - Use _smp_mflags in build
  - Thanks to Eduardo Echeverria for reviewing the package


author: Andrew Price <anprice@redhat.com> - 1.0-4
changelog:
  - Fix a label overflow in plot_io
    Resolves: rhbz#1004820
  - Add bounds checking in find_step
    Resolves: rhbz#1004882
  - Fix processing of trace filenames containing spaces
    Resolves: rhbz#1004865


author: Andrew Price <anprice@redhat.com> - 1.0-6
changelog:
  - Add Requires: librsvg2-tools to enable video generation
  - Merge trace dumping functions into one
  - Check program exit code properly
  - Fix up directory trace processing
    Resolves: rhbz#1004865


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-12.el7
changelog:
  - Resolves: #1447284 Upgrade from ipa-4.1 fails when enabling KDC proxy
    - python2-ipalib: add missing python dependency
    - installer service: fix typo in service entry
    - upgrade: add missing suffix to http instance
  - Resolves: #1444791 Update man page of ipa-kra-install 
    - ipa-kra-install manpage: document domain-level 1
  - Resolves: #1441493 ipa cert-show raises stack traces when
    --certificate-out=/tmp 
    - cert-show: writable files does not mean dirs 
  - Resolves: #1441192 Add the name of URL parameter which will be check for
    username during cert login
    - Bump version of ipa.conf file
  - Resolves: #1378797 Web UI must check OCSP and CRL during smartcard login
    - Turn on NSSOCSP check in mod_nss conf
  - Resolves: #1322963 Errors from AD when trying to sign ipa.csr, conflicting
    template on
    - renew agent: respect CA renewal master setting
    - server upgrade: always fix certmonger tracking request
    - cainstance: use correct profile for lightweight CA certificates
    - renew agent: allow reusing existing certs
    - renew agent: always export CSR on IPA CA certificate renewal
    - renew agent: get rid of virtual profiles
    - ipa-cacert-manage: add --external-ca-type
  - Resolves: #1441593 error adding authenticator indicators to host 
    - Fixing adding authenticator indicators to host
  - Resolves: #1449525 Set directory ownership in spec file 
    - Added plugins directory to ipaclient subpackages
    - ipaclient: fix missing RPM ownership
  - Resolves: #1451279 otptoken-add-yubikey KeyError: 'ipatokenotpdigits'
    - otptoken-add-yubikey: When --digits not provided use default value


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-13.el7
changelog:
  - Resolves: #1451804 "AttributeError: 'tuple' object has no attribute 'append'"
    error observed during ipa upgrade with latest package. 
    - ipa-server-install: fix uninstall
  - Resolves: #1445390 ipa-[ca|kra]-install with invalid DM password break
    replica 
    - ca install: merge duplicated code for DM password
    - installutils: add DM password validator
    - ca, kra install: validate DM password


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-14.el7
changelog:
  - Resolves: #1438731 Extend ipa-server-certinstall and ipa-certupdate to 
    handle PKINIT certificates/anchors
    - certdb: add named trust flag constants
    - certdb, certs: make trust flags argument mandatory
    - certdb: use custom object for trust flags
    - install: trust IPA CA for PKINIT
    - client install: fix client PKINIT configuration
    - install: introduce generic Kerberos Augeas lens
    - server install: fix KDC PKINIT configuration
    - ipapython.ipautil.run: Add option to set umask before executing command
    - certs: do not export keys world-readable in install_key_from_p12
    - certs: do not export CA certs in install_pem_from_p12
    - server install: fix KDC certificate validation in CA-less
    - replica install: respect --pkinit-cert-file
    - cacert manage: support PKINIT
    - server certinstall: support PKINIT
  - Resolves: #1444432 CA-less pkinit not installable with --pkinit-cert-file
    option
    - certs: do not export CA certs in install_pem_from_p12
    - server install: fix KDC certificate validation in CA-less
  - Resolves: #1451228 ipa-kra-install fails when primary KRA server has been
    decommissioned
    - ipa-kra-install: fix pkispawn setting for pki_security_domain_hostname 
  - Resolves: #1451712 KRA installation fails on server that was originally
    installed as CA-less
    - ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
  - Resolves: #1441499 ipa cert-show does not raise error if no file name
    specified
    - ca/cert-show: check certificate_out in options
  - Resolves: #1449522 Deprecate `ipa pkinit-anonymous` command in FreeIPA 4.5+
    - Remove pkinit-anonymous command
  - Resolves: #1449523 Provide an API command to retrieve PKINIT status
    in the FreeIPA topology
    - Allow for multivalued server attributes
    - Refactor the role/attribute member reporting code
    - Add an attribute reporting client PKINIT-capable servers
    - Add the list of PKINIT servers as a virtual attribute to global config
    - Add `pkinit-status` command
    - test_serverroles: Get rid of MockLDAP and use ldap2 instead
  - Resolves: #1452216 Replica installation grants HTTP principal access in WebUI
    - Fix rare race condition with missing ccache file
  - Resolves: #1455045 Simple service uninstallers must be able to handle
    missing service files gracefully
    - only stop/disable simple service if it is installed
  - Resolves: #1455541 after upgrade login from web ui breaks
    - krb5: make sure KDC certificate is readable
  - Resolves: #1455862 "ipa: ERROR: an internal error has occurred" on executing
    command "ipa cert-request --add" after upgrade
    - Change python-cryptography to python2-cryptography


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-15.el7
changelog:
  - Resolves: #1442233 IPA client commands fail when pointing to replica 
    - httpinstance: wait until the service entry is replicated
  - Resolves: #1456769 ipaAnchorUUID index incorrectly configured and then
    not indexed
    - Fix index definition for ipaAnchorUUID
  - Resolves: #1438016 gssapi errors after IPA server upgrade
    - Avoid possible endless recursion in RPC call
    - rpc: preparations for recursion fix
    - rpc: avoid possible recursion in create_connection
  - Resolves: #1446087 services entries missing krbCanonicalName attribute.
    - Changing cert-find to do not use only primary key to search in LDAP.
  - Resolves: #1452763 ipa certmaprule change not reflected in krb5kdc workers
    - ipa-kdb: reload certificate mapping rules periodically
  - Resolves: #1455541 after upgrade login from web ui breaks
    - kdc.key should not be visible to all 
  - Resolves: #1435606 Add pkinit_indicator option to KDC configuration
    - ipa-kdb: add pkinit authentication indicator in case of a successful
      certauth
  - Resolves: #1455945 Enabling OCSP checks in mod_nss breaks certificate
    issuance when ipa-ca records are not resolvable
    - Turn off OCSP check
  - Resolves: #1454483 rhel73 ipa ui - cannot del server - IPA Error 903 -
    server_del - TypeError: 'NoneType' object is not iterable
    - fix incorrect suffix handling in topology checks


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-16.el7
changelog:
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces
    - Only warn when specified server IP addresses don't match intf
  - Resolves: #1438016 gssapi errors after IPA server upgrade
    - Bump version of python-gssapi
  - Resolves: #1457942 certauth: use canonical principal for lookups
    - ipa-kdb: use canonical principal in certauth plugin
  - Resolves: #1459153 Do not send Max-Age in ipa_session cookie to avoid
    breaking older clients
    - Add code to be able to set default kinit lifetime
    - Revert setting sessionMaxAge for old clients


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-17.el7
changelog:
  - Resolve: #1455946 Provide a tooling automating the configuration 
    of Smart Card authentication on a FreeIPA master
    - server certinstall: update KDC master entry
    - pkinit manage: introduce ipa-pkinit-manage
    - server upgrade: do not enable PKINIT by default
    - Extend the advice printing code by some useful abstractions
    - Prepare advise plugin for smart card auth configuration
  - Resolve: #1461053 allow to modify list of UPNs of a trusted forest
    - trust-mod: allow modifying list of UPNs of a trusted forest
    - WebUI: add support for changing trust UPN suffixes


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-18.el7
changelog:
  - Resolves: #1449189 ipa-kra-install timeouts on replica
    - kra: promote: Get ticket before calling custodia


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-19.el7
changelog:
  - Resolves: #1462112 ipaserver installation fails in FIPS mode: OpenSSL
    internal error, assertion failed: Digest MD4 forbidden in FIPS mode!
    - ipa-sam: replace encode_nt_key() with E_md4hash() 
    - ipa_pwd_extop: do not generate NT hashes in FIPS mode
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces 
    - Fix local IP address validation 
    - ipa-dns-install: remove check for local ip address
    - refactor CheckedIPAddress class
    - CheckedIPAddress: remove match_local param
    - Remove ip_netmask from option parser
    - replica install: add missing check for non-local IP address
    - Remove network and broadcast address warnings


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-20.el7
changelog:
  - Resolves: #1452216 Replica installation grants HTTP principal
    access in WebUI
    - Make sure we check ccaches in all rpcserver paths


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7
changelog:
  - Resolves: #1470125 Replica install fails to configure IPA-specific
    temporary files/directories
    - replica install: drop-in IPA specific config to tmpfiles.d
  - Resolves: #1469978 bind package is not automatically updated during
    ipa-server upgrade process
    - Bumped Required version of bind-dyndb-ldap and bind package


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1
changelog:
  - Resolves: #1473272 Provide a tooling automating the configuration
    of Smart Card authentication on a FreeIPA master
    - smart-card advises: configure systemwide NSS DB also on master
    - smart-card advises: add steps to store smart card signing CA cert
    - Allow to pass in multiple CA cert paths to the smart card advises
    - add a class that tracks the indentation in the generated advises
    - delegate the indentation handling in advises to dedicated class
    - advise: add an infrastructure for formatting Bash compound statements
    - delegate formatting of compound Bash statements to dedicated classes
    - Fix indentation of statements in Smart card advises
    - Use the compound statement formatting API for configuring PKINIT
    - smart card advises: use a wrapper around Bash `for` loops
    - smart card advise: use password when changing trust flags on HTTP cert
    - smart-card-advises: ensure that krb5-pkinit is installed on client
  - Resolves: #1477046 Use CommonNameToSANDefault in default profile 
    (new installs only)
    - Add CommonNameToSANDefault to default cert profile
  - Resolves: #1475664 NULL LDAP context in call to ldap_search_ext_s
    during search in cn=ad,cn=trusts,dc=example,dc=com
    - NULL LDAP context in call to ldap_search_ext_s during search


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1.1
changelog:
  - Resolves: #1477046 Use CommonNameToSANDefault in default profile
    (new installs only)
    - Restore old version of caIPAserviceCert for upgrade only


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-21.el7.2
changelog:
  - Resolves: #1486794 - [ipa-replica-install] - 406 Client Error: Failed to
    validate message: Incorrect number of results (0) searching forpublic
    key for host
      - Always check peer has keys before connecting
  - Resolves: #1489300 - Unable to set ca renewal master on replica
      - Fix ipa config-mod --ca-renewal-master
  - Resolves: #1489815 - TypeError in renew_ca_cert prevents from swiching
    back to self-signed CA
      - Backport PR 988 to ipa-4-5 Fix Certificate renewal (with ext ca)
  - Resolves: #1489817 - ipa-server-upgrade failes with "This entry already exists"
      - Backport PR 1008 to ipa-4-5 Fix ipa-server-upgrade: This entry already exists
  - Resolves: #1490331 - FreeIPA/IdM installations which were upgraded from
    versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
    thus startup of Web UI fails
      - Adds whoami DS plugin in case that plugin is missing
  - Resolves: #1491545 - IPA WebUI does not work after upgrade from IPA 4.4 to 4.5
      - Fixing how sssd.conf is updated when promoting a client to replica
  - Resolves: #1492616 - ipa-otptoken-import - XML file is missing PBKDF2
    parameters!
      - ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace
  - Resolves: #1493153 - Updating from RHEL 7.3 fails with Server-Cert not found
    (ipa-server-upgrade)
      - Backport 4-5: Fix ipa-server-upgrade with server cert tracking


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-21.el7.2.2
changelog:
  - Resolves: #1493410 ipa-server-upgrade timeouts on wait_for_open ports
    expecting IPA services listening on IPv6 ports
      - Make sure upgrade also checks for IPv6 stack
      - control logging of host_port_open from caller
      - log progress of wait_for_open_ports
  - Resolves: #1493411 ipa help command returns traceback when no cache
    is present
      - Store help in Schema before writing to disk
      - Disable pylint in get_help function because of type confusion.


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-22.el7
changelog:
  - Resolves: #1506528 In case full PKINIT configuration is failing during
    server/replica install the error message should be more meaningful.
      - Less confusing message for PKINIT configuration during install
  - Resolves: #1506526 Use X509v3 Basic Constraints "CA:TRUE" instead of
    "CA:FALSE" IPA CA CSR
      - Include the CA basic constraint in CSRs when renewing a CA
  - Resolves: #1506913 ipa-replica-install might fail because of an already
    existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
      - Checks if replica-s4u2proxy.ldif should be applied
  - Resolves: #1506525 server-del doesn't remove dns-server configuration
    from ldap
      - server.py: Removes dns-server configuration from ldap


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.4-2.el7
changelog:
  - Resolves: #1461177 ipa-otptoken-import  - XML file is missing PBKDF2
    parameters!
  - Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s during
    search in cn=ad, cn=trusts,dc=example,dc=com
  - Resolves: #1467887 iommu platform support for ipxe
  - Resolves: #1477178 [ipa-replica-install] - 406 Client Error: Failed to
    validate message: Incorrect number of results (0) searching forpublic key for
    host
  - Resolves: #1478251 IPA WebUI does not work after upgrade from IPA 4.4 to
    4.5
  - Resolves: #1480102 ipa-server-upgrade failes with "This entry already
    exists"
  - Resolves: #1482802 Unable to set ca renewal master on replica
  - Resolves: #1484428 Updating from RHEL 7.3 fails with Server-Cert not found
    (ipa-server-upgrade)
  - Resolves: #1484826 FreeIPA/IdM installations which were upgraded from
    versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
    thus startup of Web UI fails
  - Resolves: #1486283 TypeError in renew_ca_cert prevents from swiching back
    to self-signed CA
  - Resolves: #1469246 Replica install fails to configure IPA-specific
    temporary files/directories
  - Resolves: #1469480 bind package is not automatically updated during
    ipa-server upgrade process
  - Resolves: #1475238 Use CommonNameToSANDefault in default profile (new
    installs only)
  - Resolves: #1477703 IPA upgrade fails for latest ipa package


author: Rob Crittenden <rcritten@redhat.com> - 4.5.4-3.el7
changelog:
  - Drop workaround for building on AArch64 (#1482244)
  - Temporarily reduce Requires on python-netaddr to 0.7.5-7 (#1506485)


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.4-4.el7
changelog:
  - Resolves: #1388135 [RFE] limit the retro changelog to dns subtree.
    - ldap: limit the retro changelog to dns subtree
  - Resolves: #1427798 Use X509v3 Basic Constraints "CA:TRUE" instead
    of "CA:FALSE" IPA CA CSR
    - Include the CA basic constraint in CSRs when renewing a CA
  - Resolves: #1493145 ipa-replica-install might fail because of an already
    existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
    - Checks if replica-s4u2proxy.ldif should be applied
  - Resolves: #1493150 [RFE] set nsslapd-ignore-time-skew: on by default
    - ds: ignore time skew during initial replication step
    - ipa-replica-manage: implicitly ignore initial time skew in force-sync 
  - Resolves: #1500218 Replica installation at domain-level 0 fails against
    upgraded ipa-server
    - Fix ipa-replica-conncheck when called with --principal
  - Resolves: #1506188 server-del doesn't remove dns-server configuration
    from ldap


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.5.4-5.el7
changelog:
  - Resolves: #1415162 ipa-exdom-extop plugin can exhaust DS worker threads
  - Resolves: #1378892 host-find slowness caused by missing host attributes in index


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-7.el7
changelog:
  - Resolves: #1421869 Unable to re-add broken AD trust - Unexpected Information received
    - adtrust: filter out subdomains when defining our topology to AD
  - Resolves: #1486286 IPA failing to authenticate via password+OTP on RHEL7.4 with fips enabled
    - Don't allow OTP or RADIUS in FIPS mode
  - Resolves: #1494226 IPA User Details not being displayed in WebUI
    - Fix cert-find for CA-less installations
  - Resolves: #1498387 389-ds-base crashed as part of ipa-server-intall in ipa-uuid
    - 389-ds-base crashed as part of ipa-server-intall in ipa-uuid
  - Resolves: #1503022 ipa-getkeytab man page should have more details about consequences of krb5 key renewal
    - ipa-getkeytab man page: add more details about the -r option
  - Resolves: #1509288 IPA trust-add internal error (expected security.dom_sid got None)
    - ipaserver/plugins/trust.py; fix some indenting issues
    - trust: detect and error out when non-AD trust with IPA domain name exists
    - ipaserver/plugins/trust.py: pep8 compliance
  - Resolves: #1511019 ipa-restore broken with python2
    - Fix ipa-restore (python2)
  - Resolves: #1511607 ipa-backup does not backup Custodia keys and files
    - Backup ipa-custodia conf and keys
  - Resolves: #1512482 kra install fails after ipa cert renewed
    - Don't use admin cert during KRA installation
    - Prevent set_directive from clobbering other keys
    - pep8: reduce line lengths in CAInstance.__enable_crl_publish
    - installutils: refactor set_directive
    - Add tests for installutils.set_directive
    - Add safe DirectiveSetter context manager
    - Old pylint doesn't support bad python3 option
  - Resolves: #1514163 CA less IPA install with external certificates fails on RHEL 7 in FIPS mode
    - Fix ca less IPA install on fips mode


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-8.el7
changelog:
  - Resolves: #1477531 Incorrect attribute level rights (ipaallowedtoperform) of service object
    - WebUI: make keytab tables on service and host pages writable
  - Resolves: #1529444 ObjectclassViolation seen while adding idview with domain-resolution-order option
    - Idviews: fix objectclass violation on idview-add
  - Resolves: #1451576 ipa cert-request failed to generate certificate from csr
    - Fixing the cert-request comparing whole email address case-sensitively.


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-9.el7
changelog:
  - Resolves: #1458169 --force-join option is not mentioned in ipa-replica-install man page
    - Add --force-join into ipa-replica-install manpage
  - Resolves: #1457876 ipa-backup fails silently
    - Changed ownership of ldiffile to DS_USER
  - Resolves: #1409786 Second phase of --external-ca ipa-server-install setup fails when dirsrv is not running
    - Checks if Dir Server is installed and running before IPA installation
  - Resolves: #1452086 Pagination Size under Customization in IPA WebUI accepts negative values
    - WebUI: Add positive number validator
    - WebUI: change validator of page size settings
    - WebUI: fix jslint error


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-11.el7
changelog:
  - Resolves: #1565519 Clarify the need to restart services in ipa-server-certinstall(1)
    - Add a notice to restart ipa services after certs are installed
  - Resolves: #1564390 OTP and Radius Authentication does not work in FIPS mode
    - Fix OTP validation in FIPS mode
    - Increase the default token key size
    - Revert "Don't allow OTP or RADIUS in FIPS mode"
    - Log errors from NSS during FIPS OTP key import
  - Resolves: #1565520 ipa client pointing to replica shows KDC has no support for encryption type
    - ipa-replica-install: make sure that certmonger picks the right master
  - Resolves: #1565605 DNS records updated with all IPAddresses of an interface when IPA server/replica try to install with Specific IP address of that interface
    - replica-install: pass --ip-address to client install


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-10.el7.2
changelog:
  - Resolves: #1579189 nsds5ReplicaReleaseTimeout should be set by default
    - Add nsds5ReplicaReleaseTimeout to replica config
    - Fix upgrade (update_replica_config) in single master mode
  - Resolves: #1579190 Improve Custodia client and key distribution handling
    - Use single Custodia instance in installers
  - Resolves: #1579203 4.5.0 -> 4.5.4 upgrade breaks in ipa-server-upgrade: No such file or directory: '/var/lib/pki/pki-tomcat/conf/ca/CS.cfg'
    - Don't try to backup CS.cfg during upgrade if CA is not configured


author: Rob Crittenden <rcritten@redhat.com> - 4.5.4-10.el7.3
changelog:
  - Resolves: #1579190 Improve Custodia client and key distribution handling
    - Use single Custodia instance in installers


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-10.el7.4
changelog:
  - Resolves: #1615983 ipa-restore fails on newly installed system.
    - Fix ipa-restore: create /var/run/ipa files
  - Resolves: #1615966 ipa-replica-manage re-initialize TypeError: 'NoneType' object does not support item assignment
    - Check if replication agreement exist before enable/disable it
  - Resolves: #1615984 ldapmodify userPassword reflects on krblastpwdchange on RHEL6 but not RHEL7
    - Tests: add integration test for password changes by dir mgr
    - In IPA 4.4 when updating userpassword with ldapmodify does not update krbPasswordExpiration nor krbLastPwdChange
  - Resolves: #1615893 nsds5ReplicaReleaseTimeout should be set by default.
    - Tune DS replication settings
  - Resolves: #1615964 Authn/TOTP defined users periodically prompt for just password credentials to access resources
    - Fix elements not being removed in otpd_queue_pop_msgid()


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-10.el7.4.2
changelog:
  - Resolves: #1623673 SRV lookup doesn't correctly sort results
    - Sort and shuffle SRV record by priority and weight
  - Resolves: #1623679 Installation of replica against a specific master
    - Always set ca_host when installing replica
    - Query for server role IPA master
    - Only create DNS SRV records for ready server
    - Delay enabling services until end of installer
    - replicainstall: DS SSL replica install pick right certmonger host
    - Fix race condition in get_locations_records()
    - Fix DNSSEC install regression
    - Handle races in replica config
    - Fix KRA replica installation from CA master
    - Do not set ca_host when --setup-ca is used
  - Resolves: #1623676 Replication races in DogtagInstance.setup_admin
    - Improve and fix timeout bug in wait_for_entry()
    - Use common replication wait timeout of 5min
    - Fix replication races in Dogtag admin code
    - Catch ACIError instead of invalid credentials
  - Resolves: #1623680 Increase WSGI worker process count
    - Increase WSGI process count to 5 on 64bit
    - Use 4 WSGI workers on 64bit systems
  - Resolves: #1623669 ipa-replica-install defines nsds5replicabinddngroup before the group contains the DN of the replication manager
    - DS replication settings: fix regression with <3.3 master
  - Resolves: #1623668 Replica install: certmonger sometimes fails
    - Auto-retry failed certmonger requests
    - Wait for client certificates


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-10.el7.4.3
changelog:
  - Resolves: #1624811 ipa-otpd: fix potential double-free and infinite loop in queue code
    - Clear next field when returnining list elements in queue.c
    - Add cmocka unit tests for ipa otpd queue code


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-10.el7_5.4.4
changelog:
  - Resolves: #1626379 PKINIT configuration did not succeed message is received during Replica-install
    - ipa-replica-install: fix pkinit setup


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-2.el7
changelog:
  - Resolves: #1594142 SRV lookup doesn't correctly sort results
    - Sort and shuffle SRV record by priority and weight
  - Resolves: #1594141 Replication races in DogtagInstance.setup_admin
    - Fix replication races in Dogtag admin code
    - Use common replication wait timeout of 5min
    - Improve and fix timeout bug in wait_for_entry()
  - Resolves: #1591824 Installation of replica against a specific master
    - Always set ca_host when installing replica
  - Resolves: #1591647 Increase WSGI worker process count
    - Increase WSGI process count to 5 on 64bit
  - Resolves: #1394034 Custom SELinux User Map order is changed after updating IPA
    - Use replace instead of add to set new default ipaSELinuxUserMapOrder
  - Resolves: #1381535 ipa config-mod returns "Configured size limit exceeded"
    - ipaserver config plugin: Increase search records minimum limit


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.4-3.el7
changelog:
  - Resolves: #1603514 Replica install fails with "Certificate issuance failed (CA_REJECTED)" - ACIError


author: Tibor Dudlák <tdudlak@redhat.com> - 4.6.4-4.el7
changelog:
  - Resolves: #1600525 ipa-client-install --uninstall fails to uninstall client.
    - ipa client uninstall: clean the state store when restoring hostname
  - Resolves: #1598117 client uninstall fails when installed using non-existing hostname
    - ipa client uninstall: clean the state store when restoring hostname
  - Resolves: #1596168 ipa help topics displays 'ipa: ERROR: an internal error has occurred'
    - Fix regression: Handle unicode where str is expected
  - Resolves: #1591824 Installation of replica against a specific master
    - Query for server role IPA master
    - Only create DNS SRV records for ready server
    - Delay enabling services until end of installer
    - replicainstall: DS SSL replica install pick right certmonger host
    - Fix CA topology warning
    - Fix race condition in get_locations_records()
    - Fix DNSSEC install regression
    - Handle races in replica config
  - Resolves: #1591647 Increase WSGI worker process count
    - Use 4 WSGI workers on 64bit systems
  - Resolves: #1565633 nsds5ReplicaReleaseTimeout should be set by default.
    - Tune DS replication settings
  - Resolves: #1607616 Traceback in messages file during ipa-server-install: File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 541, in <module>#012
    - Removing filesystem encoding check
  - Resolves: #1598044  plugable.py:491:bootstrap:SystemEncodingError: System encoding must be UTF-8, 'ANSI_X3.4-1968' is not supported.
    - Removing filesystem encoding check


author: Tibor Dudlák <tdudlak@redhat.com> - 4.6.4-5.el7
changelog:
  - Resolves: #1607616 Traceback in messages file during ipa-server-install: File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 541, in <module>#012
    - Removing filesystem encoding check
  - Resolves: #1598044  plugable.py:491:bootstrap:SystemEncodingError: System encoding must be UTF-8, 'ANSI_X3.4-1968' is not supported.
    - Removing filesystem encoding check


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-6.el7
changelog:
  - Resolves: #1590647 ldapmodify userPassword reflects on krblastpwdchange on RHEL6 but not RHEL7
    - In IPA 4.4 when updating userpassword with ldapmodify does not update krbPasswordExpiration nor krbLastPwdChange
  - Resolves: #1600074 ipa-server-upgrade displays 'DN: cn=Schema Compatibility,cn=plugins,cn=config does not exists or haven't been updated'
    - Re-open the ldif file to prevent error message
  - Resolves: #1608783 ipa trust-add fails in FIPS mode.
    - Move fips_enabled to a common library to share across different plugins
    - ipasam: do not use RC4 in FIPS mode


author: Tibor Dudlák <tdudlak@redhat.com> - 4.6.4-7.el7
changelog:
  - Resolves: #1609882 ipaserver/plugins/cert.py: Add reason to raise of errors.NotFound
    - ipaserver/plugins/cert.py: Added reason to raise of errors.NotFound
  - Resolves: #1598662 Replica installation fails with connection refused error 
    - Do not set ca_host when --setup-ca is used
  - Resolves: #1577108 Improve Custodia client and key distribution handling
    - Fix KRA replica installation from CA master
  - Resolves: #1515314 ipa-replica-install fails with PIN error [ CA-less environment ]
    - Fix ipa-replica-install when key not protected by PIN
  - Resolves: #1480502 ipa server uninstall with -v option displays "IOError: [Errno 9] Bad file descriptor Logged from file ipautil.py, line 442"
    - uninstall -v: remove Tracebacks
  - Resolves: #1368345 Replace ERROR: cannot connect to 'http://localhost:8888/ipa/json': [Errno 111] Connection refused with 'IPA is not configured on this system'
    - ipa commands: print 'IPA is not configured' when ipa is not setup
    - Disable message about log in ipa-backup if IPA is not configured
  - Resolves: #1591824 Installation of replica against a specific master
    - Do not set ca_host when --setup-ca is used
  - Resolves: #1594141 Replication races in DogtagInstance.setup_admin
    - Catch ACIError instead of invalid credentials
  - Resolves: #1623112  ipa-replica-install defines nsds5replicabinddngroup before the group contains the DN of the replication manager
    - DS replication settings: fix regression with <3.3 master
  - Resolves: #1623113 Replica install: certmonger sometimes fails
    - Wait for client certificates
    - Auto-retry failed certmonger requests


author: Tibor Dudlák <tdudlak@redhat.com> - 4.6.4-8.el7
changelog:
  - Resolves #1508498 Authn/TOTP defined users periodically prompt for just password credentials to access resources
    - Clear next field when returnining list elements in queue.c
    - Add cmocka unit tests for ipa otpd queue code
  - Resolves #1622168 ipa-otpd: fix potential double-free and infinite loop in queue code
    - Clear next field when returnining list elements in queue.c
    - Add cmocka unit tests for ipa otpd queue code
  - Resolves #1603444 ipa-server-install script is failing when using the "--no-dnssec-validation" parameter combined with the "--forwarder"
    - ipa-server-install: do not perform forwarder validation with --no-dnssec-validation


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-9.el7
changelog:
  - Resolves: #1624755 Re-installing replica on the same system displays 'WARNING: cannot check if port 443 is already configured'
    - ipa-replica-install: properly use the file store
  - Resolves: #1623486 PKINIT configuration did not succeed message is received during Replica-install
    - ipa-replica-install: fix pkinit setup
  - Related: #1624289 AVC denials noticed during test execution for SUB-CA test-suite in FIPS mode
    - Update minimum selinux-policy to 3.13.1-224


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-10.el7
changelog:
  - Resolves: 1630361 PKINIT fails in FIPS mode
    - Ensure that public cert and CA bundle are readable
    - Always make ipa.p11-kit world-readable
    - Make /etc/httpd/alias world readable & executable
    - Fix permission of public files in upgrader


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-10.el7_6.2
changelog:
  - Resolves: 1659492 searching for ipa users by certificate fails
    - ipaldap.py: fix method creating a ldap filter for IPACertificate
    - ipatests: add xmlrpc test for user|host-find --certificate
  - Resolves: 1659509 IPA Upgrade failed with "unable to convert the attribute u'cACertificate;binary'"
    - ipa upgrade: handle double-encoded certificates
    - ipatests: add upgrade test for double-encoded cacert
    - ipatests: fix TestUpgrade::test_double_encoded_cacert
  - Resolves: 1659500 'ipa vault-retrieve' is failing with "ipa: ERROR: an internal error has occurred"
    - Add a shared-vault-retrieve test
    - Add a "Find enabled services" ACI in 20-aci.update so that all users can find IPA servers and services. ACI suggested by Christian Heimes.
  - Resolves: 1659511 ipa-pkinit-manage reports a switch from local pkinit to full pkinit configuration was successful although it was not.
    - ipatest: add test for ipa-pkinit-manage enable|disable
    - PKINIT: fix ipa-pkinit-manage enable|disable
  - Resolves: 1659499 automember-rebuild crashes
    - Find orphan automember rules
  - Resolves: 1660389 ipa-replica-install fails migrating RHEL 6 to 7
    - replication: check remote ds version before editing attributes


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-10.el7_6.3
changelog:
  - Resolves: 1672343 pki spawn fails for IPA replica install from RHEL6 IPA master
    - Update mod_nss cipher list so there is overlap with a 4.x master
  - Resolves: 1672342 Fix compile issue with new 389-ds
    - ipa-sidgen: make internal fetch_attr helper really internal
  - Resolves: 1672176 host_del and host_disable fails, ra.find() search for every certificates instead of the host's certificate by subject
    - Add workaround for slow host/service del
    - Optimize cert remove case
  - Resolves: 1672238 The ipa-replica-install command failed, exception: ValidationError: invalid 'dnszoneidnsname': only master zones can contain record
    - replica installation: add master record only if in managed zone
    - ipatests: add test for replica in forward zone


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-10.el7_6.6
changelog:
  - Resolves: 1716882 - ERROR: invalid 'PKINIT enabled server': all masters must have IPA master role enabled
    - Consider configured servers as valid


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-3.el7
changelog:
  - Resolves: 1694623 ipa-kra-install failing with invalid 'role_servrole': must be Unicode text error
    - ipa-setup-kra: fix python2 parameter
  - Resolves: 1694596 ipa-server-upgrade fails with ConversionError: invalid 'cn': must be Unicode text
    - ipa-server-upgrade: fix add_systemd_user_hbac


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-4.el7
changelog:
  - Resolves: 1686302 ipa trust fetch-domains, server parameter ignored
    - oddjob: allow to pass options to trust-fetch-domains
  - Resolves: 1695481 ipa trust-add failing with CIFS server communication error
    - adtrust: define Guests mapping after creating cifs/ principal
    - net groupmap: force using empty config when mapping Guests


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-5.el7
changelog:
  - Resolves: 1697242 Communication with oddjob helper fails
    - Bypass D-BUS interface definition deficiences for trust-fetch-domains


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-7.el7
changelog:
  - Resolves: 1704227 - Wrong logic in ipactl restart leads to start instead of restart pki-tomcatd
    - ipactl restart: fix wrong logic when checking service list


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-8.el7
changelog:
  - Resolves: 1702651 - Command ipa conole is broken
    - ipa console: catch proper exception when history file can not be open
  - Resolves: 1704796 - Wrong CA replication topology created with two replicas
    - replica install: acknowledge ca_host override
  - Resolves: 1708873 - Unable to upgrade ipa data: IPA version error: data needs to be upgraded (expected version '4.7.90.pre1-3.fc30', current version '4.7.2-8.fc30')
    - upgrade: adtrust - catch empty result when retrieving list of trusts


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-9.el7
changelog:
  - Resolves: 1712794 - ERROR: invalid 'PKINIT enabled server': all masters must have IPA master role enabled
    - Consider configured servers as valid


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-10.el7
changelog:
  - Resolves: 1723473 - ipa upgrade fails with trust entry already exists
    - adtrust upgrade: fix wrong primary principal name


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-11.el7
changelog:
  - Resolves: 1723473 - ipa upgrade fails with trust entry already exists
    - adtrust upgrade: fix wrong primary principal name, part 2
  - Resolves: 1686302 - ipa trust fetch-domains, server parameter ignored
    - trust-fetch-domains: make sure we use right KDC when --server is specified


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-11.el7_7.2
changelog:
  - Resolves: #1752740 - when migrating trusted domain object structure, add default access control definitions, if they were missing in old trust objects
    - add default access control when migrating trust objects
    - adtrust: add default read_keys permission for TDO objects
    - Disable deprecated-lambda check in adtrust upgrade code


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-11.el7_7.3
changelog:
  - Resolves: #1756914 - Sub-CA key replication failure
    - Handle missing LWCA certificate or chain
    - Fix CustodiaClient ccache handling
    - CustodiaClient: use ldapi when ldap_uri not specified
    - CustodiaClient: fix IPASecStore config on ipa-4-7
    - Bump krb5 min version


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-11.el7_7.4
changelog:
  - Resolves: #1781153 - After upgrade AD Trust Agents were removed from LDAP
    - trust upgrade: ensure that host is member of adtrust agents
  - Resolves: #1777303 - CVE-2019-10195 ipa: batch API logging user passwords to /var/log/httpd/error_log
    - CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
  - Resolves: #1773953 - User incorrectly added to negative cache when backend is reconnecting to IPA service / timed out: error code 32 'No such object'
    - extdom: unify error code handling especially LDAP_NO_SUCH_OBJECT
    - ipa-extdom-extop: test timed out getgrgid_r
  - Resolves: #1770728 - Issue with adding multiple RHEL 7 IPA replica to RHEL 6 IPA master
    - DL0 replica install: fix nsDS5ReplicaBindDN config 
  - Resolves: #1767300 - CVE-2019-14867 ipa: Denial of service in IPA server due to wrong use of ber_scanf()
    - Make sure to have storage space for tag


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.6-3.el7
changelog:
  - Resolves: 1717008 - User incorrectly added to negative cache when backend is reconnecting to IPA service / timed out: error code 32 'No such object'


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.6-4.el7
changelog:
  - Resolves: 1744926 - rebuild against Samba 4.10 to solve undefined symbol: DEBUGLEVEL_CLASS
  - Backport patches to compile against Samba 4.10
  - Fix Python 2 compatibility in adtrustinstance


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-5.el7
changelog:
  - Resolves: #1749788 - ipa host-find --pkey-only includes SSH keys in output
    - Don't return SSH keys with ipa host-find --pkey-only
  - Resolves: #1745108 - Bug 1497334 invalidating single-label domains introduces regression of usage for customers
    - check for single-label domains only during server install
  - Resolves: #1583950 - IPA: IDM drops all custom attributes when moving account from preserved to stage
    - user-stage: transfer all attributes from preserved to stage user
    - xmlrpc test: add test for preserved > stage user


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-6.el7
changelog:
  - Resolves: #1752005 - Keyrings should not be used in containerized environment
    - Don't configure KEYRING ccache in containers
  - Resolves: #1751951 - When master's IP address does not resolve to its name, ipa-replica-install fails
    - Add container environment check to replicainstall
  - Resolves: #1750700 - when migrating trusted domain object structure, add default access control definitions, if they were missing in old trust objects
    - add default access control when migrating trust objects
    - adtrust: add default read_keys permission for TDO objects
    - Disable deprecated-lambda check in adtrust upgrade code


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-7.el7
changelog:
  - Resolves: #1754494 - ipa-replica-install does not enforce --server option
    - replica install: enforce --server arg
  - Resolves: #1729638 - ipa_kdb: assertion failure from NULL lcontext pointer to ldap_get_values_len()
    - Fix segfault in ipadb_parse_ldap_entry()
    - Log INFO message when LDAP connection fails on startup
    - Fix NULL pointer dereference in maybe_require_preauth()
  - Resolves: #1636765 - ipa-restore set wrong file permissions and ownership for /var/log/dirsrv/slapd- directory
    - ipa-restore: Restore ownership and perms on 389-ds log directory


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-8.el7
changelog:
  - Resolves: #1755223 - Sub-CA key replication failure
    - Handle missing LWCA certificate or chain
    - Fix CustodiaClient ccache handling
    - CustodiaClient: use ldapi when ldap_uri not specified
    - CustodiaClient: fix IPASecStore config on ipa-4-7
    - Bump krb5 min version


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-9.el7
changelog:
  - Resolves: #1762317 - ipa-backup command is failing on rhel-7.8
    -  ipa-backup: fix python2 issue with os.mkdir


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-10.el7
changelog:
  - Resolves: #1728123 - EMBARGOED CVE-2019-10195 ipa: FreeIPA: batch API logging user passwords to /var/log/httpd/error_log [rhel-7]
    - CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
  - Resolves: #1773550 - IPA upgrade fails for latest ipa package when adtrust is installed
    - Do not run trust upgrade code if master lacks Samba bindings
  - Resolves: #1767302 - EMBARGOED CVE-2019-14867 ipa: Denial of service in IPA server due to wrong use of ber_scanf() [rhel-7.8]
    - Make sure to have storage space for tag


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-11.el7
changelog:
  - Resolves: #1778777 - After upgrade AD Trust Agents were removed from LDAP
    - trust upgrade: ensure that host is member of adtrust agents


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-12.el7
changelog:
  - Resolves: #1754902 - Running ipa-server-install fails when RHEL 7.7 packages are installed on RHEL 7.6
  - Resolves: #1404770 - ID Views: do not allow custom Views for the masters
    - idviews: prevent applying to a master
  - Resolves: #1801791 - Compatibility Schema difference in functionality for systems following RHEL 7.5 -> 7.6 upgrade path as opposed to new RHEL 7.6 systems
    - install/updates: move external members past schema compat update
  - Resolves: #1795890 - ipa-pkinit-manage enable fails on replica if it doesn't host the CA
    - pkinit setup: fix regression on master install
    - pkinit enable: use local dogtag only if host has CA
  - Resolves: #1788907 - Renewed certs are not picked up by IPA CAs
    - Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit
  - Resolves: #1780548 - Man page ipa-cacert-manage does not display correctly on RHEL
    - ipa-cacert-manage man page: fix indentation
  - Resolves: #1782587 - add "systemctl restart sssd" to warning message when adding trust agents to replicas
    - adtrust.py: mention restarting sssd when adding trust agents
  - Resolves: #1771356 - Default client configuration breaks ssh in FIPS mode
    - Use default ssh host key algorithms
  - Resolves: #1755535 - ipa-advise on a RHEL7 IdM server is not able to generate a configuration script for a RHEL8 IdM client
    - smartcard: make the ipa-advise script compatible with authselect/authconfig
  - Resolves: #1758406 - KRA authentication fails when IPA CA has custom Subject DN
    - upgrade: fix ipakra people entry 'description' attribute
    - krainstance: set correct issuer DN in uid=ipakra entry
  - Resolves: #1756568 - ipa-server-certinstall man page does not match built-in help
    - ipa-server-certinstall manpage: add missing options
  - Resolves: #1206690 - UPG not being enforced properly
    - ipa user_add: do not check group if UPG is disabled
  - Resolves: #1811982 - CVE-2018-14042 ipa: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip.
  - Resolves: #1811978 - CVE-2018-14040 ipa: bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute
  - Resolves: #1811972 - CVE-2016-10735 ipa: bootstrap: XSS in the data-target attribute
  - Resolves: #1811969 -CVE-2018-20676 ipa: bootstrap: XSS in the tooltip data-viewport attribute
  - Resolves: #1811966 - CVE-2018-20677 ipa: bootstrap: XSS in the affix configuration target property
  - Resolves: #1811962 - CVE-2019-8331 ipa: bootstrap: XSS in the tooltip or popover data-template attribute
    - Web UI: Upgrade Bootstrap version 3.3.7 -> 3.4.1
  - Resolves: #1769791 - Invisible part of notification area in Web UI intercepts clicks of some page elements
    - WebUI: Fix notification area layout
  - Resolves: #1545755 - ipa-replica-prepare should not update pki admin password
    - Fix indentation levels
    - ipa-pwd-extop: use SLAPI_BIND_TARGET_SDN
    - ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager
    - Don't save password history on non-Kerberos accounts


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-1.el7
changelog:
  - Resolves: #1819725 - Rebase IPA to latest 4.6.x version
  - Resolves: #1817927 - host-add --password logs cleartext userpassword to Apache error log
  - Resolves: #1817923 - IPA upgrade is failing with error "Failed to get request: bus, object_path and dbus_interface must not be None."
  - Resolves: #1817922 - covscan memory leaks report
  - Resolves: #1817919 - Enable compat tree to provide information about AD users and groups on trust agents
  - Resolves: #1817918 - Secure tomcat AJP connector
  - Resolves: #1817886 - ipa group-add-member: prevent adding IPA objects as external members
  - Resolves: #1788718 - ipa-server-install incorrectly setting slew mode (-x) when setting up ntpd


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-2.el7
changelog:
  - Resolves: #1802408 CVE-2020-1722 ipa: No password length restriction leads to denial of service
    - Add interactive prompt for the LDAP bind password to ipa-getkeytab
    - CVE-2020-1722: prevent use of too long passwords


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-3.el7
changelog:
  - Resolves: #1834385 Man page syntax issue detected by rpminspect
    - Man pages: fix syntax issues
  - Resolves: #1829787 ipa service-del deletes the required principal when specified in lower/upper case
    - Make check_required_principal() case-insensitive
  - Resolves: #1825829 ipa-advise on a RHEL7 IdM server generate a configuration script for client having hardcoded python3
    - ipa-advise: fallback to /usr/libexec/platform-python if python3 not found
  - Resolves: #1812020 CVE-2015-9251 ipa: js-jquery: Cross-site scripting via cross-domain ajax requests
    - Web UI: Upgrade jQuery version 2.0.3 -> 3.4.1
  - Resolves: #1713487 CVE-2019-11358 ipa: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection
    - Web UI: Upgrade jQuery version 2.0.3 -> 3.4.1


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-4.el7
changelog:
  - Resolves: #1842950 ipa-adtrust-install fails when replica is offline
    - ipa-adtrust-install: avoid failure when replica is offline
  - Resolves: #1831856 CVE-2020-11022 ipa: jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method
    - WebUI: Apply jQuery patch to fix htmlPrefilter issue


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7
changelog:
  - Resolves: #1826659 IPA: Ldap authentication failure due to Kerberos principal expiration UTC timestamp
    -  ipa-pwd-extop: use timegm() instead of mktime() to preserve timezone offset


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.4
changelog:
  - Resolves: #1897253 IPA WebUI inaccessible after upgrading to RHEL 8.3.- idoverride-memberof.js missing
    - wgi/plugins.py: ignore empty plugin directories
  - Resolves: #1895197 improve IPA PKI susbsystem detection by other means than a directory presence, use pki-server subsystem-find
    - Improve PKI subsystem detection
    - ipatests: add test for PKI subsystem detection
    - ipatest: fix test_upgrade.py::TestUpgrade::()::test_kra_detection
  - Resolves: #1892793 Authentication and login times are over several seconds due to unindexed ipaExternalMember
    - Add more indices
  - Resolves: #1884819 IdM Web UI shows users as disabled
    - fix cert-find errors in CA-less deployment
  - Resolves: #1863619 CA-less install does not set required permissions on KDC certificate
    - CAless installation: set the perms on KDC cert file
    - ipatests: check KDC cert permissions in CA less install
  - Resolves: #1859248 CVE-2020-11023 ipa: jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution
    - WebUI: Fix jQuery DOM manipulation issues
  - Resolves: #1846349 cannot issue certs with multiple IP addresses corresponding to different hosts
    - fix iPAddress cert issuance for >1 host/service


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.5
changelog:
  - Resolves: #1931405 krb5kdc crash - Segmentation fault in ldap_first_entry().
    - ipa-kdb: fix compiler warnings
    - ipa-kdb: add missing prototypes
    - ipa-kdb: reformat ipa_kdb_certauth
    - ipa-kdb: mark test functions as static
    - ipa-kdb: do not use OpenLDAP functions with NULL LDAP context
  - Resolves: #1835741 krb5kdc crashing on ipa server
  - Resolves: #1929372 krb5kdc is crashing intermittently on IPA server.


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.7
changelog:
  - Resolves: #1956550 - IPA server installation fails when cert contains non-ASCII character
    - CA less installation: non ASCII chars in CA subject
    - ipatests: use non-ascii chars in CA-less install
  - Resolves: #1974328 - Revise PKINIT upgrade code
    - Allow PKINIT to be enabled when updating from a pre-PKINIT IPA CA server


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.9
changelog:
  - Resolves: #2000261 - extdom: LDAP_INVALID_SYNTAX returned instead of LDAP_NO_SUCH_OBJECT
    - extdom: return LDAP_NO_SUCH_OBJECT if domains differ


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.10
changelog:
  - Resolves: 2025848 - RHEL 8.6 IPA Replica Failed to configure PKINIT setup against a RHEL 7.9 IPA server 
    - Fix cert_request for KDC cert
  - Resolves: 2021444 - CVE-2020-25719 ipa: samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets
    - SMB: switch IPA domain controller role


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.11
changelog:
  - Resolves: 2082272 - [RFE] Require confirmation to change "Default host group" in IdM automember rules
    - WebUI: Add confirmation dialog for changing default user/host group


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.12
changelog:
  - Resolves: 2084223 - 'ipa idview-show idviewname' & IPA WebUI takes longer time to return the results
    - idviews: use cached ipaOriginalUid value when resolving ID override
  - Resolves: 2124369 - OTP token sync always returns OK even with random numbers
    - ipa otptoken-sync: return error when sync fails
    - ipatests: add negative test for otptoken-sync
    - ipatests: python2 does not support f-strings
    - Fix otptoken_sync plugin


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.13
changelog:
  - Resolves: 2148249 - ipa-client-install does not maintain server affinity during installation
    - Defer creating the final krb5.conf on clients
    - Move client certificate request after krb5.conf is created
    - server install: remove error log about missing bkup file


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.14
changelog:
  - Resolves: 2180919 [rhel-7] Sequence processing failures for group_add using server context
    - ipaserver: deepcopy objectclasses list from IPA config


author: Michal Ruprich <mruprich@redhat.com> - 3.1.7-1
changelog:
  - Related: #913329 - [RFE] include iperf3 in RHEL 7
                     - adding latest version before including iperf3 in RHEL-7


author: Michal Ruprich - 3.1.7-2
changelog:
  - Related: #913329 - [RFE] include iperf3 in RHEL 7
                     - adding requires to spec file for devel package


author: Josef Ridky <jridky@redhat.com> - 0:1.8.18-3
changelog:
  - Fix issues with warning: dereferencing type-punned pointer 
    will break strict-aliasing rules from RPMDiff


author: Pavel Cahyna <pcahyna@redhat.com> - 0:1.8.18-10
changelog:
  - Protect against negative values to memmove that caused
    "ipmitool sol activate" to crash against an IBM DataPower appliance
    (#1951480) and IP-131 Dayton blades in a SGI ICE-X (#2025519)
    Cherry-picked from upstream PR#78.


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.18-11
changelog:
  - Add upstream ipmievd patch to check received msg id against expectation
    Fixes problem where SEL response is not recognized correctly
    when SEL request times out
    Resolves: rhbz#2224569


author: Boris Ranto <branto@redhat.com> - 0:1.8.15-7
changelog:
  - New release (0:1.8.15-7)
  - ID:437 - sel: Fix "sel time set <time>"
  - ID 408 - fix sel list last X listing


author: Phil Sutter <psutter@redhat.com> [3.10.0-80.el7]
changelog:
  - tc: m_xt: Drop needless parentheses from #if checks (Phil Sutter) [1326726]
  - tc: m_xt: Fix segfault with iptables-1.6.0 (Phil Sutter) [1326726]
  - m_xt: whitespace cleanup (Phil Sutter) [1326726]
  - tc: m_xt: Introduce get_xtables_target_opts() (Phil Sutter) [1326726]
  - tc: m_xt: Simplify argc adjusting in parse_ipt() (Phil Sutter) [1326726]
  - tc: m_xt: Get rid of iargc variable in parse_ipt() (Phil Sutter) [1326726]
  - tc: m_xt: Get rid of rargc in parse_ipt() (Phil Sutter) [1326726]
  - tc: m_xt: Drop unused variable fw in parse_ipt() (Phil Sutter) [1326726]
  - tc: m_xt: Get rid of one indentation level in parse_ipt() (Phil Sutter) [1326726]
  - tc: m_xt: Fix indenting (Phil Sutter) [1326726]
  - tc: m_xt: Fix segfault when adding multiple actions at once (Phil Sutter) [1326726]
  - tc: m_xt: Prevent segfault with standard targets (Phil Sutter) [1326726]
  - man: update doc after support of ESN and anti-replay window (Phil Sutter) [1425059]
  - xfrm: add support of ESN and anti-replay window (Phil Sutter) [1425059]


author: Phil Sutter <psutter@redhat.com> [3.10.0-81.el7]
changelog:
  - man: ip-link: Specify min/max values for bridge slave priority and cost (Phil Sutter) [1374360]
  - man: ip-link.8: document bridge options (Phil Sutter) [1373869]


author: Ivan Vecera <ivecera@redhat.com> [3.10.0-84.el7]
changelog:
  - tc: Add support for the matchall traffic classifier. (Ivan Vecera) [1435624]
  - tc: man: Add man entry for the matchall classifier. (Ivan Vecera) [1435624]
  - tc: add missing limits.h header (Ivan Vecera) [1435624]
  - tc: man: matchall: Fix example indentation (Ivan Vecera) [1435624]
  - tc: matchall: Print skip flags when dumping a filter (Ivan Vecera) [1435624]
  - tc, clsact: add clsact frontend (Ivan Vecera) [1435624]


author: Eric Garver <egarver@redhat.com> [3.10.0-86.el7]
changelog:
  - Revert "ip-route man: add usage and description for lwtunnel encap attributes" (Eric Garver) [1459975]
  - Revert "lwtunnel: implement support for ip6 encap" (Eric Garver) [1459975]
  - Revert "lwtunnel: fix argument parsing" (Eric Garver) [1459975]
  - Revert "lwtunnel: Add encapsulation support to ip route" (Eric Garver) [1459975]


author: Sabrina Dubroca <sdubroca@redhat.com> [3.10.0-87.el7]
changelog:
  - devlink: Add e-switch support (Sabrina Dubroca) [1459772]
  - devlink: whitespace cleanup (Sabrina Dubroca) [1459772]
  - devlink: Convert conditional in dl_argv_handle_port() to switch() (Sabrina Dubroca) [1459772]
  - devlink: write usage help messages to stderr (Sabrina Dubroca) [1459772]
  - devlink: Add usage help for eswitch subcommand (Sabrina Dubroca) [1459772]
  - devlink: Call dl_free in early exit case (Sabrina Dubroca) [1459772]


author: Lans Hung <lans.hung@oracle.com> - 4.14.1.5.0.1
changelog:
  - Use the standard, prebuilt package kernel-uek-devel and simulate
    the include paths to replace with need of using kernel-uek-header.
    The purpose is not to build a manual kernel-uek-header hack. [Orabug: 27728602]


author: Lans Hung <lans.hung@oracle.com> - 4.14.1-5.0.2
changelog:
  - Build with kernel-uek-headers to provide __NR_bpf in order to pass BPF selftests [Orabug: 27728602]


author: Lans Hung <lans.hung@oracle.com> - 4.16.0-1.0.5
changelog:
  - Fix rdma: Ignore unknown netlink attributes [Orabug: 29890190]
  - Fix rdma: Fix incorrectly handled NLA validation. (also fixes upstream 74bd75c)


author: Lans Hung <lans.hung@oracle.com> - 5.4.0-1.0.1
changelog:
  - Import rdma: Add "stat show mr" support [Orabug: 30511768]
  - Import rdma: Document MR statistics [Orabug: 30511768]


author: Jakub Čajka <jcajka@redhat.com> - 2.4.2-1
changelog:
  - Resolves: #1088562 - [7.1 FEAT] iprutils package update - ppc64
  - Resolves: #1044679 - iprutils should use systemd
  - Resolves: #1092519 - iprutils - PIE and RELRO check


author: Jakub Čajka <jcajka@redhat.com> - 2.4.8-1
changelog:
  - Resolves: #1182038 - [7.2 FEAT] iprutils package update - ppc64/ppc64le
  - Resolves: #1183460 - RHEL7.1 BE: iprutils: Set known zeroed after format


author: Sinny Kumari <skumari@redhat.com> - 2.4.11.1-1
changelog:
  - Resolves: #1274367 - [7.3 FEAT] iprutils package update
  - Resolves: #1297921 - IPR: Raid migration fails to kick while executing through command line


author: Sinny Kumari <skumari@redhat.com> - 2.4.12.1-1
changelog:
  - Resolves: #1364131 - Integrate various important bug fixes for iprutils in
    RHEL7.3 by updating iprutils to 2.4.12


author: Sinny Kumari <skumari@redhat.com> - 2.4.16.1-1
changelog:
  - Resolves: #1587834 - vpdupdate takes over an hour on system with 104 drive
  - Resolves: #1521052 - iprutils package update for POWER
  - Resolves: #1547891 - iprconfig unable to Download microcode on all applicable devices
  - Resolves: #1576013 - iprconfig tools shows wrong error message, while creating raid using RI SSDs and normal SSDs


author: Thomas Woerner <twoerner@redhat.com> - 6.19-5
changelog:
  - New service sub package to provide the ipset service (RHBZ#1136257)
    Service and start-stop script from F-24
  - Fixed ipset package summary (RHBZ#1195171)
    Spec file derived from F-24


author: Thomas Woerner <twoerner@redhat.com> - 6.19-6
changelog:
  - Use /etc/sysconfig/ipset-config in service as EnvironmentFile (RHBZ#1136257)
  - Use /etc/sysconfig/ipset for data as in RHEL-6 (RHBZ#1136257)
  - No save on reload, but legacy save action (RHBZ#1136257)


author: Thomas Woerner <twoerner@redhat.com> - 6.29-1
changelog:
  - Rebase to 6.29 (RHBZ#1351299)
  - Fixes:
    - Backport ipset capability to run in namespaces (RHBZ#1226051)
    - Fix service save with empty ipset list and existing ipset save file
      (RHBZ#1377621)
    - Fix internal error at printing to output buffer (RHBZ#1395865)


author: Stefano Brivio <sbrivio@redhat.com> - 6.38-1
changelog:
  - Rebase to 6.38 (RHBZ#1557600):
    - hash:ipmac type support added to ipset, userspace part (Tomasz Chilinski)
  - Refactor /etc/sysconfig/ipset.start-stop
  - Fixes:
    - IPSet Service Monolithic Operation (RHBZ#1440741)
    - "systemctl start ipset" doesn't handle existing ipset's having counters
      (RHBZ#1502212)


author: Stefano Brivio <sbrivio@redhat.com> - 7.1-1
changelog:
  - Rebase to 7.1 (RHBZ#1649080):
    - Add compatibility support for strscpy()
    - Correct the manpage about the sort option
    - Add missing functions to libipset.map
    - configure.ac: Fix build regression on RHEL/CentOS/SL (Serhey Popovych)
    - Implement sorting for hash types in the ipset tool
    - Fix to list/save into file specified by option (reported by Isaac Good)
    - Introduction of new commands and protocol version 7, updated kernel include files
    - Add compatibility support for async in pernet_operations
    - Use more robust awk patterns to check for backward compatibility
    - Prepare the ipset tool to handle multiple protocol version
    - Fix warning message handlin
    - Correct to test null valued entry in hash:net6,port,net6 test
    - Library reworked to support embedding ipset completely
    - Add compatibility to support kvcalloc()
    - Validate string type attributes in attr2data() (Stefano Brivio)
    - manpage: Add comment about matching on destination MAC address (Stefano Brivio)
      (RHBZ#1649079)
    - Add compatibility to support is_zero_ether_addr()
    - Fix use-after-free in ipset_parse_name_compat() (Stefano Brivio) (RHBZ#1649073)
    - Fix leak in build_argv() on line parsing error (Stefano Brivio) (RHBZ#1649073)
    - Simplify return statement in ipset_mnl_query() (Stefano Brivio) (RHBZ#1649073)
    - tests/check_klog.sh: Try dmesg too, don't let shell terminate script (Stefano Brivio) 
  - Fixes:
    - Fix all shellcheck warnings in init script (RHBZ#1649073)
    - Make error reporting consistent, introduce different severities (RHBZ#1649877)
    - While restoring, on invalid entries, remove them and retry (RHBZ#1650297)
    - Fix covscan SC2166 warning in init script (RHBZ#1649073)
    - Hardcode triggerin, triggerun versions for ipset-service (RHBZ#1646666)


author: Patrick Uiterwijk <puiterwijk@redhat.com> - 1.0.0-6
changelog:
  - Removed gpg key check during build RHBZ#1248529
  - Fixed the license tag to include external code RHBZ#1248538
  - Use full path url RHBZ#1251149


author: Patrick Uiterwijk <puiterwijk@redhat.com> - 1.0.0-7
changelog:
  - Added dependency on python-requests for client RHBZ#1254644
  - Fixed possible XSS flaws CVE-2015-5215, CVE-2015-5216
  - Fixed permission check CVE-2015-5217


author: Patrick Uiterwijk <puiterwijk@redhat.com> - 1.0.0-8
changelog:
  - Moved ipsilon-client-install man page to client subpackage RHBZ#1255103
  - Backported patch to count IPA as login plugin RHBZ#1256517
  - Backported patch to log error if nameid is invalid RHBZ#1256520
  - Backported patch to add city attribute RHBZ#1257213


author: Patrick Uiterwijk <puiterwijk@redhat.com> - 1.0.0-9
changelog:
  - Backport database keys patch RHBZ#1252392
  - Backport SAML path check patch RHBZ#1253821
  - Backport database cleanup RHBZ#1256518


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-14
changelog:
  - Add cgroup support (RHBZ#1058660)
  - Add wait seonds support for commands (RHBZ#1156411)
  - Add dhcpv6-client in default IPv6 firewall rules (RHBZ#1169036)
  - Add message for init script error returns (RHBZ#1200415)
  - Use flock for wait option (RHBZ#1202435)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-16
changelog:
  - Fix important coverity findings: missing include for flock and use bash for
    init script (RHBZ#1264399)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-17
changelog:
  - Fixed init script not to fail on missing restorecon (RHBZ#1246380)
  - Adapted man page snipplet for TRACE to use proper logging backend names
    (RHBZ#1261238)
  - Warn about use of DROP in nat table (RHBZ#1298879)
  - Fixed modules unload in init script (RHBZ#1324102)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-18
changelog:
  - Add support for --wait options to restore commands (RHBZ#1438597)
  - Do not set changed flag for rule check operations with module targets
    (RHBZ#1438597)
  - Add version option to restore commands (RHBZ#1438597)


author: Phil Sutter - 1.4.21-18.2
changelog:
  - Prevent iptables.service and ip6tables.service from running in parallel
    (RHBZ#1491963)
  - Don't restart services upon upgrade (RHBZ#1491961)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-9
changelog:
  - fixed missing system hang at shutdown if root device is network based
    (RHBZ#1007934)
  - Fixed iptables-save man page completely wrong (RHBZ#1054871)
  - Fixed missing reload action for iptables service (RHBZ#1066007)
  - Fixed regressions from RHEL-6 iptables services (RHBZ#1067670)


author: Phil Sutter - 1.4.21-20
changelog:
  - Prevent iptables.service and ip6tables.service from running in parallel
    (RHBZ#1486803)
  - Don't restart services upon upgrade (RHBZ#1380141)


author: Phil Sutter - 1.4.21-24.1
changelog:
  - Fix for stopping iptables and ip6tables at the same time (RHBZ#1563168)
  - Propagate errors on service stop (RHBZ#1563168)
  - Avoid overwriting parent's return code (RHBZ#1563168)


author: Phil Sutter - 1.4.21-25
changelog:
  - Fix for stopping iptables and ip6tables at the same time (RHBZ#1560012)
  - Propagate errors on service stop (RHBZ#1560012)


author: Phil Sutter - 1.4.21-27
changelog:
  - libxt_tcpmss: Detect invalid ranges (RHBZ#1128510)
  - ip(6)tables-save/restore: Exit if invalid option was given (RHBZ#1465078)
  - ip(6)tables-save/restore: Require value to -W option (RHBZ#1465078)
  - ip(6)tables-save/restore: Don't accept -W without -w (RHBZ#1465078)
  - Ignore security table when setting policies (RHBZ#1494012)
  - Fix spec file changing SRPM content (RHBZ#1531290)


author: Phil Sutter - 1.4.21-29
changelog:
  - Do not attempt to unload any modules when stopping the firewall (RHBZ#1520534)
  - Fix for covscan warnings (RHBZ#1525980)


author: Phil Sutter <psutter@redhat.com> - 1.4.21-31
changelog:
  - Fix iptables-restore with empty comment in rule (RHBZ#1668475)
  - Fix parsing and printing of -m ipvs --vproto option (RHBZ#1679726)
  - Fix for wrong location of devgroup definition file (RHBZ#1657075)
  - Fix for non-numeric devgroup name output (RHBZ#1657075)
  - Reject negative realm values (RHBZ#1657075)


author: Phil Sutter <psutter@redhat.com> - 1.4.21-34
changelog:
  - Fix iptables-restore for rules with '-' and 't' in comments (RHBZ#1749700)
  - Make services start before network-pre.target is reached (RHBZ#1736765)


author: EL Errata <el-errata_ww@oracle.com> - 1.4.21-35.0.1
changelog:
  - Correct changelog
  - free table lock if a table is skipped (upstream commit 31e4b5906f)
    [Orabug: 31409379]


author: Alex Burmashev <alexander.burmashev@oracle.com> - 1.4.21-35.0.3
changelog:
  - iptables: snat: add randomize-full support [Orabug: 33847229]
  - iptables: masquerade: add randomize-full support [Orabug: 33847229]


author: Phil Cameron <pcameron@redhat.com> - 1.1.4-6
changelog:
  - fix 1283773 - segfault in rate_add_rate

    Jun 17 2014 Alejandro Pérez  <aeperezt@fedoraproject.org>
    fix 1109768 bad configuration logrotate
    Mar 02 2014 Alejandro Pérez  <aeperezt@fedoraproject.org>
    fix bug 1020552 - rpm report /var/lock/ipraf-ng is missing
    added missing file iptraf-nf-tmpfiles.conf
    Dec 03 2013 Nikola Pajkovsky <npajkovs@redhat.com>
    Fedora start using -Werror=format-security and iptraf-ng had some
    parts where error compilation was trigged.
    202b2e7b27a1 Makefile: add -Werror=format-security
    Resolved: #1037133


author: Phil Cameron <pcameron@redhat.com> - 1.1.4-7
changelog:
  - Fixes error in patch Patch03 - this fixes 1283773 and 1539081
    1501821 - Upstream moved to https://github.com/iptraf-ng/iptraf-ng/
    1020552, 1372679 - fix missing /var/lock/iptraf-ng file
    Add BuildRequires:  gcc to spec file.
    1109768 - bad configuration logrotate


author: Jan Synáček <jsynacek@redhat.com> - 20160308-7
changelog:
  - ping hung when it cannot receive echo reply (#1362463)
  - arping documentation inconsistency (#1351704)


author: Jan Synáček <jsynacek@redhat.com> - 20160308-9
changelog:
  - IPv4 vs IPv6 inconsistency on return value of ping (#1362388)
  - ping6 does not use device specified with -I parameter (#1371824, #1424965)
  - double cap_free call in ping_common.c (#1410114)
  - ping assumes EACCESS errors are due to broadcast addresses (#1387315)
  - ping -t with multicast address without effect on ppc64 (#1373333)
  - arping -c <n> does not exit when the device is deleted (#1387542)


author: Marcos Matsunaga <Marcos.Matsunaga@oracle.com> - 20171112-1.el7
changelog:
  - BUILDINFO: commit=8572e4c814343b4f76dce719a803c5960e6ee15b
  - ipxe spec: Fix %prep to be compatible with autobuild


author: Miroslav Rezanina <mrezanin@redhat.com> - 20130517-6.gitc4bce43.el7
changelog:
  - ipxe-import-EfiRom-from-edk2-BaseTools-RHEL-only.patch [bz#1084561]
  - ipxe-add-custom-Makefile-for-EfiRom-RHEL-only.patch [bz#1084561]
  - ipxe-redhat-build-and-install-combined-legacy-UEFI-roms-f.patch [bz#1084561]
  - Resolves: bz#1084561
    (RFE: ship UEFI drivers for ipxe in RHEL-7.y)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20160127-2.git6366fa7a.el7
changelog:
  - ipxe-Enable-IPv6-protocol-in-non-QEMU-builds.patch [bz#1350167]
  - Resolves: bz#1350167
    (ipxe: enable IPV6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20160127-3.git6366fa7a.el7
changelog:
  - ipxe-Add-pci_find_next_capability.patch [bz#1242850]
  - ipxe-Add-virtio-1.0-constants-and-data-structures.patch [bz#1242850]
  - ipxe-Add-virtio-1.0-PCI-support.patch [bz#1242850]
  - ipxe-Add-virtio-net-1.0-support.patch [bz#1242850]
  - ipxe-Renumber-virtio_pci_region-flags.patch [bz#1242850]
  - ipxe-Fix-virtio-pci-logging.patch [bz#1242850]
  - Resolves: bz#1242850
    (Ipxe can not recognize "network device" when enable virtio-1 of virtio-net-pci)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20160127-4.git6366fa7a.el7
changelog:
  - ipxe-Send-TCP-keepalives-on-idle-established-connections.patch [bz#1322056]
  - ipxe-enable-e1000e-rom.patch [bz#1361534]
  - Resolves: bz#1322056
    (ipxe freeze during HTTP download with last RPM)
  - Resolves: bz#1361534
    (RFE: Integrate e1000e implementation in downstream QEMU)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20160127-5.git6366fa7a.el7
changelog:
  - ipxe-Strip-802.1Q-VLAN-0-priority-tags.patch [bz#1316329]
  - Resolves: bz#1316329
    ([RFE] Properly Handle 8021.Q VID 0 Frames, as new vlan model in linux kernel does.)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20170123-2.git4e85b27.el7
changelog:
  - ipxe-Support-VIRTIO_NET_F_IOMMU_PLATFORM.patch [bz#1467887]
  - Resolves: bz#1467887
    (iommu platform support for ipxe)


author: Petr Holasek <pholasek@redhat.com> - 2:1.0.7-2
changelog:
  - fixed unused variable revealed by covscan
  - fixed ignored pid argument (#1155632)
  - warning when irqbalance started under non-root (#1155799)
  - more robust signal handling (#1158937)
  - fixed hostname in manpage (#1162251)


author: John Donnelly <john.p.donnelly@oracle.com> - 3:1.0.8-1
changelog:
  - Rebase distribtion from 1.0.7.gz to 1.0.8.gz to address [Orabug: 28833131].
  - Patch1: Apply [Orabug: 28420119] that resolves parsing node names in /sys
  - Patch2: Apply [Orabug: 12603869] for segfault when parse 1000+ interrupts
  - Patch3: Apply RH debug log patch from v1.0.9.
  - Removed all the stale patches already contained in v1.0.8


author: Shaleen Bathla <shaleen.bathla@oracle.com> - 3:1.0.8-3.0.1
changelog:
  - removing unused variable cache_stat [Orabug: 35096496]
  - cputree: adjust snprintf sizes to avoid gcc warnings [Orabug: 35096496]
  - add return value check of opendir in do_one_cpu [Orabug: 35096496]


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.8.15-8
changelog:
  - Fixed crash that can occur if term is resized during irssi init
    (init-resize-crash-fix patch)
    Resolves: rhbz#796457


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-6
changelog:
  - 1507945 force start iscsiuio for boot session recovery with qedi
  - 1457359 start systemd socket listeners, otherwise if iscsid is started
    directly iscsiuio doesn't activate as expected


author: EL Errata <el-errata_ww@oracle.com> - 6.2.0.874-10.0.1
changelog:
  - Rename 0053-use-red-hat-name.patch to 0153-use-oracle-for-name.patch
    and use com.oracle in prefix
    change InitiatorName to "iqn.1988-12.com.oracle" (Tianyue Lan) [18791695]


author: Jianchao Wang <jianchao.w.wang@oracle.com> 6.2.0.874-10.0.2
changelog:
  - Use sd_notify() to tell systemd when iscsid is ready. At the same time,
     change iscsid.service to use TYPE=notify and NotifyAcess=main, add
     'Requires=iscsid.service' into iscsi.service to cooperate with After to
     ensure iscsi.service is started after iscsid.service is ready. [orabug29128380]


author: Fred Herard <fred.herard@oracle.com> 6.2.0.874-10.0.6
changelog:
  - Print vital iscsid messages on console using rsyslog facility.  This
    is particularly useful when using iscsi boot and there is a connection
    or session issue.
  - Execute systemctl daemon-reload during post installation upgrade
    and try to restart iscsi services during upgrade.
    [Orabug: 29503805]


author: Fred Herard <fred.herard@oracle.com> 6.2.0.874-10.0.7
changelog:
  - Modify iscsi-mark-root-nodes script to only update node.startup to onboot
    for iscsi sessions that are active during boot.
  - Add pre rpm scriptlet to fix a bug in previous version of
    iscsi-mark-root-nodes.
    [Orabug: 29554378]


author: Fred Herard <fred.herard@oracle.com> 6.2.0.874-10.0.9
changelog:
  - Moddify iscsi-mark-root nodes script to not mark nodes when iscsi.service
    is restarted.
    [Orabug: 29715514]


author: Edward Leung <edward.leung@oracle.com> - 6.2.0.874-11.0.1
changelog:
  - Moddify iscsi-mark-root nodes script to not mark nodes when iscsi.service
    is restarted.
    [Orabug: 29715514]
  - Modify iscsi-mark-root-nodes script to only update node.startup to onboot
    for iscsi sessions that are active during boot.
  - Add pre rpm scriptlet to fix a bug in previous version of
    iscsi-mark-root-nodes.
    [Orabug: 29554378]
  - Print vital iscsid messages on console using rsyslog facility.  This
    is particularly useful when using iscsi boot and there is a connection
    or session issue.
  - Execute systemctl daemon-reload during post installation upgrade
    and try to restart iscsi services during upgrade.
    [Orabug: 29503805]
  - Add 0203-Update-systemd-to-always-restart-iscsid-service.patch to fix
    [Orabug: 29306329]
   - Add -10.0.3 version.
   - Use sd_notify() to tell systemd when iscsid is ready. At the same time,
     change iscsid.service to use TYPE=notify and NotifyAcess=main, add
     'Requires=iscsid.service' into iscsi.service to cooperate with After to
     ensure iscsi.service is started after iscsid.service is ready. [Orabug: 29128380]
  - Rename 0053-use-red-hat-name.patch to 0153-use-oracle-for-name.patch
    and use com.oracle in prefix
    change InitiatorName to "iqn.1988-12.com.oracle" (Tianyue Lan) [Orabug: 18791695]


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-12
changelog:
  - 1389071 handle newer ISCSI_ERR_NOP_TIMEDOUT code from the kernel
  - 1624670 Login negotiation failed due to CHAP_N values do not match
            (rec update race condition)


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-17
changelog:
  - 1518367 boot from iSCSI not establishing all sessions persistently
  - 1667965 A manual restart of iscsi.service modifies records node.startup value


author: EL Errata <el-errata_ww@oracle.com> - 6.2.0.874-17.0.1
changelog:
  - Tune TimeoutSec of iscsid service to 10 minutes
    [Orabug: 29917429]
  - Moddify iscsi-mark-root nodes script to not mark nodes when iscsi.service
    is restarted.
    [Orabug: 29715514]
  - Modify iscsi-mark-root-nodes script to only update node.startup to onboot
    for iscsi sessions that are active during boot.
  - Add pre rpm scriptlet to fix a bug in previous version of
    iscsi-mark-root-nodes.
    [Orabug: 29554378]
  - Print vital iscsid messages on console using rsyslog facility.  This
    is particularly useful when using iscsi boot and there is a connection
    or session issue.
  - Execute systemctl daemon-reload during post installation upgrade
    and try to restart iscsi services during upgrade.
    [Orabug: 29503805]
  - Add 0203-Update-systemd-to-always-restart-iscsid-service.patch to fix
    [Orabug: 29306329]
   - Add -10.0.3 version.
   - Use sd_notify() to tell systemd when iscsid is ready. At the same time,
     change iscsid.service to use TYPE=notify and NotifyAcess=main, add
     'Requires=iscsid.service' into iscsi.service to cooperate with After to
     ensure iscsi.service is started after iscsid.service is ready. [Orabug: 29128380]
  - Rename 0053-use-red-hat-name.patch to 0153-use-oracle-for-name.patch
    and use com.oracle in prefix
    change InitiatorName to "iqn.1988-12.com.oracle" (Tianyue Lan) [Orabug: 18791695]


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-18
changelog:
  - 1809945 backport new CHAP modes for FIPS environments (SHA1 and SHA256 only, no SHA3 in OpenSSL-1.0.2)


author: EL Errata <el-errata_ww@oracle.com> - 6.2.0.874-19.0.1
changelog:
  - iscsid -stop connection check for invalid session id.
    [Orabug: 31813824]
  - iscsid - Proper disconnect of TCP connection.
    [Orabug: 30711156]
  - Fix SIGPIPE loop in iscsid signal handler.
    [Orabug: 31176637]
  - Tune TimeoutSec of iscsid service to 10 minutes
    [Orabug: 29917429]
  - Moddify iscsi-mark-root nodes script to not mark nodes when iscsi.service
    is restarted.
    [Orabug: 29715514]
  - Modify iscsi-mark-root-nodes script to only update node.startup to onboot
    for iscsi sessions that are active during boot.
  - Add pre rpm scriptlet to fix a bug in previous version of
    iscsi-mark-root-nodes.
    [Orabug: 29554378]
  - Print vital iscsid messages on console using rsyslog facility.  This
    is particularly useful when using iscsi boot and there is a connection
    or session issue.
  - Execute systemctl daemon-reload during post installation upgrade
    and try to restart iscsi services during upgrade.
    [Orabug: 29503805]
  - Add 0203-Update-systemd-to-always-restart-iscsid-service.patch to fix
    [Orabug: 29306329]
   - Add -10.0.3 version.
   - Use sd_notify() to tell systemd when iscsid is ready. At the same time,
     change iscsid.service to use TYPE=notify and NotifyAcess=main, add
     'Requires=iscsid.service' into iscsi.service to cooperate with After to
     ensure iscsi.service is started after iscsid.service is ready. [Orabug: 29128380]
  - Rename 0053-use-red-hat-name.patch to 0153-use-oracle-for-name.patch
    and use com.oracle in prefix
    change InitiatorName to "iqn.1988-12.com.oracle" (Tianyue Lan) [Orabug: 18791695]


author: Gulam Mohamed <gulam.mohamed@oracle.com> - 6.2.0.874-20.0.2
changelog:
  - Use timeout when waiting for responses from iscsid.
  - Change return error code from iscsid response.
  - Fix coredump when printing session info.
  - Fix timeout setting on discoverydb commands.
  - Reduce delays to improve iscsi boot performance.
  - Fix iscsistart login issue when target is delayed.
  - Check-ISCSI_ERR_ISCSID_NOTCONN-in-iscsistart-login.
    [Orabug: 32716218]


author: EL Errata <el-errata_ww@oracle.com> - 6.2.0.874-21.0.1
changelog:
  - Fix iscsistart login issue when target is delayed [Orabug: 33087402]
  - Log error when auth debug status is set.
    [Orabug: 32831137]
  - Use timeout when waiting for responses from iscsid.
  - Change return error code from iscsid response.
  - Fix coredump when printing session info.
  - Fix timeout setting on discoverydb commands.
  - Reduce delays to improve iscsi boot performance.
  - Fix iscsistart login issue when target is delayed.
  - Check-ISCSI_ERR_ISCSID_NOTCONN-in-iscsistart-login.
    [Orabug: 32716218]
  - iscsid -stop connection check for invalid session id.
    [Orabug: 31813824]
  - iscsid - Proper disconnect of TCP connection.
    [Orabug: 30711156]
  - Fix SIGPIPE loop in iscsid signal handler.
    [Orabug: 31176637]
  - Tune TimeoutSec of iscsid service to 10 minutes
    [Orabug: 29917429]
  - Moddify iscsi-mark-root nodes script to not mark nodes when iscsi.service
    is restarted.
    [Orabug: 29715514]
  - Modify iscsi-mark-root-nodes script to only update node.startup to onboot
    for iscsi sessions that are active during boot.
  - Add pre rpm scriptlet to fix a bug in previous version of
    iscsi-mark-root-nodes.
    [Orabug: 29554378]
  - Print vital iscsid messages on console using rsyslog facility.  This
    is particularly useful when using iscsi boot and there is a connection
    or session issue.
  - Execute systemctl daemon-reload during post installation upgrade
    and try to restart iscsi services during upgrade.
    [Orabug: 29503805]
  - Add 0203-Update-systemd-to-always-restart-iscsid-service.patch to fix
    [Orabug: 29306329]
   - Add -10.0.3 version.
   - Use sd_notify() to tell systemd when iscsid is ready. At the same time,
     change iscsid.service to use TYPE=notify and NotifyAcess=main, add
     'Requires=iscsid.service' into iscsi.service to cooperate with After to
     ensure iscsi.service is started after iscsid.service is ready. [Orabug: 29128380]
  - Rename 0053-use-red-hat-name.patch to 0153-use-oracle-for-name.patch
    and use com.oracle in prefix
    change InitiatorName to "iqn.1988-12.com.oracle" (Tianyue Lan) [Orabug: 18791695]


author: EL Errata <el-errata_ww@oracle.com> - 6.2.0.874-22.0.1
changelog:
  - Handle recv call returning 0 in iscsid_response() [Orabug: 33250283]
  - Fix iscsistart login issue when target is delayed [Orabug: 33087402]
  - Log error when auth debug status is set.
    [Orabug: 32831137]
  - Use timeout when waiting for responses from iscsid.
  - Change return error code from iscsid response.
  - Fix coredump when printing session info.
  - Fix timeout setting on discoverydb commands.
  - Reduce delays to improve iscsi boot performance.
  - Fix iscsistart login issue when target is delayed.
  - Check-ISCSI_ERR_ISCSID_NOTCONN-in-iscsistart-login.
    [Orabug: 32716218]
  - iscsid -stop connection check for invalid session id.
    [Orabug: 31813824]
  - iscsid - Proper disconnect of TCP connection.
    [Orabug: 30711156]
  - Fix SIGPIPE loop in iscsid signal handler.
    [Orabug: 31176637]
  - Tune TimeoutSec of iscsid service to 10 minutes
    [Orabug: 29917429]
  - Moddify iscsi-mark-root nodes script to not mark nodes when iscsi.service
    is restarted.
    [Orabug: 29715514]
  - Modify iscsi-mark-root-nodes script to only update node.startup to onboot
    for iscsi sessions that are active during boot.
  - Add pre rpm scriptlet to fix a bug in previous version of
    iscsi-mark-root-nodes.
    [Orabug: 29554378]
  - Print vital iscsid messages on console using rsyslog facility.  This
    is particularly useful when using iscsi boot and there is a connection
    or session issue.
  - Execute systemctl daemon-reload during post installation upgrade
    and try to restart iscsi services during upgrade.
    [Orabug: 29503805]
  - Add 0203-Update-systemd-to-always-restart-iscsid-service.patch to fix
    [Orabug: 29306329]
   - Add -10.0.3 version.
   - Use sd_notify() to tell systemd when iscsid is ready. At the same time,
     change iscsid.service to use TYPE=notify and NotifyAcess=main, add
     'Requires=iscsid.service' into iscsi.service to cooperate with After to
     ensure iscsi.service is started after iscsid.service is ready. [Orabug: 29128380]
  - Rename 0053-use-red-hat-name.patch to 0153-use-oracle-for-name.patch
    and use com.oracle in prefix
    change InitiatorName to "iqn.1988-12.com.oracle" (Tianyue Lan) [Orabug: 18791695]


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-32
changelog:
  - 1235684 apply safe_logout setting to flashnode sessions as well
    but only when logging out by session id, not by flashnode index


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-34
changelog:
  - 1322000 ensure TCP abort on session failure to prevent data corruption with link flap
  - 1294964, 1265073, 1213569 iscsiuio update, fix small ARP table issue
  - 1309488 remove broken sysfs cache code to speed up login of many sessions
  - 1330348 sync with upstream Open-iSCSI for minor fixes


author: Than Ngo <than@redhat.com> - 3.2-94
changelog:
  - Resolves: bz#1060370
    update patch to handle all cases by recursing through fmtmsg
    instead of vfmtmsg directly which depends on va_list type.


author: Chris Leech <cleech@redhat.com> - 0.93-4
changelog:
  - set hardened build flag, required for long running processes (isnsd)
  - patch makefile to actually use LDFLAGS


author: Brian C. Lane <bcl@redhat.com> 1.0.9-1
changelog:
  - Add python-isomd5sum package with python bindings
  - Add callback and interrupt support to the python library
  - Add RPM_OPT_FLAGS to CFLAGS and update makefile to use CFLAGS from environment


author: Brian C. Lane <bcl@redhat.com> 1.0.10-1
changelog:
  - Fix for gcc type-punned and sizeof pointer warnings. (bcl)
  - Add exit code 2 for user abort (#907600) (bcl)
  - Cleanup TABs and update Copyrights (bcl)
  - Standardize *FLAGS in Makefile (ryan)


author: Mark Kanda <mark.kanda@oracle.com> - 12:2.11.1-2.el7
changelog:
  - hw/acpi-build: build SRAT memory affinity structures for DIMM devices (Haozhong Zhang)  [Orabug: 27509753] 
  - qmp: distinguish PC-DIMM and NVDIMM in MemoryDeviceInfoList (Haozhong Zhang)  [Orabug: 27509753] 
  - pc-dimm: make qmp_pc_dimm_device_list() sort devices by address (Haozhong Zhang)  [Orabug: 27509753] 
  - nvdimm: add a macro for property "label-size" (Haozhong Zhang)  [Orabug: 27509753] 
  - nvdimm: add 'unarmed' option (Haozhong Zhang)  [Orabug: 27509753] 
  - block: Fix NULL dereference on empty drive error (Kevin Wolf)  [Orabug: 27832106] 
  - Revert "IDE: Do not flush empty CDROM drives" (Stefan Hajnoczi)  [Orabug: 27832106] 
  - block: test blk_aio_flush() with blk->root == NULL (Kevin Wolf)  [Orabug: 27832106] 
  - block: add BlockBackend->in_flight counter (Stefan Hajnoczi)  [Orabug: 27832106] 
  - block: extract AIO_WAIT_WHILE() from BlockDriverState (Stefan Hajnoczi)  [Orabug: 27832106] 
  - aio: rename aio_context_in_iothread() to in_aio_context_home_thread() (Stefan Hajnoczi)  [Orabug: 27832106] 
  - qemu.spec: Add dependency for libiscsi 1.9.0-8 (Mark Kanda)  [Orabug: 27832300] 
  - multiboot.c: Document as fixed against CVE-2018-7550 (Jack Schwartz)  [Orabug: 27832332]  {CVE-2018-7550}
  - CVE-2017-18030: cirrus_invalidate_region() lets priv guest user cause DoS (Mark Kanda)  [Orabug: 27832319]  {CVE-2017-18030}
  - vga: fix region calculation (Gerd Hoffmann)  [Orabug: 27832309]  {CVE-2018-7858}
  - keymap: use glib hash for kbd_layout_t (Gerd Hoffmann)  [Orabug: 27663795] 
  - qemu.spec: Enable coroutine pool and vhost-vsock (Karl Heubaum)  [Orabug: 27832337]


author: Mark Kanda <mark.kanda@oracle.com> - 15:3.0.0-1.el7
changelog:
  - net: ignore packet size greater than INT_MAX (Jason Wang)  [Orabug: 28763782]  {CVE-2018-17963}
  - pcnet: fix possible buffer overflow (Jason Wang)  [Orabug: 28763774]  {CVE-2018-17962}
  - rtl8139: fix possible out of bound access (Jason Wang)  [Orabug: 28763765]  {CVE-2018-17958}
  - ne2000: fix possible out of bound access in ne2000_receive (Jason Wang)  [Orabug: 28763758]  {CVE-2018-10839}
  - seccomp: set the seccomp filter to all threads (Marc-André Lureau)  [Orabug: 28763748]  {CVE-2018-15746}
  - virtio_net: Introduce VIRTIO_NET_F_STANDBY feature bit to virtio_net (Sridhar Samudrala)  [Orabug: 28763724] 
  - kvm: add call to qemu_add_opts() for -overcommit option (Prasad Singamsetty)  
  - Document various CVEs as fixed (Mark Kanda)  [Orabug: 28763710]  {CVE-2017-10806} {CVE-2017-11334} {CVE-2017-12809} {CVE-2017-13672} {CVE-2017-13673} {CVE-2017-13711} {CVE-2017-14167} {CVE-2017-15038} {CVE-2017-15119} {CVE-2017-15124} {CVE-2017-15268} {CVE-2017-15289} {CVE-2017-16845} {CVE-2017-17381} {CVE-2017-18030} {CVE-2017-18043} {CVE-2017-2630} {CVE-2017-2633} {CVE-2017-5715} {CVE-2017-5753} {CVE-2017-5754} {CVE-2017-7471} {CVE-2017-7493} {CVE-2017-8112} {CVE-2017-8309} {CVE-2017-8379} {CVE-2017-8380} {CVE-2017-9503} {CVE-2018-11806} {CVE-2018-12617} {CVE-2018-3639} {CVE-2018-5683} {CVE-2018-7550} {CVE-2018-7858}
  - qemu.spec: Initial qemu.spec (Mark Kanda)  
  - virtio-pci: Set subsystem vendor ID to Oracle (Mark Kanda)  
  - qemu_regdump.py: Initial qemu_regdump.py (Mark Kanda)  
  - qmp-regdump: Initial qmp-regdump (Mark Kanda)  
  - bridge.conf: Initial bridge.conf (Mark Kanda)  
  - kvm.conf: Initial kvm.conf (Mark Kanda)  
  - 80-kvm.rules: Initial 80-kvm.rules (Mark Kanda)  
  - Update version for v3.0.0 release (Peter Maydell)  
  - Update version for v3.0.0-rc4 release (Peter Maydell)  
  - virtio-gpu: fix crashes upon warm reboot with vga mode (Marc-André Lureau)  
  - slirp: Correct size check in m_inc() (Peter Maydell)  
  - target/xtensa/cpu: Set owner of memory region in xtensa_cpu_initfn (Thomas Huth)  
  - hw/intc/arm_gicv3_common: Move gicd shift bug handling to gicv3_post_load (Peter Maydell)  
  - hw/intc/arm_gicv3_common: Move post_load hooks to top-level VMSD (Peter Maydell)  
  - target/arm: Add dummy needed functions to M profile vmstate subsections (Peter Maydell)  
  - hw/intc/arm_gicv3_common: Combine duplicate .subsections in vmstate_gicv3_cpu (Peter Maydell)  
  - hw/intc/arm_gicv3_common: Give no-migration-shift-bug subsection a needed function (Peter Maydell)  
  - tcg/optimize: Do not skip default processing of dup_vec (Richard Henderson)  
  - tests/acpi: update tables after memory hotplug changes (Michael S. Tsirkin)  
  - pc: acpi: fix memory hotplug regression by reducing stub SRAT entry size (Igor Mammedov)  
  - tests/acpi-test: update ACPI tables test blobs (Dou Liyang)  
  - hw/acpi-build: Add a check for memory-less NUMA nodes (Dou Liyang)  
  - vhost: check region type before casting (Tiwei Bie)  
  - sam460ex: Fix PCI interrupts with multiple devices (BALATON Zoltan)  
  - hw/misc/macio: Fix device introspection problems in macio devices (Thomas Huth)  
  - Update version for v3.0.0-rc3 release (Peter Maydell)  
  - monitor: temporary fix for dead-lock on event recursion (Marc-André Lureau)  
  - linux-user: ppc64: don't use volatile register during safe_syscall (Shivaprasad G Bhat)  
  - tests: add check_invalid_maps to test-mmap (Alex Bennée)  
  - linux-user/mmap.c: handle invalid len maps correctly (Alex Bennée)  
  - s390x/sclp: fix maxram calculation (Christian Borntraeger)  
  - target/arm: Remove duplicate 'host' entry in '-cpu ?' output (Philippe Mathieu-Daudé)  
  - hw/misc/tz-mpc: Zero the LUT on initialization, not just reset (Peter Maydell)  
  - hw/arm/iotkit: Fix IRQ number for timer1 (Peter Maydell)  
  - armv7m_nvic: Fix m-security subsection name (Peter Maydell)  
  - hw/arm/sysbus-fdt: Fix assertion in copy_properties_from_host() (Geert Uytterhoeven)  
  - arm/smmuv3: Fix missing VMSD terminator (Dr. David Alan Gilbert)  
  - qemu-iotests: Test query-blockstats with -drive and -blockdev (Kevin Wolf)  
  - block/qapi: Include anonymous BBs in query-blockstats (Kevin Wolf)  
  - block/qapi: Add 'qdev' field to query-blockstats result (Kevin Wolf)  
  - file-posix: Fix write_zeroes with unmap on block devices (Kevin Wolf)  
  - block: Fix documentation for BDRV_REQ_MAY_UNMAP (Kevin Wolf)  
  - iotests: Add test for 'qemu-img convert -C' compatibility (Fam Zheng)  
  - qemu-img: Add -C option for convert with copy offloading (Fam Zheng)  
  - Revert "qemu-img: Document copy offloading implications with -S and -c" (Fam Zheng)  
  - iotests: Don't lock /dev/null in 226 (Fam Zheng)  
  - docs: Describe using images in writing iotests (Fam Zheng)  
  - file-posix: Handle EINTR in preallocation=full write (Fam Zheng)  
  - qcow2: A grammar fix in conflicting cache sizing error message (Leonid Bloch)  
  - qcow: fix a reference leak (KONRAD Frederic)  
  - backends/cryptodev: remove dead code (Jay Zhou)  
  - timer: remove replay clock probe in deadline calculation (Pavel Dovgalyuk)  
  - i386: implement MSR_SMI_COUNT for TCG (Paolo Bonzini)  
  - i386: do not migrate MSR_SMI_COUNT on machine types <2.12 (Paolo Bonzini)  
  - qstring: Move qstring_from_substr()'s @end one to the right (Markus Armbruster)  
  - qstring: Assert size calculations don't overflow (Markus Armbruster)  
  - qstring: Fix qstring_from_substr() not to provoke int overflow (liujunjie)  
  - Update version for v3.0.0-rc2 release (Peter Maydell)  
  - tests: fix TLS handshake failure with TLS 1.3 (Daniel P. Berrangé)  
  - tests: use error_abort in places expecting errors (Daniel P. Berrangé)  
  - tests: don't silence error reporting for all tests (Daniel P. Berrangé)  
  - tests: call qcrypto_init instead of gnutls_global_init (Daniel P. Berrangé)  
  - migration: fix duplicate initialization for expected_downtime and cleanup_bh (Lidong Chen)  
  - tests: only update last_byte when at the edge (Peter Xu)  
  - migration: disallow recovery for release-ram (Peter Xu)  
  - migration: update recv bitmap only on dest vm (Peter Xu)  
  - audio/hda: Fix migration (Dr. David Alan Gilbert)  
  - migrate: Fix cancelling state warning (Dr. David Alan Gilbert)  
  - migration: fix potential overflow in multifd send (Peter Xu)  
  - block/file-posix: add bdrv_attach_aio_context callback for host dev and cdrom (Nishanth Aravamudan)  
  - tests/tcg: remove runcom test (Alex Bennée)  
  - docker: perform basic binfmt_misc validation in docker.py (Alex Bennée)  
  - docker: ignore distro versioning of debootstrap (Alex Bennée)  
  - docker: add commentary to debian-bootstrap.docker (Alex Bennée)  
  - docker: Update debootstrap script after Debian migration from Alioth to Salsa (Philippe Mathieu-Daudé)  
  - docker: report hint when docker.py check fails (Alex Bennée)  
  - docker: drop QEMU_TARGET check, fallback in EXECUTABLE not set (Alex Bennée)  
  - docker: add expansion for docker-test-FOO to Makefile.include (Alex Bennée)  
  - docker: add test-unit runner (Alex Bennée)  
  - docker: Makefile.include don't include partial images (Alex Bennée)  
  - docker: gracefully skip check_qemu (Alex Bennée)  
  - docker: move make check into check_qemu helper (Alex Bennée)  
  - docker: split configure_qemu from build_qemu (Alex Bennée)  
  - docker: fail more gracefully on docker.py check (Alex Bennée)  
  - docker: par down QEMU_CONFIGURE_OPTS in debian-tricore-cross (Alex Bennée)  
  - docker: base debian-tricore on qemu:debian9 (Alex Bennée)  
  - tests/.gitignore: don't ignore docker tests (Alex Bennée)  
  - target/arm: Escalate to correct HardFault when AIRCR.BFHFNMINS is set (Peter Maydell)  
  - hw/intc/arm_gicv3: Check correct HCR_EL2 bit when routing IRQ (Peter Maydell)  
  - ui/cocoa.m: prevent stuck command key when going into full screen mode (John Arbuckle)  
  - qga: process_event() simplification and leak fix (Marc-André Lureau)  
  - qga-win: Handle fstrim for OSes lower than Win8 (Sameeh Jubran)  
  - tcg/i386: Mark xmm registers call-clobbered (Richard Henderson)  
  - i386: Rename enum CacheType members (Eduardo Habkost)  
  - block/vvfat: Disable debug message by default (Thomas Huth)  
  - iotests: Disallow compat=0.10 in 223 (Max Reitz)  
  - iotest: Fix filtering order in 226 (Max Reitz)  
  - iotests: remove LUKS support from test 226 (John Snow)  
  - qemu-img: avoid overflow of min_sparse parameter (Peter Lieven)  
  - block: Fix typos in comments (found by codespell) (Stefan Weil)  
  - qemu-iotests: Use host_device instead of file in 149 (Kevin Wolf)  
  - hw/intc/exynos4210_gic: Turn instance_init into realize function (Thomas Huth)  
  - hw/arm/spitz: Move problematic nand_init() code to realize function (Thomas Huth)  
  - target/arm: Correctly handle overlapping small MPU regions (Peter Maydell)  
  - hw/sd/bcm2835_sdhost: Fix PIO mode writes (Guenter Roeck)  
  - hw/microblaze/xlnx-zynqmp-pmu: Fix introspection problem in 'xlnx, zynqmp-pmu-soc' (Thomas Huth)  
  - monitor: Fix unsafe sharing of @cur_mon among threads (Peter Xu)  
  - qapi: Make 'allow-oob' optional in SchemaInfoCommand (Markus Armbruster)  
  - po: Don't include comments with location (Stefan Weil)  
  - linux-user/ppc: Implement swapcontext syscall (Richard Henderson)  
  - linux-user: fix ELF load alignment error (Laurent Vivier)  
  - tap: fix memory leak on success to create a tap device (Yunjian Wang)  
  - e1000e: Prevent MSI/MSI-X storms (Jan Kiszka)  
  - tcg/aarch64: limit mul_vec size (Alex Bennée)  
  - spike: Fix crash when introspecting the device (Alistair Francis)  
  - riscv_hart: Fix crash when introspecting the device (Alistair Francis)  
  - virt: Fix crash when introspecting the device (Alistair Francis)  
  - sifive_u: Fix crash when introspecting the device (Alistair Francis)  
  - sifive_e: Fix crash when introspecting the device (Alistair Francis)  
  - tracing: Use double-dash spelling for trace option (Yaowei Bai)  
  - throttle-groups: fix hang when group member leaves (Stefan Hajnoczi)  
  - s390x/cpumodel: fix segmentation fault when baselining models (David Hildenbrand)  
  - Update version for v3.0.0-rc1 release (Peter Maydell)  
  - Document command line options with single dash (BALATON Zoltan)  
  - opts: remove redundant check for NULL parameter (Daniel P. Berrangé)  
  - i386: only parse the initrd_filename once for multiboot modules (Daniel P. Berrangé)  
  - i386: fix regression parsing multiboot initrd modules (Daniel P. Berrangé)  
  - hw/arm/xlnx-zynqmp: Fix crash when introspecting the "xlnx, zynqmp" device (Thomas Huth)  
  - hw/display/xlnx_dp: Move problematic code from instance_init to realize (Paolo Bonzini)  
  - hw/arm/stm32f205_soc: Fix introspection problem with 'stm32f205-soc' device (Thomas Huth)  
  - hw/arm/allwinner-a10: Fix introspection problem with 'allwinner-a10' (Thomas Huth)  
  - hw/*/realview: Fix introspection problem with 'realview_mpcore' & 'realview_gic' (Thomas Huth)  
  - hw/cpu/arm11mpcore: Fix introspection problem with 'arm11mpcore_priv' (Thomas Huth)  
  - hw/arm/fsl-imx31: Fix introspection problem with the "fsl, imx31" device (Thomas Huth)  
  - hw/arm/fsl-imx25: Fix introspection problem with the "fsl, imx25" device (Thomas Huth)  
  - hw/arm/fsl-imx7: Fix introspection problems with the "fsl, imx7" device (Thomas Huth)  
  - hw/arm/fsl-imx6: Fix introspection problems with the "fsl, imx6" device (Thomas Huth)  
  - hw/cpu/a9mpcore: Fix introspection problems with the "a9mpcore_priv" device (Thomas Huth)  
  - hw/arm/msf2-soc: Fix introspection problem with the "msf2-soc" device (Thomas Huth)  
  - hw/cpu/a15mpcore: Fix introspection problem with the a15mpcore_priv device (Thomas Huth)  
  - hw/arm/armv7: Fix crash when introspecting the "iotkit" device (Thomas Huth)  
  - hw/arm/bcm2836: Fix crash with device_add bcm2837 on unsupported machines (Thomas Huth)  
  - hw/core/sysbus: Add a function for creating and attaching an object (Thomas Huth)  
  - qom/object: Add a new function object_initialize_child() (Thomas Huth)  
  - qga: fix file descriptor leak (Paolo Bonzini)  
  - qga: fix 'driver' leak in guest-get-fsinfo (Marc-André Lureau)  
  - accel/tcg: Assert that tlb fill gave us a valid TLB entry (Peter Maydell)  
  - accel/tcg: Use correct test when looking in victim TLB for code (Peter Maydell)  
  - bcm2835_aux: Swap RX and TX interrupt assignments (Guenter Roeck)  
  - hw/arm/bcm2836: Mark the bcm2836 / bcm2837 devices with user_creatable = false (Thomas Huth)  
  - hw/intc/arm_gic: Fix handling of GICD_ITARGETSR (Peter Maydell)  
  - hw/intc/arm_gic: Check interrupt number in gic_deactivate_irq() (Peter Maydell)  
  - aspeed: Implement write-1-{set, clear} for AST2500 strapping (Andrew Jeffery)  
  - target/arm: Fix LD1W and LDFF1W (scalar plus vector) (Richard Henderson)  
  - virtio-scsi: fix hotplug ->reset() vs event race (Stefan Hajnoczi)  
  - qdev: add HotplugHandler->post_plug() callback (Stefan Hajnoczi)  
  - hw/char/serial: retry write if EAGAIN (Marc-André Lureau)  
  - PC Chipset: Improve serial divisor calculation (Calvin Lee)  
  - vhost-user-test: added proper TestServer *dest initialization in test_migrate() (Emanuele Giuseppe Esposito)  
  - hyperv: ensure VP index equal to QEMU cpu_index (Roman Kagan)  
  - hyperv: rename vcpu_id to vp_index (Roman Kagan)  
  - accel: Fix typo and grammar in comment (Stefan Weil)  
  - dump: add kernel_gs_base to QEMU CPU state (Viktor Prutyanov)  
  - monitor: Fix tracepoint crash on JSON syntax error (Markus Armbruster)  
  - MAINTAINERS: New section "Incompatible changes", copy libvir-list (Markus Armbruster)  
  - qemu-doc: Move appendix "Deprecated features" to its own file (Markus Armbruster)  
  - cli qmp: Mark --preconfig, exit-preconfig experimental (Markus Armbruster)  
  - qapi: Do not expose "allow-preconfig" in query-qmp-schema (Markus Armbruster)  
  - sm501: Fix warning about unreachable code (BALATON Zoltan)  
  - sam460ex: Correct use after free error (BALATON Zoltan)  
  - etsec: fix IRQ (un)masking (Michael Davidsaver)  
  - ppc/xics: fix ICP reset path (Greg Kurz)  
  - spapr: Correct inverted test in spapr_pc_dimm_node() (David Gibson)  
  - sm501: Update screen on frame buffer address change (BALATON Zoltan)  
  - Zero out the host's `msg_control` buffer (Jonas Schievink)  
  - linux-user: fix mmap_find_vma_reserved() (Laurent Vivier)  
  - linux-user: convert remaining fcntl() to safe_fcntl() (Laurent Vivier)  
  - linux-user: ppc64: use the correct values for F_*LK64s (Shivaprasad G Bhat)  
  - docs: Grammar and spelling fixes (Ville Skyttä)  
  - qemu-img: align result of is_allocated_sectors (Peter Lieven)  
  - scsi-disk: Block Device Characteristics emulation fix (Daniel Henrique Barboza)  
  - iotests: add test 226 for file driver types (John Snow)  
  - file-posix: specify expected filetypes (John Snow)  
  - iotests: nbd: Stop qemu-nbd before remaking image (Fam Zheng)  
  - iotests: 153: Fix dead code (Fam Zheng)  
  - ui/cocoa.m: replace scrollingDeltaY with deltaY (John Arbuckle)  
  - seccomp: allow sched_setscheduler() with SCHED_IDLE policy (Marc-André Lureau)  
  - vfio/pci: do not set the PCIDevice 'has_rom' attribute (Cédric Le Goater)  
  - monitor: fix double-free of request error (Marc-André Lureau)  
  - error: Remove NULL checks on error_propagate() calls (Philippe Mathieu-Daudé)  
  - s390x/storage attributes: fix CMMA_BLOCK_SIZE usage (Claudio Imbrenda)


author: Mark Kanda <mark.kanda@oracle.com> - 15:3.0.0-2.el7
changelog:
  - vfio-pci: emit FAILOVER_PRIMARY_CHANGED event on guest behalf when unrealized (Si-Wei Liu)  [Orabug: 29011784] 
  - vfio-pci: add FAILOVER_PRIMARY_CHANGED event to shorten downtime during failover (Si-Wei Liu)  [Orabug: 29011776] 
  - virtio_net: Add support for "Data Path Switching" during Live Migration. (Venu Busireddy)  [Orabug: 28732921] 
  - parfait: Run static analysis when --with parfait specified (Liam Merwick)  [Orabug: 28625099] 
  - parfait: add buildrpm/parfait-qemu.conf (Liam Merwick)  [Orabug: 28625099] 
  - configure: Provide option to explicitly disable AVX2 (Liam Merwick)  [Orabug: 28625099] 
  - lsi53c895a: convert to trace-events (Mark Cave-Ayland)  [Orabug: 29011792] 
  - lsi: Reselection needed to remove pending commands from queue (George Kennedy)  [Orabug: 28626593] 
  - lsi53c895a: check message length value is valid (Prasad J Pandit)  [Orabug: 28873239]  {CVE-2018-18849}
  - 9p: fix QEMU crash when renaming files (Greg Kurz)  [Orabug: 28971710]  {CVE-2018-19489}
  - 9p: take write lock on fid path updates (CVE-2018-19364) (Greg Kurz)  [Orabug: 28957033]  {CVE-2018-19364}
  - nvme: fix out-of-bounds access to the CMB (Paolo Bonzini)  [Orabug: 28885521]  {CVE-2018-16847}
  - kvm: x86: Fix kvm_arch_fixup_msi_route for remap-less case (Jan Kiszka)  [Orabug: 28891193] 
  - i386: Add new model of Cascadelake-Server (Tao Xu)  [Orabug: 28886460] 
  - i386: Add PKU on Skylake-Server CPU model (Tao Xu)  [Orabug: 28886461]


author: Mark Kanda <mark.kanda@oracle.com> - 15:3.0.0-3.el7
changelog:
  - monitor: guard iothread access by mon->use_io_thread (Wolfgang Bumiller)  [Orabug: 29046045] 
  - monitor: delay monitor iothread creation (Wolfgang Bumiller)  [Orabug: 29010480] 
  - Revert "qmp: isolate responses into io thread" (Marc-André Lureau)  [Orabug: 29010480] 
  - usb-mtp: outlaw slashes in filenames (Gerd Hoffmann)  [Orabug: 29037012]  {CVE-2018-16867}


author: Mark Kanda <mark.kanda@oracle.com> - 15:3.0.0-4.el7
changelog:
  - usb-mtp: use O_NOFOLLOW and O_CLOEXEC. (Gerd Hoffmann)  [Orabug: 29056673]  {CVE-2018-16872}
  - pvrdma: add uar_read routine (Prasad J Pandit)   {CVE-2018-20191}
  - pvrdma: release ring object in case of an error (Prasad J Pandit)  [Orabug: 29171822]  {CVE-2018-20126}
  - pvrdma: check number of pages when creating rings (Prasad J Pandit)  [Orabug: 29171821]  {CVE-2018-20125}
  - pvrdma: check return value from pvrdma_idx_ring_has_ routines (Prasad J Pandit)  [Orabug: 29171820]  {CVE-2018-20216}
  - rdma: remove unused VENDOR_ERR_NO_SGE macro (Prasad J Pandit)  [Orabug: 29121181]  {CVE-2018-20124}
  - rdma: check num_sge does not exceed MAX_SGE (Prasad J Pandit)  [Orabug: 29121181]  {CVE-2018-20124}
  - i386: Add "stibp" flag name (Eduardo Habkost)  [Orabug: 29114828] 
  - i386: Add some MSR based features on Cascadelake-Server CPU model (Tao Xu)  [Orabug: 29029615] 
  - i386: Update stepping of Cascadelake-Server (Tao Xu)  [Orabug: 29029615] 
  - kvm: Use KVM_GET_MSR_INDEX_LIST for MSR_IA32_ARCH_CAPABILITIES support (Bandan Das)  [Orabug: 29029615] 
  - x86: define a new MSR based feature word -- FEATURE_WORDS_ARCH_CAPABILITIES (Robert Hoo)  [Orabug: 29029615] 
  - x86: Data structure changes to support MSR based features (Robert Hoo)  [Orabug: 29029615] 
  - kvm: Add support to KVM_GET_MSR_FEATURE_INDEX_LIST and KVM_GET_MSRS system ioctl (Robert Hoo)  [Orabug: 29029615] 
  - i386: Add CPUID bit and feature words for IA32_ARCH_CAPABILITIES MSR (Robert Hoo)  [Orabug: 29029615] 
  - i386: Add new MSR indices for IA32_PRED_CMD and IA32_ARCH_CAPABILITIES (Robert Hoo)  [Orabug: 29029615] 
  - Fix compilation issue: 'qapi_event_send_failover_primary_changed' not declared (Mark Kanda)  [Orabug: 29121163] 
  - lsi_scsi: add support for PPR Extended Message (George Kennedy)  [Orabug: 28879117]


author: Mark Kanda <mark.kanda@oracle.com> - 15:3.1.0-1.el7
changelog:
  - vfio-pci: emit FAILOVER_PRIMARY_CHANGED event on guest behalf when unrealized
  - vfio-pci: emit FAILOVER_PRIMARY_CHANGED event on guest behalf when unrealized (Si-Wei Liu)  [Orabug: 29216696] 
  - vfio-pci: add FAILOVER_PRIMARY_CHANGED event to shorten downtime during failover (Si-Wei Liu)  [Orabug: 29216701] 
  - virtio_net: Add support for "Data Path Switching" during Live Migration. (Venu Busireddy)  [Orabug: 29216704] 
  - virtio_net: Introduce VIRTIO_NET_F_STANDBY feature bit to virtio_net (Sridhar Samudrala)  [Orabug: 29216714] 
  - i386: Add some MSR based features on Cascadelake-Server CPU model (Tao Xu)  [Orabug: 29216681] 
  - i386: Update stepping of Cascadelake-Server (Tao Xu)  [Orabug: 29216681] 
  - usb-mtp: use O_NOFOLLOW and O_CLOEXEC. (Gerd Hoffmann)  [Orabug: 29216656]  {CVE-2018-16872}
  - pvrdma: add uar_read routine (Prasad J Pandit)  [Orabug: 29216658]  {CVE-2018-20191}
  - pvrdma: release ring object in case of an error (Prasad J Pandit)  [Orabug: 29216659]  {CVE-2018-20126}
  - pvrdma: check number of pages when creating rings (Prasad J Pandit)  [Orabug: 29216666]  {CVE-2018-20125}
  - pvrdma: check return value from pvrdma_idx_ring_has_ routines (Prasad J Pandit)  [Orabug: 29216672]  {CVE-2018-20216}
  - rdma: remove unused VENDOR_ERR_NO_SGE macro (Prasad J Pandit)  [Orabug: 29216678]  {CVE-2018-20124}
  - rdma: check num_sge does not exceed MAX_SGE (Prasad J Pandit)  [Orabug: 29216678]  {CVE-2018-20124}
  - i386: Add "stibp" flag name (Eduardo Habkost)  
  - parfait: Run static analysis when --with parfait specified (Liam Merwick)  [Orabug: 29216688] 
  - parfait: add buildrpm/parfait-qemu.conf (Liam Merwick)  [Orabug: 29216688] 
  - Document various CVEs as fixed (Mark Kanda)  [Orabug: 29212424]  {CVE-2017-10806} {CVE-2017-11334} {CVE-2017-12809} {CVE-2017-13672} {CVE-2017-13673} {CVE-2017-13711} {CVE-2017-14167} {CVE-2017-15038} {CVE-2017-15119} {CVE-2017-15124} {CVE-2017-15268} {CVE-2017-15289} {CVE-2017-16845} {CVE-2017-17381} {CVE-2017-18030} {CVE-2017-18043} {CVE-2017-2630} {CVE-2017-2633} {CVE-2017-5715} {CVE-2017-5753} {CVE-2017-5754} {CVE-2017-7471} {CVE-2017-7493} {CVE-2017-8112} {CVE-2017-8309} {CVE-2017-8379} {CVE-2017-8380} {CVE-2017-9503} {CVE-2018-10839} {CVE-2018-11806} {CVE-2018-12617} {CVE-2018-15746} {CVE-2018-16847} {CVE-2018-16867} {CVE-2018-17958} {CVE-2018-17962} {CVE-2018-17963} {CVE-2018-18849} {CVE-2018-19364} {CVE-2018-19489} {CVE-2018-3639} {CVE-2018-5683} {CVE-2018-7550} {CVE-2018-7858}
  - qemu.spec: Initial qemu.spec (Mark Kanda)  
  - virtio-pci: Set subsystem vendor ID to Oracle (Mark Kanda)  
  - qemu_regdump.py: Initial qemu_regdump.py (Mark Kanda)  
  - qmp-regdump: Initial qmp-regdump (Mark Kanda)  
  - bridge.conf: Initial bridge.conf (Mark Kanda)  
  - kvm.conf: Initial kvm.conf (Mark Kanda)  
  - 80-kvm.rules: Initial 80-kvm.rules (Mark Kanda)


author: Mark Kanda <mark.kanda@oracle.com> - 15:3.1.0-2.el7
changelog:
  - x86: Add mds feature (Karl Heubaum)  
  - e1000: Never increment the RX undersize count register (Chris Kenna)  
  - qemu.spec: audioflags set but never passed to configure script (Liam Merwick)  [Orabug: 29715562] 
  - parfait: deal with parfait returning non-zero return value (Liam Merwick)  [Orabug: 29715548] 
  - parfait: use nproc to choose default number of threads (Liam Merwick)  [Orabug: 29715548] 
  - parfait: provide option to upload results (Liam Merwick)  [Orabug: 29715548] 
  - parfait: disable misaligned-access check (Liam Merwick)  [Orabug: 29715548] 
  - Document CVE-2019-8934 and CVE-2019-5008 as fixed (Mark Kanda)  [Orabug: 29715605]  {CVE-2019-5008} {CVE-2019-8934}
  - device_tree.c: Don't use load_image() (Peter Maydell)  [Orabug: 29715527]  {CVE-2018-20815}
  - slirp: check sscanf result when emulating ident (William Bowling)  [Orabug: 29715525]  {CVE-2019-9824}
  - i2c-ddc: fix oob read (Gerd Hoffmann)  [Orabug: 29715520]  {CVE-2019-3812}
  - scsi-generic: avoid possible out-of-bounds access to r->buf (Paolo Bonzini)  [Orabug: 29259700]  {CVE-2019-6501}
  - slirp: check data length while emulating ident function (Prasad J Pandit)  [Orabug: 29715755]  {CVE-2019-6778}


author: Mark Kanda <mark.kanda@oracle.com> - 15:3.1.0-3.el7
changelog:
  - x86: Document CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 as
    fixed (Mark Kanda)  [Orabug: 29744956]  {CVE-2018-12126} {CVE-2018-12127}
    {CVE-2018-12130} {CVE-2019-11091}


author: Mark Kanda <mark.kanda@oracle.com> - 15:3.1.0-4.el7
changelog:
  - kvm: i386: halt poll control MSR support (Marcelo Tosatti)  [Orabug: 29933278] 
  - Document CVEs as fixed: CVE-2017-9524, CVE-2017-6058, CVE-2017-5931 (Mark Kanda)  [Orabug: 29886908]  {CVE-2017-5931} {CVE-2017-6058} {CVE-2017-9524}
  - pvrdma: release device resources in case of an error (Prasad J Pandit)  [Orabug: 29056678]  {CVE-2018-20123}
  - qxl: check release info object (Prasad J Pandit)  [Orabug: 29886906]  {CVE-2019-12155}
  - target/i386: add MDS-NO feature (Paolo Bonzini)  [Orabug: 29820428]  {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2019-11091}
  - docs: recommend use of md-clear feature on all Intel CPUs (Daniel P. Berrangé)  [Orabug: 29820428]  {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2019-11091}
  - target/i386: define md-clear bit (Paolo Bonzini)  [Orabug: 29820428]  {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2019-11091}
  - pvh: block migration if booting using PVH (Liam Merwick)  [Orabug: 29796676] 
  - hw/i386/pc: run the multiboot loader before the PVH loader (Stefano Garzarella)  [Orabug: 29796676] 
  - optionrom/pvh: load initrd from fw_cfg (Stefano Garzarella)  [Orabug: 29796676] 
  - hw/i386/pc: use PVH option rom (Stefano Garzarella)  [Orabug: 29796676] 
  - qemu.spec: add pvh.bin to %files (Liam Merwick)  [Orabug: 29796676] 
  - optionrom: add new PVH option rom (Stefano Garzarella)  [Orabug: 29796676] 
  - linuxboot_dma: move common functions in a new header (Stefano Garzarella)  [Orabug: 29796676] 
  - linuxboot_dma: remove duplicate definitions of FW_CFG (Stefano Garzarella)  [Orabug: 29796676] 
  - pvh: load initrd and expose it through fw_cfg (Stefano Garzarella)  [Orabug: 29796676] 
  - pvh: Boot uncompressed kernel using direct boot ABI (Liam Merwick)  [Orabug: 29796676] 
  - pvh: Add x86/HVM direct boot ABI header file (Liam Merwick)  [Orabug: 29796676] 
  - elf-ops.h: Add get_elf_note_type() (Liam Merwick)  [Orabug: 29796676] 
  - elf: Add optional function ptr to load_elf() to parse ELF notes (Liam Merwick)  [Orabug: 29796676]


author: Mark Kanda <mark.kanda@oracle.com> - 15:3.1.0-5.el7
changelog:
  - Only enable the halt poll control MSR if it is supported by the host (Mark
    Kanda)  [Orabug: 29946722]


author: Karl Heubaum <karl.heubaum@oracle.com> - 15:3.1.0-6.el7
changelog:
  - qemu.spec: Remove "BuildRequires: kernel" (Karl Heubaum)  [Orabug: 30858754] 
  - target/i386: add support for MSR_IA32_TSX_CTRL (Paolo Bonzini)  [Orabug: 30652327] 
  - iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711) (Felipe Franciosi)  [Orabug: 30807256]  {CVE-2020-1711}
  - scsi: lsi: exit infinite loop while executing script (CVE-2019-12068) (Paolo Bonzini)  [Orabug: 30351703]  {CVE-2019-12068}
  - lsi: use enum type for s->waiting (Sven Schnelle)   {CVE-2019-12068}
  - json: Fix % handling when not interpolating (Christophe Fergeau)  [Orabug: 30640103] 
  - qemu.spec: enable have_curl in spec (Dongli Zhang)  [Orabug: 30640103] 
  - Fix heap overflow in ip_reass on big packet input (Samuel Thibault)  [Orabug: 30229916]  {CVE-2019-14378}
  - Make poll_control_msr default 1 (Mark Kanda)  
  - Remove redundant check for host support of halt polling (Mark Kanda)  [Orabug: 30240121] 
  - Enable '-Werror' compiler flag (Mark Kanda)  [Orabug: 30213025] 
  - qemu-submodule-init: Add Git submodule init script (Karl Heubaum)  [Orabug: 30729551]


author: Karl Heubaum <karl.heubaum@oracle.com> - 15:4.2.1-1.el7
changelog:
  - hw/sd/sdcard: Do not switch to ReceivingData if address is invalid (Philippe Mathieu-Daudé)  [Orabug: 31414336]  {CVE-2020-13253}
  - hw/sd/sdcard: Update coding style to make checkpatch.pl happy (Philippe Mathieu-Daudé)  [Orabug: 31414336] 
  - hw/sd/sdcard: Do not allow invalid SD card sizes (Philippe Mathieu-Daudé)  [Orabug: 31414336]  {CVE-2020-13253}
  - hw/sd/sdcard: Simplify realize() a bit (Philippe Mathieu-Daudé)  [Orabug: 31414336] 
  - hw/sd/sdcard: Restrict Class 6 commands to SCSD cards (Philippe Mathieu-Daudé)  [Orabug: 31414336] 
  - libslirp: Update to v4.3.1 to fix CVE-2020-10756 (Karl Heubaum)  [Orabug: 31604999]  {CVE-2020-10756}
  - Document CVEs as fixed 2/2 (Karl Heubaum)  [Orabug: 30618035]  {CVE-2017-18043} {CVE-2018-10839} {CVE-2018-11806} {CVE-2018-12617} {CVE-2018-15746} {CVE-2018-16847} {CVE-2018-16867} {CVE-2018-17958} {CVE-2018-17962} {CVE-2018-17963} {CVE-2018-18849} {CVE-2018-19364} {CVE-2018-19489} {CVE-2018-3639} {CVE-2018-5683} {CVE-2018-7550} {CVE-2018-7858} {CVE-2019-12068} {CVE-2019-15034} {CVE-2019-15890} {CVE-2019-20382} {CVE-2020-10702} {CVE-2020-10761} {CVE-2020-11102} {CVE-2020-11869} {CVE-2020-13361} {CVE-2020-13765} {CVE-2020-13800} {CVE-2020-1711} {CVE-2020-1983} {CVE-2020-8608}
  - Document CVEs as fixed 1/2 (Karl Heubaum)  [Orabug: 30618035]  {CVE-2017-10806} {CVE-2017-11334} {CVE-2017-12809} {CVE-2017-13672} {CVE-2017-13673} {CVE-2017-13711} {CVE-2017-14167} {CVE-2017-15038} {CVE-2017-15119} {CVE-2017-15124} {CVE-2017-15268} {CVE-2017-15289} {CVE-2017-16845} {CVE-2017-17381} {CVE-2017-18030} {CVE-2017-2630} {CVE-2017-2633} {CVE-2017-5715} {CVE-2017-5753} {CVE-2017-5754} {CVE-2017-5931} {CVE-2017-6058} {CVE-2017-7471} {CVE-2017-7493} {CVE-2017-8112} {CVE-2017-8309} {CVE-2017-8379} {CVE-2017-8380} {CVE-2017-9503} {CVE-2017-9524} {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2018-16872} {CVE-2018-20123} {CVE-2018-20124} {CVE-2018-20125} {CVE-2018-20126} {CVE-2018-20191} {CVE-2018-20216} {CVE-2018-20815} {CVE-2019-11091} {CVE-2019-12155} {CVE-2019-14378} {CVE-2019-3812} {CVE-2019-5008} {CVE-2019-6501} {CVE-2019-6778} {CVE-2019-8934} {CVE-2019-9824}
  - qemu-kvm.spec: Add .spec file for OL8 (Karl Heubaum)  [Orabug: 30618035] 
  - qemu.spec: Add .spec file for OL7 (Karl Heubaum)  [Orabug: 30618035] 
  - qemu-submodule-init: Add Git submodule init script (Karl Heubaum)  [Orabug: 30618035] 
  - vhost.conf: Initial vhost.conf (Karl Heubaum)  [Orabug: 30618035] 
  - parfait: Add buildrpm/parfait-qemu.conf (Karl Heubaum)  [Orabug: 30618035] 
  - virtio: Set PCI subsystem vendor ID to Oracle (Karl Heubaum)  [Orabug: 30618035] 
  - qemu_regdump.py: Initial qemu_regdump.py (Karl Heubaum)  [Orabug: 30618035] 
  - qmp-regdump: Initial qmp-regdump (Karl Heubaum)  [Orabug: 30618035] 
  - bridge.conf: Initial bridge.conf (Karl Heubaum)  [Orabug: 30618035] 
  - kvm.conf: Initial kvm.conf (Karl Heubaum)  [Orabug: 30618035] 
  - 80-kvm.rules: Initial 80-kvm.rules (Karl Heubaum)  [Orabug: 30618035] 
  - exec: set map length to zero when returning NULL (Prasad J Pandit)  [Orabug: 31439733]  {CVE-2020-13659}
  - megasas: use unsigned type for reply_queue_head and check index (Prasad J Pandit)  [Orabug: 31414338]  {CVE-2020-13362}
  - memory: Revert "memory: accept mismatching sizes in memory_region_access_valid" (Michael S. Tsirkin)  [Orabug: 31439736] [Orabug: 31452202]  {CVE-2020-13754} {CVE-2020-13791}


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-2.el7
changelog:
  - hw/net/xgmac: Fix buffer overflow in xgmac_enet_send() (Mauro Matteo Cascella)  [Orabug: 31667649]  {CVE-2020-15863}
  - hw/net/net_tx_pkt: fix assertion failure in net_tx_pkt_add_raw_fragment() (Mauro Matteo Cascella)  [Orabug: 31737809]  {CVE-2020-16092}
  - migration: fix memory leak in qmp_migrate_set_parameters (Zheng Chuan)  [Orabug: 31806256] 
  - virtio-net: fix removal of failover device (Juan Quintela)  [Orabug: 31806255] 
  - pvpanic: implement crashloaded event handling (Zhenwei Pi)  [Orabug: 31677154] 
  - pvpanic: introduce crashloaded for pvpanic (Zhenwei Pi)  [Orabug: 31677154]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-3.el7
changelog:
  - qemu-kvm.spec: Install block storage module RPMs by default (Karl Heubaum)  [Orabug: 31943789] 
  - qemu-kvm.spec: Enable block-ssh module RPM (Karl Heubaum)  [Orabug: 31943763] 
  - hw: usb: hcd-ohci: check for processed TD before retire (Prasad J Pandit)  [Orabug: 31901690]  {CVE-2020-25625}
  - hw: usb: hcd-ohci: check len and frame_number variables (Prasad J Pandit)  [Orabug: 31901690]  {CVE-2020-25625}
  - hw: ehci: check return value of 'usb_packet_map' (Li Qiang)  [Orabug: 31901649]  {CVE-2020-25084}
  - hw: xhci: check return value of 'usb_packet_map' (Li Qiang)  [Orabug: 31901649]  {CVE-2020-25084}
  - qemu.spec: Enable '-Werror' for OL7 builds (Mark Kanda)  [Orabug: 31922718] 
  - usb: fix setup_len init (CVE-2020-14364) (Gerd Hoffmann)  [Orabug: 31848849]  {CVE-2020-14364}
  - Document CVE-2020-12829 and CVE-2020-14415 as fixed (Mark Kanda)  [Orabug: 31855502] [Orabug: 31855427]  {CVE-2020-12829} {CVE-2020-14415}


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-4.el7
changelog:
  - Document CVE-2020-25723 as fixed (Mark Kanda)  [Orabug: 32222397]  {CVE-2020-25084} {CVE-2020-25723}
  - hw/net/e1000e: advance desc_offset in case of null descriptor (Prasad J Pandit)  [Orabug: 32217517]  {CVE-2020-28916}
  - i386: Add 2nd Generation AMD EPYC processors (Moger, Babu)  [Orabug: 32217570] 
  - libslirp: Update version to include CVE fixes (Mark Kanda)  [Orabug: 32208456] [Orabug: 32208462]  {CVE-2020-29129} {CVE-2020-29130}
  - Document CVE-2020-25624 as fixed (Mark Kanda)  [Orabug: 32212527]  {CVE-2020-25624} {CVE-2020-25625}
  - pvpanic: Advertise the PVPANIC_CRASHLOADED event support (Paolo Bonzini)  [Orabug: 32102853] 
  - ati: check x y display parameter values (Prasad J Pandit)  [Orabug: 32108251]  {CVE-2020-27616}
  - Add AArch64 support for QMP regdump tool and sosreport plugin (Mark Kanda)  [Orabug: 32080658] 
  - Add qemu_regdump sosreport plugin support for '-mon' QMP sockets (Mark Kanda)  
  - migration/dirtyrate: present dirty rate only when querying the rate has completed (Chuan Zheng)  
  - migration/dirtyrate: record start_time and calc_time while at the measuring state (Chuan Zheng)  
  - migration/dirtyrate: Add trace_calls to make it easier to debug (Chuan Zheng)  
  - migration/dirtyrate: Implement qmp_cal_dirty_rate()/qmp_get_dirty_rate() function (Chuan Zheng)  
  - migration/dirtyrate: Implement calculate_dirtyrate() function (Chuan Zheng)  
  - migration/dirtyrate: Implement set_sample_page_period() and is_sample_period_valid() (Chuan Zheng)  
  - migration/dirtyrate: skip sampling ramblock with size below MIN_RAMBLOCK_SIZE (Chuan Zheng)  
  - migration/dirtyrate: Compare page hash results for recorded sampled page (Chuan Zheng)  
  - migration/dirtyrate: Record hash results for each sampled page (Chuan Zheng)  
  - migration/dirtyrate: move RAMBLOCK_FOREACH_MIGRATABLE into ram.h (Chuan Zheng)  
  - migration/dirtyrate: Add dirtyrate statistics series functions (Chuan Zheng)  
  - migration/dirtyrate: Add RamblockDirtyInfo to store sampled page info (Chuan Zheng)  
  - migration/dirtyrate: add DirtyRateStatus to denote calculation status (Chuan Zheng)  
  - migration/dirtyrate: setup up query-dirtyrate framwork (Chuan Zheng)  
  - ram_addr: Split RAMBlock definition (Juan Quintela)


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-5.el7
changelog:
  - qemu.spec: use --tls-priority=NORMAL for OL7 (Elena Ufimtseva)  
  - hostmem: fix default "prealloc-threads" count (Mark Kanda)  [Orabug: 32472127] 
  - hostmem: introduce "prealloc-threads" property (Igor Mammedov)  
  - qom: introduce object_register_sugar_prop (Paolo Bonzini)  
  - migration/multifd: Do error_free after migrate_set_error to avoid memleaks (Pan Nengyuan)  
  - multifd/tls: fix memoryleak of the QIOChannelSocket object when cancelling migration (Chuan Zheng)  
  - migration/multifd: fix hangup with TLS-Multifd due to blocking handshake (Chuan Zheng)  
  - migration/tls: add trace points for multifd-tls (Chuan Zheng)  
  - migration/tls: add support for multifd tls-handshake (Chuan Zheng)  
  - migration/tls: extract cleanup function for common-use (Chuan Zheng)  
  - migration/multifd: fix memleaks in multifd_new_send_channel_async (Pan Nengyuan)  
  - migration/multifd: fix nullptr access in multifd_send_terminate_threads (Zhimin Feng)  
  - migration/tls: add tls_hostname into MultiFDSendParams (Chuan Zheng)  
  - migration/tls: extract migration_tls_client_create for common-use (Chuan Zheng)  
  - migration/tls: save hostname into MigrationState (Chuan Zheng)  
  - tests/qtest: add a test case for pvpanic-pci (Mihai Carabas)  
  - pvpanic : update pvpanic spec document (Mihai Carabas)  
  - hw/misc/pvpanic: add PCI interface support (Mihai Carabas)  
  - hw/misc/pvpanic: split-out generic and bus dependent code (Mihai Carabas)  
  - 9pfs: Fully restart unreclaim loop (CVE-2021-20181) (Greg Kurz)  [Orabug: 32441198]  {CVE-2021-20181}
  - ide: atapi: check logical block address and read size (CVE-2020-29443) (Prasad J Pandit)  [Orabug: 32393835]  {CVE-2020-29443}
  - Document CVE-2019-20808 as fixed (Mark Kanda)  [Orabug: 32339196]  {CVE-2019-20808}
  - block/iscsi:fix heap-buffer-overflow in iscsi_aio_ioctl_cb (Chen Qun)  [Orabug: 32339207]  {CVE-2020-11947}
  - net: remove an assert call in eth_get_gso_type (Prasad J Pandit)  [Orabug: 32102583]  {CVE-2020-27617}
  - nvdimm: honor -object memory-backend-file, readonly=on option (Stefan Hajnoczi)  [Orabug: 32265408] 
  - hostmem-file: add readonly=on|off option (Stefan Hajnoczi)  [Orabug: 32265408] 
  - memory: add readonly support to memory_region_init_ram_from_file() (Stefan Hajnoczi)  [Orabug: 32265408]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-6.el7
changelog:
  - i386/pc: Keep PCI 64-bit hole within usable IOVA space (Joao Martins)  
  - pc/cmos: Adjust CMOS above 4G memory size according to 1Tb boundary (Joao Martins)  
  - i386/pc: Round up the hotpluggable memory within valid IOVA ranges (Joao Martins)  
  - i386/pc: Account IOVA reserved ranges above 4G boundary (Joao Martins)


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-7.el7
changelog:
  - arm/virt: Add memory hot remove support (Mihai Carabas)  [Orabug: 32643506] 
  - i386/pc: consolidate usable iova iteration (Joao Martins)  
  - i386/acpi: fix SRAT ranges in accordance to usable IOVA (Joao Martins)  
  - migration: increase listening socket backlog (Elena Ufimtseva)  [Orabug: 32792545] 
  - multifd: Make multifd_save_setup() get an Error parameter (Juan Quintela)  
  - multifd: Make multifd_load_setup() get an Error parameter (Juan Quintela)  
  - migration: fix maybe-uninitialized warning (Marc-André Lureau)  
  - migration: Fix the re-run check of the migrate-incoming command (Yury Kotov)  
  - multifd: Initialize local variable (Juan Quintela)  
  - multifd: Be consistent about using uint64_t (Juan Quintela)  
  - Bug #1829242 correction. (Alexey Romko)  
  - migration/multifd: fix destroyed mutex access in terminating multifd threads (Jiahui Cen)  
  - migration/multifd: fix nullptr access in terminating multifd threads (Jiahui Cen)  
  - migration/multifd: not use multifd during postcopy (Wei Yang)  
  - migration/multifd: clean pages after filling packet (Wei Yang)  
  - migration: Make sure that we don't call write() in case of error (Juan Quintela)  
  - migration: fix multifd_send_pages() next channel (Laurent Vivier)  
  - migration/multifd: bypass uuid check for initial packet (Elena Ufimtseva)  [Orabug: 32610480] 
  - migration/tls: add error handling in multifd_tls_handshake_thread (Hao Wang)  
  - migration/tls: fix inverted semantics in multifd_channel_connect (Hao Wang)  
  - migration/multifd: do not access uninitialized multifd_recv_state (Elena Ufimtseva)  [Orabug: 32795384] 
  - io/channel-tls.c: make qio_channel_tls_shutdown thread-safe (Lukas Straub)  
  - qemu.spec: Enable qemu-guest-agent RPM for OL7 (Karl Heubaum)  [Orabug: 32415543] 
  - virtio-net: Set mac address to hardware if the peer is vdpa (Cindy Lu)  
  - net: Add vhost-vdpa in show_netdevs() (Cindy Lu)  
  - vhost-vdpa: Add qemu_close in vhost_vdpa_cleanup (Cindy Lu)  
  - hw/virtio/vhost-vdpa: Fix Coverity CID 1432864 (Philippe Mathieu-Daudé)  
  - vhost-vdpa: negotiate VIRTIO_NET_F_STATUS with driver (Si-Wei Liu)  
  - configure: Fix build dependencies with vhost-vdpa. (Laurent Vivier)  
  - configure: simplify vhost condition with Kconfig (Marc-André Lureau)  
  - vhost-vdpa: add trace-events (Laurent Vivier)  
  - dma/pl330: Fix qemu_hexdump() usage in pl330.c (Mark Kanda)  
  - util/hexdump: introduce qemu_hexdump_line() (Laurent Vivier)  
  - util/hexdump: Reorder qemu_hexdump() arguments (Philippe Mathieu-Daudé)  
  - util/hexdump: Convert to take a void pointer argument (Philippe Mathieu-Daudé)  
  - net/colo-compare.c: Only hexdump packets if tracing is enabled (Lukas Straub)  
  - vhost-vdpa: batch updating IOTLB mappings (Jason Wang)  
  - vhost: switch to use IOTLB v2 format (Jason Wang)  
  - vhost-vdpa: remove useless variable (Laurent Vivier)  
  - virtio: vdpa: omit check return of g_malloc (Li Qiang)  
  - vhost-vdpa: fix indentation in vdpa_ops (Stefano Garzarella)  
  - virtio-net: check the existence of peer before accessing vDPA config (Jason Wang)  
  - virtio-pci: fix wrong index in virtio_pci_queue_enabled (Yuri Benditovich)  
  - virtio-pci: fix virtio_pci_queue_enabled() (Laurent Vivier)  
  - vhost-vdpa :Fix Coverity CID 1430270 / CID 1420267 (Cindy Lu)  
  - vhost-vdpa: fix the compile issue without kvm (Cindy Lu)  
  - vhost-vdpa: introduce vhost-vdpa net client (Cindy Lu)  
  - vhost-vdpa: introduce vhost-vdpa backend (Cindy Lu)  
  - linux headers: sync to 5.9-rc4 (Jason Wang)  
  - Linux headers: update (Cornelia Huck)  
  - virtio-net: fix rsc_ext compat handling (Cornelia Huck)  
  - linux-headers: update against Linux 5.7-rc3 (Cornelia Huck)  
  - virtiofsd: Pull in kernel's fuse.h (Dr. David Alan Gilbert)  
  - linux-headers: Update (Bharata B Rao)  
  - vhost_net: introduce set_config & get_config (Cindy Lu)  
  - vhost: implement vhost_force_iommu method (Cindy Lu)  
  - vhost: introduce new VhostOps vhost_force_iommu (Cindy Lu)  
  - vhost: implement vhost_vq_get_addr method (Cindy Lu)  
  - vhost: introduce new VhostOps vhost_vq_get_addr (Cindy Lu)  
  - vhost: implement vhost_dev_start method (Cindy Lu)  
  - vhost: introduce new VhostOps vhost_dev_start (Cindy Lu)  
  - vhost: check the existence of vhost_set_iotlb_callback (Jason Wang)  
  - virtio-pci: implement queue_enabled method (Jason Wang)  
  - virtio-bus: introduce queue_enabled method (Jason Wang)  
  - vhost_net: use the function qemu_get_peer (Cindy Lu)  
  - net: introduce qemu_get_peer (Cindy Lu)  
  - vhost: correctly turn on VIRTIO_F_IOMMU_PLATFORM (Jason Wang)  
  - imx7-ccm: add digprog mmio write method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - tz-ppc: add dummy read/write methods (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - spapr_pci: add spapr msi read method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - nvram: add nrf51_soc flash read method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - prep: add ppc-parity write method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - vfio: add quirk device write method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - pci-host: designware: add pcie-msi read method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - hw/pci-host: add pci-intack write method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - oslib-posix: initialize backend memory objects in parallel (Mark Kanda)  [Orabug: 32555402] 
  - oslib-posix: refactor memory prealloc threads (Mark Kanda)  [Orabug: 32555402] 
  - oslib-posix: take lock before qemu_cond_broadcast (Bauerchen)  [Orabug: 32555402] 
  - oslib-posix: initialize mutex and condition variable (Paolo Bonzini)  [Orabug: 32555402] 
  - mem-prealloc: optimize large guest startup (bauerchen)  [Orabug: 32555402] 
  - i386: Add the support for AMD EPYC 3rd generation processors (Babu Moger)  
  - acpi: cpuhp: document CPHP_GET_CPU_ID_CMD command (Igor Mammedov)  
  - acpi: cpuhp: add CPHP_GET_CPU_ID_CMD command (Igor Mammedov)  
  - acpi: cpuhp: spec: add typical usecases (Igor Mammedov)  
  - acpi: cpuhp: spec: clarify store into 'Command data' when 'Command field' == 0 (Igor Mammedov)  
  - acpi: cpuhp: spec: fix 'Command data' description (Igor Mammedov)  
  - acpi: cpuhp: spec: clarify 'CPU selector' register usage and endianness (Igor Mammedov)  
  - acpi: cpuhp: introduce 'Command data 2' field (Igor Mammedov)  
  - x86: ich9: let firmware negotiate 'CPU hot-unplug with SMI' feature (Igor Mammedov)  
  - x86: ich9: factor out "guest_cpu_hotplug_features" (Igor Mammedov)  
  - x86: acpi: let the firmware handle pending "CPU remove" events in SMM (Igor Mammedov)  
  - x86: acpi: introduce AcpiPmInfo::smi_on_cpu_unplug (Igor Mammedov)  
  - acpi: cpuhp: introduce 'firmware performs eject' status/control bits (Igor Mammedov)  
  - x68: acpi: trigger SMI before sending hotplug Notify event to OSPM (Igor Mammedov)  
  - x86: acpi: introduce the PCI0.SMI0 ACPI device (Igor Mammedov)  
  - x86: acpi: introduce AcpiPmInfo::smi_on_cpuhp (Igor Mammedov)  
  - x86: ich9: expose "smi_negotiated_features" as a QOM property (Igor Mammedov)  
  - tests: acpi: mark to be changed tables in bios-tables-test-allowed-diff (Igor Mammedov)  
  - acpi: add aml_land() and aml_break() primitives (Igor Mammedov)  
  - x86: cpuhp: refuse cpu hot-unplug request earlier if not supported (Igor Mammedov)  
  - x86: cpuhp: prevent guest crash on CPU hotplug when broadcast SMI is in use (Igor Mammedov)  
  - x86: lpc9: let firmware negotiate 'CPU hotplug with SMI' features (Igor Mammedov)  
  - q35: implement 128K SMRAM at default SMBASE address (Igor Mammedov)  
  - hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register (Philippe Mathieu-Daudé)  [Orabug: 32470471]  {CVE-2021-20221}
  - memory: clamp cached translation in case it points to an MMIO region (Paolo Bonzini)  [Orabug: 32252673]  {CVE-2020-27821}
  - hw/sd/sdhci: Fix DMA Transfer Block Size field (Philippe Mathieu-Daudé)  [Orabug: 32613470]  {CVE-2021-3409}


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-9.el7
changelog:
  - Revert "oslib-posix: refactor memory prealloc threads" (Mark Kanda)  [Orabug: 32903662] 
  - Revert "oslib-posix: initialize backend memory objects in parallel" (Mark Kanda)  [Orabug: 32903662]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-10.el7
changelog:
  - e1000: fail early for evil descriptor (Jason Wang)  [Orabug: 32560552]  {CVE-2021-20257}
  - Document CVE-2020-27661 as fixed (Mark Kanda)  [Orabug: 32960200]  {CVE-2020-27661}
  - block: Avoid stale pointer dereference in blk_get_aio_context() (Greg Kurz)  
  - block: Fix blk->in_flight during blk_wait_while_drained() (Kevin Wolf)  
  - block: Increase BB.in_flight for coroutine and sync interfaces (Kevin Wolf)  
  - block-backend: Reorder flush/pdiscard function definitions (Kevin Wolf)


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-11.el7
changelog:
  - pvrdma: Fix the ring init error flow (CVE-2021-3608) (Marcel Apfelbaum)  [Orabug: 33120142]  {CVE-2021-3608}
  - pvrdma: Ensure correct input on ring init (CVE-2021-3607) (Marcel Apfelbaum)  [Orabug: 33120146]  {CVE-2021-3607}
  - hw/rdma: Fix possible mremap overflow in the pvrdma device (CVE-2021-3582) (Marcel Apfelbaum)  [Orabug: 33120084]  {CVE-2021-3582}
  - vhost-user-gpu: reorder free calls. (Gerd Hoffmann)  [Orabug: 32950701]  {CVE-2021-3544}
  - vhost-user-gpu: abstract vg_cleanup_mapping_iov (Li Qiang)  [Orabug: 32950716]  {CVE-2021-3546}
  - vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546) (Li Qiang)  [Orabug: 32950716]  {CVE-2021-3546}
  - vhost-user-gpu: fix memory leak in 'virgl_resource_attach_backing' (CVE-2021-3544) (Li Qiang)  [Orabug: 32950701]  {CVE-2021-3544}
  - vhost-user-gpu: fix memory leak in 'virgl_cmd_resource_unref' (CVE-2021-3544) (Li Qiang)  [Orabug: 32950701]  {CVE-2021-3544}
  - vhost-user-gpu: fix memory leak while calling 'vg_resource_unref' (CVE-2021-3544) (Li Qiang)  [Orabug: 32950701]  {CVE-2021-3544}
  - vhost-user-gpu: fix memory leak in vg_resource_attach_backing (CVE-2021-3544) (Li Qiang)  [Orabug: 32950701]  {CVE-2021-3544}
  - vhost-user-gpu: fix resource leak in 'vg_resource_create_2d' (CVE-2021-3544) (Li Qiang)  [Orabug: 32950701]  {CVE-2021-3544}
  - vhost-user-gpu: fix memory disclosure in virgl_cmd_get_capset_info (CVE-2021-3545) (Li Qiang)  [Orabug: 32950708]  {CVE-2021-3545}
  - usb: limit combined packets to 1 MiB (CVE-2021-3527) (Gerd Hoffmann)  [Orabug: 32842778]  {CVE-2021-3527}
  - usb/redir: avoid dynamic stack allocation (CVE-2021-3527) (Gerd Hoffmann)  [Orabug: 32842778]  {CVE-2021-3527}
  - mptsas: Remove unused MPTSASState 'pending' field (CVE-2021-3392) (Michael Tokarev)  [Orabug: 32470463]  {CVE-2021-3392}


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-12.el7
changelog:
  - hw/pflash_cfi01: Allow backing devices to be smaller than memory region (David Edmondson)  
  - pcie: expire pending delete (Gerd Hoffmann)  [Orabug: 33450706] 
  - pcie: fast unplug when slot power is off (Gerd Hoffmann)  [Orabug: 33450706] 
  - pcie: factor out pcie_cap_slot_unplug() (Gerd Hoffmann)  [Orabug: 33450706] 
  - pcie: add power indicator blink check (Gerd Hoffmann)  [Orabug: 33450706] 
  - pcie: implement slot power control for pcie root ports (Gerd Hoffmann)  [Orabug: 33450706] 
  - pci: implement power state (Gerd Hoffmann)  [Orabug: 33450706] 
  - hw/pci/pcie: Move hot plug capability check to pre_plug callback (Julia Suvorova)  [Orabug: 33450706] 
  - hw/pci/pcie: Replace PCI_DEVICE() casts with existing variable (Julia Suvorova)  [Orabug: 33450706] 
  - hw/pci/pcie: Forbid hot-plug if it's disabled on the slot (Julia Suvorova)  [Orabug: 33450706] 
  - pcie_root_port: Add hotplug disabling option (Julia Suvorova)  [Orabug: 33450706] 
  - qdev-monitor: Forbid repeated device_del (Julia Suvorova)  [Orabug: 33450706] 
  - i386:acpi: Remove _HID from the SMBus ACPI entry (Corey Minyard)  
  - uas: add stream number sanity checks. (Gerd Hoffmann)  [Orabug: 33280793]  {CVE-2021-3713}
  - usbredir: fix free call (Gerd Hoffmann)  [Orabug: 33198441]  {CVE-2021-3682}
  - hw/scsi/scsi-disk: MODE_PAGE_ALLS not allowed in MODE SELECT commands (Mauro Matteo Cascella)  [Orabug: 33548490]  {CVE-2021-3930}
  - e1000: fix tx re-entrancy problem (Jon Maloy)  [Orabug: 32560552]  {CVE-2021-20257}
  - Update libslirp to v4.6.1 (Marc-André Lureau)  [Orabug: 33014409] [Orabug: 33014414] [Orabug: 33014417] [Orabug: 33014420]  {CVE-2020-10756} {CVE-2020-1983} {CVE-2020-29129} {CVE-2021-3592} {CVE-2021-3593} {CVE-2021-3594} {CVE-2021-3595}
  - virtio-net-pci: Don't use "efi-virtio.rom" on AArch64 (Mark Kanda)  
  - MAINTAINERS: Add ACPI/HEST/GHES entries (Dongjiu Geng)  
  - target-arm: kvm64: handle SIGBUS signal from kernel or KVM (Dongjiu Geng)  
  - ACPI: Record Generic Error Status Block(GESB) table (Dongjiu Geng)  
  - KVM: Move hwpoison page related functions into kvm-all.c (Dongjiu Geng)  
  - ACPI: Record the Generic Error Status Block address (Dongjiu Geng)  
  - ACPI: Build Hardware Error Source Table (Dongjiu Geng)  
  - ACPI: Build related register address fields via hardware error fw_cfg blob (Dongjiu Geng)  
  - docs: APEI GHES generation and CPER record description (Dongjiu Geng)  
  - hw/arm/virt: Introduce a RAS machine option (Dongjiu Geng)  
  - acpi: nvdimm: change NVDIMM_UUID_LE to a common macro (Dongjiu Geng)  
  - block/curl: HTTP header field names are case insensitive (David Edmondson)  [Orabug: 33287589] 
  - block/curl: HTTP header fields allow whitespace around values (David Edmondson)  [Orabug: 33287589]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-12.1.el7
changelog:
  - Update slirp to address various CVEs (Mark Kanda)  [Orabug: 32208456] [Orabug: 33014409] [Orabug: 33014414] [Orabug: 33014417] [Orabug: 33014420]  {CVE-2020-29129} {CVE-2020-29130} {CVE-2021-3592} {CVE-2021-3593} {CVE-2021-3594} {CVE-2021-3595}
  - Revert "Update libslirp to v4.6.1" (Mark Kanda)  [Orabug: 33607100]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-14.el7
changelog:
  - scsi: fix sense code for EREMOTEIO (Paolo Bonzini)  [Orabug: 33537443] 
  - scsi: move host_status handling into SCSI drivers (Hannes Reinecke)  [Orabug: 33537443] 
  - scsi: inline sg_io_sense_from_errno() into the callers. (Hannes Reinecke)  [Orabug: 33537443] 
  - scsi-generic: do not snoop the output of failed commands (Paolo Bonzini)  [Orabug: 33537443] 
  - scsi: Add mapping for generic SCSI_HOST status to sense codes (Hannes Reinecke)  [Orabug: 33537443] 
  - scsi: Rename linux-specific SG_ERR codes to generic SCSI_HOST error codes (Hannes Reinecke)  [Orabug: 33537443] 
  - scsi: drop 'result' argument from command_complete callback (Hannes Reinecke)  [Orabug: 33537443] 
  - scsi-disk: pass guest recoverable errors through even for rerror=stop (Paolo Bonzini)  [Orabug: 33537443] 
  - scsi-disk: pass SCSI status to scsi_handle_rw_error (Paolo Bonzini)  [Orabug: 33537443] 
  - scsi: introduce scsi_sense_from_errno() (Paolo Bonzini)  [Orabug: 33537443] 
  - scsi-disk: do not complete requests early for rerror/werror=ignore (Paolo Bonzini)  [Orabug: 33537443] 
  - scsi-disk: move scsi_handle_rw_error earlier (Paolo Bonzini)  [Orabug: 33537443] 
  - scsi-disk: convert more errno values back to SCSI statuses (Paolo Bonzini)  [Orabug: 33537443]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-15.el7
changelog:
  - Document CVE-2021-4158 and CVE-2021-3947 as fixed (Mark Kanda)  [Orabug: 33719302] [Orabug: 33754145]  {CVE-2021-3947} {CVE-2021-4158}
  - hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196 (Philippe Mathieu-Daudé)  [Orabug: 32439466]  {CVE-2021-20196}
  - hw/block/fdc: Extract blk_create_empty_drive() (Philippe Mathieu-Daudé)  [Orabug: 32439466]  {CVE-2021-20196}
  - net: vmxnet3: validate configuration values during activate (CVE-2021-20203) (Prasad J Pandit)  [Orabug: 32559476]  {CVE-2021-20203}
  - lan9118: switch to use qemu_receive_packet() for loopback (Alexander Bulekov)  [Orabug: 32560540]  {CVE-2021-3416}
  - pcnet: switch to use qemu_receive_packet() for loopback (Alexander Bulekov)  [Orabug: 32560540]  {CVE-2021-3416}
  - rtl8139: switch to use qemu_receive_packet() for loopback (Alexander Bulekov)  [Orabug: 32560540]  {CVE-2021-3416}
  - tx_pkt: switch to use qemu_receive_packet_iov() for loopback (Jason Wang)  [Orabug: 32560540]  {CVE-2021-3416}
  - sungem: switch to use qemu_receive_packet() for loopback (Jason Wang)  [Orabug: 32560540]  {CVE-2021-3416}
  - dp8393x: switch to use qemu_receive_packet() for loopback packet (Jason Wang)  [Orabug: 32560540]  {CVE-2021-3416}
  - e1000: switch to use qemu_receive_packet() for loopback (Jason Wang)  [Orabug: 32560540]  {CVE-2021-3416}
  - net: introduce qemu_receive_packet() (Jason Wang)  [Orabug: 32560540]  {CVE-2021-3416}
  - target/i386: Populate x86_ext_save_areas offsets using cpuid where possible (David Edmondson)  
  - target/i386: Observe XSAVE state area offsets (David Edmondson)  
  - target/i386: Make x86_ext_save_areas visible outside cpu.c (David Edmondson)  
  - target/i386: Pass buffer and length to XSAVE helper (David Edmondson)  
  - target/i386: Clarify the padding requirements of X86XSaveArea (David Edmondson)  
  - target/i386: Consolidate the X86XSaveArea offset checks (David Edmondson)  
  - target/i386: Declare constants for XSAVE offsets (David Edmondson)


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-16.el7
changelog:
  - Document CVE-2021-4145 as fixed (Mark Kanda)  [Orabug: 33791496]  {CVE-2021-4145}
  - migration: Tally pre-copy, downtime and post-copy bytes independently (David Edmondson)  
  - migration: Introduce ram_transferred_add() (David Edmondson)  
  - ACPI ERST: specification for ERST support (Eric DeVolder)  
  - ACPI ERST: step 6 of bios-tables-test.c (Eric DeVolder)  
  - ACPI ERST: bios-tables-test testcase (Eric DeVolder)  
  - ACPI ERST: qtest for ERST (Eric DeVolder)  
  - ACPI ERST: create ACPI ERST table for pc/x86 machines (Eric DeVolder)  
  - ACPI ERST: build the ACPI ERST table (Eric DeVolder)  
  - ACPI ERST: support for ACPI ERST feature (Eric DeVolder)  
  - ACPI ERST: header file for ERST (Eric DeVolder)  
  - ACPI ERST: PCI device_id for ERST (Eric DeVolder)  
  - ACPI ERST: bios-tables-test.c steps 1 and 2 (Eric DeVolder)  
  - ACPI: cleanup bios-tables-test state (Eric DeVolder)  
  - KVM: x86: believe what KVM says about WAITPKG (Paolo Bonzini)  [Orabug: 33832295] 
  - cputlb: destroy CPUTLB with tlb_destroy (Emilio G. Cota)  [Orabug: 33428107]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-17.el7
changelog:
  - arm/acpi: fix an out of spec _UID for PCI root (Michael S. Tsirkin)  
  - arm/acpi: fix duplicated _UID of PCI interrupt link devices (Heyi Guo)  
  - arm/acpi: fix PCI _PRT definition (Heyi Guo)  
  - docs: fix references to docs/devel/atomics.rst (Stefano Garzarella)  [Orabug: 33659123] 
  - rcu: do not mention atomic_mb_read/set in documentation (Paolo Bonzini)  [Orabug: 33659123] 
  - atomics: update documentation (Paolo Bonzini)  [Orabug: 33659123] 
  - atomics: convert to reStructuredText (Paolo Bonzini)  [Orabug: 33659123] 
  - async: use explicit memory barriers (Paolo Bonzini)  [Orabug: 33659123] 
  - aio-wait: delegate polling of main AioContext if BQL not held (Paolo Bonzini)  [Orabug: 33659123] 
  - qapi: Add '@allow-write-only-overlay' feature for 'blockdev-snapshot' (Peter Krempa)  [Orabug: 33888021] 
  - iotests: Add iothread cases to 155 (Kevin Wolf)  [Orabug: 33888021] 
  - block: Fix cross-AioContext blockdev-snapshot (Kevin Wolf)  [Orabug: 33888021] 
  - iotests: Test mirror with temporarily disabled target backing file (Kevin Wolf)  [Orabug: 33888021] 
  - iotests: Fix run_job() with use_log=False (Kevin Wolf)  [Orabug: 33888021] 
  - block: Relax restrictions for blockdev-snapshot (Kevin Wolf)  [Orabug: 33888021] 
  - block: Make bdrv_get_cumulative_perm() public (Kevin Wolf)  [Orabug: 33888021] 
  - iotests: Use complete_and_wait() in 155 (Max Reitz)  [Orabug: 33888021] 
  - iotests: Support job-complete in run_job() (Kevin Wolf)  [Orabug: 33888021] 
  - linux-headers: update again to 5.8 (Paolo Bonzini)  [Orabug: 34022218] 
  - virtio-net: fix map leaking on error during receive (Jason Wang)  [Orabug: 33941879]  {CVE-2022-26353}
  - vhost-vsock: detach the virqueue element in case of error (Stefano Garzarella)  [Orabug: 33941844]  {CVE-2022-26354}
  - virtio-net: fix use after unmap/free for sg (Jason Wang)  [Orabug: 33972912]  {CVE-2021-3748}
  - migration: Report the error returned when save_live_iterate fails (David Edmondson)


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-18.el7
changelog:
  - block: introduce max_hw_iov for use in scsi-generic (Paolo Bonzini)  [Orabug: 33785156] 
  - file-posix: try BLKSECTGET on block devices too, do not round to power of 2 (Paolo Bonzini)  [Orabug: 33785156] 
  - block: add max_hw_transfer to BlockLimits (Paolo Bonzini)  [Orabug: 33785156] 
  - block-backend: align max_transfer to request alignment (Paolo Bonzini)  [Orabug: 33785156] 
  - osdep: provide ROUND_DOWN macro (Paolo Bonzini)  [Orabug: 33785156] 
  - scsi-generic: pass max_segments via max_iov field in BlockLimits (Paolo Bonzini)  [Orabug: 33785156] 
  - file-posix: fix max_iov for /dev/sg devices (Paolo Bonzini)  [Orabug: 33785156] 
  - display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207) (Mauro Matteo Cascella)  [Orabug: 34049511]  {CVE-2021-4207}
  - ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206) (Mauro Matteo Cascella)  [Orabug: 34049509]  {CVE-2021-4206}
  - hw/block/fdc: Prevent end-of-track overrun (CVE-2021-3507) (Philippe Mathieu-Daudé)  [Orabug: 32860387]  {CVE-2021-3507}
  - pc: q35: Bump max_cpus to 512 (Suravee Suthikulpanit)  [Orabug: 34314249] 
  - tests/qtest: fix pvpanic-pci-test (Mark Kanda)  [Orabug: 34284763] 
  - libqos: pci-pc: use 32-bit write for EJ register (Paolo Bonzini)  [Orabug: 34284758] 
  - libqos: usb-hcd-ehci: use 32-bit write for config register (Paolo Bonzini)  [Orabug: 34284768] 
  - target/i386/kvm: Fix disabling MPX on "-cpu host" with MPX-capable host (Maciej S. Szmigiero)  [Orabug: 33528615] 
  - i386: Mask SVM features if nested SVM is disabled (Eduardo Habkost)  [Orabug: 33860224] 
  - ide: Cap LBA28 capacity announcement to 2^28-1 (Samuel Thibault)  [Orabug: 25327652] 
  - tests/acpi: update expected arm/virt tables (Mark Kanda)  [Orabug: 34132842]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-19.el7
changelog:
  - virtio-net: handle zero mac for a vdpa peer (Cindy Lu)  [Orabug: 34137522] 
  - virtio-net: don't handle mq request in userspace handler for vhost-vdpa (Si-Wei Liu)  [Orabug: 34137522] 
  - vhost-vdpa: change name and polarity for vhost_vdpa_one_time_request() (Si-Wei Liu)  [Orabug: 34137522] 
  - vhost-vdpa: backend feature should set only once (Si-Wei Liu)  [Orabug: 34137522] 
  - vhost-net: fix improper cleanup in vhost_net_start (Si-Wei Liu)  [Orabug: 34137522] 
  - vhost-vdpa: fix improper cleanup in net_init_vhost_vdpa (Si-Wei Liu)  [Orabug: 34137522] 
  - virtio-net: align ctrl_vq index for non-mq guest for vhost_vdpa (Si-Wei Liu)  [Orabug: 34137522] 
  - virtio-net: setup vhost_dev and notifiers for cvq only when feature is negotiated (Si-Wei Liu)  [Orabug: 34137522] 
  - virtio: fix the condition for iommu_platform not supported (Halil Pasic)  [Orabug: 34137522] 
  - vdpa: Make ncs autofree (Eugenio Pérez)  [Orabug: 34137522] 
  - vhost-vdpa: make notifiers _init()/_uninit() symmetric (Laurent Vivier)  [Orabug: 34137522] 
  - hw/virtio: vdpa: Fix leak of host-notifier memory-region (Laurent Vivier)  [Orabug: 34137522] 
  - vhost-vdpa: stick to -errno error return convention (Roman Kagan)  [Orabug: 34137522] 
  - vdpa: Add dummy receive callback (Eugenio Pérez)  [Orabug: 34137522] 
  - vdpa: Check for existence of opts.vhostdev (Eugenio Pérez)  [Orabug: 34137522] 
  - vhost: Fix last vq queue index of devices with no cvq (Eugenio Pérez)  [Orabug: 34137522] 
  - vhost: Rename last_index to vq_index_end (Eugenio Pérez)  [Orabug: 34137522] 
  - net/vhost-vdpa: fix memory leak in vhost_vdpa_get_max_queue_pairs() (Stefano Garzarella)  [Orabug: 34137522] 
  - vhost-vdpa: multiqueue support (Jason Wang)  [Orabug: 34137522] 
  - virtio-net: vhost control virtqueue support (Jason Wang)  [Orabug: 34137522] 
  - vhost: record the last virtqueue index for the virtio device (Jason Wang)  [Orabug: 34137522] 
  - virtio-net: use "queue_pairs" instead of "queues" when possible (Jason Wang)  [Orabug: 34137522] 
  - vhost-net: control virtqueue support (Jason Wang)  [Orabug: 34137522] 
  - net: introduce control client (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: let net_vhost_vdpa_init() returns NetClientState * (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: prepare for the multiqueue support (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: classify one time request (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: open device fd in net_init_vhost_vdpa() (Jason Wang)  [Orabug: 34137522] 
  - vdpa: Check for iova range at mappings changes (Eugenio Pérez)  [Orabug: 34137522] 
  - vdpa: Add vhost_vdpa_section_end (Eugenio Pérez)  [Orabug: 34137522] 
  - net/vhost-vdpa: Fix device compatibility check (Kevin Wolf)  [Orabug: 34137522] 
  - net/vhost-user: Fix device compatibility check (Kevin Wolf)  [Orabug: 34137522] 
  - net: Introduce NetClientInfo.check_peer_type() (Kevin Wolf)  [Orabug: 34137522] 
  - vhost-vdpa: remove the unncessary queue_index assignment (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: fix the wrong assertion in vhost_vdpa_init() (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: tweak the error label in vhost_vdpa_add() (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: fix leaking of vhost_net in vhost_vdpa_add() (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: don't cleanup twice in vhost_vdpa_add() (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: remove the unnecessary check in vhost_vdpa_add() (Jason Wang)  [Orabug: 34137522] 
  - vhost_net: do not assume nvqs is always 2 (Jason Wang)  [Orabug: 34137522] 
  - vhost: use unsigned int for nvqs (Jason Wang)  [Orabug: 34137522] 
  - vhost_net: remove the meaningless assignment in vhost_net_start_one() (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: correctly return err in vhost_vdpa_set_backend_cap() (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: remove unused variable "acked_features" (Jason Wang)  [Orabug: 34137522] 
  - vhost: correctly detect the enabling IOMMU (Jason Wang)  [Orabug: 34137522] 
  - virtio-pci: implement iommu_enabled() (Jason Wang)  [Orabug: 34137522] 
  - virtio-bus: introduce iommu_enabled() (Jason Wang)  [Orabug: 34137522] 
  - hw/virtio: Fix leak of host-notifier memory-region (Yajun Wu)  [Orabug: 34137522] 
  - vhost-vdpa: Do not send empty IOTLB update batches (Eugenio Pérez)  [Orabug: 34137522] 
  - vhost-vdpa: remove the unused vhost_vdpa_get_acked_features() (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: don't initialize backend_features (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: map virtqueue notification area if possible (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: skip ram device from the IOTLB mapping (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: Remove redundant declaration of address_space_memory (Xie Yongji)  [Orabug: 34137522] 
  - virtio: Fail if iommu_platform is requested, but unsupported (Kevin Wolf)  [Orabug: 34137522] 
  - vhost-vdpa: Make vhost_vdpa_get_device_id() static (Zenghui Yu)  [Orabug: 34137522] 
  - Update linux headers to 5.11-rc2 (Eric Farman)  [Orabug: 34137522] 
  - linux-headers: update against 5.10-rc1 (Matthew Rosato)  [Orabug: 34137522] 
  - linux headers: sync to 5.9-rc7 (Andrew Jones)  [Orabug: 34137522]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-20.el7
changelog:
  - vl: Add an -action option to override MCE handling (Mark Kanda)  [Orabug: 34538907] 
  - vl: Add an -action option specifying response to guest events (Alejandro Jimenez)  [Orabug: 34538907] 
  - qmp: generalize watchdog-set-action to -no-reboot/-no-shutdown (Alejandro Jimenez)  [Orabug: 34538907]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-21.el7
changelog:
  - qemu-kvm.spec: Fix the qemu-regdump sos report plugin path (Mark Kanda)  [Orabug: 34680062] 
  - qmp-regdump: Require python3 on OL8 (Mark Kanda)  [Orabug: 34672256] 
  - iotests: Adjust 186.out to account for 'null' node-name (Mark Kanda)  [Orabug: 34447388] 
  - block: Set the name of BlockBackend if possible (Annie Li)  [Orabug: 34447388] 
  - acpi: Update _DSM method in expected files (Mark Kanda)  [Orabug: 34616322] 
  - acpi/gpex: Fix cca attribute check for pxb device (Xingang Wang)  [Orabug: 34616322] 
  - acpi: Enable pxb unit-test for ARM virt machine (Jiahui Cen)  [Orabug: 34616322] 
  - Kconfig: Compile PXB for ARM_VIRT (Jiahui Cen)  [Orabug: 34616322] 
  - acpi/gpex: Exclude pxb's resources from PCI0 (Jiahui Cen)  [Orabug: 34616322] 
  - acpi/gpex: Inform os to keep firmware resource map (Jiahui Cen)  [Orabug: 34616322] 
  - acpi: Add addr offset in build_crs (Jiahui Cen)  [Orabug: 34616322] 
  - unit-test: Add testcase for pxb (Yubo Miao)  [Orabug: 34616322] 
  - acpi: Align the size to 128k (Yubo Miao)  [Orabug: 34616322] 
  - acpi/gpex: Build tables for pxb (Yubo Miao)  [Orabug: 34616322] 
  - acpi: Extract crs build form acpi_build.c (Yubo Miao)  [Orabug: 34616322] 
  - hw/arm/virt: Write extra pci roots into fw_cfg (Jiahui Cen)  [Orabug: 34616322] 
  - fw_cfg: Refactor extra pci roots addition (Jiahui Cen)  [Orabug: 34616322] 
  - acpi/gpex: Extract two APIs from acpi_dsdt_add_pci (Yubo Miao)  [Orabug: 34616322] 
  - arm: use acpi_dsdt_add_gpex (Gerd Hoffmann)  [Orabug: 34616322] 
  - acpi: add acpi_dsdt_add_gpex (Gerd Hoffmann)  [Orabug: 34616322] 
  - acpi: Allow DSDT acpi table changes (Jiahui Cen)  [Orabug: 34616322] 
  - move MemMapEntry (Gerd Hoffmann)  [Orabug: 34616322] 
  - scsi/lsi53c895a: really fix use-after-free in lsi_do_msgout (CVE-2022-0216) (Mauro Matteo Cascella)  [Orabug: 34353672]  {CVE-2022-0216}
  - scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216) (Mauro Matteo Cascella)  [Orabug: 34353672]  {CVE-2022-0216}
  - tests/qtest: Add fuzz-lsi53c895a-test (Philippe Mathieu-Daudé)  [Orabug: 34353672]  {CVE-2022-0216}
  - hw/scsi/lsi53c895a: Do not abort when DMA requested and no data queued (Philippe Mathieu-Daudé)  [Orabug: 34353672]  {CVE-2022-0216}
  - vfio: defer to commit kvm irq routing when enable msi/msix (Longpeng (Mike))  [Orabug: 34419422] 
  - vfio: simplify the failure path in vfio_msi_enable (Longpeng (Mike))  [Orabug: 34419422] 
  - vfio: move re-enabling INTX out of the common helper (Longpeng (Mike))  [Orabug: 34419422] 
  - vfio: simplify the conditional statements in vfio_msi_enable (Longpeng (Mike))  [Orabug: 34419422] 
  - kvm/msi: do explicit commit when adding msi routes (Longpeng (Mike))  [Orabug: 34419422] 
  - kvm-irqchip: introduce new API to support route change (Longpeng (Mike))  [Orabug: 34419422] 
  - event_notifier: handle initialization failure better (Maxim Levitsky)  [Orabug: 34419422] 
  - qmp-regdump: use QMP command 'query-cpus-fast' (Mark Kanda)  [Orabug: 34510460]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-22.el7
changelog:
  - Revert "block: Set the name of BlockBackend if possible" (Joe Jin)  [Orabug: 34841102] 
  - Revert "iotests: Adjust 186.out to account for 'null' node-name" (Joe Jin)  [Orabug: 34841102]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-23.el7
changelog:
  - hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) (Philippe Mathieu-Daudé)  [Orabug: 33930374]  {CVE-2021-3638}
  - tests/acpi: virt: update ACPI MADT and FADT binaries (Miguel Luis)  
  - acpi: arm/virt: madt: bump to revision 4 accordingly to ACPI 6.0 Errata A (Miguel Luis)  
  - acpi: arm/virt: madt: use build_append_int_noprefix() API to compose MADT table (Igor Mammedov)  
  - acpi: madt: arm/x86: use acpi_table_begin()/acpi_table_end() instead of build_header() (Igor Mammedov)  
  - hw/arm/virt-acpi-build:Remove dead assignment in build_madt() (Chen Qun)  
  - acpi: build_fadt: adapt FADT table names (Miguel Luis)  
  - acpi: fadt: support revision 6.0 of the ACPI specification (Miguel Luis)  
  - tests/acpi: virt: allow acpi MADT and FADT changes (Miguel Luis)  
  - Document CVE-2022-1050 and CVE-2022-3165 (Mark Kanda)  [Orabug: 34132133] [Orabug: 34713999]  {CVE-2022-1050} {CVE-2022-3165}
  - hw/acpi/erst.c: Fix memory handling issues (Christian A. Ehrhardt)  [Orabug: 34779472]  {CVE-2022-4172}
  - vhost-vdpa: fix assert !virtio_net_get_subqueue(nc)->async_tx.elem in virtio_net_reset (Si-Wei Liu)  
  - net/vhost-vdpa.c: Fix clang compilation failure (Peter Maydell)  
  - vhost-vdpa: allow passing opened vhostfd to vhost-vdpa (Si-Wei Liu)  
  - virtio-scsi: Send "REPORTED LUNS CHANGED" sense data upon disk hotplug events (Venu Busireddy)  [Orabug: 33649154] 
  - hw/acpi/aml-build: Improve scalability of PPTT generation (Yanan Wang)  
  - tests/data/acpi/virt: update empty file for PPTT (Miguel Luis)  
  - hw/arm/virt-acpi-build: Generate PPTT table (Yanan Wang)  
  - tests/data/acpi/virt: Add an empty expected file for PPTT (Yanan Wang)  
  - hw/acpi/aml-build: Add PPTT table (Andrew Jones)  
  - hw/acpi/aml-build: Add Processor hierarchy node structure (Yanan Wang)  
  - machine: Add SMP Sockets in CpuTopology (Babu Moger)  
  - bios-tables-test: generate table for virt/DBG2 (Miguel Luis)  
  - hw/arm/virt_acpi_build: Generate DBG2 table (Eric Auger)  
  - tests/acpi: Add void table for virt/DBG2 bios-tables-test (Eric Auger)  
  - tests/acpi: virt: update ACPI GTDT binaries (Miguel Luis)  [Orabug: 34711916] 
  - acpi: arm/virt: build_gtdt: fix invalid 64-bit physical addresses (Miguel Luis)  [Orabug: 34711916] 
  - tests/acpi: virt: allow acpi GTDT changes (Miguel Luis)  [Orabug: 34711916] 
  - acpi: fix OEM ID/OEM Table ID padding (Igor Mammedov)  [Orabug: 34711916] 
  - acpi: arm/virt: build_gtdt: use acpi_table_begin()/acpi_table_end() instead of build_header() (Igor Mammedov)  [Orabug: 34711916] 
  - acpi: add helper routines to initialize ACPI tables (Igor Mammedov)  [Orabug: 34711916] 
  - acpi: declare the default assignable value for the ACPI table header (Miguel Luis)  [Orabug: 34711916]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-24.el7
changelog:
  - Revert "virtio-scsi: Send "REPORTED LUNS CHANGED" sense data upon disk hotplug
    events" (Mark Kanda)  [Orabug: 34905939]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-25.el7
changelog:
  - target/i386/kvm: get and put AMD pmu registers (Dongli Zhang)  [Orabug: 34641255] 
  - i386/kvm: fix a use-after-free when vcpu plug/unplug (Pan Nengyuan)  [Orabug: 34859902] 
  - memory: batch allocate ioeventfds[] in address_space_update_ioeventfds() (Stefan Hajnoczi)  [Orabug: 34538900] 
  - virtio-blk: Fix clean up of host notifiers for single MR transaction. (Mark Mielke)  [Orabug: 34538900] 
  - virtio-scsi: Configure all host notifiers in a single MR transaction (Greg Kurz)  [Orabug: 34538900] 
  - virtio-scsi: Set host notifiers and callbacks separately (Greg Kurz)  [Orabug: 34538900] 
  - virtio-blk: Configure all host notifiers in a single MR transaction (Greg Kurz)  [Orabug: 34538900] 
  - virtio-blk: Fix rollback path in virtio_blk_data_plane_start() (Greg Kurz)  [Orabug: 34538900] 
  - event_notifier: Set ->initialized earlier in event_notifier_init() (Greg Kurz)  [Orabug: 34538900] 
  - virtio-scsi: don't process IO on fenced dataplane (Maxim Levitsky)  [Orabug: 34538900] 
  - virtio-scsi: don't uninitialize queues that we didn't initialize (Maxim Levitsky)  [Orabug: 34538900] 
  - hw/arm/virt: build SMBIOS 19 table (Mihai Carabas)


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-26.el7
changelog:
  - migration: check magic value for deciding the mapping of channels (manish.mishra)  [Orabug: 34735462] 
  - io: Add support for MSG_PEEK for socket channel (manish.mishra)  [Orabug: 34735462] 
  - migration: Move channel setup out of postcopy_try_recover() (Peter Xu)  [Orabug: 34735462] 
  - vdpa: commit all host notifier MRs in a single MR transaction (Longpeng (Mike))  [Orabug: 35252234] 
  - vhost: configure all host notifiers in a single MR transaction (Longpeng (Mike))  [Orabug: 35252234] 
  - vhost: simplify vhost_dev_enable_notifiers (Longpeng (Mike))  [Orabug: 35252234] 
  - pcie: Do not update hotplugged device power in RUN_STATE_INMIGRATE state (Annie Li)  [Orabug: 35055290] 
  - qga/win32: Use rundll for VSS installation (Konstantin Kostiuk)  [Orabug: 35206108]  {CVE-2023-0664}
  - qga/win32: Remove change action from MSI installer (Konstantin Kostiuk)  [Orabug: 35206108]  {CVE-2023-0664}
  - hw/display/qxl: Assert memory slot fits in preallocated MemoryRegion (Philippe Mathieu-Daudé)  [Orabug: 34846087]  {CVE-2022-4144}
  - hw/display/qxl: Avoid buffer overrun in qxl_phys2virt (CVE-2022-4144) (Philippe Mathieu-Daudé)  [Orabug: 34846087]  {CVE-2022-4144}
  - hw/display/qxl: Pass requested buffer size to qxl_phys2virt() (Philippe Mathieu-Daudé)  [Orabug: 34846087]  {CVE-2022-4144}
  - hw/display/qxl: Document qxl_phys2virt() (Philippe Mathieu-Daudé)  [Orabug: 34846087]  {CVE-2022-4144}
  - hw/display/qxl: Have qxl_log_command Return early if no log_cmd handler (Philippe Mathieu-Daudé)  [Orabug: 34846087]  {CVE-2022-4144}
  - virtio-blk: On restart, process queued requests in the proper context (Sergio Lopez)  [Orabug: 35060530] 
  - virtio-blk: Refactor the code that processes queued requests (Sergio Lopez)  [Orabug: 35060530] 
  - hw/intc/ioapic: Update KVM routes before redelivering IRQ, on RTE update (David Woodhouse)  [Orabug: 35219223] 
  - modules: load modules from /var/run/qemu/ directory firstly (Siddhi Katage)  [Orabug: 34867783] 
  - qemu.spec: Add post-install script for block storage modules (Siddhi Katage)  [Orabug: 34867783] 
  - qemu.spec: Enable '-module-upgrades' for OL7 (Siddhi Katage)  [Orabug: 34867783] 
  - module: increase dirs array size by one (Bruce Rogers)  [Orabug: 34867783] 
  - modules: load modules from versioned /var/run dir (Christian Ehrhardt)  [Orabug: 34867783] 
  - blockjob: Fix crash with IOthread when block commit after snapshot (Michael Qiu)  [Orabug: 35118668]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-27.el7
changelog:
  - hw/arm/virt: Add nvdimm hotplug support (Shameer Kolothum)  [Orabug: 35505663] 
  - hw/arm/virt: Add nvdimm hot-plug infrastructure (Kwangwoo Lee)  [Orabug: 35505663] 
  - nvdimm: Use configurable ACPI IO base and size (Kwangwoo Lee)  [Orabug: 35505663] 
  - target/i386: define a new MSR based feature word - FEAT_PERF_CAPABILITIES (Like Xu)  [Orabug: 35370615]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-28.el7
changelog:
  - virtio-crypto: verify src&dst buffer length for sym request (Zhenwei Pi)  [Orabug: 35724113]  {CVE-2023-3180}
  - hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) (Thomas Huth)  [Orabug: 35724112]  {CVE-2023-0330}
  - kvm: Atomic memslot updates (David Hildenbrand)  [Orabug: 35719844] 
  - KVM: keep track of running ioctls (Emanuele Giuseppe Esposito)  [Orabug: 35719844] 
  - accel: introduce accelerator blocker API (Emanuele Giuseppe Esposito)  [Orabug: 35719844] 
  - KVM: Use a big lock to replace per-kml slots_lock (Peter Xu)  [Orabug: 35719844] 
  - pcie: don't set link state active if the slot is empty (Laurent Vivier)  [Orabug: 35707933] 
  - vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (Ani Sinha)  [Orabug: 35662850]  {CVE-2023-3301}


author: Karl Heubaum <karl.heubaum@oracle.com> - 15:4.1.1-2.el7
changelog:
  - Document CVE-2020-13765 as fixed (Karl Heubaum)  [Orabug: 31463250]  {CVE-2020-13765}
  - kvm: Reallocate dirty_bmap when we change a slot (Dr. David Alan Gilbert)  [Orabug: 31076399] 
  - kvm: split too big memory section on several memslots (Igor Mammedov)  [Orabug: 31076399] 
  - target/i386: do not set unsupported VMX secondary execution controls (Vitaly Kuznetsov)  [Orabug: 31463710] 
  - target/i386: add VMX definitions (Paolo Bonzini)  [Orabug: 31463710] 
  - ati-vga: check mm_index before recursive call (CVE-2020-13800) (Prasad J Pandit)  [Orabug: 31452206]  {CVE-2020-13800}
  - es1370: check total frame count against current frame (Prasad J Pandit)  [Orabug: 31463235]  {CVE-2020-13361}
  - ati-vga: Fix checks in ati_2d_blt() to avoid crash (BALATON Zoltan)  [Orabug: 31238432]  {CVE-2020-11869}
  - libslirp: Update to stable-4.2 to fix CVE-2020-1983 (Karl Heubaum)  [Orabug: 31241227]  {CVE-2020-1983}
  - Document CVEs as fixed (Karl Heubaum)   {CVE-2019-12068} {CVE-2019-15034}
  - libslirp: Update to version 4.2.0 to fix CVEs (Karl Heubaum)  [Orabug: 30274592] [Orabug: 30869830]  {CVE-2019-15890} {CVE-2020-8608}
  - target/i386: add support for MSR_IA32_TSX_CTRL (Paolo Bonzini)  [Orabug: 31124041] 
  - qemu-img: Add --target-is-zero to convert (David Edmondson)  
  - vnc: fix memory leak when vnc disconnect (Li Qiang)  [Orabug: 30996427]  {CVE-2019-20382}
  - iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711) (Felipe Franciosi)  [Orabug: 31124035]  {CVE-2020-1711}
  - qemu.spec: Remove "BuildRequires: kernel" (Karl Heubaum)  [Orabug: 31124047]


author: Karl Heubaum <karl.heubaum@oracle.com> - 15:4.1.1-3.el7
changelog:
  - buildrpm/spec files: Don't package elf2dmp (Karl Heubaum)  [Orabug: 31657424] 
  - qemu-kvm.spec: Enable the block-curl package (Karl Heubaum)  [Orabug: 31657424] 
  - qemu.spec: enable have_curl in spec (Dongli Zhang)  [Orabug: 31657424]


author: Rafael Aquini <aquini@redhat.com> - 20170530-54.gitdf40d15
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - opa: HFI firmware problems with new OPA switch firmware (rhbz 1452253)


author: Rafael Aquini <aquini@redhat.com> - 20171011-57.gitbf04291
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - ath10k: Update to the latest firmware released version (rhbz 1457363)
  - opa: update Intel Omni-Path Architecture firmware (rhbz 1452785)
  - chelsio: Pull in the latest firmware 1.16.63.0 (rhbz 1458328)
  - qla2xxx: Update firmware version to 8.07.00 (rhbz 1427148)


author: Rafael Aquini <aquini@redhat.com> - 20171127-58.git17e6288
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - iwlwifi: Firmware update for 3160, 3168, 7260, 7265 and 7265D WIFI devices (rhbz 1508709)
  - iwlwifi: Firmware update for 8260 and 8265 WIFI devices (rhbz 1508711)
  - iwlwifi: Firmware update for 9260 and 9560 WIFI devices (rhbz 1501166)
  - Fixes CVE-2016-0801 CVE-2017-0561 CVE-2017-9417


author: Rafael Aquini <aquini@redhat.com> - 20180113-60.git65b1c68
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - netr: Add Netronome TC flower firmware (rhbz 1518900)
  - Revert amd-ucode for fam17h (rhbz 1533945)


author: Rafael Aquini <aquini@redhat.com> - 20180220-62.git6d51311
changelog:
  - nfp: NIC stops transmitting for small MSS values when TSO is enabled (rhbz 1542263)
  - chelsio: pull in latests firmware 1.17.14.0 (rhbz 1538590)


author: Ethan Zhao <ethan.zhao@oracle.com> - 20170803-56.git7d2c913d.0.1.el7
changelog:
  - Merge upstream change and bump up version (Orabug 26566815)
  - opa: Revert switch firmware back to 0.47 (rhbz 1464629)


author: Ethan Zhao <ethan.zhao@oracle.com> - 20171027-56.gitbf042913.0.3.el7
changelog:
  - Update linux-firmware-base.list with ls_fw.sh and UEK5 dev build (Orabug 27026301)
  - For UEK5 kernel-uek-base-4.14.0-1.el7uek.x86_64.rpm and later build.


author: Ethan Zhao <ethan.zhao@oracle.com> - 20171128-58.git17e62881.0.1.el7
changelog:
  - Update ql2600_fw.bin ql2700_fw.bin ql8300_fw.bin to 8.07.00 (Orabug: 27160935)
  - Merge latest upstream change (Orabug: 27210871)
  - Fix cxgb4 symlinks (Orabug: 27223984)
  - Pack iwl* FW files as separate packages (Orabug: 27174930)
  - Bump release number to avoid conflict with existing product build (Orabug: 27256604)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> - 20180507-63.git0df406af.0.1.el7
changelog:
  - Rebase to latest upstream linux-firmware.
  - Don't add linux-nano-firmware.list to rpm.
  - Remove the temporary files at the cleanup
  - Bump release number.


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> - 20180906-999.git85c5d90f.el7
changelog:
  - Rebase to latest upstream linux-firmware.
  - Sync with RHEL linux-firmware-20180529-66.git7518922.el7


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> - 20181031-999.git1baa3486.el7
changelog:
  - Rebase to latest upstream linux-firmware.
  - Sync with RHEL linux-firmware-20180911-69.git85c5d90.el7


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> - 999:20181031-999.1.git1baa3486.el7
changelog:
  - ol7/spec: Fix release number to get new filenames for rpms. (Somasundaram
    Krishnasamy)  [Orabug: 28862841]


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> - 20201217-999.7.git7455a360.el7
changelog:
  - Sync to latest to get fix for CVE-2020-12321 linux-firmware: hardware: buffer overflow in bluetooth firmware (bz# 62321)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> - 20211203-999.9.gitb0e898fb.el7
changelog:
  - Move the build env to latest OL chroot.
  - Split Intel wireless AX2xx series to a separate package
  - Rebase to latest upstream linux-firmware


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> - 20230227-999.16.git60971a64.el7
changelog:
  - Fix rpm install issue due to directory replaced by symlink (Orabug: 35112753)
  - Rebase to upstream


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> - 20230516-999.20.git6c9e0ed5.el7
changelog:
  - cd72938cb480 linux-firmware: Update AMD fam17h cpu microcode
  - 92624e57af69 linux-firmware: Update AMD cpu microcode


author: Jack Vogel <jack.vogel@oracle.com> - 20230516-999.22.git6c9e0ed5.el7
changelog:
  - remove amd-ucode/README (Orabug: 35645306)
  - Resolves "Zenbleed" (Orabug: 35650345) {CVE-2023-20593}


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> - 20230516-999.25.git6c9e0ed5.el7
changelog:
  - Add missing amd-ucode/ files to nano rpm (Orabug: 35642190)
  - Add posttrans scriptlet to reload microcode on AMD (Orabug: 35636951)
  - Recreate initramfs for AMD systems (Orabug: 35636951)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> - 20230516-999.26.git6c9e0ed5.el7
changelog:
  - Run dracut -f in %posttrans instead of %post (Orabug: 35661938)
  - Drop latest AMD microcode commits to family 19 file to include Milan microcode but not Genoa (Orabug: 35708511)


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> - 20231025-999.28.git4ee01756.el7
changelog:
  - Rebase to upstream and contains AMD fix (Orabug: 35933859)
  - Add some iwlwifi-gl* files to be included to rpm package (Orabug: 35933859)
  - Make python3 as the default version for specfile (Orabug: 35933859)


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> - 20231102-999.29.git2b304bfe.el7
changelog:
  - Rebase to latest upstream (Orabug: 35978299)
  - Update AMD Genoa microcode from upstream commit (Orabug: 35965948)


author: Jack Vogel <jack.vogel@oracle.com> - 20230516-999.22.git6c9e0ed5.el7
changelog:
  - remove amd-ucode/README [Orabug: 35645306]
  - Resolves "Zenbleed" [Orabug: 35650345] {CVE-2023-20593}


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> - 20230516-999.25.git6c9e0ed5.el7
changelog:
  - Add missing amd-ucode/ files to nano rpm [Orabug: 35642190]
  - Add posttrans scriptlet to reload microcode on AMD [Orabug: 35636951]
  - Recreate initramfs for AMD systems [Orabug: 35636951]


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> - 20230516-999.26.git6c9e0ed5.el7
changelog:
  - Run dracut -f in %posttrans instead of %post [Orabug: 35661938]
  - Drop latest AMD microcode commits to family 19 file to include Milan microcode but not Genoa [Orabug: 35708511]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> - 20231025-999.28.git4ee01756.el7
changelog:
  - Rebase to upstream and contains AMD fix [Orabug: 35933859]
  - Add some iwlwifi-gl* files to be included to rpm package [Orabug: 35933859]
  - Make python3 as the default version for specfile [Orabug: 35933859]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> - 20231102-999.29.git2b304bfe.el7
changelog:
  - Rebase to latest upstream [Orabug: 35978299]
  - Update AMD Genoa microcode from upstream commit [Orabug: 35965948]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> - 20240122-999.31.gitbf0987d3.el7
changelog:
  - Rebase to latest upstream [Orabug: 36174455]
  - Remove python3 dependency for linux-firmware [Orabug: 36067969]
  - Ignore duplicates as we don't have rdfind installed [Orabug: 36242384]
  - Avoid conflicts when upgrading from OL7 to OL8 [Orabug: 36077380]


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> - 20200124-999.4.git1eb2408c.el7
changelog:
  - Rebase to latest upstream firmware (Orabug: 30762405).
  - Create symlinks from WHENCE file (Orabug: 30762405)
  - Merge iwl7265-firmware rpm files to iwl7260-firmware (Orabug: 30707813).
  - Fix linux-firmware package description (Orabug: 30707718).


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> - 20201217-999.7.git7455a360.el7
changelog:
  - BUILDINFO: commit=b23c4760f2ebe58829ad905dc3bf471df0128066
  - Sync to latest to get fix for CVE-2020-12321 linux-firmware: hardware: buffer overflow in bluetooth firmware (bz# 62321)


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> - 20211203-999.9.1.gitb0e898fb.el7
changelog:
  - Make iwl7260-firmware to depend on iwlax2xx-firmware
  - Update AMD family 19h microcode for SPAMD-8000-24 and SPAMD-8001-MP CPU faults (Orabug: 33850583)


author: Michal Srb <msrb@redhat.com> - 0:1.1.2-13
changelog:
  - Prevent XXE and RCE in JSTL XML tags
  - Apply correction for previous CVE-2015-0254 patch (prevent XXE in <x:transform>)
  - Resolves: CVE-2015-0254


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-27
changelog:
  - CVE-2014-9029 - incorrect component number check in COC, RGN and QCC
                    marker segment decoders (#1171211)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-28
changelog:
  - CVE-2014-8137 - double-free in in jas_iccattrval_destroy (#1173569)
  - CVE-2014-8138 - heap overflow in jp2_decode (#1173569)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-29
changelog:
  - CVE-2014-8157 - dec->numtiles off-by-one check in jpc_dec_process_sot() (#1183674)
  - CVE-2014-8158 - unrestricted stack memory use in jpc_qmfb.c (#1183682)


author: Josef Ridky <jridky@redhat.com> - 1.900.1-30
changelog:
  - Multiple security fixes (fixed by thoger):
    CVE-2015-5203 CVE-2015-5221 CVE-2016-1577 CVE-2016-1867 CVE-2016-2089
    CVE-2016-2116 CVE-2016-8654 CVE-2016-8690 CVE-2016-8691 CVE-2016-8692
    CVE-2016-8693 CVE-2016-8883 CVE-2016-8884 CVE-2016-8885 CVE-2016-9262
    CVE-2016-9387 CVE-2016-9388 CVE-2016-9389 CVE-2016-9390 CVE-2016-9391
    CVE-2016-9392 CVE-2016-9393 CVE-2016-9394 CVE-2016-9560 CVE-2016-9583
    CVE-2016-9591 CVE-2016-9600 CVE-2016-10248 CVE-2016-10249 CVE-2016-10251
  - Fix implicit declaration warning caused by security fixes above


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.1
changelog:
  - Bump to 2.6.9 and u131b00.
  - Remove patch application debris in fsg.sh.
  - Re-generate PR2809 and RH1022017 against 2.6.9.
  - Update md5sum list with checksum for the new java.security file.
  - Add blacklisted.certs to installation file list.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.2
changelog:
  - Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
  - Update jstack tapset to handle AArch64
  - Handle unsupported architectures by calling the error function rather than a parse failure
  - ABS_JAVA_HOME_DIR is no longer used in the updated tapsets
  - Resolves: rhbz#1373986


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.3
changelog:
  - Backport "8173783: IllegalArgumentException: jdk.tls.namedGroups"
  - Apply backports before local RPM fixes so they will be the same as when applied upstream
  - Adjust RH1022017 following application of 8173783
  - Resolves: rhbz#1422738


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.1
changelog:
  - Bump to 2.6.10 and u141b00.
  - Add more detailed output to fsg.sh and generate_source_tarball.sh.
  - Update md5sum list with checksum for the new java.security file.
  - Drop 8173783 backport which is now applied upstream.
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.3
changelog:
  - Add support for using RSAandMGF1 with the SHA hash algorithms in the PKCS11 provider 
  - Resolves: rhbz#1273760


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.4
changelog:
  - Fix merge error with "native2ascii changes file permissions of input file"
  - Resolves: rhbz#1446700


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.141-2.6.10.5
changelog:
  - make to use latest c-j-c and so fix persisting issues with java.security and other configfiles
  - aligned with this change, applied repackReproduciblePolycies.sh
  - 1183793 is missing blocker
  - Resolves: rhbz#1448880


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.151-2.6.11.1
changelog:
  - Bump to 2.6.11 and u151b00.
  - Update java-access-bridge-security.patch to apply against 2.6.11.
  - Drop 7177216 merge fix which is applied upstream.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.161-2.6.12.0
changelog:
  - Bump to 2.6.12 and u161b00.
  - Update SystemTap tapsets to version in IcedTea 2.6.12pre01 to fix RH1492139.
  - Drop 8185716 patch, now applied upstream.
  - Update location of OpenJDK zlib system library source code in remove-intree-libraries.sh
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.161-2.6.12.0
changelog:
  - Add missing implementation of Matcher::pass_original_key_for_aes() on AArch64 (PR3497)
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.1
changelog:
  - Extend pr3393-rh1273760.patch so Token.getMechanismInfo can handle CK_MECHANISM
  - Fix missing return statement in hotspot/src/cpu/aarch64/vm/vm_version_aarch64.cpp
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.1
changelog:
  - Update to new tarball with AArch64 return value fixes, dropping local patch.
  - Drop -Wno-error=return-type now they appear to be fixed.
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.1
changelog:
  - Spoke too soon... fix missing return statement in src/os_cpu/linux_zero/vm/os_linux_zero.cpp (non-LP64 only)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.2
changelog:
  - Rebuild with RPM optimisation flags disabled due to issues on x86 multilib
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.0
changelog:
  - Bump to 2.6.14 and u181b00.
  - Drop 8197981 Zero 32-bit patch now applied upstream.
  - Update RC4 patch (8076221/PR2809) to apply after 8175075 (disable 3DES)
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.1
changelog:
  - Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add missing ones
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.3
changelog:
  - Bump release number to an unused one as rhel-7.5-z-java-unsafe-candidate wrongly using .el7
  - Resolves: rhbz#1559766


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.181-2.6.14.5
changelog:
  - added depndence on latest c-j-c who do not have the incorrect jre-abrt handling
  - Resolves: rhbz#1559766


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.181-2.6.14.10
changelog:
  - jsa files changed to 444 to pass rpm verification
  - Add reg-ex for filtering private libraries' provides/requires.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.10
changelog:
  - Cleanup RH1566890 patch and differentiate from java-1.8.0-openjdk version.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.191-2.6.15.0
changelog:
  - Bump to 2.6.15 and u191b00.
  - Drop PR3608/RH1566890/CVE-2018-3639 patch now applied upstream.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.201-2.6.16.1
changelog:
  - Bump to 2.6.16 and u201b00.
  - Update 8076221/PR2809 (disable RC4) to apply after 8208350 (disable DES)
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.201-2.6.17pre01.0
changelog:
  - Bump to 2.6.17pre01.
  - Add support for icedtea_snapshot so we can build pre-releases.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.211-2.6.17.0
changelog:
  - Bump to 2.6.17.
  - Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after 8211883
  - Regenerate pr3393-rh1273760-support_rsaandmgf1_with_sha_in_pkcs11.patch against current sources
  - Resolves: rhbz#1661577


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.7.0.211-2.6.17.1
changelog:
  - Produce debug symbols for libpulse-java.so
  - Set IT_CFLAGS=-g so that debug symbols for the pulse audio
  - native library are being produced. This is needed to fix
  - rpmdiff errors of missing .debug_info in pulse-java.so.debug.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.211-2.6.17.2
changelog:
  - Synchronise Requires with java-1.8.0-openjdk
  - Replace liblcms.so and libsctp.so in _privatelibs with libjavalcms.so and libjavasctp.so
  - Add libjavagtk.so and libmawt.so to _privatelibs
  - Remove duplicate fontconfig build requirement
  - Remove unneeded Requires for fontconfig, lcms2 and libjpeg (all dynamically linked against)
  - Add _isa to NSS requirements
  - Move policytool desktop file and man page to java-1.7.0-openjdk where the binary is
  - Resolves: rhbz#1608957


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.231-2.6.19.0
changelog:
  - Bump to 2.6.19 (including tapsets) and OpenJDK 7u231-b01.
  - Fix fsg.sh to fail if patching fails.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.241-2.6.20.0
changelog:
  - Bump to 2.6.20 and OpenJDK 7u241-b01.
  - Drop PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.241-2.6.20.1
changelog:
  - Bump to 2.6.20 and OpenJDK 7u241-b01.
  - Drop PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Drop JDK-8226318/RH1738637 which is now included upstream.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.261-2.6.22.1
changelog:
  - Add release notes from IcedTea.
  - Mark license files with appropriate macro.
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-4.b11
changelog:
  - Rename SystemTap tapset tarball to avoid conflicts with previous version.
  - Resolves: rhbz#1438514


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-6.b12
changelog:
  - Update to aarch64-jdk8u131-b12 and aarch64-shenandoah-jdk8u131-b12 for AArch64 8168699 fix
  - Resolves: rhbz#1443417


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-8.b12
changelog:
  - Restore cacerts symlink as some broken apps hardcode the path (see RH1448802)
  - Resolves: rhbz#1319875


author: Zhengyu Gu <zgu@redhat.com> - 1:1.8.0.131-10.b12
changelog:
  - Added 8181055-pr3394-rh1448880.patch to fix a corner case of previous change
  - Resolves: rhbz#1448880


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.131-11.b12
changelog:
  - make to use latest c-j-c and so fix persisting issues with java.security and other configfiles
  - 1183793 is missing blocker
  - Resolves: rhbz#1448880


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - Reverting to java-1.7.0-openjdk on AArch64 as rhel-7.4-z-java-unsafe-candidate using wrong suffix.
  - Resolves: rhbz#1499207


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.151-5.b12
changelog:
  - Backport "8180048: Interned string and symbol table leak memory during parallel unlinking" (gnu_andrew)
  - Resolves: rhbz#1515212


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.161-0.b12
changelog:
  - Update to aarch64-jdk8u161-b12 and aarch64-shenandoah-jdk8u161-b12 (mbalao)
  - Drop upstreamed patches for 8075484 (RH1490713), 8153711 (RH1284948),
    8162384 (RH1358661), 8164293 (RH1459641), 8173941, 8175813 (RH1448880),
    8175887 and 8180048 (RH1449870).(mbalao)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-0.b12
changelog:
  - Switch bootstrap back to java-1.7.0-openjdk on all architectures, depending on RH1482244 fix
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-0.b12
changelog:
  - Replace tarballs with version including AArch64 fix for 8174962 (S8194686)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-0.b13
changelog:
  - Update to b13 including Zero fix for 8174962 (S8194739) and restoring tzdata2017c update
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-5.b13
changelog:
  - Update to aarch64-jdk8u151-b13 and aarch64-shenandoah-jdk8u151-b13.
  - Drop upstreamed patch for 8075484.
  - Resolves: rhbz#1508017


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.152-1.b16
changelog:
  - Update to aarch64-jdk8u152-b16 and aarch64-shenandoah-jdk8u152-b16.
  - Update 8145913/PR3466/RH1498309 patch following upstream addition of 8152172 (AES for PPC)
  - Add new file cmsalpha.c to %{name}-remove-intree-libraries.sh
  - Remove upstreamed patches for 8153711/PR3313/RH1284948, 8162384/PR3122/RH1358661, 8173941/PR3226,
  -    8175813/PR3394/RH1448880, 8175887/PR3415, 8146086/PR3439/RH1478402, 8180048/PR3411/RH1449870 and
  -    8164293/PR3412/RH1459641
  - Resolves: rhbz#1508017


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.152-1.b16
changelog:
  - Update to tzdata2017c (8190258/PR3499) to resolve TCK failure due to mismatch with system version.
  - Resolves: rhbz#1508017


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.152-1.b16
changelog:
  - Backport 8191137 and add updates to the translations (8191840 in OpenJDK 7)
  - Resolves: rhbz#1512647


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.161-1.b12
changelog:
  - Update to aarch64-jdk8u161-b12 and aarch64-shenandoah-jdk8u161-b12 (mbalao)
  - Drop upstreamed patches for 8075484 (RH1490713), 8153711 (RH1284948),
    8162384 (RH1358661), 8164293 (RH1459641), 8173941, 8175813 (RH1448880),
    8175887 and 8180048 (RH1449870).(mbalao)
  - drop more of usptreamed patches 565,566,567,568
    ( 8184673-pr3475-rh1487266.patch  8191840-pr3503-rh1512647.patch  8191137-pr3503-rh1512647.patch 8190258-pr3499-tzdata2017c.patch)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.162-0.b12
changelog:
  - Update to aarch64-jdk8u162-b12 and aarch64-shenandoah-jdk8u162-b12.
  - Remove upstreamed patches for 8181055/PR3394/RH1448880,
  -  8181419/PR3413/RH1463144, 8145913/PR3466/RH1498309,
  -  8168318/PR3466/RH1498320, 8170328/PR3466/RR1498321 and
  -  8181810/PR3466/RH1498319.
  - Resolves: rhbz#1559766


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.171-1.b10
changelog:
  - Backported from fedora: aarch64BuildFailure.patch, rhbz_1536622-JDK8197429-jdk8.patch, rhbz_1540242.patch
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-1.b10
changelog:
  - Cleanup from previous commit.
  - Remove unused upstream patch 8167200.hotspotAarch64.patch.
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-3.b10
changelog:
  - Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add misisng ones
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-3.b10
changelog:
  - Fix jconsole.desktop.in subcategory, replacing "Monitor" with "Profiling" (PR3550)
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-7.b10
changelog:
  - Bump release number to be greater than RHEL 7.6 package to allow build with .el7 suffix
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-4.b11
changelog:
  - Read jssecacerts file prior to trying either cacerts file (system or local) (PR3575)
  - Resolves: rhbz#1593737


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-0.b03
changelog:
  - Update to aarch64-jdk8u181-b03 and aarch64-shenandoah-jdk8u181-b03.
  - Remove AArch64 patch for PR3458/RH1540242 as applied upstream.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-1.b04
changelog:
  - Mark bugs that have been pushed to 8u upstream and are scheduled for a release.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-2.b04
changelog:
  - Add "8206406, PR3610, RH1597825: StubCodeDesc constructor publishes partially-constructed objects on StubCodeDesc::_list"
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-7.b13
changelog:
  - Update to aarch64-jdk8u181-b13 and aarch64-shenandoah-jdk8u181-b13.
  - Remove 8187577/PR3578 now applied upstream.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b15-0
changelog:
  - Move to single OpenJDK tarball build, based on aarch64/shenandoah-jdk8u.
  - Update to aarch64-shenandoah-jdk8u181-b15.
  - Drop 8165489-pr3589.patch which was only applied to aarch64/jdk8u builds.
  - Move buildver to where it should be in the OpenJDK version.
  - Split ppc64 Shenandoah fix into separate patch file with its own bug ID (PR3620).
  - Update pr3539-rh1548475.patch to apply after 8187045.
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b16-0
changelog:
  - Update to aarch64-shenandoah-jdk8u181-b16.
  - Drop PR3619 & PR3620 Shenandoah patches which should now be fixed upstream.
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b10.
  - Drop 8146115/PR3508/RH1463098 applied upstream.
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b15-0
changelog:
  - Move to single OpenJDK tarball build, based on aarch64/shenandoah-jdk8u.
  - Update to aarch64-shenandoah-jdk8u181-b15.
  - Drop 8165489-pr3589.patch which was only applied to aarch64/jdk8u builds.
  - Move buildver to where it should be in the OpenJDK version.
  - Split ppc64 Shenandoah fix into separate patch file with its own bug ID (PR3620).
  - Update pr3539-rh1548475.patch to apply after 8187045.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b16-0
changelog:
  - Update to aarch64-shenandoah-jdk8u181-b16.
  - Drop PR3619 & PR3620 Shenandoah patches which should now be fixed upstream.
  - Resolves: rhbz#1633822


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b13-0
changelog:
  - Fix jdk8073139-pr1758-rh1191652-ppc64_le_says_its_arch_is_ppc64_not_ppc64le_jdk.patch paths to pass git apply
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b13-0
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b13.
  - Update tarball generation script in preparation for PR3667/RH1656676 SunEC changes.
  - Use remove-intree-libraries.sh to remove the remaining SunEC code for now.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b14-0
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b14.
  - Adjust JDK-8073139/PR1758/RH1191652 to apply following 8155627 backport.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b14-1
changelog:
  - Add 8131048 & 8164920 (PR3574/RH1498936) to provide a CRC32 intrinsic for PPC64.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.192.b12-0
changelog:
  - Update to aarch64-shenandoah-jdk8u192-b12.
  - Remove patches included upstream
    - JDK-8031668/PR2842
    - JDK-8148351/PR2842
    - JDK-6260348/PR3066
    - JDK-8061305/PR3335/RH1423421
    - JDK-8188030/PR3459/RH1484079
    - JDK-8205104/PR3539/RH1548475
    - JDK-8185723/PR3553
    - JDK-8186461/PR3557
    - JDK-8201509/PR3579
    - JDK-8075942/PR3602
    - JDK-8203182/PR3603
    - JDK-8206406/PR3610/RH1597825
    - JDK-8206425
    - JDK-8036003
    - JDK-8201495/PR2415
    - JDK-8150954/PR2866/RH1176206
  - Re-generate patches (mostly due to upstream build changes)
    - JDK-8073139/PR1758/RH1191652
    - JDK-8143245/PR3548 (due to JDK-8202600)
    - JDK-8197429/PR3546/RH1536622 (due to JDK-8189170)
    - JDK-8199936/PR3533
    - JDK-8199936/PR3591
    - JDK-8207057/PR3613
    - JDK-8210761/RH1632174 (due to JDK-8207402)
    - PR3559 (due to JDK-8185723/JDK-8186461/JDK-8201509)
    - PR3593 (due to JDK-8081202)
    - RH1566890/CVE-2018-3639 (due to JDK-8189170)
    - RH1649664 (due to JDK-8196516)
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.192.b12-0
changelog:
  - Add port of 8189170 to AArch64 which is missing from upstream 8u version.
  - Resolves: rhbz#1661577


author: Jiri Vanek jvanek@redhat.com - 1:1.8.0.201.b09-2
changelog:
  - Replaced pcsc-lite-devel (which is in optional channel) with pcsc-lite-libs.
  - added rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch to make jdk work with pcsc


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.201.b09-3
changelog:
  - Update patch for RH1566890.
    - Renamed rh1566890_speculative_store_bypass_so_added_more_per_task_speculation_control_CVE_2018_3639 to
      rh1566890-CVE_2018_3639-speculative_store_bypass.patch
    - Added dependent patch,
      rh1566890-CVE_2018_3639-speculative_store_bypass_toggle.patch
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.201.b13-0
changelog:
  - Update to aarch64-shenandoah-jdk8u201-b13.
  - Drop JDK-8160748 & JDK-8189170 AArch64 patches now applied upstream.
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.202.b08-0
changelog:
  - Update to aarch64-shenandoah-jdk8u202-b08.
  - Remove patches included upstream
    - JDK-8211387/PR3559
    - JDK-8207057/PR3613
    - JDK-8165852/PR3468
    - JDK-8073139/PR1758/RH1191652
    - JDK-8044235
    - JDK-8172850/RH1640127
    - JDK-8209639/RH1640127
    - JDK-8131048/PR3574/RH1498936
    - JDK-8164920/PR3574/RH1498936
  - Re-generate patches
    - JDK-8210647/RH1632174
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b02-0
changelog:
  - Update to aarch64-shenandoah-jdk8u212-b02.
  - Remove patches included upstream
    - JDK-8197429/PR3546/RH153662{2,3}
    - JDK-8184309/PR3596
    - JDK-8210647/RH1632174
  - Re-generate patches
    - JDK-8203030
  - Add casts to resolve s390 ambiguity in calls to log2_intptr
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b02-1
changelog:
  - Add missing part of JDK-8213419 for AArch64 removing duplicate uabs definitions
  - Yet another cast to resolve s390 ambiguity in call to log2_intptr
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b01-1
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b01.
  - Refactor PR2888 after inclusion of 8129988 upstream. Now includes PR3575.
  - Drop 8171000, 8197546 & PR3634 as applied upstream.
  - Adjust 8214206 fix for S390 as BinaryMagnitudeSeq moved to shenandoahNumberSeq.cpp
  - Resolves: rhbz#1705328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b02-1
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b02.
  - Drop 8064786/PR3599 & 8210416/RH1632174 as applied upstream (8064786 silently in 8176100).
  - Resolves: rhbz#1705328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b03-1
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b03.
  - Set milestone to "ea" as this is not the final release.
  - Drop 8210425 patches applied upstream. Still need to add AArch64 version in aarch64/shenandoah-jdk8u.
  - Re-generate JDK-8141570 & JDK-8143245 patches due to 8210425 zeroshark.make changes.
  - Resolves: rhbz#1705328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b03-1
changelog:
  - Handle milestone as variables so we can alter it easily and set the docs zip filename appropriately.
  - Drop unused use_shenandoah_hotspot variable.
  - Resolves: rhbz#1705328


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.222.b03-0.1.ea
changelog:
  - Don't produce javadoc/javadoc-zip sub packages for the debug variant build.
  - Don't perform a bootcycle build for the debug variant build.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b03-0.1.ea
changelog:
  - Provide Javadoc debug subpackages for now, but populate them from the normal build.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b03-0.1.ea
changelog:
  - Use normal_suffix for Javadoc zip filename to copy, as there is is no debug version.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b04.
  - Drop remaining JDK-8210425/RH1632174 patch now AArch64 part is upstream.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b07 and Shenandoah merge 2019-06-13.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b08-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b08.
  - Adjust PR3083/RH134640 to apply after JDK-8182999
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b09-0
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b01-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b01.
  - Switch to EA mode.
  - Drop JDK-8210761/RH1632174 as now upstream.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b05-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b05.
  - Drop upstreamed patch JDK-8141570/PR3548.
  - Adjust context of JDK-8143245/PR3548 to apply against upstream JDK-8141570.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b05-shenandoah-merge-2019-09-09.
  - Update version logic to handle -shenandoah* tag suffix.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-0
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b09.
  - Switch to GA mode for final release.
  - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Resolves: rhbz#1753423


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-1
changelog:
  - Remove CVE-2018-3639 mitigation due to performance regression and
      OpenJDK position on speculative execution vulnerabilities.
      https://mail.openjdk.java.net/pipermail/vuln-announce/2019-July/000002.html
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b01-0.1.ea
changelog:
  - Revert SSBD removal for now, until appropriate messaging has been decided.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b05.
  - Attempt to fix Shenandoah formatting failures on S390, introduced by JDK-8232102.
  - Revise b05 snapshot to include JDK-8236178.
  - Add additional Shenandoah formatting fixes revealed by successful -Wno-error=format run
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b07-0
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b07.
  - Switch to GA mode for final release.
  - Remove Shenandoah S390 patch which is now included upstream as JDK-8236829.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b08-0
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b08.
  - Remove local copies of JDK-8031111 & JDK-8132111 as replaced by upstream versions.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-3
changelog:
  - Mark net.properties as a config file (based on Fedora patch by James Cassell)
  - Resolves: rhbz#1710928


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-4
changelog:
  - Update generate_source_tarball.sh script to use the PR3756 patch and retain the secp256k1 curve.
  - Regenerate source tarball using the updated script and add the -'4curve' suffix.
  - Resolves: rhbz#1746874


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-5
changelog:
  - Replace JDK-8231991 backport with upstream version and include JDK-8234107 fixup.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b08-1
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b08.
  - Remove local copies of JDK-8031111 & JDK-8132111 as replaced by upstream versions.
  - Fix paths in jdk8231991-mouse_wheel_focus.patch after git apply --stat complaints.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b03-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u252-b03.
  - Adjust PR2974/RH1337583 & PR3083/RH1346460 following context changes in JDK-8230978
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b09-0
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b06-0.1.ea
changelog:
  - Sync SystemTap & desktop files with upstream IcedTea release 3.15.0, removing previous workarounds
  - Sync stapinstall handling with RHEL 8 implementation
  - Need to support noarch for creating source RPMs for non-scratch builds.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b07.
  - Require tzdata 2020a so system tzdata matches resource updates in b07
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b09.
  - With JDK-8248399 fixed, a broken jfr binary is no longer installed on architectures without JFR.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u262 release.
  - Fix typo in jfr_arches which leads to ppc64 being wrongly excluded.
  - Split JDK-8042159 patch into per-repo patches as upstream.
  - Update JDK-8042159 JDK patch to apply after JDK-8238002 changes to Awt2dLibraries.gmk
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b07-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b07.
  - Drop JDK-8243541 backport now applied upstream.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.4.ea
changelog:
  - With JDK-8248399 fixed, a broken jfr binary is no longer installed on architectures without JFR.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.5.ea
changelog:
  - Restructure the build so a minimal initial build is then used for the final build (with docs)
  - This reduces pressure on the system JDK and ensures the JDK being built can do a full build
  - Introduce jfr_arches for architectures which support JFR.
  - Introduce sa_arches for architectures which support the serviceability agent.
  - Introduce share_arches for architectures which support class sharing (-Xshare:dump).
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b10-1
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u262 release.
  - Split JDK-8042159 patch into per-repo patches as upstream.
  - Update JDK-8042159 JDK patch to apply after JDK-8238002 changes to Awt2dLibraries.gmk
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.265.b01-0
changelog:
  - Update to aarch64-shenandoah-jdk8u265-b01.
  - Update release notes for 8u265 release.
  - Resolves: rhbz#1860456


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.265.b01-1
changelog:
  - ASSEMBLY_EXCEPTION LICENSE THIRD_PARTY_README moved to fully versioned dirs
  - Resolves: rhbz#1861222


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b05-shenandoah-merge-2020-08-28.
  - Add additional s390 log2_intptr case in shenandoahUtils.cpp introduced by JDK-8245464
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.2.ea
changelog:
  - Enable JFR on x86, now we have JDK-8252096: Shenandoah: adjust SerialPageShiftCount for x86_32 and JFR
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b06-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b06.
  - Update tarball generation script to use PR3799, following inclusion of JDK-8245468 (TLSv1.3)
  - Resolves: rhbz#1876665


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.272.b09-0.1.ea
changelog:
  - Set vendor property and vendor URLs
  - Made URLs to be preconfigured by OS
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b09-0.1.ea
changelog:
  - Include a test in the RPM to check the build has the correct vendor information.
  - Use 'oj_' prefix on new vendor globals to avoid a conflict with RPM's vendor value.
  - Improve quoting of vendor name
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u272 release.
  - Add backport of JDK-8254177 to update to tzdata 2020b
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - Delay tzdata 2020b dependency until tzdata update has shipped.
  - Adjust JDK-8062808/PR3548 following constantPool.hpp context change in JDK-8243302
  - Adjust PR3593 following g1StringDedupTable.cpp context change in JDK-8240124 & JDK-8244955
  - This tarball is embargoed until 2020-10-20 @ 1pm PT.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-1
changelog:
  - Add backport of JDK-8215727: "Restore JFR thread sampler loop to old / previous behaviour"
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.275.b01-0
changelog:
  - Update to aarch64-shenandoah-jdk8u275-b01 (GA)
  - Update release notes for 8u275.
  - Resolves: rhbz#1895062


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.282.b01-0.1.ea
changelog:
  - Added patch600: rh1750419-redhat_alt_java.patch
  - Replaced alt-java placeholder with real patched alt-java
  - Removed patch529: rh1566890-CVE_2018_3639-speculative_store_bypass.patch
  - Removed patch531: rh1566890-CVE_2018_3639-speculative_store_bypass_toggle.patch
  - Both surpassed by new patch
  - Resolves: rhbz#1901690


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b01-0.1.ea
changelog:
  - Extend RH1750419 alt-java fix to include external debuginfo, following JDK-8252395 in 8u282-b01
  - Resolves: rhbz#1901690


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b02-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b02 (EA)
  - Update release notes for 8u282-b02.
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b03-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b03 (EA)
  - Update release notes for 8u282-b03.
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b04-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b04 (EA)
  - Update release notes for 8u282-b04.
  - Remove upstreamed patch PR3519
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b05-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b05 (EA)
  - Update release notes for 8u282-b05 and make some minor corrections.
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b06-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b06 (EA)
  - Update release notes for 8u282-b06.
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b07 (EA)
  - Update release notes for 8u282-b07.
  - Fix placement issue in release notes, caught by comparing with vanilla version.
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b08-0
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b08 (GA)
  - Update release notes for 8u282-b08.
  - This tarball is embargoed until 2021-01-19 @ 1pm PT.
  - Resolves: rhbz#1908963


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b04-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b04 (EA)
  - Update release notes for 8u292-b04.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b05 (EA)
  - Update release notes for 8u292-b05.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.1.ea
changelog:
  - Re-organise S/390 patches for upstream submission, separating 8u upstream from Shenandoah fixes.
  - Add new formatting case found in memprofiler.cpp on debug builds to PR3593 patch.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b05-shenandoah-merge-2021-03-11 (EA)
  - Update release notes for 8u292-b05-shenandoah-merge-2021-03-11.
  - Extend s390 patch to fix issue caused by JDK-8252660 backport and lack of JDK-8188813 in 8u.
  - Revise JDK-8252660 s390 failure to make _soft_max_size a jlong so pointer types are accurate.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b06-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b06 (EA)
  - Update release notes for 8u292-b06.
  - Require tzdata 2020f due to JDK-8259048
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b07 (EA)
  - Update release notes for 8u292-b07.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b08-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b08 (EA)
  - Update release notes for 8u292-b08.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b09-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b09 (EA)
  - Update release notes for 8u292-b09.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b10 (GA)
  - Update release notes for 8u292-b10.
  - This tarball is embargoed until 2021-04-20 @ 1pm PT.
  - Resolves: rhbz#1938201


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b01-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b01 (EA)
  - Update release notes for 8u302-b01.
  - Switch to EA mode.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b02-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b02 (EA)
  - Update release notes for 8u302-b02.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b03-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b03 (EA)
  - Update release notes for 8u302-b03.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b03-shenandoah-merge-2021-06-23 (EA)
  - Update release notes for 8u302-b03-shenandoah-merge-2021-06-23.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b04-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b04 (EA)
  - Update release notes for 8u302-b04.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b05-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b05 (EA)
  - Update release notes for 8u302-b05.
  - Remove JDK-8266929/RH1960024 as now upstream.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b06-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b06 (EA)
  - Update release notes for 8u302-b06.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b07 (EA)
  - Update release notes for 8u302-b07.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b08-0
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b08 (EA)
  - Update release notes for 8u302-b08.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-07-20 @ 1pm PT.
  - Resolves: rhbz#1972395


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b01 (EA)
  - Update release notes for 8u312-b01.
  - Switch to EA mode.
  - Remove "-clean" suffix as no 8u312 builds are unclean.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b02-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b02 (EA)
  - Update release notes for 8u312-b02.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b03 (EA)
  - Update release notes for 8u312-b03.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b04 (EA)
  - Update release notes for 8u312-b04.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b05 (EA)
  - Update release notes for 8u312-b05.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b05-shenandoah-merge-2021-10-07
  - Update release notes for 8u312-b05-shenandoah-merge-2021-10-07.
  - Resolves: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.3.ea
changelog:
  - Add patch to improve performance of common separators in Scanner.useLocale
  - Move alt-java patch to correct section.
  - Resolves: rhbz#1862929


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b07-1
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b07 (EA)
  - Update release notes for 8u312-b07.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-10-19 @ 1pm PT.
  - Resolves: rhbz#2011826


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b04 (EA)
  - Update release notes for 8u322-b04.
  - Require tzdata 2021c as of JDK-8274407.
  - Switch to EA mode.
  - Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
  - Related: rhbz#2022809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-1
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b06 (EA)
  - Update release notes for 8u322-b06.
  - Switch to GA mode for final release.
  - Require tzdata 2021e as of JDK-8275766.
  - Update tarball generation script to use git following shenandoah-jdk8u's move to github
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u332-b01 (EA)
  - Update release notes for shenandoah-8u332-b01.
  - Switch to EA mode.
  - Related: rhbz#2047529


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b06-0.1.ea
changelog:
  - Update to shenandoah-jdk8u332-b06 (EA)
  - Update release notes for shenandoah-8u332-b06.
  - Resolves: rhbz#2047529


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b09-1
changelog:
  - Update to shenandoah-jdk8u332-b09 (GA)
  - Update release notes for 8u332-b09.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2022-04-19 @ 1pm PT.
  - Resolves: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.342.b07-1
changelog:
  - Update to shenandoah-jdk8u342-b07
  - Update release notes for shenandoah-8u342-b07.
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Use "git apply" with patches in the tarball script to allow binary diffs
  - Remove redundant "REPOS" variable from tarball script
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Rebase JDK-8186464 patch so it applies after JDK-8190753
  - Resolves: rhbz#2106502


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.345.b01-1
changelog:
  - Update to shenandoah-jdk8u345-b01 (GA)
  - Update release notes for 8u345-b01.
  - Resolves: rhbz#2112383


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b08-1
changelog:
  - Update to shenandoah-jdk8u352-b08 (GA)
  - Update release notes for shenandoah-8u352-b08.
  - * This tarball is embargoed until 2022-10-18 @ 1pm PT. *
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b08-2
changelog:
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Add test to ensure timezones can be translated
  - Related: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b07-0.1.ea
changelog:
  - Update to shenandoah-jdk8u362-b07 (EA)
  - Update release notes for shenandoah-8u362-b07.
  - Switch to EA mode for 8u362 pre-release builds.
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Drop tzdata patches for 2022d & 2022e (JDK-8294357 & JDK-8295173) which are now upstream
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
  - Resolves: rhbz#2150191


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b08-1
changelog:
  - Update to shenandoah-jdk8u352-b08 (GA)
  - Update release notes for shenandoah-8u352-b08.
  - Fix broken links and missing release notes in older releases.
  - Drop RH1163501 patch which is not upstream or in 11, 17 & 19 packages and seems obsolete
    - Patch was broken by inclusion of "JDK-8293554: Enhanced DH Key Exchanges"
    - Patch was added for a specific corner case of a 4096-bit DH key on a Fedora host that no longer exists
    - Fedora now appears to be using RSA and the JDK now supports ECC in preference to large DH keys
  - Resolves: rhbz#2160111


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.372.b07-1
changelog:
  - Update to shenandoah-jdk8u372-b07 (GA)
  - Update release notes for shenandoah-8u372-b07.
  - Require tzdata 2023c due to inclusion of JDK-8305113 in 8u372-b07
  - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
  - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
  - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
  - Include JDK-8271199 backport early ahead of 8u382 (RH2175317)
  - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
  - Resolves: rhbz#2185182
  - Resolves: rhbz#2159458


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u382-b01 (EA)
  - Update release notes for shenandoah-8u382-b01.
  - Switch to EA mode.
  - Remove JDK-8271199 patch which is now upstream.
  - Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b04-0.1.ea
changelog:
  - Update to shenandoah-jdk8u382-b04 (EA)
  - Update release notes for shenandoah-8u382-b04.
  - Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b05-1
changelog:
  - Update to shenandoah-jdk8u372-b05 (GA)
  - Update release notes for shenandoah-8u372-b05.
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b05-1
changelog:
  - Update to shenandoah-jdk8u382-b05 (GA)
  - Update release notes for shenandoah-8u382-b05.
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2221106


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.392.b08-1
changelog:
  - For non debug subpackages, ghosted all alternatives (rhbz1649776)
  - For non system JDKs, if-outed versionless provides.
  - Aligned versions to be %{epoch}:%{version}-%{release} instead of chaotic
  - Related: RHEL-11319


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.392.b08-1
changelog:
  - Update to shenandoah-jdk8u392-b08 (GA)
  - Update release notes for shenandoah-8u392-b08.
  - Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Regenerate PR2462 patch following JDK-8315135
  - Add backport of JDK-8312489 heading upstream for 8u402 (see OPENJDK-2095)
  - Add missing JFR alternative ghost
  - Move jcmd to the headless package
  - ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
  - Resolves: RHEL-12212
  - Resolves: RHEL-13574
  - Resolves: RHEL-13575
  - Resolves: RHEL-13576
  - Resolves: RHEL-11319
  - Resolves: RHEL-13577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.392.b08-3
changelog:
  - Restore %{epoch}:%{javaver} versioning to jre, java, jre-headless, java-headless, java-devel & java-sdk
  - Resolves: RHEL-19630


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.402.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u402-b01 (EA)
  - Update release notes for shenandoah-8u402-b01.
  - Switch to EA mode.
  - Sync NEWS with vanilla branch version.
  - Related: RHEL-17914


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.402.b06-0.1.ea
changelog:
  - Update to shenandoah-jdk8u402-b06 (GA)
  - Update release notes for shenandoah-8u402-b06.
  - Drop local copy of JDK-8312489 which is now included upstream
  - Switch to GA mode.
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
  - Resolves: RHEL-17914
  - Resolves: RHEL-20965


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u412-b01 (EA)
  - Update release notes for shenandoah-8u412-b01.
  - Switch to EA mode.
  - Related: RHEL-30926


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:1.8.0.412.b01-0.1.ea
changelog:
  - Invoke xz in multi-threaded mode
  - generate_source_tarball.sh: Add WITH_TEMP environment variable
  - generate_source_tarball.sh: Multithread xz on all available cores
  - generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
  - generate_source_tarball.sh: Update comment about tarball naming
  - generate_source_tarball.sh: Reformat comment header
  - generate_source_tarball.sh: Reformat and update help output
  - generate_source_tarball.sh: Do a shallow clone, for speed
  - generate_source_tarball.sh: Eliminate some removal prompting
  - generate_source_tarball.sh: Make tarball reproducible
  - generate_source_tarball.sh: Prefix temporary directory with temp-
  - generate_source_tarball.sh: Remove temporary directory exit conditions
  - generate_source_tarball.sh: Set compile-command in Emacs
  - generate_source_tarball.sh: Remove REPO_NAME from FILE_NAME_ROOT
  - generate_source_tarball.sh: Move PROJECT_NAME and REPO_NAME checks
  - generate_source_tarball.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - generate_source_tarball.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: shellcheck: Do not use -a (SC2166)
  - generate_source_tarball.sh: shellcheck: Do not use $ on arithmetic variables (SC2004)
  - Use backward-compatible patch syntax
  - generate_source_tarball.sh: Ignore -ga tags with OPENJDK_LATEST
  - generate_source_tarball.sh: Remove trailing period in echo
  - generate_source_tarball.sh: Use long-style argument to grep
  - generate_source_tarball.sh: Add license
  - generate_source_tarball.sh: Add indentation instructions for Emacs
  - Remove -T0 argument from systemtap tar invocation
  - Related: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b01-0.1.ea
changelog:
  - Turn off xz multi-threading on i686 as it fails with an out of memory error
  - Normalise whitespace
  - Move to upstream tag style (shenandoah8ux-by) in preparation for eventually moving back to official sources
  - generate_source_tarball.sh: Rename JCONSOLE_JS_PATCH{,_DEFAULT} to JCONSOLE_PATCH{,_DEFAULT} for brevity
  - generate_source_tarball.sh: Adapt OPENJDK_LATEST logic to work with 8u Shenandoah fork
  - generate_source_tarball.sh: Adapt version logic to work with 8u
  - generate_source_tarball.sh: Add quoting for SCRIPT_DIR and JCONSOLE_PATCH (SC2086)
  - generate_source_tarball.sh: Update examples in header for clarity
  - generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
  - generate_source_tarball.sh: Only add --depth=1 on non-local repositories
  - Move maintenance scripts to a scripts subdirectory
  - icedtea_sync.sh: Update with a VCS mode that retrieves sources from a Mercurial repository
  - jconsole.desktop.in: Restored by running icedtea_sync.sh
  - policytool.desktop.in: Likewise.
  - Restore IcedTea sources correctly in spec file
  - discover_trees.sh: Set compile-command and indentation instructions for Emacs
  - discover_trees.sh: shellcheck: Do not use -o (SC2166)
  - discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: Add authorship
  - icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
  - icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
  - icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: Set compile-command and indentation instructions for Emacs
  - openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
  - openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
  - generate_source_tarball.sh: Handle an existing checkout
  - generate_source_tarball.sh: Sync indentation with java-21-openjdk version
  - generate_source_tarball.sh: Support using a subdirectory via TO_COMPRESS
  - Related: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b07-0.1.ea
changelog:
  - Update to shenandoah-jdk8u412-b07 (EA)
  - Update release notes for shenandoah-8u412-b07.
  - Require tzdata 2024a due to upstream inclusion of JDK-8322725
  - Only require tzdata 2023d for now as 2024a is unavailable in buildroot
  - Resolves: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b08-1
changelog:
  - Update to shenandoah-jdk8u412-b08 (GA)
  - Update release notes for shenandoah-8u412-b08.
  - Complete release note for Certainly roots
  - Switch to GA mode.
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
  - Related: RHEL-30926


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.28-5
changelog:
  - Add patch, RHBZ-1628612-JDK-8210461-workaround-disable-aarch64-intrinsic.patch,
    so as to disable dsin/dcos math intrinsics on aarch64. Work-around for
    JDK-8210461.
  - Resolves: rhbz#1570856


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.28-6
changelog:
  - Add patch, RHBZ-1630996-JDK-8210858-workaround-disable-aarch64-intrinsic-log.patch,
    so as to disable log math intrinsic on aarch64. Work-around for
    JDK-8210858
  - Resolves: rhbz#1570856


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.ea.28-8
changelog:
  - removed version less provides
  - javadocdir moved to arched dir as it is no longer noarch
  - Resolves: rhbz#1570856


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.28-9
changelog:
  - Rework changes from 1:11.0.ea.22-6. RHBZ#1632174 supercedes
    RHBZ-1624122.
  - Add patch, JDK-8210416-RHBZ-1632174-fdlibm-opt-fix.patch, so as to
    optimize compilation of fdlibm library.
  - Add patch, JDK-8210425-RHBZ-1632174-sharedRuntimeTrig-opt-fix.patch, so
    as to optimize compilation of sharedRuntime{Trig,Trans}.cpp
  - Add patch, JDK-8210647-RHBZ-1632174-libsaproc-opt-fix.patch, so as to
    optimize compilation of libsaproc (extra c flags won't override
    optimization).
  - Add patch, JDK-8210761-RHBZ-1632174-libjsig-opt-fix.patch, so as to
    optimize compilation of libjsig.
  - Add patch, JDK-8210703-RHBZ-1632174-vmStructs-opt-fix.patch, so as to
    optimize compilation of vmStructs.cpp (part of libjvm.so).
  - Reinstate filtering of opt flags coming from redhat-rpm-config.


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.0.28-1
changelog:
  - Identify as GA version and no longer as early access (EA).
  - JDK 11 has been released for GA on 2018-09-25.


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.1-0.0.ea
changelog:
  - Update to jdk-11.0.10.0+1
  - Update release notes to 11.0.10.0+1
  - Use JEP-322 Time-Based Versioning so we can handle a future 11.0.9.1-like release correctly.
  - Still use 11.0.x rather than 11.0.x.0 for file naming, as the trailing zero is omitted from tags.
  - Revert configure and built_doc_archive hacks to build 11.0.9.1 from 11.0.9.0 sources, and synced with Fedora version.
  - Cleanup debug package descriptions and version number placement.
  - Switch to EA mode for 11.0.10 pre-release builds.
  - Drop JDK-8222286 & JDK-8254177 as applied upstream
  - Explicitly request bundled Harfbuzz (too risky to change this so late in the RHEL 7 lifecycle)
  - Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.2-0.0.ea
changelog:
  - Update to jdk-11.0.10.0+2
  - Update release notes to 11.0.10.0+2
  - Update tarball generation script to use PR3818 which handles JDK-8171279 changes
  - Drop JDK-8250861 as applied upstream.
  - Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.2-0.0.ea
changelog:
  - Completely revert hacks from previous release, using buildver in configure and tzdata 2020b
  - Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.5-0.0.ea
changelog:
  - Update to jdk-11.0.10.0+5
  - Update release notes to 11.0.10.0+5
  - Drop JDK-8222527 as applied upstream.
  - Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.8-0.0.ea
changelog:
  - Update to jdk-11.0.10.0+8
  - Update release notes to 11.0.10.0+8 and add missing JDK-8245051 from b04.
  - Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.9-0
changelog:
  - Update to jdk-11.0.10.0+9
  - Update release notes to 11.0.10.0+9
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-01-19 @ 1pm PT.
  - Resolves: rhbz#1908970


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.2-0.1.ea
changelog:
  - Debug builds need to find their documentation from the release build.
  - RHEL 7 builds still include a doc package for debug builds, though debug builds do not build docs.
  - Resolves: rhbz#1930527


author: Jayashree Huttanagoudar <jhuttana@redhat.com> - 1:11.0.11.0.3-0.1.ea
changelog:
  - Fix issue where CheckVendor.java test erroneously passes when it should fail.
  - Add proper quoting so '&' is not treated as a special character by the shell.
  - Resolves: rhbz#1938082


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.9-0
changelog:
  - Update to jdk-11.0.11.0+9
  - Update release notes to 11.0.11.0+9
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-04-20 @ 1pm PT.
  - Resolves: rhbz#1940228


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.1-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+1
  - Update release notes to 11.0.12.0+1
  - Switch to EA mode for 11.0.12 pre-release builds.
  - Update ECC patch following JDK-8226374 (bug ID yet to be confirmed)
  - Remove local JDK-8187450 backport as now included upstream.
  - Resolves: rhbz#1967811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.4-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+4
  - Update release notes to 11.0.12.0+4
  - Correct bug ID JDK-8264846 to intended ID of JDK-8264848
  - Resolves: rhbz#1967811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.6-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+6
  - Update release notes to 11.0.12.0+6
  - Skip 11.0.12.0+5 as 11.0.12.0+6 only adds a test change
  - Resolves: rhbz#1967811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-0
changelog:
  - Update to jdk-11.0.12.0+7
  - Update release notes to 11.0.12.0+7
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-07-20 @ 1pm PT.
  - Resolves: rhbz#1972395


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-3
changelog:
  - Restructure the build so a minimal initial build is then used for the final build (with docs)
  - This reduces pressure on the system JDK and ensures the JDK being built can do a full build
  - Related: rhbz#1999936


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.13.0+1
  - Update release notes to 11.0.13.0+1
  - Update tarball generation script to use git following OpenJDK 11u's move to github
  - Switch to EA mode for 11.0.13 pre-release builds.
  - Remove non-Free test from source tarball.
  - Related: rhbz#1999936


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.8-1
changelog:
  - Update to jdk-11.0.12.0+8
  - Update release notes to 11.0.12.0+8
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-10-19 @ 1pm PT.
  - Resolves: rhbz#2012332


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.14.0.8-0.1.ea
changelog:
  - Replaced hardcoded 11 by featurever where appropriate
  - Fixed comment of `for slowdebug` to correct `any debug`
  - Related: rhbz#2022810


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.8-0.1.ea
changelog:
  - Update to jdk-11.0.14.0+8
  - Update release notes to 11.0.14.0+8
  - Switch to EA mode for 11.0.14 pre-release builds.
  - Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
  - Rename blacklisted.certs to blocked.certs following JDK-8253866
  - Resolves: rhbz#2022810


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.9-1
changelog:
  - Update to jdk-11.0.14.0+9
  - Update release notes to 11.0.14.0+9
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2022-01-18 @ 1pm PT.
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.15.0+1
  - Update release notes to 11.0.15.0+1
  - Switch to EA mode for 11.0.15 pre-release builds.
  - Related: rhbz#2047531


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.9-1
changelog:
  - Update to jdk-11.0.15.0+9
  - Update release notes to 11.0.15.0+9
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2022-04-19 @ 1pm PT. **
  - Resolves: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.9-2
changelog:
  - Remove security items from release notes that were only in 17u and N/A for 11u
  - Related: rhbz#2073422


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.16.0.8-1
changelog:
  - Add additional patch during tarball generation to align tests with ECC changes
  - Related: rhbz#2106510


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.0.8-1
changelog:
  - Update to jdk-11.0.16+8
  - Update release notes to 11.0.16+8
  - Use same tarball naming style as java-17-openjdk and java-latest-openjdk
  - Drop JDK-8284920 patch now upstreamed
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Use "git apply" with patches in the tarball script to allow binary diffs
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Make use of the vendor version string to store our version & release rather than an upstream release date
  - Explicitly require crypto-policies during build and runtime for system security properties
  - Resolves: rhbz#2106510


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.1.1-1
changelog:
  - Update to jdk-11.0.16.1+1
  - Update release notes to 11.0.16.1+1
  - Add patch to provide translations for Europe/Kyiv added in tzdata2022b
  - Add test to ensure timezones can be translated
  - Resolves: rhbz#2119512


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.17+1
  - Update release notes to 11.0.17+1
  - Switch to EA mode for 11.0.17 pre-release builds.
  - Related: rhbz#2130373


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.1-0.1.ea
changelog:
  - Include Aleksey's patch for JDK-8291053 to try and get HarfBuzz to build again
  - Related: rhbz#2130373


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.1-0.1.ea
changelog:
  - Try to build using system HarfBuzz to avoid build failures with 4.4.1 & gcc 4.8.5
  - Related: rhbz#2130373


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.8-1
changelog:
  - Update to jdk-11.0.17+8 (GA)
  - Update release notes to 11.0.17+8
  - Switch to GA mode for release
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.8-2
changelog:
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Update CLDR data with Europe/Kyiv (JDK-8293834)
  - Drop JDK-8292223 patch which we found to be unnecessary
  - Update TestTranslations.java to use public API based on TimeZoneNamesTest upstream
  - Remove unneeded JDK-8291053 patch as we no longer build in-tree HarfBuzz
  - Related: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.18+1
  - Update release notes to 11.0.18+1
  - Switch to EA mode for 11.0.18 pre-release builds.
  - Drop local copies of JDK-8294357 & JDK-8295173 now upstream contains tzdata 2022e
  - Related: rhbz#2150192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.9-0.2.ea
changelog:
  - Update to jdk-11.0.18+9
  - Update release notes to 11.0.18+9
  - Drop local copy of JDK-8293834 now this is upstream
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
  - Resolves: rhbz#2150192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.10-1
changelog:
  - Update to jdk-11.0.18+10 (GA)
  - Update release notes to 11.0.18+10
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2023-01-17 @ 1pm PT. **
  - Related: rhbz#2150192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-1
changelog:
  - Update to jdk-11.0.19.0+7
  - Update release notes to 11.0.19.0+7
  - Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
  - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
  - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
  - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
  - Rebase RH1750419 alt-java patch against 11.0.19+6
  - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
  - Resolves: rhbz#2185182


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.28-9
changelog:
  - Rework changes from 1:11.0.ea.22-6. RHBZ#1632174 supercedes
    RHBZ-1624122.
  - Add patch, jdk8210416-rh1632174-compile_fdlibm_with_o2_ffp_contract_off_on_gcc_clang_arches.patch, so as to
    optimize compilation of fdlibm library.
  - Add patch, jdk8210425-rh1632174-sharedRuntimeTrig_sharedRuntimeTrans_compiled_without_optimization.patch, so
    as to optimize compilation of sharedRuntime{Trig,Trans}.cpp
  - Add patch, jdk8210647-rh1632174-libsaproc_is_being_compiled_without_optimization.patch, so as to
    optimize compilation of libsaproc (extra c flags won't override
    optimization).
  - Add patch, jdk8210761-rh1632174-libjsig_is_being_compiled_without_optimization.patch, so as to
    optimize compilation of libjsig.
  - Add patch, jdk8210703-rh1632174-vmStructs_cpp_no_longer_compiled_with_o0, so as to
    optimize compilation of vmStructs.cpp (part of libjvm.so).
  - Reinstate filtering of opt flags coming from redhat-rpm-config.


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.1.13-3
changelog:
  - Use upstream's version of Aarch64 intrinsics disable patch:
    - Removed:
      RHBZ-1628612-JDK-8210461-workaround-disable-aarch64-intrinsic.patch
      RHBZ-1630996-JDK-8210858-workaround-disable-aarch64-intrinsic-log.patch
    - Superceded by:
      jdk8211105-aarch64-disable_cos_sin_and_log_intrinsics.patch


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.1.13-4
changelog:
  - Update to shenandoah-jdk-11.0.1+13-20190101
  - Update tarball generation script in preparation for PR3681/RH1656677 SunEC changes.
  - Use remove-intree-libraries.sh to remove the remaining SunEC code for now.
  - Fix remove-intree-libraries.sh to not exit early and skip SunEC handling.
  - Fix PR1983 SunEC patch so that ecc_impl.h is patched rather than added
  - Add missing RH1022017 patch to reduce curves reported by SSL to those we support.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.2.7-0
changelog:
  - Update to shenandoah-jdk-11.0.2+7 (January 2019 CPU)
  - Make tagsuffix optional and comment it out while unused.
  - Drop JDK-8211105/RH1628612/RH1630996 applied upstream.
  - Drop JDK-8209639/RH1640127 applied upstream.
  - Re-generate JDK-8210416/RH1632174 following JDK-8209786
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.20+1 (EA)
  - Update release notes to 11.0.20+1
  - Switch to EA mode
  - Drop local inclusion of JDK-8274864 & JDK-8305113 as they are included in 11.0.20+1
  - Add missing Swing release note
  - Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.8-1
changelog:
  - Update to jdk-11.0.20.0+8 (GA)
  - Update release notes to 11.0.20.0+8
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.1.1-1
changelog:
  - Update to jdk-11.0.20.1+1 (GA)
  - Update release notes to 11.0.20.1+1
  - Add backport of JDK-8312489 already upstream in 11.0.22 (see OPENJDK-2095)
  - Add backport of JDK-8243210 already upstream in 11.0.21 (see RH2229269)
  - Update openjdk_news script to specify subdirectory last
  - Add missing discover_trees script required by openjdk_news
  - Synchronise runtime and buildtime tzdata requirements
  - Update README.md to match the version in later RHEL releases
  - Resolves: rhbz#2236229


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.21.0.9-1
changelog:
  - For non debug subpackages, ghosted all alternatives (rhbz1649776)
  - For non system JDKs, if-outed versionless provides.
  - Aligned versions to be %{epoch}:%{version}-%{release} instead of chaotic
  - Related: RHEL-11320


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.21.0.9-1
changelog:
  - Update to jdk-11.0.21+9 (GA)
  - Update release notes to 11.0.21+9
  - Remove system crypto policy patch which doesn't belong on RHEL 7 with no system policies
  - Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Apply all patches using -p1
  - Drop local backport of JDK-8243210 which is upstream from 11.0.21+2
  - Add missing JFR alternative ghost
  - Move jcmd to the headless package
  - Replace -mstackrealign with -mincoming-stack-boundary=2 -mpreferred-stack-boundary=4 on x86_32 for stack alignment
  - Disable the serviceability agent on Zero architectures even when the architecture itself is supported
  - ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
  - Resolves: RHEL-12217
  - Resolves: RHEL-12910
  - Resolves: RHEL-12913
  - Resolves: RHEL-11320
  - Resolves: RHEL-13227
  - Resolves: RHEL-13217


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.21.0.9-2
changelog:
  - Restore %{epoch}:%{javaver} versioning to jre, java, jre-headless, java-headless, java-devel & java-sdk
  - Resolves: RHEL-19642


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.22.0.6-0.1.ea
changelog:
  - Update to jdk-11.0.22+6 (EA)
  - Update release notes to 11.0.22+6
  - Switch to EA mode
  - Drop local copy of JDK-8312489 which is now included upstream
  - Resolves: RHEL-21031


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.22.0.7-1
changelog:
  - Update to jdk-11.0.22+7 (GA)
  - Update release notes to 11.0.22+7
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
  - Resolves: RHEL-20966


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.3.6-0
changelog:
  - Update to shenandoah-jdk-11.0.3+6 (April 2019 EA)
  - Drop JDK-8210416/RH1632174 applied upstream.
  - Drop JDK-8210425/RH1632174 applied upstream.
  - Drop JDK-8210647/RH1632174 applied upstream.
  - Drop JDK-8210761/RH1632174 applied upstream.
  - Drop JDK-8210703/RH1632174 applied upstream.
  - Add cast to resolve s390 ambiguity in call to log2_intptr
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.2.7-4
changelog:
  - Replace pcsc-lite-devel with pcsc-lite-libs so deps can be resolved without optional repository
  - Add JDK-8009550/RH910107 patch so OpenJDK checks for libpcsclite.so.1 (in pcsc-lite-libs)
  - Add missing ISA to cups-libs requirement
  - Remove duplicate lksctp-tools requirement
  - Resolves: rhbz#1684617


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.3.6-1
changelog:
  - Update to shenandoah-jdk-11.0.3+6 (April 2019 EA)
  - Drop JDK-8210416/RH1632174 applied upstream.
  - Drop JDK-8210425/RH1632174 applied upstream.
  - Drop JDK-8210647/RH1632174 applied upstream.
  - Drop JDK-8210761/RH1632174 applied upstream.
  - Drop JDK-8210703/RH1632174 applied upstream.
  - Resolves: rhbz#1677516


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.4.11-0
changelog:
  - Update to shenandoah-jdk-11.0.4+11 (GA)
  - Switch to GA mode for final release.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.5.1-0.0.ea
changelog:
  - Update to shenandoah-jdk-11.0.5+1 (EA)
  - Switch to EA mode for 11.0.5 pre-release builds.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.5.10-0
changelog:
  - Update to shenandoah-jdk-11.0.5+10 (GA)
  - Switch to GA mode for final release.
  - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.6.1-0.1.ea
changelog:
  - Update to shenandoah-jdk-11.0.6+1 (EA)
  - Switch to EA mode for 11.0.6 pre-release builds.
  - Add support for jfr binary.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.6.10-0
changelog:
  - Update to shenandoah-jdk-11.0.6+10 (GA)
  - Switch to GA mode for final release.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.6.10-3
changelog:
  - Add JDK-8237396 backport to resolve Shenandoah TCK breakage in traversal mode.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.7.10-0
changelog:
  - Update to shenandoah-jdk-11.0.7+10 (GA)
  - Switch to GA mode for final release.
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.4-0.0.ea
changelog:
  - Update to shenandoah-jdk-11.0.8+4 (EA)
  - Require tzdata 2020a due to resource changes in JDK-8243541
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.7-0.1.ea
changelog:
  - java-11-openjdk doesn't have a JRE tree, so don't try and copy alt-java there...
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.9-0.0.ea
changelog:
  - Update to shenandoah-jdk-11.0.8+9 (EA)
  - Update release notes for 11.0.8 release.
  - This tarball is embargoed until 2020-07-14 @ 1pm PT.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.10-0
changelog:
  - Update to shenandoah-jdk-11.0.8+10 (GA)
  - Switch to GA mode for final release.
  - Update release notes with last minute fix (JDK-8248505).
  - This tarball is embargoed until 2020-07-14 @ 1pm PT.
  - Resolves: rhbz#1838811


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.8.5-0.2.ea
changelog:
  - Disable stripping of debug symbols for static libraries part of
    the -static-libs sub-package.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.8-0.0.ea
changelog:
  - Update to jdk-11.0.9+8 (EA)
  - Remove JDK-8252258/RH1868406 now applied upstream.
  - Resolves: rhbz#1876665


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.9.10-0.1.ea
changelog:
  - Set vendor property and vendor URLs
  - Made URLs to be preconfigured by OS
  - Moved vendor_version_string to a better place
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.11-0
changelog:
  - Update to jdk-11.0.9+11
  - Update release notes for 11.0.9 release.
  - Add backport of JDK-8254177 to update to tzdata 2020b
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - This tarball is embargoed until 2020-10-20 @ 1pm PT.
  - Resolves: rhbz#1876665


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.9.11-1
changelog:
  - Move all license files to NVR-specific JVM directory.
  - This bad placement was killing parallel installability and thus having a bad impact on leapp, if used.
  - Resolves: rhbz#1896609


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.9.11-1
changelog:
  - Update to jdk-11.0.9.1+1
  - RPM version stays at 11.0.9.11 so as to not break upgrade path.
  - Adds a single patch for JDK-8250861.
  - Resolves: rhbz#1895275


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.11-2
changelog:
  - Add backport of JDk-8222537 so the Host header is sent when using proxies.
  - Resolves: rhbz#1869530


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.22-8
changelog:
  - Adjust system NSS patch, RHBZ-1565658-system-nss-SunEC.patch, so
    as to filter -Wl,--as-needed from linker flags. Fixes FTBFS issue.
  - Resolves: rhbz#1570856


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.ea.28-2
changelog:
  - jfr/*jfc files listed for all arches
  - lib/classlist do not exists s390, ifarch-ed via jit_arches out
  - specfile slightly improved to allow srpm rebuild on rhel8/fedoras
  - Resolves: rhbz#1570856


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 3.3.1-2
changelog:
  - Remove workaround for guice-no_aop
  - Remove fedora-review subpackage
  - Resolves: rhbz#1016667
  - Related: rhbz#1015158


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 0:1.1.3-7
changelog:
  - Remove unneeded dependency from POM: maven-cobertura-plugin
  - Remove unneeded dependency from POM: maven-findbugs-plugin
  - Resolves: rhbz#880692


author: Jiri Popelka <jpopelka@redhat.com> - 2.0-5
changelog:
  - Moving from rpmfusion-free to Fedora because it will be free of known patents
    in all countries from 2012-04-04 onwards
  - Changed license from GPL to GPLv2+ and included up-to-date license file


author: Ville Skyttä <ville.skytta@iki.fi> - 20091111-6
changelog:
  - Address more comments/TODO's from #655601:
  - Patch test suite generation to use Xalan.
  - Include license texts in jing-javadoc.
  - Make datatype-sample buildable out of the box, drop prebuilt jar.


author: Ville Skyttä <ville.skytta@iki.fi> - 20091111-10
changelog:
  - Tweak java-devel build dep for buildability without Java 1.6.
  - Fix build classpath with recent TestNG.


author: Jan Pokorný <jpokorny@redhat.com> - 20091111-14
changelog:
  - Resync with recent spec file changes in Fedora by Ville Skyttä:
  - BuildRequire ant instead of -trax (non-EL).
  - Depend on headless JRE where available.
  - Fix build (#1048867) and depend on headless JRE on EL7


author: Chris Spike <spike@fedoraproject.org> 2.1-1.tzdata2012g
changelog:
  - Updated to 2.1
  - New tzdata (2012g)
  - Updated spec file according to latest java packaging guidelines


author: Parag <pnemade AT redhat DOT com> - 0.003-13
changelog:
  - Resolves:rh#847621 - better enabling autohinting by default
  - Resolves:rh#847623 - fontconfig file isn't shipped in rpm
  - Resolves:rh#847627 - Malformed fontconfig config file


author: Pavel Alexeev <Pahan@Hubbitus.info> - 1:1.8.5-11
changelog:
  - Thanks to Ville Skyttä (bz#875343) build against libedit instead of readline
  	what simplify licensing apparently without any loss of functionality


author: Juan Hernandez <juan.hernandez@redhat.com> 1.1.1-1
changelog:
  - Adapted (mostly copied, in fact) from the corresponding package from Mageia
    (http://www.mageia.org) with support from Gil Cattaneo <puntogil@libero.it>.


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-4
changelog:
  - Bugzilla Bug #1394414 - Rebase jss to 4.4.0 in RHEL 7.4
  - Updated build requirements for NSPR
  - Updated build and runtime requirements for NSS
  - ## 'jss-post-rebase.patch' resolves the following issues ported from
    - Mozilla Bugzilla #1337092 - CMC conformance update: Implement required ASN.1
    code for RFC5272+ (cfu)
  - Mozilla Bugzilla #1347394 - Eclipse project files for JSS (edewata)
  - Mozilla Bugzilla #1347429 - Deprecated SSL 3.0 cipher names in SSLSocket
    class. (edewata)
  - Mozilla Bugzilla #1348856 - SSL alert callback (edewata)
  - Mozilla Bugzilla #1349278 - SSL cipher enumeration (edewata)
  - Mozilla Bugzilla #1349349 - Problem with Password.readPasswordFromConsole().
    (edewata)
  - Mozilla Bugzilla #1349831 - Revise top-level README file (mharmsen)
  - Mozilla Bugzilla #1349836 - Changes to JSS Version Block (mharmsen)
  - Mozilla Bugzilla #1350130 - Missing
    CryptoManager.verifyCertificateNowCUNative() implementation. (emaldona)


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-5
changelog:
  - Mozilla Bugzilla #1355268 - JSS 4.4 is incompatible with versions of
    idm-console-framework < 1.1.17-4
  - Red Hat Bugzilla #1435076 - Remove unused legacy lines from JSS spec files


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-6
changelog:
  - Mozilla Bugzilla #1352476 - RFE: Document on the README how to create a
    release tag (mharmsen)
  - Mozilla Bugzilla #1355358 - CryptoStore: add methods for importing and
    exporting EncryptedPrivateKeyInfo (ftweedal)
  - Mozilla Bugzilla #1359731 - CryptoStore.importPrivateKey enhancements
    (ftweedal)


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-7
changelog:
  - Bump NSS dependencies from 4.28.3 to 4.28.4-6 to pick-up fix in
    Mozilla Bugzilla #1360207 - Fix incorrect if (ss->...) in SSL_ReconfigFD


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-8
changelog:
  - Bugzilla #1488846 - Fix HmacTest code for AES encrypt/unwrap [rhel-7.4.z]
    (jmagne)
  - Bugzilla #1490494 - PKCS12: (JSS) upgrade to at least AES and SHA2 (FIPS)
    [RHEL-7.4.z] (ftweedal)
  - Bugzilla #1490740 - PK11Store.getEncryptedPrivateKeyInfo() segfault if
    export fails [rhel-7.4.z] (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-9
changelog:
  - Bugzilla #1505690 - new JSS failures: HMAC Unwrap and KeyWrapping
    FIPSMODE [rhel-7.4.z] (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-10
changelog:
  - Bugzilla #1506710 - JSS throws ObjectNotFoundException without message
    (edewata)
  - Bugzilla #1506826 - org.mozilla.jss.pkix.cms.SignerInfo incorrectly
    producing signatures (especially for EC) (cfu,dstutzman)


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-11
changelog:
  - Bugzilla #1506826 - org.mozilla.jss.pkix.cms.SignerInfo incorrectly
    producing signatures (especially for EC) (cfu,dstutzman)
  - Bugzilla #1533667 - Add: standard algorithm names for all ECC signature
    types (cfu,dstutzman)
  - Bugzilla #1534761 - SignerInfo class inserts wrong version # into the
    resulting structure (cfu,dstutzman)


author: Dogtag Team <pki-devel@redhat.com> 4.4.2-12
changelog:
  - Bugzilla #1579202 - JSS has wrong encoding for ecdsa with sha*
    AlgorithmIdentifier [rhel-7.5.z] (cfu)


author: Dogtag Team <pki-devel@redhat.com> 4.4.2-13
changelog:
  - Bugzilla #1595759 - org.mozilla.jss.pkix.primitive.AlgorithmIdentifier
    decode/encode process alters original data [rhel-7.5.z] (cfu)
  - Bugzilla #1596552 - JSS: Add support for TLS_*_SHA384 ciphers
    [rhel-7.5.z] (cfu)


author: Christina Fu <cfu@redhat.com> - 4.2.6-42
changelog:
  - Sync up patches from both Fedora and RHEL; adding two patches
    (cfu, edewata, mharmsen) from RHEL:
  - Bugzilla Bug #1238450 - UnsatisfiedLinkError on Windows (cfu)
  - make it compile on Windows platforms (cfu for nhosoi)


author: Elio Maldonado <emaldona@redhat.com> - 4.4.0-1
changelog:
  - Bugzilla Bug #1394414 - Rebase jss to 4.4.0 in RHEL 7.4
  - ## JSS 4.4.0 includes the following patches ported from downstream:
  - Mozilla Bugzilla #507536 - Add IPv6 functionality to JSS
  - Mozilla Bugzilla #1307872 - Expose NSS calls for OCSP settings
  - Mozilla Bugzilla #1307882 - RFE ecc - add ecc curve name support in JSS and
    CS interface
  - Mozilla Bugzilla #1307993 - Expose updated certificate verification function
    in JSS
  - Mozilla Bugzilla #1308000 - Incorrect socket accept error message due to bad
    pointer arithmetic
  - Mozilla Bugzilla #1308001 - Verification should fail when a revoked
    certificate is added
  - Mozilla Bugzilla #1308004 - Warnings should be cleaned up in JSS build
  - Mozilla Bugzilla #1308006 - DRM failed to recovery keys when in FIPS mode
    (HSM + NSS)
  - Mozilla Bugzilla #1308008 - Defects revealed by Coverity scan
  - Mozilla Bugzilla #1308009 - Add support for PKCS5v2; support for secure PKCS12
  - Mozilla Bugzilla #1308012 - DRM: during archiving and recovering, wrapping
    unwrapping keys should be done in the token
  - Mozilla Bugzilla #1308013 - JSS - HSM token name was mistaken for
    manufacturer identifier
  - Mozilla Bugzilla #1308017 - Un-deprecate previously deprecated methods in
    JSS 4.2.6
  - Mozilla Bugzilla #1308019 - Provide Tomcat support for TLS v1.1 and
    TLS v1.2 via NSS through JSS
  - Mozilla Bugzilla #1308026 - JSS certificate validation does not pass up exact
    error from NSS
  - Mozilla Bugzilla #1308027 - Merge pki-symkey into jss
  - Mozilla Bugzilla #1308029 - Resolve Javadoc build issues
  - Mozilla Bugzilla #1308047 - support ECC encryption key archival and recovery
  - Mozilla Bugzilla #1313122 - Remove bypass tests as latest NSS has removed
    PKCS#11 bypass support
  - Mozilla Bugzilla #1328675 - Simple problem unwrapping AES sym keys on token
  - Mozilla Bugzilla #1345174 - Cannot create system certs when using LunaSA HSM
    in FIPS Mode and ECC algorithms
  - Mozilla Bugzilla #1345613 - expose AES KeyWrap and add some useful OID
    functions
  - Mozilla Bugzilla #1346410 - Load JSS libraries appropriately
  - ## JSS 4.4.0 includes the following changes for building and testing:
  - Mozilla Bugzilla #1331765 - Simplify JSS Makefile build and test
  - Mozilla Bugzilla #1346420 - Document steps required to use the proper
    libjss4.so when running certain HMAC Algorithms tests


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.4-3
changelog:
  - Bugzilla #1534772 - org.mozilla.jss.pkix.primitive.AlgorithmIdentifier
    decode/encode process alters original data (cfu)
  - Bugzilla #1554056 - JSS: Add support for TLS_*_SHA384 ciphers (cfu)


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.4-4
changelog:
  - Bugzilla #1671244 - x25519 allowed in FIPS mode [rhel-7.6.z] (ascheel)
  - Bugzilla #1671247 - CC: Enable AIA OCSP cert checking for entire cert
    chain [rhel-7.6.z] (jmagne)


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.4-5
changelog:
  - Bugzilla #1671247 - CC: Enable AIA OCSP cert checking for entire cert
    chain [rhel-7.6.z] (jmagne)


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.6-2
changelog:
  - Bugzilla #1747966 - CVE 2019-14823 jss: OCSP policy "Leaf and Chain" implicitly trusts the root certificate


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.7-2
changelog:
  - Bugzilla #1747967 - CVE 2019-14823 jss: OCSP policy "Leaf and Chain" implicitly trusts the root certificate


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.7-3
changelog:
  - Bugzilla #1710105 - JSS: add RSA PSS support (jmagne)
  - Bugzilla #1796642 - JSS -- remove hardcoded native library
    /usr/lib{64}/jss/libjss4.so (ascheel)


author: Michal Srb <msrb@redhat.com> - 0:4.11-7
changelog:
  - Drop "-SNAPSHOT" from version ID
  - See: https://lists.fedoraproject.org/pipermail/java-devel/2013-August/004923.html


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 4.11-9
changelog:
  - Update to current packaging guidelines
  - Drop old Obsoletes/Provides for junit4 rename
  - Disable test which fails with Java 8


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-8
changelog:
  - Fix vlock doesn't perform PAM account management or credential reinitialization
    Resolves: #1032140


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-14
changelog:
  - Replace CtrlL_Lock with Caps_Lock in generated us.map
    Resolves: #1441411
  - Improve man pages and usage messages quality and consistency
    Resolves: #949015


author: Rex Dieter <rdieter@fedoraproject.org> 0.5.3-5
changelog:
  - kcm-gtk : "GTK+ Appearance" in systemsettings->lost and found (#628381)
  - Requires: kdebase-runtime


author: Kevin Kofler <Kevin@tigcc.ticalc.org> 0.5.3-8
changelog:
  - add support for GTK+ 3 (backported from upstream bzr gtk3 branch)
  - drop ancient Fedora < 13 env_script conditional, now always in kde-settings


author: Rex Dieter <rdieter@fedoraproject.org>
changelog:
  - 0.5.3-10
  - update kcm_category patch
  - kubuntu_01_xsettings_kipc.patch
  - drop old Obsoletes: gtk-qt-engine


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-8
changelog:
  - Powerdevil: do not notify about a non existent action
    Resolves: bz#1289149
  - Plasma taskmanager: close context menu when task is closed
    Resolves: bz#1262603


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-10
changelog:
  - Fix grouping of tasks in taskmanager applet
    Resolves: bz#1348917
  - Fix unlocking of kscreenlocker, unlock it just once
    Resolves: bz#1333441


author: Jan Grulich <jgrulich@redhat.com> - 4.11-19-13
changelog:
  - Sanitise notification HTML
    Resolves: bz#1568853

  - Increase cpu buffer size in ksysguard
    Resolves: bz#1611762


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-14
changelog:
  - Do not show disabled buttons in Plastik decoration theme
    Resolves: bz#1677641

  - Taskmanager: dismiss group when application is closed and there is enough space
    Resolve: bz#1698048


author: Daniel Vrátil <dvratil@redhat.com> - 4.10.5-21
changelog:
  - Resolves: bz#1090492 - changing calendar settings does not appear in plasmoid until month changed (fixed patch)
  - Resolves: bz#1109936 - incorrect dispaly corner detection with multiple displays (fixed patch)


author: Ryan Rix <ry@n.rix.si> - 0.3.1-3
changelog:
  - Update the category to adhere to new SC 4.5 systemsettings layout. Will now
    appear under the "input devices" section.


author: Kevin Kofler <Kevin@tigcc.ticalc.org> - 0.3.1-6
changelog:
  - Merge bugfixes from Kubuntu, fixes circular scrolling and more (#633353)
  - Drop default kcmtouchpadrc, use driver defaults (#611611)
  - Make the Scrolling tab use a vertical scrollbar if needed (#600121)


author: Jan Grulich <jgrulich@redhat.com> 0.9.0.8-2
changelog:
  - remove mobile-broadband-mobile-provider-devel as BR
  - add ModemManager as runtime dependency
  - add mobile-broadband-mobile-provider as runtime dependency


author: Jan Grulich <jgrulich@redhat.com> - 4.10.5-10
changelog:
  - Avoid duplicates in solid device automounter kcm
    Resolves: bz#1084191
  - Enable automount overrides even when automatic mounting is disabled
    Resolves: bz#1084497


author: Jan Grulich <jgrulich@redhat.com> - 19-23.9
changelog:
  - Check if we have write access to home directory before creating default folders
    Resolves: bz#1579764


author: Jan Grulich <jgrulich@redhat.com> - 19-23.11
changelog:
  - Do not fail when HOME is defined as multiwords
    Resolves: bz#1786089

  - Do not fail when prelink is not installed or disabled
    Resolves: bz#1732607


author: Jan Grulich <jgrulich@redhat.com> - 19-23.11
changelog:
  - Do not fail when prelink is not installed or disabled (fixed syntax
    error in previous patch)
    Resolves: bz#1732607


author: Jan Grulich <jgrulich@redhat.com> - 6:4.14.8-9
changelog:
  - Do not fork konsole process when opening terminal from apps using dolphin-part
    Resolves: bz#1710362


author: Jan Grulich <jgrulich@redhat.com> - 6:4.14.8-6
changelog:
  - KAuth: verify that whoever is calling us is actually who he says he is (CVE-2017-8422)
    Resolves: CVE-2017-8422


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-1818.0.1.el7uek]
changelog:
  - IB/core: Introducing /sys/class/infiniband_verbs/uek_abi_version (Gerd Rausch)  [Orabug: 27876851]  
  - cpufreq: CPPC: Use transition_delay_us depending transition_latency (George Cherian)  [Orabug: 27766637]  
  - uek-rpm: aarch64 olddefconfig update to 4.14.35 (Tom Saeger)  [Orabug: 27981014]  
  - uek-rpm: aarch64 disable nct hwmon modules (Tom Saeger)  [Orabug: 27980341]  
  - uek-rpm: aarch64 remove perl dependency from perf (Tom Saeger)  [Orabug: 27981033]  
  - uek-rpm: aarch64 add arm64 defconfig platforms (Tom Saeger)  [Orabug: 27980988]


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-1818.0.2.el7uek]
changelog:
  - scsi: esas2r: remove initialization / cleanup dead wood (Christoph Hellwig)  [Orabug: 28011715]  
  - sctp: Copy struct sctp_sock.autoclose to userspace using put_user() (David Windsor)  [Orabug: 28022093]  
  - lkdtm: Update usercopy tests for whitelisting (Kees Cook)  [Orabug: 28022093]  
  - arm: Implement thread_struct whitelist for hardened usercopy (Kees Cook)  [Orabug: 28022093]  
  - arm64: Implement thread_struct whitelist for hardened usercopy (Kees Cook)  [Orabug: 28022093]  
  - x86: Implement thread_struct whitelist for hardened usercopy (Kees Cook)  [Orabug: 28022093]  
  - fork: Provide usercopy whitelisting for task_struct (Kees Cook)  [Orabug: 28022093]  
  - net: Restrict unwhitelisted proto caches to size 0 (Kees Cook)  [Orabug: 28022093]  
  - sctp: Define usercopy region in SCTP proto slab cache (David Windsor)  [Orabug: 28022093]  
  - caif: Define usercopy region in caif proto slab cache (David Windsor)  [Orabug: 28022093]  
  - ip: Define usercopy region in IP proto slab cache (David Windsor)  [Orabug: 28022093]  
  - scsi: Define usercopy region in scsi_sense_cache slab cache (David Windsor)  [Orabug: 28022093]  
  - orangefs: Define usercopy region in orangefs_inode_cache slab cache (David Windsor)  [Orabug: 28022093]  
  - exofs: Define usercopy region in exofs_inode_cache slab cache (David Windsor)  [Orabug: 28022093]  
  - befs: Define usercopy region in befs_inode_cache slab cache (David Windsor)  [Orabug: 28022093]  
  - jfs: Define usercopy region in jfs_ip slab cache (David Windsor)  [Orabug: 28022093]  
  - vfs: Copy struct mount.mnt_id to userspace using put_user() (David Windsor)  [Orabug: 28022093]  
  - dcache: Define usercopy region in dentry_cache slab cache (David Windsor)  [Orabug: 28022093]  
  - ext4: Define usercopy region in ext4_inode_cache slab cache (David Windsor)  [Orabug: 28022093]  
  - ext2: Define usercopy region in ext2_inode_cache slab cache (David Windsor)  [Orabug: 28022093]  
  - ufs: Define usercopy region in ufs_inode_cache slab cache (David Windsor)  [Orabug: 28022093]  
  - vxfs: Define usercopy region in vxfs_inode slab cache (David Windsor)  [Orabug: 28022093]  
  - cifs: Define usercopy region in cifs_request slab cache (David Windsor)  [Orabug: 28022093]  
  - net: Define usercopy region in struct proto slab cache (David Windsor)  [Orabug: 28022093]  
  - fork: Define usercopy region in mm_struct slab caches (David Windsor)  [Orabug: 28022093]  
  - fork: Define usercopy region in thread_stack slab caches (David Windsor)  [Orabug: 28022093]  
  - net: Whitelist the skbuff_head_cache "cb" field (Kees Cook)  [Orabug: 28022093]  
  - vfs: Define usercopy region in names_cache slab caches (David Windsor)  [Orabug: 28022093]  
  - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen)  [Orabug: 28004007]  {CVE-2018-10323} 
  - ARM: dts: bcm2837-rpi-3-b: add GPIO expander (Baruch Siach)  [Orabug: 27883564]  
  - ARM: dts: bcm283x: Fix pin function of JTAG pins (Henry Zhang)  [Orabug: 27883564]  
  - arm64: dts: broadcom: Add reference to Raspberry Pi 3 B+ (Stefan Wahren)  [Orabug: 27883564]  
  - ARM: dts: bcm2837: Add Raspberry Pi 3 B+ (Stefan Wahren)  [Orabug: 27883564]  
  - dt-bindings: bcm: Add Raspberry Pi 3 B+ (Stefan Wahren)  [Orabug: 27883564]  
  - ARM: dts: bcm2837: Add missing GPIOs of Expander (Stefan Wahren)  [Orabug: 27883564]  
  - ARM: dts: bcm283x: Fix PWM pin assignment (Stefan Wahren)  [Orabug: 27883564]  
  - ARM: dts: bcm283x: Use GPIO polarity defines consistently (Stefan Wahren)  [Orabug: 27883564]  
  - arm64: sdei: Add trampoline code for remapping the kernel (James Morse)  [Orabug: 28003465]  
  - arm64: mmu: add the entry trampolines start/end section markers into sections.h (James Morse)  [Orabug: 28003465]  
  - firmware: arm_sdei: Discover SDEI support via ACPI (James Morse)  [Orabug: 28003465]  
  - arm64: acpi: Remove __init from acpi_psci_use_hvc() for use by SDEI (James Morse)  [Orabug: 28003465]  
  - firmware: arm_sdei: add support for CPU private events (James Morse)  [Orabug: 28003465]  
  - firmware: arm_sdei: Add support for CPU and system power states (James Morse)  [Orabug: 28003465]  
  - arm64: kernel: Add arch-specific SDEI entry code and CPU masking (James Morse)  [Orabug: 28003465]  
  - arm64: uaccess: Add PAN helper (James Morse)  [Orabug: 28003465]  
  - arm64: Add vmap_stack header file (James Morse)  [Orabug: 28003465]  
  - firmware: arm_sdei: Add driver for Software Delegated Exceptions (James Morse)  [Orabug: 28003465]  
  - Docs: dt: add devicetree binding for describing arm64 SDEI firmware (James Morse)  [Orabug: 28003465]  
  - arm64: alternatives: use tpidr_el2 on VHE hosts (James Morse)  [Orabug: 28003465]  
  - uek-rpm: Update linux-firmware dependency to latest (Somasundaram Krishnasamy)  [Orabug: 27989707]  
  - kbuild: arm64: Set objects.builtin dependency to Image for CONFIG_CTF (Dave Kleikamp)  [Orabug: 27988752]  
  - Revert "qla2xxx: Remove unavailable firmware files" (Somasundaram Krishnasamy)  [Orabug: 27853785]  
  - tcmu: Fix trailing semicolon (Luis de Bethencourt)  [Orabug: 27986186]  
  - tcmu: fix cmd user after free (Mike Christie)  [Orabug: 27986186]  
  - target: fix destroy device in target_configure_device (tangwenji)  [Orabug: 27986186]  
  - tcmu: allow userspace to reset ring (Mike Christie)  [Orabug: 27986186]  
  - target core: add device action configfs files (Mike Christie)  [Orabug: 27986186]  
  - tcmu: fix error return code in tcmu_configure_device() (Wei Yongjun)  [Orabug: 27986186]  
  - target_core_user: add cmd id to broken ring message (Mike Christie)  [Orabug: 27986186]  
  - target: add SAM_STAT_BUSY sense reason (Mike Christie)  [Orabug: 27986186]  
  - tcmu: prevent corruption when invalid data page requested (Mike Christie)  [Orabug: 27986186]  
  - tcmu: allow max block and global max blocks to be settable (Mike Christie)  [Orabug: 27986186]  
  - tcmu: make ring buffer timer configurable (Mike Christie)  [Orabug: 27986186]  
  - tcmu: don't block submitting context for block waits (Mike Christie)  [Orabug: 27986186]  
  - tcmu: simplify dbi thresh handling (Mike Christie)  [Orabug: 27986186]  
  - tcmu: prep queue_cmd_ring to be used by unmap wq (Mike Christie)  [Orabug: 27986186]  
  - tcmu: clean up the scatter helper (Xiubo Li)  [Orabug: 27986186]  
  - tcmu: fix free block calculation (Mike Christie)  [Orabug: 27986186]  
  - tcmu: simplify scatter_data_area error handling (Mike Christie)  [Orabug: 27986186]  
  - tcmu: remove commands_lock (Mike Christie)  [Orabug: 27986186]  
  - tcmu: move expired command completion to unmap thread (Mike Christie)  [Orabug: 27986186]  
  - tcmu: fix unmap thread race (Mike Christie)  [Orabug: 27986186]  
  - tcmu: split unmap_thread_fn (Mike Christie)  [Orabug: 27986186]  
  - tcmu: merge common block release code (Mike Christie)  [Orabug: 27986186]  
  - tcmu: fix page addr in tcmu_flush_dcache_range (tangwenji)  [Orabug: 27986186]  
  - tcmu: Add a missing unlock on an error path (Dan Carpenter)  [Orabug: 27986186]  
  - tcmu: Fix some memory corruption (Dan Carpenter)  [Orabug: 27986186]  
  - tcmu: fix double se_cmd completion (Mike Christie)  [Orabug: 27986186]  
  - target: Add netlink command reply supported option for each device (Kenjiro Nakayama)  [Orabug: 27986186]  
  - target/tcmu: Use macro to call container_of in tcmu_cmd_time_out_show (Kenjiro Nakayama)  [Orabug: 27986186]  
  - tcmu: fix crash when removing the tcmu device (Xiubo Li)  [Orabug: 27986186]  
  - target: return SAM_STAT_TASK_SET_FULL for TCM_OUT_OF_RESOURCES (Mike Christie)  [Orabug: 27986186]  
  - target: fix ALUA state file path truncation (David Disseldorp)  [Orabug: 27986186]  
  - iscsi-target: fix memory leak in iscsit_release_discovery_tpg() (tangwenji)  [Orabug: 27986186]  
  - target: fix match_token option in target_core_configfs.c (tangwenji)  [Orabug: 27986186]  
  - target: add sense code INSUFFICIENT REGISTRATION RESOURCES (tangwenji)  [Orabug: 27986186]  
  - kernel.spec: add requires system-release for OL7 (Brian Maly)  [Orabug: 27964290]


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-1818.0.3.el7uek]
changelog:
  - Revert "mlx4: change the ICM table allocations to lowest needed size" (Håkon Bugge)  [Orabug: 27979815]  
  - uek-rpm: aarch64 make olddefconfig for ARM SDEI (Tom Saeger)  [Orabug: 28043363]  
  - uek-rpm: aarch64 build using oracle-armtoolset (Tom Saeger)  [Orabug: 28048505]  
  - uek-rpm: aarch64 enable QLOGIC modules (Tom Saeger)  [Orabug: 28043482]  
  - uek-rpm: aarch64 disable HARDENED_USERCOPY (Tom Saeger)  [Orabug: 28043473]  
  - uek-rpm: aarch64 disable modules that panic kernel (Tom Saeger)  [Orabug: 28043451]  
  - uek-rpm: Add kernel/drivers/crypto/ccp/ccp.ko to nano modules list (Liam Merwick)  [Orabug: 28035328]  
  - arm64: iommu: default to iommu.passthrough=1 (Tom Saeger)  [Orabug: 27933624]  
  - uek-rpm: aarch64 make TORTURE modules debug only (Tom Saeger)  [Orabug: 28043498]


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-1818.0.4.el7uek]
changelog:
  - uek-rpm: enable building SHA3 algorithms (Khalid Aziz)  [Orabug: 27204940]  
  - xfs: convert XFS_AGFL_SIZE to a helper function (Dave Chinner)  [Orabug: 28064324]  
  - xfs: detect agfl count corruption and reset agfl (Brian Foster)  [Orabug: 28064324]  
  - uek-rpm: aarch64 use 64K pagesize (Tom Saeger)  [Orabug: 28071298]


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-1818.0.5.el7uek]
changelog:
  - uek-rpm: aarch64 make olddefconfig usercopy whitelist (Tom Saeger)  [Orabug: 28096626]  
  - scsi: core: run queue if SCSI device queue isn't ready and queue is idle (Ming Lei)  [Orabug: 28088148]  
  - SCSI: don't get target/host busy_count in scsi_mq_get_budget() (Ming Lei)  [Orabug: 28088148]  
  - scsi: lpfc: update driver version to 12.0.0.2 (James Smart)  [Orabug: 28078300]  
  - scsi: lpfc: Correct missing remoteport registration during link bounces (James Smart)  [Orabug: 28078300]  
  - scsi: lpfc: Fix NULL pointer reference when resetting adapter (James Smart)  [Orabug: 28078300]  
  - scsi: lpfc: Fix nvme remoteport registration race conditions (James Smart)  [Orabug: 28078300]  
  - scsi: lpfc: Fix driver not recovering NVME rports during target link faults (James Smart)  [Orabug: 28078300]  
  - scsi: lpfc: Fix WQ/CQ creation for older asic's. (James Smart)  [Orabug: 28078300]  
  - scsi: lpfc: Fix NULL pointer access in lpfc_nvme_info_show (James Smart)  [Orabug: 28078300]  
  - scsi: lpfc: Fix lingering lpfc_wq resource after driver unload (James Smart)  [Orabug: 28078300]  
  - scsi: lpfc: Fix Abort request WQ selection (James Smart)  [Orabug: 28078300]  
  - scsi: lpfc: Enlarge nvmet asynchronous receive buffer counts (James Smart)  [Orabug: 28078300]  
  - scsi: lpfc: Add per io channel NVME IO statistics (James Smart)  [Orabug: 28078300]  
  - scsi: lpfc: Correct target queue depth application changes (James Smart)  [Orabug: 28078300]  
  - scsi: lpfc: Fix multiple PRLI completion error path (James Smart)  [Orabug: 28078300]  
  - scsi: lpfc: make several unions static, fix non-ANSI prototype (Colin Ian King)  [Orabug: 28078300]  
  - uek-rpm: aarch64 set default cpu governor to PERFORMANCE (Tom Saeger)  [Orabug: 28084219]  
  - system panic with active bonding enabled via resilient_rdmaip (Sudhakar Dindukurti)  [Orabug: 28069278]  
  - fsnotify: Fix fsnotify_mark_connector race (Robert Kolchmeyer)  [Orabug: 27110182]  
  - task_struct: only use anon struct under randstruct plugin (Kees Cook)  [Orabug: 27110182]  
  - add correct copyright/license info to uek_kabi.h (Dan Duval)  [Orabug: 27110182]  
  - add new checksum files for kABI; re-enable kABI checking (Dan Duval)  [Orabug: 27110182]  
  - add padding to writeback_control structure for future expansion (Dan Duval)  [Orabug: 27110182]  
  - add padding to scheduler data structures for future expansion (Dan Duval)  [Orabug: 27110182]  
  - add padding to PCI data structures for future expansion (Dan Duval)  [Orabug: 27110182]  
  - add padding to memory-management data structures for future expansion (Dan Duval)  [Orabug: 27110182]  
  - add padding to networking structures for future expansion (Dan Duval)  [Orabug: 27110182]  
  - add padding to cgroup structures for future expansion (Dan Duval)  [Orabug: 27110182]  
  - add padding to block-device data structures for future expansion (Dan Duval)  [Orabug: 27110182]  
  - add padding to scsi data structures for future expansion (Dan Duval)  [Orabug: 27110182]  
  - kABI padding for Oracle-specific future extensions (Dan Duval)  [Orabug: 27110182]  
  - mailbox: ACPI: erroneous error message when parsing the ACPI PCCT (Allen Pais)  [Orabug: 27468132]  
  - lan78xx: Lan7801 Support for Fixed PHY (Raghuram Chary J)  [Orabug: 27889387]  
  - lan78xx: Add support to dump lan78xx registers (Raghuram Chary J)  [Orabug: 27889387]  
  - dt-bindings: Document the DT bindings for lan78xx (Phil Elwell)  [Orabug: 27889387]  
  - lan78xx: Read LED states from Device Tree (Phil Elwell)  [Orabug: 27889387]  
  - lan78xx: Read MAC address from DT if present (Phil Elwell)  [Orabug: 27889387]  
  - lan78xx: PHY DSP registers initialization to address EEE link drop issues with long cables (Raghuram Chary J)  [Orabug: 27889387]  
  - lan78xx: Don't reset the interface on open (Phil Elwell)  [Orabug: 27889387]  
  - lan78xx: Avoid spurious kevent 4 "error" (Phil Elwell)  [Orabug: 27889387]  
  - lan78xx: Connect phy early (Alexander Graf)  [Orabug: 27889387]  
  - lan78xx: Set ASD in MAC_CR when EEE is enabled. (Raghuram Chary J)  [Orabug: 27889387]  
  - lan78xx: remove redundant initialization of pointer 'phydev' (Colin Ian King)  [Orabug: 27889387]  
  - net: phy: add paged phy register accessors (Russell King)  [Orabug: 27889387]  
  - net: phy: add unlocked accessors (Russell King)  [Orabug: 27889387]  
  - net: mdiobus: add unlocked accessors (Russell King)  [Orabug: 27889387]  
  - vmscan: fix build warning caused by commit 44b0e03f8ab1 (Khalid Aziz)  [Orabug: 27950186]


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-1818.0.6.el7uek]
changelog:
  - xen/pv: Do not call get_cpu_cap() for PV guest in xen_start_kernel() (Boris Ostrovsky)  [Orabug: 28121079]  
  - KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD (Tom Lendacky)  [Orabug: 28063989]  {CVE-2018-3639} 
  - x86/bugs/IBRS: Keep SSBD mitigation in effect if spectre_v2=ibrs is selected. (Boris Ostrovsky)   
  - KVM/VMX: Expose SSBD properly to guests (Konrad Rzeszutek Wilk)   {CVE-2018-3639} 
  - x86/speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG (Thomas Gleixner)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs: Rework spec_ctrl base and mask logic (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs: Expose x86_spec_ctrl_base directly (Thomas Gleixner)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs: Unify x86_spec_ctrl_{set_guest,restore_host} (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/speculation: Rework speculative_store_bypass_update() (Thomas Gleixner)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/speculation: Add virtualized speculative store bypass disable support (Tom Lendacky)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/speculation: Handle HT correctly on AMD (Thomas Gleixner)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/cpufeatures: Add FEATURE_ZEN (Thomas Gleixner)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/cpufeatures: Disentangle SSBD enumeration (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS (Thomas Gleixner)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/speculation: Use synthetic bits for IBRS/IBPB/STIBP (Borislav Petkov)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs: Rename SSBD_NO to SSB_NO (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - xen: Don't call non-Xen routines early in the boot (Boris Ostrovsky)  [Orabug: 28041775]  {CVE-2018-3639} 
  - KVM: SVM: Move spec control call after restore of GS (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/cpu: Make alternative_msr_write work for 32-bit code (Jim Mattson)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs: Fix the parameters alignment and missing void (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs: Make cpu_show_common() static (Jiri Kosina)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs: Fix __ssb_select_mitigation() return type (Jiri Kosina)  [Orabug: 28041775]  {CVE-2018-3639} 
  - Documentation/spec_ctrl: Do some minor cleanups (Borislav Petkov)  [Orabug: 28041775]  {CVE-2018-3639} 
  - proc: Use underscores for SSBD in 'status' (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs: Rename _RDS to _SSBD (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/speculation: Make "seccomp" the default mode for Speculative Store Bypass (Kees Cook)  [Orabug: 28041775]  {CVE-2018-3639} 
  - seccomp: Move speculation migitation control to arch code (Thomas Gleixner)  [Orabug: 28041775]  {CVE-2018-3639} 
  - seccomp: Add filter flag to opt-out of SSB mitigation (Kees Cook)  [Orabug: 28041775]  {CVE-2018-3639} 
  - seccomp: Use PR_SPEC_FORCE_DISABLE (Thomas Gleixner)  [Orabug: 28041775]  {CVE-2018-3639} 
  - prctl: Add force disable speculation (Thomas Gleixner)  [Orabug: 28041775]  {CVE-2018-3639} 
  - seccomp: Enable speculation flaw mitigations (Kees Cook)  [Orabug: 28041775]  {CVE-2018-3639} 
  - proc: Provide details on speculation flaw mitigations (Kees Cook)  [Orabug: 28041775]  {CVE-2018-3639} 
  - nospec: Allow getting/setting on non-current task (Kees Cook)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs/IBRS: Disable SSB (RDS) if IBRS is selected for spectre_v2. (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/speculation: Add prctl for Speculative Store Bypass mitigation (Thomas Gleixner)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/process: Allow runtime control of Speculative Store Bypass (Thomas Gleixner)  [Orabug: 28041775]  {CVE-2018-3639} 
  - prctl: Add speculation control prctls (Thomas Gleixner)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/speculation: Create spec-ctrl.h to avoid include hell (Thomas Gleixner)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/KVM/VMX: Expose SPEC_CTRL Bit(2) to the guest (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs/AMD: Add support to disable RDS on Fam[15,16,17]h if requested (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs: Whitelist allowed SPEC_CTRL MSR values (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs/intel: Set proper CPU features and setup RDS (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/cpufeatures: Add X86_FEATURE_RDS (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs: Expose /sys/../spec_store_bypass (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs, KVM: Support the combination of guest and host IBRS (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs/IBRS: Warn if IBRS is enabled during boot. (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs/IBRS: Use variable instead of defines for enabling IBRS (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs: Read SPEC_CTRL MSR during boot and re-use reserved bits (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs: Concentrate bug reporting into a separate function (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs: Concentrate bug detection into a separate function (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/nospec: Simplify alternative_msr_write() (Linus Torvalds)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/bugs/IBRS: Turn on IBRS in spectre_v2_select_mitigation (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - x86/msr: Add SPEC_CTRL_IBRS.. (Konrad Rzeszutek Wilk)  [Orabug: 28041775]  {CVE-2018-3639} 
  - arm64: add support for crashkernel=auto (Dave Kleikamp)  [Orabug: 27080948]  
  - i40e: disable MSI-X in kdump kernel (Shan Hai)  [Orabug: 28064626]  
  - uek-rpm: aarch64 sync NVME config with x86 (Tom Saeger)  [Orabug: 28097243]  
  - uek-rpm: config: disable CONFIG_DEBUG_VM on aarch64 (Henry Willard)  [Orabug: 28104017]  
  - PCI: hv: Fix 2 hang issues in hv_compose_msi_msg() (Dexuan Cui)  [Orabug: 27384409]  
  - use the new async probing feature for the hyperv drivers (Arjan van de Ven)  [Orabug: 27384409]  
  - tools: adding file to support building user level daemon (Vivek Yadav)  [Orabug: 27384409]  
  - pci-hyperv: Use only 16 bit integer for PCI domain (Haiyang Zhang)  [Orabug: 27384409]  
  - hv_balloon: fix bugs in num_pages_onlined accounting (Vitaly Kuznetsov)  [Orabug: 27384409]  
  - hv_balloon: fix printk loglevel (Vitaly Kuznetsov)  [Orabug: 27384409]  
  - hv_balloon: simplify hv_online_page()/hv_page_online_one() (Vitaly Kuznetsov)  [Orabug: 27384409]  
  - hv_balloon: trace post_status (Vitaly Kuznetsov)  [Orabug: 27384409]  
  - Revert "Add a SysRq option to lift kernel lockdown" (Victor Erminpour)  [Orabug: 28111227]  
  - uek-rpm: Disable CONFIG_NET_VRF (Victor Erminpour)  [Orabug: 28111216]  
  - uek-rpm: Enable CONFIG_QED_OOO option in UEK5 (Victor Erminpour)  [Orabug: 28111210]  
  - uek-rpm: Run 'make olddefconfig' for UEK5 v4.14.35 (Victor Erminpour)  [Orabug: 28111068]  
  - uek-rpm: Turn on intel iommu/vt-d (Tushar Dave)  [Orabug: 28111039]  
  - uek-rpm: Enable silently dropped options from UEK4 (Victor Erminpour)  [Orabug: 28111022]  
  - uek-rpm: Remove deprecated config options from UEK5 (Victor Erminpour)  [Orabug: 28110994]  
  - uek-rpm: Enable kernel-uek-headers build. (Victor Erminpour)  [Orabug: 28029386]


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-1818.0.7.el7uek]
changelog:
  - x86/smpboot: Fix __max_logical_packages estimate (Prarit Bhargava)  [Orabug: 28084492]  
  - perf/x86/intel/uncore: Cache logical pkg id in uncore driver (Andi Kleen)  [Orabug: 28084492]  
  - fix kABI breakage caused by "x86/topology: Avoid wasting 128k for package id array" (Dan Duval)  [Orabug: 28084492]  
  - x86/topology: Avoid wasting 128k for package id array (Andi Kleen)  [Orabug: 28084492]  
  - uek-rpm: aarch64 Disable CONFIG_NET_VRF (Victor Erminpour)  [Orabug: 28158147]  
  - qla2xxx: invalid argument and missing return type with qlogic bugfix 28150193 (Rajan Shanmugavelu)  [Orabug: 28158898]  
  - xen-swiotlb: fix the check condition for xen_swiotlb_free_coherent (Joe Jin)  [Orabug: 28065196]  
  - qla2xxx: move allocation of qla2xxx_wq to earlier in adapter initialization (Himanshu Madhani)  [Orabug: 27879024]  
  - scsi: qla2xxx: Correct setting of SAM_STAT_CHECK_CONDITION (Johannes Thumshirn)  [Orabug: 27879024]  
  - scsi: qla2xxx: correctly shift host byte (Johannes Thumshirn)  [Orabug: 27879024]  
  - scsi: qla2xxx: Fix race condition between iocb timeout and initialisation (Ben Hutchings)  [Orabug: 27879024]  
  - scsi: qla2xxx: Avoid double completion of abort command (Ben Hutchings)  [Orabug: 27879024]  
  - qla2xxx: check for null fcport in qla24xx_handle_gnl_done_event() (Chuck Anderson)  [Orabug: 27969526]  
  - qla2xxx: Enable buffer boundary check when DIF bundling is on. (Rajan Shanmugavelu)  [Orabug: 28150193]


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-1818.0.9.el7uek]
changelog:
  - crypto: introduce crypto wait for async op (Gilad Ben-Yossef)  [Orabug: 28202897]  {CVE-2018-5703} 
  - tls: Use correct sk->sk_prot for IPV6 (Boris Pismenny)  [Orabug: 28202897]  {CVE-2018-5703} 
  - tls: getsockopt return record sequence number (Boris Pismenny)  [Orabug: 28202897]  {CVE-2018-5703} 
  - tls: reset the crypto info if copy_from_user fails (Boris Pismenny)  [Orabug: 28202897]  {CVE-2018-5703} 
  - net: add a UID to use for ULP socket assignment (John Fastabend)  [Orabug: 28202897]  {CVE-2018-5703} 
  - tls: Add support for encryption using async offload accelerator (Vakul Garg)  [Orabug: 28202897]  {CVE-2018-5703} 
  - tls: Correct length of scatterlist in tls_sw_sendpage (Dave Watson)  [Orabug: 28202897]  {CVE-2018-5703} 
  - tls: don't override sk_write_space if tls_set_sw_offload fails. (Ilya Lesokhin)  [Orabug: 28202897]  {CVE-2018-5703} 
  - tls: Avoid copying crypto_info again after cipher_type check. (Ilya Lesokhin)  [Orabug: 28202897]  {CVE-2018-5703} 
  - tls: Move tls_make_aad to header to allow sharing (Ilya Lesokhin)  [Orabug: 28202897]  {CVE-2018-5703} 
  - tls: Fix TLS ulp context leak, when TLS_TX setsockopt is not used. (Ilya Lesokhin)  [Orabug: 28202897]  {CVE-2018-5703} 
  - tls: Add function to update the TLS socket configuration (Ilya Lesokhin)  [Orabug: 28202897]  {CVE-2018-5703}


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-1818.0.10.el7uek]
changelog:
  - RDMA/i40iw: Avoid panic when objects are being created and destroyed (Andrew Boyer)  [Orabug: 28002611]  
  - RDMA/i40iw: Avoid reference leaks when processing the AEQ (Andrew Boyer)  [Orabug: 28002611]  
  - RDMA/i40iw: Avoid panic when reading back the IRQ affinity hint (Andrew Boyer)  [Orabug: 28002611]  
  - ext4: fix bitmap position validation (Lukas Czerner)  [Orabug: 28078155]  
  - rpi: MMC fails to find DMA channel and falls back to PIO (Vijay Kumar)  [Orabug: 28075064]  
  - rds: tcp: compute m_ack_seq as offset from ->write_seq (Sowmini Varadhan)  [Orabug: 28085194]  
  - RPI: Fix serial console for RPI 3B and B+ (Vijay Kumar)  [Orabug: 28181668]  
  - IB/rdmaip: Fix bug in failover_group parsing (Håkon Bugge)  [Orabug: 28198745]  
  - xhci: Fix USB3 NULL pointer dereference at logical disconnect. (Mathias Nyman)  [Orabug: 28171827]


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-1818.0.15.el7uek]
changelog:
  - tcp: add tcp_ooo_try_coalesce() helper (Eric Dumazet)  [Orabug: 28453849]  {CVE-2018-5390} 
  - tcp: call tcp_drop() from tcp_data_queue_ofo() (Eric Dumazet)  [Orabug: 28453849]  {CVE-2018-5390} 
  - tcp: detect malicious patterns in tcp_collapse_ofo_queue() (Eric Dumazet)  [Orabug: 28453849]  {CVE-2018-5390} 
  - tcp: avoid collapses in tcp_prune_queue() if possible (Eric Dumazet)  [Orabug: 28453849]  {CVE-2018-5390} 
  - tcp: free batches of packets in tcp_prune_ofo_queue() (Eric Dumazet)  [Orabug: 28453849]  {CVE-2018-5390}


author: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> [4.14.35-1818.el7uek]
changelog:
  - rds_ib_exits() should free the rds_ib_inet_socket kernel socket (Sudhakar Dindukurti)  [Orabug: 27884217]  
  - iommu/arm-smmu: Enable bypass transaction caching for ARM SMMU 500 (Feng Kan)  [Orabug: 27854637]  
  - config: enable fasttrap provider for arm64 (Kris Van Hees)  [Orabug: 27847920]  
  - dtrace: fasttrap provider (USDT and pid) for aarch64 (Kris Van Hees)  [Orabug: 27847920]  
  - arm64: uprobes warning about non-uprobes sstep (Kris Van Hees)  [Orabug: 27925902]  
  - dtrace: fix user stack sentinel handling (Kris Van Hees)  [Orabug: 27847920]  
  - net/rds: ib: Release correct number of frags (Håkon Bugge)  [Orabug: 27902555]  
  - uek-rpm: Enable build of kernel-uek-doc rpm (Somasundaram Krishnasamy)  [Orabug: 27845100]  
  - ctf: do not warn about arrays with a name. (Nick Alcock)  [Orabug: 27901553]  
  - ctf: do not warn about structure members with no decl_file. (Nick Alcock)  [Orabug: 27901553]  
  - ctf: avoid strlen()ing a null pointer on an OOM path (Nick Alcock)  [Orabug: 27901553]  
  - x86/kernel/traps.c: fix trace_die_notifier return value (Kris Van Hees)   
  - x86/kABI: Increase the NCAPINTS in case we need more CPU bits. (Konrad Rzeszutek Wilk)  [Orabug: 27895138]  
  - uek-rpm: Enable options from RHCK-7.5 missing in UEK5 (Victor Erminpour)  [Orabug: 27866120]  
  - uek-rpm: Enable CONFIG_EDAC_SKX and CONFIG_RAS_CEC (Victor Erminpour)  [Orabug: 27824333]  
  - x86/microcode: probe CPU features on microcode update (Ankur Arora)  [Orabug: 27878225]  
  - x86/microcode: microcode_write() should not reference boot_cpu_data (Ankur Arora)  [Orabug: 27878225]  
  - x86/cpufeatures: use cpu_data in init_speculation_control() (Ankur Arora)  [Orabug: 27878225]  
  - Remove unused active bonding and iwarp code (Sudhakar Dindukurti)  [Orabug: 27905986]  
  - net: don't call update_pmtu unconditionally (Nicolas Dichtel)  [Orabug: 27706794]


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-1818.1.0.el7uek]
changelog:
  - ipmi: Remove ACPI SPMI probing from the SSIF (I2C) driver (Corey Minyard)  [Orabug: 27628285]  
  - rds: tcp: cancel all worker threads before shutting down socket (Sowmini Varadhan)  [Orabug: 28350092]  
  - scsi: megaraid_sas: fix selection of reply queue (Ming Lei)  [Orabug: 28353250]  
  - genirq/affinity: assign vectors to all possible CPUs (Christoph Hellwig)  [Orabug: 28353250]  
  - rds: signedness bug (Dan Carpenter)  [Orabug: 28319158]  
  - proc/kcore: don't bounds check against address 0 (Laura Abbott)  [Orabug: 28321870]  
  - mm/gup.c: teach get_user_pages_unlocked to handle FOLL_NOWAIT (Andrea Arcangeli)  [Orabug: 28322517]  
  - ocfs2: Fix locking for res->tracking and dlm->tracking_list (Ashish Samant)  [Orabug: 28256389]  
  - add kernel param to pre-allocate NICs (Brian Maly)  [Orabug: 28257071]


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-1818.1.1.el7uek]
changelog:
  - net/rds: Implement ARP flushing correctly (Håkon Bugge)  [Orabug: 28219851]  
  - scsi: smartpqi: bump driver version to 1.1.4-130 (Don Brace)   
  - scsi: smartpqi: fix critical ARM issue reading PQI index registers (Kevin Barnett)   
  - scsi: smartpqi: add inspur advantech ids (Kevin Barnett)   
  - scsi: smartpqi: improve error checking for sync requests (Kevin Barnett)   
  - scsi: smartpqi: improve handling for sync requests (Kevin Barnett)   
  - blk-mq: Allow PCI vector offset for mapping queues (Keith Busch)   
  - scsi: smartpqi: update driver version (Don Brace)   
  - scsi: smartpqi: workaround fw bug for oq deletion (Kevin Barnett)   
  - scsi: smartpqi: add in new supported controllers (Kevin Barnett)   
  - scsi: smartpqi: Convert timers to use timer_setup() (Kees Cook)   
  - uek-rpm: Enable ovmapi.ko in nano_module (Victor Erminpour)  [Orabug: 28142947]  
  - rdmaip: fix returned value not set error (Zhu Yanjun)   
  - IB: RDMAIP: avoid migration to a port that is down (Zhu Yanjun)   
  - net/rds: prevent RDS connections using stale ARP entries (Wei Lin Guay)  [Orabug: 28149099]  
  - net/rds: Fix kernel panic caused by a race between setup/teardown (Hans Westgaard Ry)  [Orabug: 28341723]  
  - net/rds: Avoid stalled connection due to CM REQ retries (Wei Lin Guay)  [Orabug: 28068633]  
  - net/rds: use one sided reconnection during a race (Wei Lin Guay)  [Orabug: 28068633]  
  - Revert "Revert "net/rds: Revert "RDS: add reconnect retry scheme for stalled" (Håkon Bugge)  [Orabug: 28068633]  
  - socket: close race condition between sock_close() and sockfs_setattr() (Cong Wang)  [Orabug: 28312496]  {CVE-2018-12232} 
  - jfs: Fix inconsistency between memory allocation and ea_buf->max_size (Shankara Pailoor)  [Orabug: 28312514]  {CVE-2018-12233} 
  - x86/speculation: Support per-process SSBD with IBRS (Alexandre Chartre)  [Orabug: 28354046]  
  - x86/speculation: Implement per-cpu IBRS control (Alexandre Chartre)  [Orabug: 28064083]


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-1818.1.2.el7uek]
changelog:
  - net/rds: Fix incorrect bigger vs. smaller IP address check (Håkon Bugge)  [Orabug: 28239459]  
  - IB/mad: Use IDR for agent IDs (willy@infradead.org)  [Orabug: 28340849]  
  - IB/mad: Agent registration is process context only (Matthew Wilcox)  [Orabug: 28340849]  
  - IB/core: Make ib_mad_client_id atomic (Håkon Bugge)  [Orabug: 28340849]  
  - scsi: lpfc: Revise copyright for new company language (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: update driver version to 12.0.0.5 (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: devloss timeout race condition caused null pointer reference (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: Fix NVME Target crash in defer rcv logic (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: Support duration field in Link Cable Beacon V1 command (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: Make PBDE optimizations configurable (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: Fix abort error path for NVMET (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: Fix panic if driver unloaded when port is offline (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: Fix driver not setting dpp bits correctly in doorbell word (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: Add Buffer overflow check, when nvme_info larger than PAGE_SIZE (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: use monotonic timestamps for statistics (Arnd Bergmann)  [Orabug: 28361789]  
  - scsi: lpfc: update driver version to 12.0.0.4 (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: Fix port initialization failure. (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: Fix 16gb hbas failing cq create. (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: Fix crash in blk_mq layer when executing modprobe -r lpfc (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: correct oversubscription of nvme io requests for an adapter (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: Fix MDS diagnostics failure (Rx < Tx) (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: fix spelling mistakes: "mabilbox" and "maibox" (Colin Ian King)  [Orabug: 28361789]  
  - scsi: lpfc: Comment cleanup regarding Broadcom copyright header (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: update driver version to 12.0.0.3 (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: Enhance log messages when reporting CQE errors (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: Fix up log messages and stats counters in IO submit code path (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: Driver NVME load fails when CPU cnt > WQ resource cnt (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: Handle new link fault code returned by adapter firmware. (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: Correct fw download error message (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: enhance LE data structure copies to hardware (James Smart)  [Orabug: 28361789]  
  - scsi: lpfc: Change IO submit return to EBUSY if remote port is recovering (James Smart)  [Orabug: 28361789]  
  - uek-rpm: aarch64 Set CONFIG_BPF_STREAM_PARSER (Henry Willard)  [Orabug: 28380994]  
  - uek-rpm: Enable net_failover.ko in nano_modules file (Victor Erminpour)  [Orabug: 28401935]  
  - uek-rpm: config: Disable CONFIG_SECURITY_DMESG_RESTRICT (Victor Erminpour)  [Orabug: 28401946]


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-1818.1.4.el7uek]
changelog:
  - x86/smpboot: Do not use smp_num_siblings in __max_logical_packages calculation (Prarit Bhargava)  [Orabug: 28390134]  
  - x86/mm/kmmio: Make the tracer robust against L1TF (Andi Kleen)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/mm/pat: Make set_memory_np() L1TF safe (Andi Kleen)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert (Andi Kleen)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Invert all not present mappings (Andi Kleen)  [Orabug: 28442418]  {CVE-2018-3620} 
  - cpu/hotplug: Fix SMT supported evaluation (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - KVM: VMX: Tell the nested hypervisor to skip L1D flush on vmentry (Paolo Bonzini)  [Orabug: 28442418]  {CVE-2018-3646} 
  - x86/speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry (Paolo Bonzini)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/speculation: Simplify sysfs report of VMX L1TF vulnerability (Paolo Bonzini)  [Orabug: 28442418]  {CVE-2018-3620} 
  - Documentation/l1tf: Remove Yonah processors from not vulnerable list (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/KVM/VMX: Don't set l1tf_flush_l1d from vmx_handle_external_intr() (Nicolai Stange)  [Orabug: 28442418]  {CVE-2018-3646} 
  - x86/irq: Let interrupt handlers set kvm_cpu_l1tf_flush_l1d (Nicolai Stange)  [Orabug: 28442418]  {CVE-2018-3646} 
  - x86: Don't include linux/irq.h from asm/hardirq.h (Nicolai Stange)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/KVM/VMX: Introduce per-host-cpu analogue of l1tf_flush_l1d (Nicolai Stange)  [Orabug: 28442418]  {CVE-2018-3646} 
  - x86/KVM/VMX: Move the l1tf_flush_l1d test to vmx_l1d_flush() (Nicolai Stange)  [Orabug: 28442418]  {CVE-2018-3646} 
  - x86/KVM/VMX: Replace 'vmx_l1d_flush_always' with 'vmx_l1d_flush_cond' (Nicolai Stange)  [Orabug: 28442418]  {CVE-2018-3646} 
  - x86/KVM/VMX: Don't set l1tf_flush_l1d to true from vmx_l1d_flush() (Nicolai Stange)  [Orabug: 28442418]  {CVE-2018-3646} 
  - KVM: VMX: support MSR_IA32_ARCH_CAPABILITIES as a feature MSR (Paolo Bonzini)  [Orabug: 28442418]  {CVE-2018-3646} 
  - cpu/hotplug: detect SMT disabled by BIOS (Josh Poimboeuf)  [Orabug: 28442418]  {CVE-2018-3620} 
  - Documentation/l1tf: Fix typos (Tony Luck)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/KVM/VMX: Initialize the vmx_l1d_flush_pages' content (Nicolai Stange)  [Orabug: 28442418]  {CVE-2018-3646} 
  - x86/speculation/l1tf: Unbreak !__HAVE_ARCH_PFN_MODIFY_ALLOWED architectures (Jiri Kosina)  [Orabug: 28442418]  {CVE-2018-3620} 
  - Documentation: Add section about CPU vulnerabilities (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/bugs, kvm: Introduce boot-time control of L1TF mitigations (Jiri Kosina)  [Orabug: 28442418]  {CVE-2018-3646} 
  - cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - cpu/hotplug: Expose SMT control init function (Jiri Kosina)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/kvm: Allow runtime control of L1D flush (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3646} 
  - x86/kvm: Serialize L1D flush parameter setter (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3646} 
  - x86/kvm: Add static key for flush always (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3646} 
  - x86/kvm: Move l1tf setup function (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3646} 
  - x86/l1tf: Handle EPT disabled state proper (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/kvm: Drop L1TF MSR list approach (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3646} 
  - x86/litf: Introduce vmx status variable (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - cpu/hotplug: Online siblings when SMT control is turned on (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required (Konrad Rzeszutek Wilk)  [Orabug: 28442418]  {CVE-2018-3646} 
  - x86/KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Konrad Rzeszutek Wilk)  [Orabug: 28442418]  {CVE-2018-3646} 
  - x86/KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting (Konrad Rzeszutek Wilk)  [Orabug: 28442418]  {CVE-2018-3646} 
  - x86/KVM/VMX: Add find_msr() helper function (Konrad Rzeszutek Wilk)  [Orabug: 28442418]  {CVE-2018-3646} 
  - x86/KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers (Konrad Rzeszutek Wilk)  [Orabug: 28442418]  {CVE-2018-3646} 
  - x86/KVM/VMX: Add L1D flush logic (Paolo Bonzini)  [Orabug: 28442418]  {CVE-2018-3646} 
  - x86/KVM/VMX: Add L1D MSR based flush (Paolo Bonzini)  [Orabug: 28442418]  {CVE-2018-3646} 
  - x86/KVM/VMX: Add L1D flush algorithm (Paolo Bonzini)  [Orabug: 28442418]  {CVE-2018-3646} 
  - x86/KVM/VMX: Add module argument for L1TF mitigation (Konrad Rzeszutek Wilk)  [Orabug: 28442418]  {CVE-2018-3646} {CVE-2018-3646} 
  - x86/KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Konrad Rzeszutek Wilk)  [Orabug: 28442418]  {CVE-2018-3646} 
  - KVM: X86: Provide a capability to disable PAUSE intercepts (Wanpeng Li)  [Orabug: 28442418]  {CVE-2018-3646} 
  - KVM: X86: Provide a capability to disable HLT intercepts (Wanpeng Li)  [Orabug: 28442418]  {CVE-2018-3646} 
  - KVM: X86: Provide a capability to disable MWAIT intercepts (Wanpeng Li)  [Orabug: 28442418]  {CVE-2018-3646} 
  - cpu/hotplug: Boot HT siblings at least once (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - Revert "x86/apic: Ignore secondary threads if nosmt=force" (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Fix up pte->pfn conversion for PAE (Michal Hocko)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Protect PAE swap entries against L1TF (Vlastimil Babka)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Borislav Petkov)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/cpufeatures: Add detection of L1D cache flush support. (Konrad Rzeszutek Wilk)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Extend 64bit swap file size limit (Vlastimil Babka)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/apic: Ignore secondary threads if nosmt=force (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/cpu/AMD: Evaluate smp_num_siblings early (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/CPU/AMD: Do not check CPUID max ext level before parsing SMP info (Borislav Petkov)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/cpu/intel: Evaluate smp_num_siblings early (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/cpu/topology: Provide detect_extended_topology_early() (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/cpu/common: Provide detect_ht_early() (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/cpu/AMD: Remove the pointless detect_ht() call (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/cpu: Remove the pointless CPU printout (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - cpu/hotplug: Provide knobs to control SMT (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - cpu/hotplug: Split do_cpu_down() (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - cpu/hotplug: Make bringup/teardown of smp threads symmetric (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/topology: Provide topology_smt_supported() (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/smp: Provide topology_is_primary_thread() (Thomas Gleixner)  [Orabug: 28442418]  {CVE-2018-3620} 
  - sched/smt: Update sched_smt_present at runtime (Peter Zijlstra)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/bugs: Move the l1tf function and define pr_fmt properly (Konrad Rzeszutek Wilk)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Limit swap file size to MAX_PA/2 (Andi Klein)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Andi Kleen)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Add sysfs reporting for l1tf (Andi Klein)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Make sure the first page is always reserved (Andi Klein)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation (Andi Klein)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Protect swap entries against L1TF (Linus Torvalds)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Change order of offset/type in swap entry (Linus Torvalds)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT (Andi Klein)  [Orabug: 28442418]  {CVE-2018-3620} 
  - x86/mm: Limit mmap() of /dev/mem to valid physical addresses (Craig Bergstrom)  [Orabug: 28442418]  {CVE-2018-3620} {CVE-2018-3620} 
  - x86/mm: Prevent non-MAP_FIXED mapping across DEFAULT_MAP_WINDOW border (Kirill A. Shutemov)  [Orabug: 28442418]  {CVE-2018-3620} {CVE-2018-3620}


