# changelog

author: Alexander Larsson <alexl@redhat.com> - 2.20-2
changelog:
  - Backport fix from svn where newly created keyrings weren't
    found
  - Don't unset default keyring on daemon shutdown


author: Alexander Larsson <alexl@redhat.com> - 2.20-4
changelog:
  - Have the pam module tell the daemon to init the login keyring 
    without using the socket as selinux limits access to that


author: Colin Walters <walters@redhat.com> - 2.22.3.6-2
changelog:
  - Add --disable-acl-prompts; you can't try to maintain integrity
    between two processes with the same UID and no other form of
    access control.


author: Richard Hughes <rhughes@redhat.com> - 2.26.0-2
changelog:
  - Fix a nasty bug that's been fixed upstream where gnome-keyring-daemon
    would hang when re-allocating from a pool of secure memory.


author: Matthias Clasen <mclasen@redhat.com> - 2.26.1-1
changelog:
  - Update to 2.26.1
  - See http://download.gnome.org/sources/gnome-keyring/2.26/gnome-keyring-2.26.1.news


author: Tomas Bzatek <tbzatek@redhat.com> - 2.29.5-2
changelog:
  - Fix endless loop when looking for password in login keyring
  - Fix undefined reference to S_ISSOCK (#557970)


author: Tomas Bzatek <tbzatek@redhat.com> - 2.29.92-2
changelog:
  - More robust error display and handling
  - [secret-store] Don't save session keyring to disk
  - [dbus] Allow unlocking even when always unlock is not available
  - [dbus] Hide the automatically unlock check when login not usable
  - [login] Fix various issues storing and using auto unlock passwords


author: David King <amigadave@amigadave.com> - 3.15.90-1
changelog:
  - Update to 3.15.90
  - Update URL
  - Use pkgconfig for BuildRequires
  - Use license macro for COPYING and COPYING.LIB
  - Preserve timestamps during install


author: Ray Strode <rstrode@redhat.com> 3.18.0-4
changelog:
  - Fix password handoff in non-autologin case
  - Remove unneccessary part of autologin fix
    Related: #1269581


author: Milan Crha <mcrha@redhat.com> - 3.28.2-5
changelog:
  - Resolves: RHEL-10493 (Move account types that depend on WebKitGTK into separate optional subpackage)


author: Milan Crha <mcrha@redhat.com> - 3.28.2-6
changelog:
  - Resolves: RHEL-10493 (Move account types that depend on WebKitGTK into separate optional subpackage)
  - backport upstream fix to use external browser for OAuth2


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.0-3
changelog:
  - Drop the run-time requirement on ImageMagick
  - Enable Python 2 during the build for itstool
  Resolves: #1564997


author: Sergey Cherevko <s.cherevko@msvsphere-os.ru> - 3.28.1-21.inferit
changelog:
  - Update Russian translation in desktop files
  - Drop gnome-custom-session.desktop
  - Rebuilt for MSVSphere 8.9


author: Sergey Cherevko <s.cherevko@msvsphere-os.ru> - 3.32.0-19.inferit.1
changelog:
  - Removing the 'System Not Registered' notification from GNOME (https://access.redhat.com/solutions/6976776)


author: Florian Müllner <fmuellner@redhat.com> - 3.32.2-50
changelog:
  - Fix struts on login screen
    Resolves: #2138941
  - Fix launching network device settings
    Resolves: #1879405


author: Owen Taylor <otaylor@redhat.com> - 2.27.2-1
changelog:
  - Update to 2.27.2
  - Add an explicit dep on gobject-introspection 0.6.5 which is required 
    for the new version


author: Adam Miller <maxamillion@fedoraproject.org> - 2.28.0.20101015git-1
changelog:
  - Added dependency on a git build of gobject-introspect to solve some breakage
  - Also went ahead and made a new git tarball


author: Adam Miller <maxamillion@fedoraproject.org> - 2.29.1-2
changelog:
  - Bumped for new version of mutter and clutter
  - Added version requirement to gjs-devel because of dependency of build


author: Adam Miller <maxamillion@fedoraproject.org> - 2.31.2-2
changelog:
  - Added new version requirements for dependencies based on upstream releases
  - Added new file listings for gnome-shell-clock-preferences binary and .desktop
  - Added gnome-shell man page file listing


author: Owen Taylor <otaylor@redhat.com> - 2.91.1-1
changelog:
  - Update to 2.91.1
  - Add libcroco-devel to BuildRequires, apparently it was getting
    pulled in indirectly before
  - Add libcanberra-devel and pulseaudio-libs-devel BuildRequires


author: Nils Philippsen <nils@redhat.com> - 3.0.0.2-1
changelog:
  - Update to 3.0.0.2 (fixes missing import that was preventing extensions from
    loading.)
  - Update source URL


author: Dan Williams <dcbw@redhat.com> - 3.0.1-4
changelog:
  - Fix initial connections to WPA Enterprise access points (#699014)
  - Fix initial connections to mobile broadband networks


author: Owen Taylor <otaylor@redhat.com> - 3.4.0-2
changelog:
  - Change gnome-shell-favourite-apps-firefox.patch to also patch the JS code
    to handle the transition from mozilla-firefox.desktop to firefox.desktop.
    (#808894, reported by Jonathan Kamens)


author: Florian Müllner <fmuellner@redhat.com> - 3.6.1-2
changelog:
  - Remove avoid-redhat-menus patch

    The standard way of supporting a desktop-specific menu layout is
    to set XDG_MENU_PREFIX (which we made gnome-session do now).


author: Kalev Lember <kalevlember@gmail.com> - 3.9.1-2
changelog:
  - Add missing telepathy-logger runtime dep
  - Depend on gnome-session-xsession so that it gets pulled in for
    typical GNOME installs


author: Florian Müllner <fmuellner@redhat.com> - 3.11.90-3
changelog:
  - Add dependency on gnome-control-center - several panels are referenced
    by a number of menu items


author: Ray Strode <rstrode@redhat.com> 3.15.91-2
changelog:
  - Drop dep on NetworkManager-config-connectivity-fedora
    It's already required by fedora-release-workstation


author: Kalev Lember <klember@redhat.com> - 3.17.4-2
changelog:
  - Create empty directories for extensions and search providers
  - Move desktop file validation to %check section
  - Use make_install macro


author: Florian Müllner <fmuellner@redhat.com> - 3.21.90.1-1
changelog:
  - Update to 3.21.90.1
    (Fixes a corrupt .desktop file that made it from the build directory into
     the 3.21.90 tarball)


author: Florian Müllner <fmuellner@redhat.com> - 3.28.3-9
changelog:
  - Fix JS "invalid access" warnings (#1642482, #1637622)
  - Fix new input sources only working after re-login (#1628154)
  - Backport IM support fixes (#1668979)


author: Carlos Garnacho <cgarnach@redhat.com> - 3.32.2-12
changelog:
  - Fix window dragging with tablets in the overview
    Resolves: #1716767
  - Fix high-contrast/symbolic race
    Resolves: #1730612
  - Make perf-tool usable on wayland
    Resolves: #1652178


author: Florian Müllner <fmuellner@redhat.com> - 3.32.2-17
changelog:
  - Really allow using perf-tool on wayland
    Resolves: #1652178
  - Fix timed login without user list
    Resolves: #1668895
  - Fix HighContrast/symbolic icon mixup
    Resolves: #1794045
  - Backport introspect API changes
    Resolves: #1837413


author: Florian Müllner <fmuellner@redhat.com> - 3.32.2-22
changelog:
  - Wake up lock screen when deactivated programmatically
    Resolves: #1854290
  - Backport better caps-lock warning
    Resolves: #1861357
  - Fix more (harmless) JS warnings
    Resolves: #1881312


author: Ray Strode <rstrode@redhat.com> - 3.32.2-36
changelog:
  - Add ability to lock down password showing
    Resolves: #1770302
  - Add requires on newer mutter version
    Related: #1937866


author: Florian Müllner <fmuellner@redhat.com> - 3.32.2-45
changelog:
  - Fix lock up when previous focus actor is destroyed during modal
    Resolves: #2075231
  - Defend against corrupt notifications file
    Resolves: #2078564


author: Florian Müllner <fmuellner@redhat.com> - 3.32.1-30
changelog:
  - Fix stuck grab if disabled with open context menu
    Resolves: #2149670
  - Support .desktop files of type Link
    Resolves: #2143825


author: Florian Müllner <fmuellner@redhat.com> - 3.32.1-31
changelog:
  - Adjust classification banner position in fullscreen
    Resolves: #2150107
  - Allow inhibiting workspace switch gesture
    Resolves: #2138109


author: Alexey Lyubimov <a.lyubimov@msvsphere.ru> - 3.32.1-38.inferit
changelog:
  - dash to panel Update Russian translation
  - dash to panel Removing items from apps menu
  - Rebuilt for MSVSphere 8.9


author: Timur Kristóf <venemo@fedoraproject.org> - 3.0.2-1.g63dd27cgit
changelog:
  - Update to a newer git snapshot
  - Fix RHBZ bug #708230
  - Enabled systemMonitor extension, but commented out since the requirements are not available


author: Michel Salim <salimma@fedoraproject.org> - 3.1.4-1
changelog:
  - Update to 3.1.4
  - Enable systemMonitor extension
  - Prepare xrandr-indicator, commenting out since it does not seem to work yet
  - Rename subpackages in line with new guidelines (# 715367)
  - Sort subpackages in alphabetical order


author: Mohamed El Morabity <melmorabity@fedoraproject.org> - 3.1.91-3.20111001gite102c0c6
changelog:
  - Update to a newer git snapshot
  - Fix GNOME Shell version to work with GS 3.2.0
  - Add Requires on GS 3.2.0 or above to gnome-shell-common


author: Mohamed El Morabity <melmorabity@fedoraproject.org> - 3.7.3-1
changelog:
  - Update to 3.7.3
  - Enable new default-min-max and static-workspaces extensions
  - Provide new subpackage gnome-classic-session
  - Revamp summaries and descriptions


author: Mohamed El Morabity <melmorabity@fedoraproject.org> - 3.7.5.1-1
changelog:
  - Update to 3.7.5
  - Enable new launch-new-instance and window-list extensions, and add them in the
    classic-mode extension set
  - Re-add places-menu in the classic-mode extension set


author: Rahul Sundaram <sundaram@fedoraproject.org> - 3.9.3-1
changelog:
  - Update to 3.9.3
  - Obsolete default-min-max and static workspaces extensions
  - Use make_install macro
  - Fix bogus dates in spec changelog


author: Ray Strode <rstrode@redhat.com> - 3.28.1-3
changelog:
  - Add a wayland variant of gnome-classic
    Also change up the names to Standard and Classic to match UX design

    Related: #1612915 1595825


author: Ray Strode <rstrode@redhat.com> - 3.28.1-4
changelog:
  - Add back corporate logo on the left of Activities
  - Remove shadow remnants of app logo to the right of Activities
    Resolves: #1620241


author: Florian Müllner <fmuellner@redhat.com> - 3.32.1-5
changelog:
  - Small refinements after design feedback:
    - use default icon size in picker button to avoid blurriness
    - use <super> shortcut to open window picker
    Resolves: #1721195


author: Florian Müllner <fmuellner@redhat.com> - 3.32-1-6
changelog:
  - Fix new classic mode issues:
    - stray signal handler with overlay key
      Resolves: #1722844
    - improve DND support:
      + don't consider regular windows
        (it doesn't work well, and GNOME 2 didn't support it either)
      + indicate that workspace thumbs are drop targets
     Related: #1704360


author: Florian Müllner <fmuellner@redhat.com> - 3.32-1-7
changelog:
  - Add window thumbnails to workspace switcher
    Resolves: #1723467
  - Fix apps-menu not disabling itself entirely
    Resolves: #1722047


author: Florian Müllner <fmuellner@redhat.com> - 3.32.1-11
changelog:
  - Adjust dash-to-dock for classic backports
    Resolves: #1805929
  - Fix inconsistent state in window-list prefs dialog
    Resolves: #1824362


author: Florian Müllner <fmuellner@redhat.com> - 3.32.1-15
changelog:
  - Fix stuck window picker after screen lock
    Resolves: #1905000
  - Add tooltips to workspace previews
    Resolves: #1894613


author: Florian Müllner <fmuellner@redhat.com> - 3.32.1-40
changelog:
  - Fix '%k' macro in .desktop files
    Resolves: RHEL-72966
  - Indicate urgency-hint in window-list
    Resolves: RHEL-70534


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.3-3
changelog:
  - Support using the '0', '+' and '-' keys from the numeric keypad as
    accelerators
  - Resolves: #837035


author: Milan Crha <mcrha@redhat.com> - 3.28.1-7
changelog:
  - extensions: Incorrectly shows enabled extensions as disabled after enable-all
  - Resolves: #1804123


author: Parag Nemade <pnemade AT redhat DOT com> - 20120503-10
changelog:
  - Add metainfo file to show this font in gnome-software
  - Remove %clean section which is optional now
  - Remove buildroot which is optional now
  - Remove removal of buildroot in %install
  - Remove %defattr
  - Remove group tag


author: Pavel Cahyna <pcahyna@redhat.com> - 5.2.4-1
changelog:
  - Rebase to upstream release 5.2.4
  - Add workaround for broken info generation (upstream bug
    https://sourceforge.net/p/gnuplot/bugs/1963/) from Debian
  - Use explicit path for texdir
  - Correct the description of command line options in manpage, bz#1612690
  - Install gnuplot-qt and gnuplot-wx manpage links, bz#1612690


author: Pavel Cahyna <pcahyna@redhat.com> - 5.2.4-2
changelog:
  - Add --with-bitmap-terminals to configure flags, among others this enables
    the pbm terminal, bz#2122652


author: Alejandro Sáez <asm@redhat.com> - 2-17
changelog:
  - Add and update the go-compiler functionality (gobuild macro)
  - Deprecate ix86
  - Update Source0
  - Resolves: rhbz#1905383


author: David Benoit <dbenoit@redhat.com> - 1.15.2-1
changelog:
  - Rebase to 1.15.2
  - Related: rhbz#1870531
  - Related: rhbz#1872622
  - Related: rhbz#1888673
  - Related: rhbz#1889437
  - Related: rhbz#1891095


author: David Benoit <dbenoit@redhat.com> - 1.16.7-1
changelog:
  - Rebase to Go 1.16.7
  - Resolves: rhbz#1994079
  - Add reject leading zeros patch
  - Resolves: rhbz#1993314


author: David Benoit <dbenoit@redhat.com> - 1.17.4-1
changelog:
  - Rebase Go to 1.17.4
  - Add vdso_s390x_gettime patch
  - Add remove_waitgroup_misuse_tests patch
  - Related: rhbz#2014088
  - Resolves: rhbz#2028570
  - Resolves: rhbz#2022828
  - Resolves: rhbz#2024686
  - Resolves: rhbz#2028662


author: David Benoit <dbenoit@redhat.com> - 1.19.4-1
changelog:
  - Rebase to Go 1.19.4
  - Fix ppc64le linker issue
  - Remove defunct patches
  - Remove downstream generated FIPS mode patches
  - Add golang-fips/go as the source for FIPS mode patches
  - Resolves: rhbz#2144542


author: Alejandro Sáez <asm@redhat.com> - 1.21.7-1
changelog:
  - Update to Go 1.21.7
  - Add aarch64 and ppc64le for Delve
  - Resolves: RHEL-24082
  - Resolves: RHEL-18363
  - Resolves: RHEL-18382


author: Archana Ravindar<aravinda@redhat.com> - 1.21.11-1
changelog:
  - Rebase to Go1.21.11 that includes fixes for CVE-2024-24789 and CVE-2024-24790
  - Resolves: RHEL-40274


author: David Benoit <dbenoit@redhat.com> - 1.22.3-1
changelog:
  - Update to Go 1.22.3
  - Resolves: RHEL-35884
  - Resolves: RHEL-35075
  - Resolves: RHEL-35632
  - Resolves: RHEL-35901


author: David Benoit <dbenoit@redhat.com> - 1.22.7-1
changelog:
  - Update to Go 1.22.7
  - Resolves: RHEL-58223
  - Resolves: RHEL-57961
  - Resolves: RHEL-57847
  - Resolves: RHEL-57860


author: Archana <aravinda@redhat.com> - 1.22.11-1
changelog:
  - Rebase to Go1.22.11 to pick up fixes for CVEs 2024-45341 and 2024-45336
  - Go rebase addresses test failures with expired certificates
  - Resolves: RHEL-73752


author: Adam Goode <adam@spicenitz.org> - 1.1.1-3
changelog:
  - Use lua for pretrans (http://fedoraproject.org/wiki/Packaging:Guidelines#The_.25pretrans_scriptlet)


author: Adam Goode <adam@spicenitz.org> - 1.1.1-4
changelog:
  - Move src to libdir for now (#973842) (upstream issue https://code.google.com/p/go/issues/detail?id=5830)
  - Eliminate noarch data package to work around RPM bug (#975909)
  - Try to add runtime-gdb.py to the gdb safe-path (#981356)


author: Adam Miller <maxamillion@fedoraproject.org> - 1.1.2-5
changelog:
  - Pull upstream patches for BZ#1010271
  - Add glibc requirement that got dropped because of meta dep fix


author: Vincent Batts <vbatts@redhat.com> - 1.1.2-6
changelog:
  - don't symlink /usr/bin out to ../lib..., move the file
  - seperate out godoc, to accomodate the go.tools godoc


author: Adam Miller <maxamillion@fedoraproject.org> 1.2-7
changelog:
  - Remove  _BSD_SOURCE and _SVID_SOURCE, they are deprecated in recent
    versions of glibc and aren't needed


author: Vincent Batts <vbatts@fedoraproject.org> 1.2.1-3
changelog:
  - including more to macros (%go_arches)
  - set a standard goroot as /usr/lib/golang, regardless of arch
  - include sub-packages for compiler toolchains, for all golang supported architectures


author: Vincent Batts <vbatts@fedoraproject.org> - 1.3-10
changelog:
  - more work to get cgo.a timestamps to line up, due to build-env
  - explicitly list all the files and directories for the source and packages trees
  - touch all the built archives to be the same


author: Vincent Batts <vbatts@fedoraproject.org> - 1.5-3
changelog:
  - bz1256910 only allow the golang zoneinfo.zip to be used in tests
  - bz1166611 add golang.org/x directory
  - bz1256525 include stdlib shared object. This will let other libraries and binaries
    build with `go build -buildmode=shared -linkshared ...` or similar.


author: Vincent Batts <vbatts@fedoraproject.org> - 1.5-6
changelog:
  - starting a shared object subpackage. This will be x86_64 only until upstream supports more arches shared objects.


author: Jakub Čajka <jcajka@redhat.com> - 1.5.2-1
changelog:
  - bz1288263 rebase to 1.5.2
  - spec file clean up
  - added build options
  - scrubbed "Project Gutenberg License"


author: Jakub Čajka <jcajka@redhat.com> - 1.5.3-1
changelog:
  - rebase to 1.5.3
  - resolves bz1293451, CVE-2015-8618
  - apply timezone patch, avoid using bundled data
  - print out rpm build system info


author: Jakub Čajka <jcajka@redhat.com> - 1.6-0.1.rc1
changelog:
  - Resolves bz1292640, rebase to pre-release 1.6
  - bootstrap for PowerPC
  - fix rpmlint errors/warning


author: Jakub Čajka <jcajka@redhat.com> - 1.6-1
changelog:
  - Resolves: bz1304701 - rebase to go1.6 release
  - Resolves: bz1304591 - fix possible stack miss-alignment in callCgoMmap


author: Jakub Čajka <jcajka@redhat.com> - 1.6.1-1
changelog:
  - rebase to 1.6.1
  - Resolves: bz1324344 - CVE-2016-3959
  - Resolves: bz1324951 - prelink is gone, /etc/prelink.conf.d/* is no longer used
  - Resolves: bz1326366 - wrong epoll_event struct for ppc64le/ppc64


author: Jakub Čajka <jcajka@redhat.com> - 1.7-0.0.rc2
changelog:
  - rebase to 1.7rc2
  - added s390x build
  - improved shared lib packaging
  - Resolves: bz1357602 - CVE-2016-5386
  - Resolves: bz1342090, bz1342090


author: Jakub Čajka <jcajka@redhat.com> - 1.7-0.3.rc5
changelog:
  - Obsolete golang-vet and golang-cover from golang-googlecode-tools package
    vet/cover binaries are provided by golang-bin rpm (thanks to jchaloup)
  - clean up exclusive arch after s390x boostrap
  - resolves: #1268206


author: Jakub Čajka <jcajka@redhat.com> - 1.8-0.rc3.2
changelog:
  - make possible to override default traceback level at build time
  - add sub-package race containing std lib built with -race enabled
  - Related: BZ#1411242


author: Derek Parker <deparker@redhat.com> - 1.10.3-15
changelog:
  - Remove usage of redhat hardening flag file, just pass a select few manually
  - Resolves: rhbz#1642798


author: David Benoit <dbenoit@redhat.com> - 1.15.2-1
changelog:
  - Rebase to 1.15.2
  - fix rhbz#1872622 in commit af9a1b1f6567a1c5273a134d395bfe7bb840b7f8
  - Resolves: rhbz#1872622
  - add net/http graceful shutdown patch
  - Resolves: rhbz#1888673
  - add x509warnCN patch
  - Resolves: rhbz#1889437


author: Alejandro Sáez <asm@redhat.com> - 1.16.1-1
changelog:
  - Rebase to go-1.16.1-2-openssl-fips
  - Resolves: rhbz#1938071
  - Adds a workaround for rhbz#1939923
  - Removes Patch224, it's on upstream -> rhbz#1888673
  - Removes Patch225, it's on upstream -> https://go-review.googlesource.com/c/text/+/238238
  - Removes old patches for cleaning purposes


author: Alejandro Sáez <asm@redhat.com> - 1.16.5-1
changelog:
  - Rebase to 1.16.5
  - Removes rhbz#1955032 patch, it's already included in this release
  - Removes rhbz#1956891 patch, it's already included in this release
  - Related: rhbz#1979677
  - Related: rhbz#1968738
  - Related: rhbz#1972420


author: Alejandro Sáez <asm@redhat.com> - 1.17.2-1
changelog:
  - Rebase to Go 1.17.2
  - Related: rhbz#2014088
  - Remove golang-1.15-warnCN.patch
  - Remove reject-leading-zeros.patch
  - Remove favicon.ico and robots.txt references
  - Exclude TestEd25519Vectors test


author: David Benoit <dbenoit@redhat.com> - 1.17.4-1
changelog:
  - Rebase Go to 1.17.4
  - Add remove_waitgroup_misuse_tests patch
  - Related: rhbz#2014088
  - Resolves: rhbz#2028570
  - Resolves: rhbz#2022828
  - Resolves: rhbz#2024686
  - Resolves: rhbz#2028662


author: David Benoit <dbenoit@redhat.com> - 1.17.5-1
changelog:
  - Rebase to Go 1.17.5
  - Remove vdso_s390x_gettime patch
  - Resolves: rhbz#2031112
  - Related: rhbz#2028570


author: Archana Ravindar <aravinda@redhat.com> - 1.21.3-2
changelog:
  - Rebase disable_static_tests_part2.patch to Go 1.21.3
  - Add missing strict fips runtime detection patch
  - Temporarily disable FIPS tests on aarch64 due to builder kernel bugs
  - Remove fix-memory-leak patch as it is fixed upstream
  - Resolves: RHEL-12620


author: Alejandro Sáez <asm@redhat.com> - 1.21.7-1
changelog:
  - Rebase to Go 1.21.7
  - Add release information
  - Set GOTOOLCHAIN to local
  - Skip TestOverlongMessagePKCS1v15
  - Resolves: RHEL-24082
  - Resolves: RHEL-18363
  - Resolves: RHEL-18382


author: David Benoit <dbenoit@redhat.com> - 1.21.13-2
changelog:
  - Rebuild Go with CVE Fixes
  - Remove fix-memleak-setupRSA.patch (exists upstream)
  - Resolves: RHEL-58223
  - Resolves: RHEL-57961
  - Resolves: RHEL-57847
  - Resolves: RHEL-57860


author: Archana <aravinda@redhat.com> - 1.22.11-1
changelog:
  - Rebase to Go1.22.11 to pick up fixes for CVE 2024-45341 and 2024-45336
  - Fix test failures with expired certificates
  - Resolves: RHEL-73752


author: Parag Nemade <pnemade AT redhat DOT com> - 20120715-8
changelog:
  - Add metainfo file to show this font in gnome-software
  - Remove %clean section which is optional now
  - Remove removal of buildroot in %install
  - Remove group tag


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 2.0-2.1219svn
changelog:
  - Moved munge repacking to prep
  - Added -Dversion to change generated manifest version
  - Removed http part of URL


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 3.1.2-1
changelog:
  - Complete rewrite of the spec file
  - New upstream, to ease future maintenance
  - Build with maven instead of ant
  - Split into multiple subpackages


author: Peng Wu <pwu@redhat.com> - 1.004-6
changelog:
  - Disable Obsoletes for epel: for google-noto-sans-cjk-fonts (rh#1396260)
  - Disable notocjkrep macro definition for epel


author: Mike FABIAN <mfabian@redhat.com> - 20180508-1
changelog:
  - Update to upstream snapshot tarball (color emoji font version 2.011)
  - Add patch to build all country flags (Resolves: rhbz#1574195)


author: Pravin Satpute <psatpute@redhat.com> - 20161022-1
changelog:
  - Resolves #1321685 - Added Noto Mono font.
  - License changed from ASL 2.0 to OFL. 
  - New package addition: Mono, Serif Bengali, Serif Devanagari
  - Serif Gujarari, Serif Malayalam, Serif Tamil and Serif Telugu.


author: Jens Petersen <petersen@redhat.com> - 20161022-3
changelog:
  - add a fontconfig priority option to the notopkg macro,
    which allows overriding the default 66 priority


author: Akira TAGOH <tagoh@redhat.com> - 20161022-7.1
changelog:
  - Add CI tests
    Resolves: rhbz#1682152
  - Fix typos in fontconfig config for Kannada
    Resolves: rhbz#1764502


author: Sam Feifer <sfeifer@redhat.com> 9.2.10-12
changelog:
  - Resolves RHEL-7503
  - Adds a selinux policy for grafana
  - Resolves RHEL-12650
  - fix CVE-2023-39325 CVE-2023-44487 rapid stream resets can cause excessive work


author: Sam Feifer <sfeifer@redhat.com> 9.2.10-14
changelog:
  - Resolves RHEL-19596
  - Fixes coredump issue introduced by selinux
  - Patches out call to panic when trying to walk "/" directory
  - Fixes postgresql AVC denial


author: Sam Feifer <sfeifer@redhat.com> 9.2.10-15
changelog:
  - Resolves RHEL-23466
  - Resolves RHEL-21027
  - Allows for gid to be 0
  - Allows for postgreSQL datasource in selinux policy


author: Mark Goodwin <mgoodwin@redhat.com> 5.4.3-2
changelog:
  - add patch to be standard FHS compliant, remove phantomjs
  - update to v5.4.3 upstream community sources


author: Mark Goodwin <mgoodwin@redhat.com> 5.4.3-7
changelog:
  - further refinement for spec doc section from Xavier Bachelot
  - disable debug_package to avoid empty debugsourcefiles.list


author: Mark Goodwin <mgoodwin@redhat.com> 5.4.3-8
changelog:
  - add BuildRequires (and unbundle) vendor sources available in Fedora
  - declare Provides for remaining (bundled) vendor go sources
  - do not attempt to unbundle anything on RHEL < 7 or Fedora < 28


author: Xavier Bachelot <xavier@bachelot.org> 5.4.3-9
changelog:
  - Remove extraneous slash (cosmetic)
  - Create directories just before moving stuff in them
  - Truncate long lines
  - Group all golang stuff
  - Simplify BuildRequires/bundled Provides
  - Sort BuildRequires/bundled Provides
  - Fix bundled go packages Provides


author: Mark Goodwin <mgoodwin@redhat.com> 5.4.3-11
changelog:
  - tweak after latest feedback, bump to 5.4.3-11 (BZ 1670656)
  - build debuginfo package again
  - unbundle BuildRequires for golang-github-hashicorp-version-devel
  - remove some unneeded development files
  - remove macros from changelog and other rpmlint tweaks


author: Mark Goodwin <mgoodwin@redhat.com> 6.0.1-1
changelog:
  - update to v6.0.1 upstream sources, tweak distro config, re-do patch
  - simplify make_webpack.sh script (Elliott Sales de Andrade)
  - vendor/github.com/go-ldap is now gone, so don't unbundle it


author: Mark Goodwin <mgoodwin@redhat.com> 6.0.2-1
changelog:
  - bump to latest upstream stable release 6.0.2-1
  - unbundle almost all remaining vendor code, see linked blockers in BZ#1670656


author: Mark Goodwin <mgoodwin@redhat.com> 6.1.3-1
changelog:
  - update to latest upstream stable release 6.1.3, see CHANGELOG
  - unbundle all vendor sources, replace with BuildRequires, see
    the long list of blocker BZs linked to BZ#1670656
  - BuildRequires go-plugin >= v1.0.0 for grpc_broker (thanks eclipseo)
  - tweak make_webpack to no longer use grunt, switch to prod build
  - add ExclusiveArch lua script (thanks quantum.analyst)
  - move db directory and plugins to /var/lib/grafana
  - split out into 6 patches, ready for upstream PRs
  - add check to run go tests for gating checks


author: Mark Goodwin <mgoodwin@redhat.com> 6.1.4-1
changelog:
  - update to latest upstream stable release 6.1.4, see CHANGELOG
  - use gobuild and gochecks macros, eliminate arch symlinks
  - re-enable grafana-debugsource package
  - fix GRAFANA_GROUP typo
  - fix more modes for brp-mangle-shebangs
  - vendor source unbundling now done in prep after patches
  - remove all rhel and fedora conditional guff


author: Mark Goodwin <mgoodwin@redhat.com> 6.1.6-1
changelog:
  - update to latest upstream stable release 6.1.6, see CHANGELOG
  - includes jQuery 3.4.0 security update


author: Mark Goodwin <mgoodwin@redhat.com> 6.2.2-1
changelog:
  - split out some datasource plugins to sub-packages
  - update to latest upstream community sources, see CHANGELOG


author: Mark Goodwin <mgoodwin@redhat.com> 6.3.4-1
changelog:
  - include fix for CVE-2019-15043
  - add patch for uaparser on 32bit systems
  - update to latest upstream community sources, see CHANGELOG


author: Mark Goodwin <mgoodwin@redhat.com> 6.3.5-1
changelog:
  - drop uaparser patch now it's upstream
  - add xerrors patch, see https://github.com/golang/go/issues/32246
  - use vendor sources on rawhide until modules are fully supported
  - update to latest upstream community sources, see CHANGELOG


author: Mark Goodwin <mgoodwin@redhat.com> 6.3.6-1
changelog:
  - add weak depenency on grafana-pcp
  - add patch to mute shellcheck SC1090 for grafana-cli
  - update to 6.3.6 upstream community sources, see CHANGELOG


author: Mark Goodwin <mgoodwin@redhat.com> 6.6.2-1
changelog:
  - added patch0 to set the version string correctly
  - removed patch 004-xerrors.patch, it's now upstream
  - added several patches for golang vendored vrs build dep differences
  - added patch to move grafana-cli binary to libexec dir
  - update to 6.6.2 tagged upstream community sources, see CHANGELOG


author: Andreas Gerstmayr <agerstmayr@redhat.com> 6.7.3-1
changelog:
  - update to 6.7.3 tagged upstream community sources, see CHANGELOG
  - add scripts to list Go dependencies and bundled npmjs dependencies
  - set Grafana version in Grafana UI and grafana-cli --version
  - declare README.md as documentation of datasource plugins
  - create grafana.db on first installation (fixes RH BZ #1805472)
  - change permissions of /var/lib/grafana to 750 (CVE-2020-12458)
  - change permissions of /var/lib/grafana/grafana.db to 640 and
    user/group grafana:grafana (CVE-2020-12458)
  - change permissions of grafana.ini and ldap.toml to 640 (CVE-2020-12459)


author: Andreas Gerstmayr <agerstmayr@redhat.com> 6.7.4-1
changelog:
  - update to 6.7.4 tagged upstream community sources, see CHANGELOG
  - security fix for CVE-2020-13379


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.3.4-1
changelog:
  - update to 7.3.4 tagged upstream community sources, see CHANGELOG
  - bundle golang dependencies
  - optionally bundle node.js dependencies and build and test frontend as part of the specfile
  - merge all datasources into main grafana package
  - change default provisioning path to /etc/grafana/provisioning
  - resolve https://bugzilla.redhat.com/show_bug.cgi?id=1843170


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.3.6-1
changelog:
  - update to 7.3.6 tagged upstream community sources, see CHANGELOG
  - remove dependency on SAML (not supported in the open source version of Grafana)


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.3.6-2
changelog:
  - change working dir to $GRAFANA_HOME in grafana-cli wrapper (fixes Red Hat BZ #1916083)
  - add pcp-redis-datasource to allow_loading_unsigned_plugins config option


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.7-2
changelog:
  - remove unused cryptographic implementations
  - use cryptographic functions from OpenSSL if FIPS mode is enabled


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.8-1
changelog:
  - update to 7.5.8 tagged upstream community sources, see CHANGELOG
  - remove unused dependencies selfsigned, http-signature and gofpdf


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.11-2
changelog:
  - resolve CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache
  - resolve CVE-2021-43813 grafana: directory traversal vulnerability for *.md files


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-1
changelog:
  - update to 7.5.15 tagged upstream community sources, see CHANGELOG
  - resolve CVE-2022-21673 grafana: Forward OAuth Identity Token can allow users to access some data sources
  - resolve CVE-2022-21702 grafana: XSS vulnerability in data source handling
  - resolve CVE-2022-21703 grafana: CSRF vulnerability can lead to privilege escalation
  - resolve CVE-2022-21713 grafana: IDOR vulnerability can lead to information disclosure
  - resolve CVE-2021-23648 sanitize-url: XSS
  - resolve CVE-2022-21698 prometheus/client_golang: Denial of service using InstrumentHandlerCounter
  - declare Node.js dependencies of subpackages
  - make vendor and webpack tarballs reproducible


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-3
changelog:
  - resolve CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse* functions
  - resolve CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header
  - resolve CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working
  - resolve CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read
  - resolve CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
  - resolve CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
  - resolve CVE-2022-30635 golang: encoding/gob: stack exhaustion in Decoder.Decode
  - resolve CVE-2022-28131 golang: encoding/xml: stack exhaustion in Decoder.Skip
  - resolve CVE-2022-30633 golang: encoding/xml: stack exhaustion in Unmarshal


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-4
changelog:
  - resolve CVE-2022-39229 grafana: using email as a username can block other users from signing in
  - resolve CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY
  - resolve CVE-2022-41715 golang: regexp/syntax: limit memory used by parsing regexps
  - resolve CVE-2022-2880 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters
  - run integration tests in check phase
  - update FIPS patch with latest changes in Go packaging


author: Andreas Gerstmayr <agerstmayr@redhat.com> 3.1.0-1
changelog:
  - update to 3.1.0 tagged upstream community sources, see CHANGELOG
  - remove unused cryptographic implementations


author: Andreas Gerstmayr <agerstmayr@redhat.com> 3.2.0-2
changelog:
  - resolve CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header
  - resolve CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working
  - resolve CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read
  - resolve CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
  - resolve CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
  - resolve CVE-2022-30635 golang: encoding/gob: stack exhaustion in Decoder.Decode


author: Mark Goodwin <mgoodwin@redhat.com> 0.0.4-1
changelog:
  - add suggested pmproxy URL in config html
  - updated instructions and README.md now that grafana is in Fedora


author: Andreas Gerstmayr <agerstmayr@redhat.com> 0.0.7-1
changelog:
  - converted into a Grafana app plugin, renamed to grafana-pcp
  - redis: support for instance domains, labels, autocompletion, automatic rate conversation
  - live and bpftrace: initial commit of datasources


author: Andreas Gerstmayr <agerstmayr@redhat.com> 1.0.0-1
changelog:
  - bpftrace: support for Flame Graphs
  - bpftrace: context-sensitive auto completion for bpftrace probes, builtin variables and functions incl. help texts
  - bpftrace: parse output of bpftrace scripts (e.g. using `printf()`) as CSV and display it in the Grafana table panel
  - bpftrace: sample dashboards (BPFtrace System Analysis, BPFtrace Flame Graphs)
  - vector: table output: show instance name in left column
  - vector: table output: support non-matching instance names (cells of metrics which don't have the specific instance will be blank)
  - vector & bpftrace: if the metric/script gets changed in the query editor, immeditately stop polling the old metric/deregister the old script
  - vector & bpftrace: improve pmwebd compatibility
  - misc: help texts for all datasources (visible with the **[ ? ]** button in the query editor)
  - misc: renamed PCP Live to PCP Vector
  - misc: logos for all datasources
  - misc: improved error handling


author: Andreas Gerstmayr <agerstmayr@redhat.com> 1.0.2-1
changelog:
  - handle counter wraps (overflows)
  - convert time based counters to time utilization
  - flame graphs: aggregate stack counts by selected time range in the Grafana UI
  - flame graphs: add option to hide idle stacks
  - vector: fix container dropdown in query editor
  - vector: remove container setting from datasource settings page
  - redis: fix value transformations (e.g. rate conversation of counters)
  - request more datapoints from the datasource to fill the borders of the graph panel


author: Andreas Gerstmayr <agerstmayr@redhat.com> 1.0.3-2
changelog:
  - remove node_modules/node-notifier directory from webpack (due to licensing issues)
  - upgrade copy-webpack-plugin, terser-webpack-plugin and remove uglifyjs-webpack-plugin to mitigate XSS vulnerability in serialize-javascript dependency


author: Andreas Gerstmayr <agerstmayr@redhat.com> 1.0.5-1
changelog:
  - upgrade to upstream 1.0.5
  - flame graphs: clean flame graph stacks every 5s (reduces CPU load)
  - general: implement PCP version checks
  - redis: set default sample interval to 60s (fixes empty graph borders)


author: Andreas Gerstmayr <agerstmayr@redhat.com> 2.0.2-2
changelog:
  - vector: do not show all cgroups in the container overview dashboard in case no containers are present on the system


author: Andreas Gerstmayr <agerstmayr@redhat.com> 3.0.0-1
changelog:
  - update to 3.0.0 tagged upstream community sources, see CHANGELOG
  - bundle golang dependencies and (optionally) node.js dependencies


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.40.1-43
changelog:
  - Fixed races during pdf documentation build which should build docs correctly
    Related: CVE-2020-18032


author: Jose Noguera <jnoguera@redhat.com> - 0.12.0-1
changelog:
  - Update to 0.12.0
  - Add ability to configure maximum number of boot attempts via env var and config file.
  - Add How does it work section to README.
  - Add CI via GitHub Actions and unit testing with BATS.
  - Add update platforms DNS resolutiona and connection checker as health checks out of the box


author: Packit Service <user-cont-team+packit-service@redhat.com> - 0.14.0-1
changelog:
  - Release 0.14.0 (Peter Robinson)
  - Updated testing documentation (Jose Noguera)
  - README updated with TOC and improved explanations (Jose Noguera)
  - Add watchdog-triggered boot check #2 (Jose Noguera)
  - Update specfile and README to reflect changes in subpackage layout. (Jose Noguera)
  - Ensure all required health checks are run #52 (Jose Noguera)


author: Dominik Mierzejewski <rpm[AT]greysector.net> 1.0.17-1
changelog:
  - update to 1.0.17 (#1465878)
  - ease future updates by better macro use
  - drop obsolete patch hunks
  - fix missing prototype for fchown warning


author: Dominik Mierzejewski <rpm[AT]greysector.net> 1.0.17-5
changelog:
  - ensure binaries are linked with Fedora LDFLAGS (#1548532)
  - use ldconfig_scriptlets macro
  - add proper man links for tcat and untoast


author: Yanko Kaneti <yaneti@declera.com> - 1.0.0-2
changelog:
  - Initial spec for review - 0.98.0-0.1.a648648
  - Additional patch + references + using %autopatch - 0.98.0-0.2.a648648
  - Update to 1.0.0. drop upstreamed paches - 1.0.0-1
  - Own some more directories as per review (#1167482) - 1.0.0-2


author: Julien Rische <jrische@redhat.com> - 1.2.0-1
changelog:
  - New release 1.2.0
  - Fix CVE-2023-25563: multiple out-of-bounds read when decoding NTLM fields
  - Fix CVE-2023-25564: memory corruption when decoding UTF16 strings
  - Fix CVE-2023-25565: incorrect free when decoding target information
  - Fix CVE-2023-25566: memory leak when parsing usernames
  - Fix CVE-2023-25567: out-of-bounds read when decoding target information
  - Resolves: rhbz#2181313


author: Rex Dieter <rdieter@fedoraproject.org> - 1.13.1-3
changelog:
  - %build: --disable-fatal-warnings --disable-silent-rules
  - fix rpath harder
  - use %ldconfig_scriptlets, %make_build, %make_install
  - -devel: tighten deps with %{_isa}


author: Wim Taymans <wtaymans@redhat.com> - 1.14.0-3
changelog:
  - Remove obsolete liboil BR (#1588303)
  - Only build extras on Fedora
  - bluez is not in extras
  - vdpau is in extras


author: Wim Taymans <wtaymans@redhat.com> - 1.16.1-1
changelog:
  - Update to 1.16.1
  - Remove upstreamed patches
  - Remove dependency on removed package
  - Add sctp and closedcaption plugins
  - The vcdsrc plugin was removed
  - Resolves: rhbz#1756299


author: Wim Taymans <wtaymans@redhat.com> - 1.16.1-4
changelog:
  - Patch CVE-2023-40474: Integer overflow
  - Patch CVE-2023-40475: Integer overflow
  - Patch CVE-2023-40476: Integer overflow in H.265 video parser
  - Resolves: RHEL-19500, RHEL-19504, RHEL-19507


author: Tomas Popela <tpopela@redhat.com> - 1.14.0-2
changelog:
  - Enable Wayland support (previously disabled due to missing wayland-devel
    as a BR - before it was probably brought in by something else).


author: Rex Dieter <rdieter@fedoraproject.org> - 1.13.1-2
changelog:
  - tigten subpkg deps
  - fix rpaths
  - update %files
  - use %ldconfig_scriptlets %make_build %make_install
  - %build: --disable-fatal-warnings --disable-silent-rules
  - Conflicts: gstreamer1-plugins-bad-free < 1.13


author: Wim Taymans <wtaymans@redhat.com> - 1.16.1-5
changelog:
  - Fixes for CVE-2024-47538, CVE-2024-47607, CVE-2024-47615
    Resolves: RHEL-70974, RHEL-71010, RHEL-70986


author: Wim Taymans <wtaymans@redhat.com> - 1.16.1-4
changelog:
  - CVE-2023-37327: integer overflow leading to heap overwrite in
    FLAC image tag handling
  - Resolves: RHEL-19469


author: Brian Pepple <bpepple@fedoraproject.org> - 0.11.93-1
changelog:
  - Update to 0.11.93.
  - Add batch to fix build with recent kernels, the v4l2_buffer input field was removed.
  - Use %global instead of %define.


author: Ralf Corsépius <corsepiu@fedoraproject.org> - 1.7.1-3
changelog:
  - Append --disable-fatal-warnings to %configure to prevent
    building from aborting for negligible warnings (Fix F24FTBFS)
  - Append --disable-silent-rules to %configure to make
    building verbose.
  - Don't remove buildroot before installing.


author: Wim Taymans <wtaymans@redhat.com> - 1.13.1-2
changelog:
  - The gtk plugin was moved from -bad, make a new subpackage for it.
  - the mp3 plugins were moved from -ugly, add BuildRequires.
  - build requires GL now for gtkglsink


author: Rex Dieter <rdieter@fedoraproject.org> - 1.13.1-3
changelog:
  - -gtk: Obsoletes/Provides: gstreamer1-plugins-bad-free-gtk
  - Obsoletes/Provides: gstreamer1-plugin-mpg123


author: Wim Taymans <wtaymans@redhat.com> - 1.16.1-5
changelog:
  - CVE-2024-47537, CVE-2024-47539, CVE-2024-47540, CVE-2024-47606,
    CVE-2024-47613
    Resolves: RHEL-70949, RHEL-70962, RHEL-70936, RHEL-71022
    Resolves: RHEL-70998


author: Daniel P. Berrangé <berrange@redhat.com> - 0.9.0-1
changelog:
  - Update to 0.9.0 release
  - Use gcrypt for DES impl instead of local DES impl (rhbz #1618426)
  - Fix crash if connection fails early (rhbz #1622189)


author: Daniel P. Berrangé <berrange@redhat.com> - 0.9.0-2
changelog:
  - Fix crash when TLS handshake fails (rhbz #1665837)
  - Ensure auth failure signal is emitted when SASL fails (rhbz #1688275)


author: Kalev Lember <klember@redhat.com> - 2.24.5-1
changelog:
  - Update to 2.24.5
  - Use license macro for COPYING
  - Don't set group tags
  - Tighten -devel requires with the _isa macro


author: Rex Dieter <rdieter@fedoraproject.org> - 5:2.0.14-7
changelog:
  - avoid linking all guile-devel consumers to libgc
  - BR: gcc
  - use %{make_build},%{make_install}
  - %check: make non-fatal


author: Peter Robinson <pbrobinson@fedoraproject.org> 0.12.8-1
changelog:
  - 0.12.8 release
  - http://ftp.gnome.org/pub/GNOME/sources/gupnp-av/0.12/gupnp-av-0.12.8.news
  - Use %license


author: Kalev Lember <klember@redhat.com> - 0.12.9-1
changelog:
  - Update to 0.12.9
  - Don't set group tags
  - Tighten subpackage deps with the _isa macro
  - Use make_install macro


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.2.4-6
changelog:
  - Python 2 binary package renamed to python2-gupnp-igd
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Kalev Lember <klember@redhat.com> - 0.2.5-1
changelog:
  - Update to 0.2.5
  - Update inter-package dependencies after python2-gupnp-igd rename
  - Tighten deps with the _isa macro
  - Update source URLs
  - Use license macro for COPYING


author: Bastien Nocera <bnocera@redhat.com> - 0.2.5-3
changelog:
  + gupnp-igd-0.2.5-3
  - Remove python2-gupnp-igd sub-package, nothing uses it in Fedora
    and gobject-introspection supports both Python2 and Python3


author: Sergey Cherevko <s.cherevko@msvsphere-os.ru> - 5.2.14-3.inferit
changelog:
  - Added SELinux policy (based on Arkady L. Shane <tigro@msvsphere-os.ru> patch for MSVSphere 9)
  - Rebuilt for MSVSphere 8.9


author: Sergey Cherevko <s.cherevko@msvsphere-os.ru> - 1.36.2-14.inferit
changelog:
  - Added yandex disk webdav support (by Alexey Berezhok <aberezhok@msvsphere-os.ru>)
  - Rebuilt for MSVSphere 8.9


author: Tomas Bzatek <tbzatek@redhat.com> - 0.2.1-2
changelog:
  - Added libarchive dependency for archive backend
  - Require new libsmbclient in order to get smb backend working again


author: David Zeuthen <davidz@redhat.com> - 0.2.3-9
changelog:
  - Ensure archive mounts are read-only and turn on thumbnailing on them
  - Update fuse threading patch


author: Alexander Larsson <alexl@redhat.com> - 1.0.2-2
changelog:
  - Don't return generic fallback icons for files,
    as this means custom mimetypes don't work (from svn)


author: David Zeuthen <davidz@redhat.com> - 1.2.1-3
changelog:
  - Clean up gdu patches and bump BR for gdu to 0.3
  - Avoiding showing volume for ignored mounts (#495033)


author: David Zeuthen <davidz@redhat.com> - 1.2.2-4
changelog:
  - Don't show drives that are supposed to be hidden (#498649)
  - Only automount if media or drive was just inserted - this fixes
    a problem with spurious automounts when partitioning/formatting


author: Tomas Bzatek <tbzatek@redhat.com> - 1.2.2-5
changelog:
  - Require separate libtalloc to fix libsmbclient
  - Ref the infos in next_files_finish (gnome #582195)
  - FTP: parse file sizes > 4GB correctly (#499286)
  - CDDA: allow query well-formed filenames only (#499266)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.3.3-2
changelog:
  - Fix gedit crashed with SEGV in strlen()
  - Fix SMB protocol not handled when opening from a bookmark (#509832)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.3.3-3
changelog:
  - Fix bad mount prefix stripping (part of #509612)
  - Fix gvfsd-sftp segfault when asking a question
  - Enable tar+xz in the archive mounter


author: Tomas Bzatek <tbzatek@redhat.com> - 1.4.0-4
changelog:
  - Fix Nautilus not displaying friendly icons for SSH-connected system (#526892)
  - Actually apply the logical partitions patch


author: Tomas Bzatek <tbzatek@redhat.com> - 1.4.0-5
changelog:
  - Don't always overwrite on trash restore
  - Separate "Safely Remove Drive" from "Eject"
  - Don't advertise can_poll for drives not using removable media
  - Disallow mounting empty drives
  - Disallow ejecting empty drives
  - Silently drop eject error messages when detaching drive


author: Tomas Bzatek <tbzatek@redhat.com> - 1.4.0-7
changelog:
  - HTTP: Support g_file_input_stream_query_info()
  - HTTP: Use libsoup header parsing function
  - Set correct MIME type for MTP music players


author: Tomas Bzatek <tbzatek@redhat.com> - 1.5.1-2
changelog:
  - Metadata fixes
  - SMB: Fix free space calculation for older samba servers
  - fuse: Fix setting timestamps


author: Tomas Bzatek <tbzatek@redhat.com> - 1.5.1-4
changelog:
  - Don't leak mount job operation (#552842)
  - Recognize gphoto2 cameras which don't implement get storageinfo (#552856)
  - ObexFTP: Use a private D-Bus connection for obex-data-server (#539347)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.8.0-2
changelog:
  - Fix threadsafety of closing channels
  - Fix d-bus messages leaks
  - Fix /dev symlink checks in gdu volume monitor


author: Ondrej Holy <oholy@redhat.com> - 1.25.2-2
changelog:
  - Move client libs into the own subpackage
  - Move gvfs tools into the own subpackage
  - Move gvfsd-fuse-tmpfiles.conf into fuse subpackage
  - Remove obsoleted expat-devel dependency
  - Remove obsoleted Group tags
  - Fix bogus dates


author: Ondrej Holy <oholy@redhat.com> - 1.36.2-1
changelog:
  - Update to 1.36.2
  - Remove mount-archive.desktop helper
  - Remove obsolete gvfs utils
  - Disable nfs support


author: Ondrej Holy <oholy@redhat.com> - 1.36.2-6
changelog:
  - Prevent spawning new daemons if outgoing operation exists (#1739117)
  - Force NT1 protocol version for workgroup support (#1739116)


author: Ondrej Holy <oholy@redhat.com> - 1.36.2-7
changelog:
  - Remove libbluray support (#1747972)
  - CVE-2019-12448: Add query_info_on_read/write functionality (rhbz#1754506)
  - CVE-2019-12447: Use fsuid to ensure correct file ownership (rhbz#1752926)
  - CVE-2019-12449: Ensure correct ownership when moving to file:// uri (rhbz#1753972)


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 0:1.3-22
changelog:
  - Elimitate race condition when injecting JAR manifest
  - Resolves: rhbz#1495234
  - Remove bogus hamcrest-text JAR


author: Guillaume Rousse <guillomovitch@users.sourceforge.net> 3.7-1mdk
changelog:
  - 3.7
  - vendor tag
  - packager tag
  - s/Copyright/License/
  - truncated description to 72 columns in spec
  - spec cleanup
  - used versioned jar
  - moved demo files to %{_datadir}/%{name}


author: Guillaume Rousse <guillomovitch@users.sourceforge.net> 3.7-6jpp
changelog:
  - versioned dir for javadoc
  - no dependencies for manual and javadoc packages
  - stricter dependency for demo package
  - additional sources in individual archives
  - section macro


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 3.8.2-3jpp.1
changelog:
  - Committed on behalf of Tania Bento <tbento@redhat.com>
  - Update per Fedora review process
  - Resolves rhbz#225954


author: Ben Konrath <bkonrath@redhat.com> - 4.3.1-2jpp
changelog:
  - Set gcj_support to 0 to work around problems with GCJ.
  - Fix buglet with the gcj post/postun if statement.
  - Fix tab / space problems.
  - Fix buildroot.
  - Update Summary.
  - Convert html files to Unix file endings.
  - Disable aot-compile-rpm because it's not working ATM.


author: Ralph Apel <r.apel@r-apel.de> - 0:4.3.1-3jpp
changelog:
  - build and upload noarch packages
  - Add pom and depmap frag
  - BR java-devel = 1.5.0
  - Restore Vendor, Distribution from macros


author: David Walluck <dwalluck@redhat.com> 0:1.1-2
changelog:
  - add options to build without integration, jarjar, and tests
  - allow build with java-devel >= 1.5.0
  - remove javadoc scriptlets
  - use more strict file list
  - fix maven directory ownership
  - add non-versioned symlink for demo
  - fix GCJ requires
  - fix eol in LICENSE.txt
  - remove Vendor and Distribution


author: David Walluck <dwalluck@redhat.com> 0:1.1-7.1
changelog:
  - Fedora-specific: enable GCJ support
  - Fedora-specific: build with java 1.6.0
  - Fedora-specific: disable integration and tests


author: Mat Booth <mat.booth@redhat.com> - 0:1.3-8
changelog:
  - Fix FTBFS
  - Always build integration jar (removes some complexity from the spec)
  - Drop unused patch


author: Jeremy Hinegardner <jeremy@hinegardner.org> - 1.3.12.1-1
changelog:
  - switch to 1.3.12.1 branch
  - add patch from upstream with O'Reilly licensing updates.
  - convert ISO-8859-1 doc files to UTF-8


author: Jeremy Hinegardner <jeremy at hinegardner dot org> - 1.3.14.2-1
changelog:
  - update to 1.3.14.2
  - update make flags that changed with this upstream release
  - added man page installation


author: Jeremy Hinegardner <jeremy at hinegardner dot org> - 1.3.14.6-1
changelog:
  - update to 1.3.14.6
  - remove gcc 4.3 patch, it has been applied upstream
  - remove MIT license as that code has been removed from upstream


author: Jeremy Hinegardner <jeremy at hinegardner dot org> - 1.3.15.6-1
changelog:
  - update to 1.3.15.6
  - use new build targets from upstream
  - add in recommended build options for x86 from upstream


author: Robin Lee <cheeselee@fedoraproject.org> - 1.4.22-1
changelog:
  - Update to 1.4.22 (CVE-2012-2942, #824544)
  - Use linux2628 build target
  - No separate x86_64 build target for halog
  - halog build honors rpmbuild optflags
  - Specfile cleanup


author: Ryan O'Hara <rohara@redhat.com> - 1.4.23-1
changelog:
  - Update to 1.4.23 (CVE-2013-1912, #947697)
  - Drop supplementary groups after setuid/setgid (#894626)


author: Florian Weimer <fweimer@redhat.com> - 1.8.3-5
changelog:
  - Build halog and iprange with linker flags from redhat-rpm-config
  - Tell build to include <crypt.h>


author: Ryan O'Hara <rohara@redhat.com> - 1.8.15-1
changelog:
  - Update to 1.8.15 (#1631815)
  - Resolve CVE-2018-20102 (#1659017)
  - Resolve CVE-2018-20103 (#1659019)


author: Debarshi Ray <rishi@fedoraproject.org> 2.14.1-2
changelog:
  - Always use lua over luajit, just more common
  - Remove no longer needed snippets
  - Add enchant/enchant2 to requires


author: Danilo de Paula <ddepaula@redhat.com> - 1.3.15-7
changelog:
  - Rebuild all virt packages to fix RHEL's upgrade path
  - Resolves: rhbz#1695587
    (Ensure modular RPM upgrade path)


author: Davide Caratti <dcaratti@redhat.com> - 2.9-16
changelog:
  - disable 'badfuncs' rpminspect test
  - change default value of CONFIG_TLS_DEFAULT_CIPHERS to allow using OpenSSL
    to compute 3DES


author: Jakub Hrozek <jhrozek@redhat.com> - 2.8.0-2
changelog:
  - Resolves: #rhbz1654223: CVE-2018-7159 http-parser: nodejs: HTTP parser
                            allowed for spaces inside Content-Length header
                            values [rhel-8]


author: Sergio Correia <scorreia@redhat.com> - 2.8.0-4
changelog:
  - Resolves: rhbz#1666382: CVE-2018-12121 http-parser: nodejs: Denial of
                            Service with large HTTP headers [rhel-8]


author: Sergio Corrreia <scorreia@redhat.com> - 2.8.0-7
changelog:
  - Resolves: CVE-2019-15605 http-parser: nodejs: HTTP request
                             smuggling using malformed Transfer-Encoding header


author: Severin Gehwolf <sgehwolf@redhat.com> 4.1.1-2
changelog:
  - Add BR/R apache-commons-codec, since httpcomponents-client's
    MANIFEST.MF has an Import-Package: org.apache.commons.codec
    header.


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 4.2.1-2
changelog:
  - Install NOTICE.txt file
  - Fix javadir directory ownership
  - Fix directory permissions
  - Preserve timestamps
  - Replace add_to_maven_depmap with add_maven_depmap


author: Mat Booth <mat.booth@redhat.com> - 4.5.6-2
changelog:
  - Add a patch to allow building with mockito 2
  - Don't package tests jars, the tests jars have the same OSGi metadata as the
    main jars, which can cause tycho to resolve the wrong one when building
    eclipse plugins


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 4.5.10-4
changelog:
  - Fix incorrect handling of malformed authority component in request URIs
  - Resolves: CVE-2020-13956


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 4.1.1-1
changelog:
  - Update to latest upstream (4.1.1)
  - Use new maven macros
  - Tweaks according to new guidelines
  - Enable tests again (seem to work OK even in koji now)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-62
changelog:
  - Resolves: #2221083 - Apache Bug 57087: mod_proxy_fcgi doesn't send cgi 
    CONTENT_LENGTH variable when the client request used Transfer-Encoding:chunked


author: Joe Orton <jorton@redhat.com> - 2.2.15-3
changelog:
  - default config tweaks:
   * harden httpd.conf w.r.t. .htaccess restriction (#591293)
   * load mod_substitute, mod_version by default
   * drop proxy_ajp.conf, load mod_proxy_ajp in httpd.conf
   * add commented list of shipped-but-unloaded modules
   * bump up worker defaults a little
   * drop KeepAliveTimeout to 5 secs per upstream
  - fix LSB compliance in init script (#522074)
  - bundle NOTICE in -tools
  - use init script in logrotate postrotate to pick up PIDFILE
  - drop some old Obsoletes/Conflicts


author: Joe Orton <jorton@redhat.com> - 2.2.17-7
changelog:
  - generate dummy mod_ssl cert with CA:FALSE constraint (#667841)
  - add man page stubs for httpd.event, httpd.worker
  - drop distcache support
  - add STOP_TIMEOUT support to init script


author: Joe Orton <jorton@redhat.com> - 2.2.21-6
changelog:
  - complete conversion to systemd, drop init script (#770311)
  - fix comments in /etc/sysconfig/httpd (#771024)
  - enable PrivateTmp in service file (#781440)
  - set LANG=C in /etc/sysconfig/httpd


author: Joe Orton <jorton@redhat.com> - 2.4.1-1
changelog:
  - update to 2.4.1
  - adopt upstream default httpd.conf (almost verbatim)
  - split all LoadModules to conf.modules.d/*.conf
  - include conf.d/*.conf at end of httpd.conf
  - trim %changelog


author: Joe Orton <jorton@redhat.com> - 2.4.1-2
changelog:
  - clean docroot better
  - ship proxy, ssl directories within /var/cache/httpd
  - default config:
   * unrestricted access to (only) /var/www
   * remove (commented) Mutex, MaxRanges, ScriptSock
   * split autoindex config to conf.d/autoindex.conf
  - ship additional example configs in docdir


author: Joe Orton <jorton@redhat.com> - 2.4.1-3
changelog:
  - add mod_proxy_html subpackage (w/mod_proxy_html + mod_xml2enc)
  - move mod_ldap, mod_authnz_ldap to mod_ldap subpackage


author: Joe Orton <jorton@redhat.com> - 2.4.2-4
changelog:
  - pull from upstream:
    * use TLS close_notify alert for dummy_connection (r1326980+)
    * cleanup symbol exports (r1327036+)


author: Joe Orton <jorton@redhat.com> - 2.4.2-15
changelog:
  - move tmpfiles.d fragment into /usr/lib per new guidelines
  - package /run/httpd not /var/run/httpd
  - set runtimedir to /run/httpd likewise


author: Joe Orton <jorton@redhat.com> - 2.4.2-18
changelog:
  - avoid use of "core" GIF for a "core" directory (#168776)
  - drop use of "syslog.target" in systemd unit file


author: Joe Orton <jorton@redhat.com> - 2.4.3-7
changelog:
  - use systemd scriptlets if available (#850149)
  - don't run posttrans restart if /etc/sysconfig/httpd-disable-posttrans exists


author: Joe Orton <jorton@redhat.com> - 2.4.3-13
changelog:
  - filter mod_*.so auto-provides (thanks to rcollet)
  - pull in syslog logging fix from upstream (r1344712)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.4-5
changelog:
  - execute systemctl reload as result of apachectl graceful
  - mod_ssl: ignore SNI hints unless required by config
  - mod_cache: forward-port CacheMaxExpire "hard" option
  - mod_ssl: fall back on another module's proxy hook if mod_ssl proxy
    is not configured.


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.4-6
changelog:
  - htpasswd/htdbm: fix hash generation bug (#956344)
  - do not dump vhosts twice in httpd -S output (#928761)
  - mod_cache: fix potential crash caused by uninitialized variable (#954109)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.4-12
changelog:
  - mod_unique_id: replace use of hostname + pid with PRNG output (#976666)
  - apxs: mention -p option in manpage


author: Joe Orton <jorton@redhat.com> - 2.4.6-4
changelog:
  - load mod_macro by default (#998452)
  - add README to conf.modules.d
  - mod_proxy_http: add possible fix for threading issues (r1534321)
  - core: add fix for truncated output with CGI scripts (r1530793)


author: Joe Orton <jorton@redhat.com> - 2.4.10-2
changelog:
  - enable mod_request by default for mod_auth_form
  - move disabled-by-default modules from 00-base.conf to 00-optional.conf


author: Joe Orton <jorton@redhat.com> - 2.4.10-6
changelog:
  - mod_ssl: treat "SSLCipherSuite PROFILE=..." as special (#1109119)
  - switch default ssl.conf to use PROFILE=SYSTEM (#1109119)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.10-7
changelog:
  - mod_systemd: updated to the latest version
  - use -lsystemd instead of -lsystemd-daemon (#1125084)
  - fix possible crash in SIGINT handling (#958934)


author: Joe Orton <jorton@redhat.com> - 2.4.10-8
changelog:
  - pull in httpd-filesystem as Requires(pre) (#1128328)
  - fix cipher selection in default ssl.conf, depend on new OpenSSL (#1134348)
  - require hostname for mod_ssl post script (#1135118)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.10-15
changelog:
  - core: fix bypassing of mod_headers rules via chunked requests (CVE-2013-5704)
  - mod_cache: fix NULL pointer dereference on empty Content-Type (CVE-2014-3581)
  - mod_proxy_fcgi: fix a potential crash with long headers (CVE-2014-3583)
  - mod_lua: fix handling of the Require line when a LuaAuthzProvider is used
    in multiple Require directives with different arguments (CVE-2014-8109)


author: Joe Orton <jorton@redhat.com> - 2.4.17-1
changelog:
  - update to 2.4.17 (#1271224)
  - build, load mod_http2
  - don't build mod_asis, mod_file_cache
  - load mod_cache_socache, mod_proxy_wstunnel by default
  - check every built mod_* is configured
  - synch ssl.conf with upstream; disable SSLv3 by default


author: Joe Orton <jorton@redhat.com> - 2.4.18-3
changelog:
  - remove httpd pre script (duplicate of httpd-filesystem's)
  - in httpd-filesystem pre script, create group/user iff non-existent


author: Joe Orton <jorton@redhat.com> - 2.4.23-1
changelog:
  - update to 2.4.23 (#1325883, #1353203)
  - load mod_proxy_hcheck
  - recommend use of "systemctl edit" in httpd.service


author: Joe Orton <jorton@redhat.com> - 2.4.23-2
changelog:
  - restore build of mod_proxy_fdpass (#1325883)
  - improve check tests to catch configured-but-not-built modules


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.23-7
changelog:
  - Resolves: #1401530 - CVE-2016-8740 httpd: Incomplete handling of
    LimitRequestFields directive in mod_http2


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.25-7
changelog:
  - Resolves: #1397243 - Backport Apache Bug 53098 - mod_proxy_ajp:
    patch to set worker secret passed to tomcat


author: Joe Orton <jorton@redhat.com> - 2.4.27-9
changelog:
  - use sscg defaults; append CA cert to generated cert
  - document httpd-init.service in httpd-init.service(8)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.28-2
changelog:
  - Resolves: #1512563 - httpd: update welcome page branding
  - Resolves: #1511123 - RFE: httpd use event MPM by default
  - Resolves: #1493510 - RFE: httpd, add IP_FREEBIND support for Listen


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.35-4
changelog:
  - Resolves: #1635681 - sync with Fedora 28/29 httpd
  - comment-out SSLProtocol, SSLProxyProtocol from ssl.conf in default
    configuration; now follow OpenSSL system default (#1468322)
  - dropped NPN support
  - mod_md: change hard-coded default MdStoreDir to state/md (#1563846)
  - don't block on service try-restart in posttrans scriptlet
  - build and load mod_brotli
  - mod_systemd: show bound ports in status and log to journal
    at startup
  - updated httpd.service.xml man page
  - tweak wording in privkey passphrase prompt
  - drop sslmultiproxy patch
  - apachectl: don't read /etc/sysconfig/httpd
  - drop irrelevant Obsoletes for devel subpackage
  - move instantiated httpd@.service to main httpd package


author: Joe Orton <jorton@redhat.com> - 2.4.35-7
changelog:
  - mod_ssl: drop SSLRandomSeed from default config (#1638730)
  - mod_ssl: follow OpenSSL protocol defaults if SSLProtocol
       is not configured (Rob Crittenden, #1638738)


author: Joe Orton <jorton@redhat.com> - 2.4.37-7
changelog:
  - add DefaultStateDir/ap_state_dir_relative() (#1653009)
  - mod_dav_fs: use state dir for default DAVLockDB
  - mod_md: use state dir for default MDStoreDir


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-11
changelog:
  - Resolves: #1695432 - CVE-2019-0211 httpd: privilege escalation
    from modules scripts
  - Resolves: #1696091 - CVE-2019-0215 httpd:2.4/httpd: mod_ssl: access control 
    bypass when using per-location client certification authentication


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-13
changelog:
  - Resolves: #1696142 - CVE-2019-0217 httpd:2.4/httpd: mod_auth_digest: access
    control bypass due to race condition
  - Resolves: #1696097 - CVE-2019-0220 httpd:2.4/httpd: URL normalization
    inconsistency
  - Resolves: #1669221 - `ExtendedStatus Off` directive when using mod_systemd
    causes systemctl to hang
  - Resolves: #1673022 - httpd can not be started with mod_md enabled


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-16
changelog:
  - Resolves: #1744999 - CVE-2019-9511 httpd:2.4/mod_http2: HTTP/2: large amount
    of data request leads to denial of service
  - Resolves: #1745086 - CVE-2019-9516 httpd:2.4/mod_http2: HTTP/2: 0-length
    headers leads to denial of service
  - Resolves: #1745154 - CVE-2019-9517 httpd:2.4/mod_http2: HTTP/2: request for
    large response leads to denial of service


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-18
changelog:
  - Resolves: #1744121 - Unexpected OCSP in proxy SSL connection
  - Resolves: #1725031 - htpasswd: support SHA-x passwords for FIPS compatibility
  - Resolves: #1633224 - mod_cgid logging issues


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-21
changelog:
  - Resolves: #1775158 - POST request with TLS 1.3 PHA client auth fails:
    Re-negotiation handshake failed: Client certificate missing


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-27
changelog:
  - Resolves: #1823259 - CVE-2020-1927 httpd:2.4/httpd: mod_rewrite configurations
    vulnerable to open redirect
  - Resolves: #1747284 - CVE-2019-10098 httpd:2.4/httpd: mod_rewrite potential
    open redirect
  - Resolves: #1747281 - CVE-2019-10092 httpd:2.4/httpd: limited cross-site 
    scripting in mod_proxy error page
  - Resolves: #1747291 - CVE-2019-10097 httpd:2.4/httpd: null-pointer dereference
    in mod_remoteip
  - Resolves: #1771847 - BalancerMember ping parameter for mod_proxy_http
    doesn't work
  - Resolves: #1794728 - Backport of SessionExpiryUpdateInterval directive


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-29
changelog:
  - Resolves: #1823263 (CVE-2020-1934) - CVE-2020-1934 httpd: mod_proxy_ftp use of
    uninitialized value


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-31
changelog:
  - Resolves: #1677590 - CVE-2018-17199 httpd:2.4/httpd: mod_session_cookie does
    not respect expiry time
  - Resolves: #1869075 - CVE-2020-11984 httpd:2.4/httpd: mod_proxy_uswgi buffer
    overflow
  - Resolves: #1872828 - httpd: typo in htpasswd, contained in httpd-tools package
  - Resolves: #1869576 - httpd : mod_proxy should allow to specify
    Proxy-Authorization in ProxyRemote directive
  - Resolves: #1875844 - mod_cgid takes CGIDScriptTimeout x 2 seconds for timeout
  - Resolves: #1891829 - mod_proxy_hcheck Doesn't perform checks when in
    a balancer


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-33
changelog:
  - Resolves: #1868608 - Intermittent Segfault in Apache httpd due to pool
    concurrency issues
  - Resolves: #1861380 - httpd/mod_proxy_http/mod_ssl aborted when sending
    a client cert to backend server
  - Resolves: #1680118 - unorderly connection close when client attempts
    renegotiation


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-36
changelog:
  - Resolves: #1896176 - [RFE] ProxyWebsocketIdleTimeout from httpd
    mod_proxy_wstunnel
  - Resolves: #1847585 - mod_ldap: High CPU usage at apr_ldap_rebind_remove()


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-37
changelog:
  - Resolves: #1883648 - [RFE] Update httpd directive SSLProxyMachineCertificateFile
    to be able to handle certs without matching private key


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-40
changelog:
  - Resolves: #1952557 - mod_proxy_wstunnel.html is a malformed XML
  - Resolves: #1937334 - SSLProtocol with based virtual hosts


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-41
changelog:
  - Resolves: #1680111 - httpd sends reply to HTTPS GET using two TLS records
  - Resolves: #1905613 - mod_ssl does not like valid certificate chain
  - Resolves: #1935742 - [RFE] backport samesite/httponly/secure flags for
    usertrack
  - Resolves: #1972500 - CVE-2021-30641 httpd:2.4/httpd: MergeSlashes regression
  - Resolves: #1968307 - CVE-2021-26690 httpd:2.4/httpd: mod_session NULL pointer
    dereference in parser
  - Resolves: #1934741 - Apache trademark update - new logo


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-42
changelog:
  - Resolves: #2007236 - CVE-2021-40438 httpd:2.4/httpd: mod_proxy: SSRF via
    a crafted request uri-path
  - Resolves: #1969229 - CVE-2021-26691 httpd:2.4/httpd: Heap overflow in
    mod_session


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-43
changelog:
  - Related: #2007236 - CVE-2021-40438 httpd:2.4/httpd: mod_proxy: SSRF via
    a crafted request uri-path


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-44
changelog:
  - Resolves: #1968278 - CVE-2020-35452 httpd:2.4/httpd: Single zero byte stack
    overflow in mod_auth_digest
  - Resolves: #2001046 - Apache httpd OOME with mod_dav in RHEL 8
  - Resolves: #2005128 (CVE-2021-34798) - CVE-2021-34798 httpd: NULL pointer
    dereference via malformed requests
  - Resolves: #1984828 - mod_proxy_hcheck piles up health checks leading to high
    memory consumption
  - Resolves: #2005119 - CVE-2021-39275 httpd: out-of-bounds write in
    ap_escape_quotes() via malicious input


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-45
changelog:
  - Resolves: #2007199 - CVE-2021-36160 httpd:2.4/httpd: mod_proxy_uwsgi:
    out-of-bounds read via a crafted request uri-path
  - Resolves: #1972491 - CVE-2021-33193 httpd:2.4/mod_http2: Request splitting via
    HTTP/2 method injection and mod_proxy


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-46
changelog:
  - Resolves: #2035063 - CVE-2021-44790 httpd:2.4/httpd: mod_lua: possible buffer
    overflow when parsing multipart content


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-47
changelog:
  - Resolves: #2035030 - CVE-2021-44224 httpd:2.4/httpd: possible NULL dereference
    or SSRF in forward proxy configurations


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-48
changelog:
  - Resolves: #2065249 - CVE-2022-22720 httpd:2.4/httpd: HTTP request smuggling
    vulnerability in Apache HTTP Server 2.4.52 and earlier


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-50
changelog:
  - Resolves: #2065237 - CVE-2022-22719 httpd:2.4/httpd: mod_lua: Use of
    uninitialized value of in r:parsebody
  - Resolves: #2065267 - CVE-2022-22721 httpd:2.4/httpd: core: Possible buffer
    overflow with very large or unlimited LimitXMLRequestBody
  - Resolves: #2065324 - CVE-2022-23943 httpd:2.4/httpd: mod_sed: Read/write
    beyond bounds


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-51
changelog:
  - Resolves: #2097015 - CVE-2022-28614 httpd:2.4/httpd: out-of-bounds read via
    ap_rwrite()
  - Resolves: #2097031 - CVE-2022-28615 httpd:2.4/httpd: out-of-bounds read in
    ap_strcmp_match()
  - Resolves: #2097458 - CVE-2022-30522 httpd:2.4/httpd: mod_sed: DoS
    vulnerability
  - Resolves: #2097480 - CVE-2022-30556 httpd:2.4/httpd: mod_lua: Information
    disclosure with websockets
  - Resolves: #2098247 - CVE-2022-31813 httpd:2.4/httpd: mod_proxy:
    X-Forwarded-For dropped by hop-by-hop mechanism
  - Resolves: #2097451 - CVE-2022-29404 httpd:2.4/httpd: mod_lua: DoS in
    r:parsebody
  - Resolves: #2096997 - CVE-2022-26377 httpd:2.4/httpd: mod_proxy_ajp: Possible
    request smuggling


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-56
changelog:
  - Resolves: #2162499 - CVE-2006-20001 httpd: mod_dav: out-of-bounds read/write
    of zero byte
  - Resolves: #2162485 - CVE-2022-37436 httpd: mod_proxy: HTTP response splitting
  - Resolves: #2162509 - CVE-2022-36760 httpd: mod_proxy_ajp: Possible request
    smuggling


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-56.4
changelog:
  - Resolves: #2177748 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting
    with mod_rewrite and mod_proxy


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.1
changelog:
  - Resolves: RHEL-45812 - httpd:2.4/httpd: Substitution encoding issue
    in mod_rewrite (CVE-2024-38474)
  - Resolves: RHEL-45785 - httpd:2.4/httpd: Encoding problem in
    mod_proxy (CVE-2024-38473)
  - Resolves: RHEL-45777 - httpd:2.4/httpd: Improper escaping of output
    in mod_rewrite (CVE-2024-38475)
  - Resolves: RHEL-45758 - httpd:2.4/httpd: null pointer dereference
    in mod_proxy (CVE-2024-38477)
  - Resolves: RHEL-45743 - httpd:2.4/httpd: Potential SSRF
    in mod_rewrite (CVE-2024-39573)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.2
changelog:
  - Resolves: RHEL-46040 - httpd:2.4/httpd: Security issues via backend
    applications whose response headers are malicious or exploitable (CVE-2024-38476)
  - Resolves: RHEL-53022 - Regression introduced by CVE-2024-38474 fix


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.3
changelog:
  - Resolves: RHEL-56068 - Apache HTTPD no longer parse PHP files with
    unicode characters in the name


author: Parag Nemade <pnemade AT redhat DOT com> - 0.20080825-12
changelog:
  - Add Supplements: tag for langpacks naming guidelines
  - Clean the specfile to follow current packaging guidelines


author: Michael Stahl <mstahl@redhat.com> - 0.20151222-1
changelog:
  - upgrade to latest version
  - upstream removed "OASIS distribution license agreement 0.1", only GPLv2/v3 now
  - remove needless use of percent-defattr


author: Michael Stahl <mstahl@redhat.com> - 0.20160407-1
changelog:
  - Resolves: rhbz#1344662 upgrade to latest release
  - switch source URL to https
  - revert the GNU grep 2.23 LANG=C bug workaround
  - added explicit build dependency on perl, now required on rawhide


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.28.20180415git.el8
changelog:
  - hpvd-Set-IgnoreOnIsolate-1-in-systemd-units.patch [bz#1769920]
  - Resolves: bz#1769920
    ([Hyper-V][RHEL8] Running 'systemctl isolate' on any target stops hyperv-daemon services)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.29.20180415git.el8
changelog:
  - hvd-Update-C-files-and-scripts-to-kernel-version-5.7-rc1.patch [bz#1816750]
  - hvd-Add-vmbus_testing-tool-build-files.patch [bz#1816750]
  - Resolves: bz#1816750
    ([Hyper-V][RHEL8.3] Update Hyper-V tools)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.30.20180415git.el8
changelog:
  - hvd-tools-hv-change-http-to-https-in-hv_kvp_daemon.c.patch [bz#1886104]
  - Resolves: bz#1886104
    ([Hyper-V][RHEL8.4] Update Hyper-V-Daemons)


author: Jon Maloy <jmaloy@redhat.com> - 0-0.31.20180415git.el8
changelog:
  - hpvd-Enable-build-on-aarch64.patch [bz#2020141]
  - Resolves: bz#2020141
    ([Hyper-V][RHEL8.6][ARM64] No hyperv-daemons package built for aarch64 platform)


author: Jon Maloy <jmaloy@redhat.com> - 0-0.32.20180415git.el8
changelog:
  - hpvd-hv_set_ifconfig.sh-Use-nmcli-commands.patch [bz#2065202]
  - hpvd-Use-filename-for-connection-profile.patch [bz#2065202]
  - Resolves: bz#2065202
    ([RHEL8.6][Hyper-V]The /usr/libexec/hypervkvpd/hv_set_ifconfig need update since the ifdown/ifup was not supported on RHEL8 [rhel-8.7.0])


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.33.20180415git
changelog:
  - hpvd-hypervkvpd.service-ordering-fixes.patch [bz#2115761]
  - hpvd-redhat-Add-ConditionalVirtualization-to-the-rest-of-.patch [bz#2115761]
  - Resolves: bz#2115761
    ([Hyper-V][RHEL-8] hypervkvpd.service service ordering)


author: Jon Maloy <jmaloy@redhat.com> - 0-0.34.20180415git
changelog:
  - hpvd-redhat-hv_set_if_config-Workaround-for-gateway-numbe.patch [bz#2142028]
  - hpvd-tools-hv-Remove-an-extraneous-the.patch [bz#2139456]
  - hpvd-tools-hv-kvp-remove-unnecessary-void-conversions.patch [bz#2139456]
  - Resolves: bz#2142028
    ([Hyper-V][RHEL-8] Cannot set gateway properly when set static IPADDR0,NETMASK0,GATEWAY in ifcfg-eth0)
  - Resolves: bz#2139456
    ([Hyper-V][RHEL8.8] Update Hyper-V-Daemons)


author: Tomas Hozza <thozza@redhat.com> - 0-0.2.20130826git
changelog:
  - Use 'hypervkvpd' directory in libexec for KVP daemon scripts (#1010268)
  - daemons are now WantedBy multi-user.target instead of basic.target (#1010260)


author: Tomas Hozza <thozza@redhat.com> - 0-0.3.20131022git
changelog:
  - rebase to the latest git snapshot next-20130927 (obtained 2013-10-22)
    - KVP, VSS: daemon use single buffer for send/recv
    - KVP: FQDN is obtained on start and cached


author: Tomas Hozza <thozza@redhat.com> - 0-0.5.20140219git
changelog:
  - rebase to the latest git snapshot next-20140219
    - KVP, VSS: removed inclusion of linux/types.h
    - VSS: Ignore VFAT mounts during freeze operation


author: Tomas Hozza <thozza@redhat.com> - 0-0.7.20140611git
changelog:
  - Fix FTBFS (#1106781)
  - Use kernel-headers instead of kernel-devel for building
  - package new Hyper-V fcopy daemon as hypervfcopyd sub-package


author: Tomas Hozza <thozza@redhat.com> - 0-0.8.20140714git
changelog:
  - Update the File copy daemon to the latest git snapshot
  - Fix hyperfcopyd.service to check for /dev/vmbus/hv_fcopy


author: Vitaly Kuznetsov <vkuznets@redhat.com> - 0-0.10.20150108git
changelog:
  - Rebase to 3.19-rc3 (20150108 git snapshot)
  - Drop 'nodaemon' patches, use newly introduced '-n' option


author: Vitaly Kuznetsov <vkuznets@redhat.com> - 0-0.12.20150702git
changelog:
  - Rebase to 4.2-rc0 (20150702 git snapshot)
  - Switch to new chardev-based communication layer (#1195029)


author: Vitaly Kuznetsov <vkuznets@redhat.com> - 0-0.15.20160728git
changelog:
  - Rebase to 4.8-rc0 (20160728 git snapshot)
  - Disable services and remove ConditionVirtualization, multi-user.target
    dependencies switching to udev-only activation (#1331577)


author: Jon Maloy <jmaloy@redhat.com> - 0-0.34.20180415git.el8_7
changelog:
  - hpvd-redhat-hv_set_if_config-Workaround-for-gateway-numbe.patch [bz#2150255]
  - Resolves: bz#2150255
    ([Hyper-V][RHEL-8] Cannot set gateway properly when set static IPADDR0,NETMASK0,GATEWAY in ifcfg-eth0 [rhel-8.7.0.z])


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.19-13
changelog:
  - Resolves: #1897548 - Rebuild IBus emoji with unicode-emoji-13.0-4 and cldr-emoji-annotation-39-2
  - Rebuild ibusemojigen.h and ibusunicodegen.h
  - Add ibus-1897548-emoji-unicode.patch to lookup Unicode names
  - Add U+32FF to IBusUnicodeData
  - Add ibus-po-1.5.19-20210706.tar.gz


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090211-1
changelog:
  - Add --xim argument in xinput-ibus
  - Add Obsoletes:  ibus-qt <= 1.1.0
  - Move libibus.so.* to ibus-libs to make ibus multilib.
  - Update to 1.1.0.20090211.


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090211-6
changelog:
  - Recreate the ibus-HEAD.patch from upstream git source tree.
  - The new patch fixes ibus-x11 segfault (#485661).


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090211-10
changelog:
  - Recreate the ibus-HEAD.patch from upstream git source tree.
  - Put 'Select an input method' in engine select combobox (#485861).


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090225-1
changelog:
  - Update to ibus-1.1.0.20090225.
  - Fix problems in %post and %postun scripts.
  - Hide ibus & ibus preferences menu items.


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090311-1
changelog:
  - Update to ibus-1.1.0.20090311.
  - Update setup ui follow GNOME Human Interface Guidelines 2.2 (#489497).


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090311-2
changelog:
  - Recreate the ibus-HEAD.patch from upstream git source tree.
  - Fix bug 490009 - Deleting Next Engine shortcuts doesn't work
  - Fix bug 490381 - Change "Next/Previous engine" labels


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090311-3
changelog:
  - Recreate the ibus-HEAD.patch from upstream git source tree
  - Fix bug 491999 - up/down arrow keys broken in xchat


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090331-1
changelog:
  - Update to ibus-1.1.0.20090331.
  - Fix bug 492956 - screws up keyboard input in firefox
  - Fix bug 490143 - ibus issue with gnome-keyring


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090407-1
changelog:
  - Update to ibus-1.1.0.20090407.
  - Fix bug 491042 - ibus default trigger hotkeys
  - Fix bug 492929 - ibus-hangul can cause gtk app to lockup
  - Fix bug 493701 -  (ibus) imsettings disconnect/reconnect kills gtk app
  - Fix bug 493687 -  ibus-hangul should default to vertical candidate selection
  - Fix bug 493449 -  ibus broke Alt-F2 command auto-completion


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090407-3
changelog:
  - Update the tarball.
  - Fix bug 494511 - ibus-gtk makes gnome-terminal abort 
    when a key is pressed


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090413-2
changelog:
  - Update ibus-HEAD.patch.
  - Change the mode of /tmp/ibus-$USER to 0700 to improve security
  - Change the mode of /tmp/ibus-$USER/socket-address to 0600 to improve security
  - Update as.po


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090413-3
changelog:
  - Update ibus-HEAD.patch.
  - Fix bug 495431 -  ibus Release modifier doesn't work with Alt
  - Fix bug 494445 -  ibus-hangul missing Hangul Han/En mode
    (and Alt_R+release hotkey)
  - Update te.po


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090417-1
changelog:
  - Update to ibus-1.1.0.20090417.
  - Fix bug 496199 -  cannot remove Ctrl+Space hotkey with ibus-setup


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090423-1
changelog:
  - Update to ibus-1.1.0.20090423.
  - Fix bug 497265 - [mai_IN] Maithili language name is not correct.
  - Fix bug 497279 - IBus does not works with evolution correctly.
  - Enhance authentication both in daemon & clients


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090423-2
changelog:
  - Fix bug 498141 - new ibus install needs gtk immodules
  - Separate ibus document from ibus-devel to ibus-devel-docs


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090508-1
changelog:
  - Update to 1.1.0.20090508
  - Fix bug 499533 - [Indic] ibus should allow input in KDE using all supported Indic locales
  - Fix bug 498352 - hotkey config table should list keys in same order as on main setup page
  - Fix bug 497707 - ibus French translation update


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090508-2
changelog:
  - Remove requires notification-daemon
  - Fix bug 500588 - Hardcoded requirement for notification-daemon


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090508-4
changelog:
  - Update ibus-HEAD.patch.
  - Fix bug 501211 - ibus-setup window should be raised if running or just stay on top/grab focus
  - Fix bug 501640 - ibus should adds new IMEs at end of engine list not beginning
  - Fix bug 501644 - [IBus] focus-out and disabled IME should hide language panel


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090508-5
changelog:
  - Update ibus-HEAD.patch.
  - Show the default input method with bold text
  - Add information text below input methods list


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090609-1
changelog:
  - Update to Update to 1.1.0.20090609
  - Fix bug 502414 - Implemented on-screen help facility
  - Fix bug 502561 - iBus should show keymap name on iBus panel
  - Fix bug 498043 - ibus Alt-grave trigger conflicts with openoffice.org
  - Implemented API for setting labels for candidates in LookupTable


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090612-1
changelog:
  - Update to 1.1.0.20090612
  - Fix bug 504942 - PageUp and PageDown do not work in candidate list
  - Fix bug 491040 - Implememnt mouse selection in candidate list


author: Peng Huang <phuang@redhat.com> - 1.2.0.20090828-1
changelog:
  - Update to 1.2.0.20090828
  - Change the icon on systray.
  - Fix segment fault in ibus_hotkey_profile_destroy
  - Fix some memory leaks.


author: Peng Huang <phuang@redhat.com> - 1.2.0.20090915-1
changelog:
  - Update to 1.2.0.20090915
  - Fix bug 521591 - check if the icon filename is a real file before trying to open it
  - Fix bug 522310 - Memory leak on show/hide
  - Fix bug 509518 - ibus-anthy should only override to jp layout for kana input


author: Peng Huang <phuang@redhat.com> - 1.2.0.20091124-1
changelog:
  - Update to 1.2.0.20091124
  - Update some translations.
  - Fix bug 538147 - [abrt] crash detected in firefox-3.5.5-1.fc12


author: Peng Huang <phuang@redhat.com> - 1.2.0.20091204-1
changelog:
  - Update to 1.2.0.20091204
  - Fix Bug 529920 - language panel pops up on the wrong monitor
  - Fix Bug 541197 - Ibus crash


author: Peng Huang <phuang@redhat.com> - 1.2.0.20091225-1
changelog:
  - Update to 1.2.0.20091225
  - Fix bug 513895 - new IME does not show up in ibus-setup
  - Fix bug 531857 - applet order should correspond with preferences order
  - Fix bug 532856 - should not list already added input-methods in Add selector


author: Peng Huang <phuang@redhat.com> - 1.3.0-3
changelog:
  - Update ibus-HEAD.patch
  - Fix bug - some time panel does not show candidates.
  - Update some po files


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.8-1
changelog:
  - Updated to 1.3.8
  - Added ibus-541492-xkb.patch
    Fixes Bug 541492 - ibus needs to support some xkb layout switching
  - Added ibus-435880-surrounding-text.patch
    Fixes Bug 435880 - ibus-gtk requires surrounding-text support
  - Added ibus-xx-workaround-gtk3.patch
    Workaround for f14 http://koji.fedoraproject.org/koji/taskinfo?taskID=2516604


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20101202-1
changelog:
  - Updated to 1.3.99.20101202
  - Added ibus-530711-preload-sys.patch
    Fixed Bug 530711 - Reload preloaded engines by login


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20110117-1
changelog:
  - Updated to 1.3.99.20110117
  - Fixed Bug 666427 - ibus requires dbus-x11
  - Fixed Bug 670137 - QT_IM_MODULE=xim in ibus.conf without ibus-qt


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20110228-1
changelog:
  - Updated to 1.3.99.20110228
  - Integrated the part of gjs in Bug 657165 ibus for gnome-shell.
    Added ibus-657165-panel-libs.patch
    Added gnome-shell-ibus-plugins-20110304.tar.bz2
  - Fixed Bug 675503 - a regression in sync mode
    Added ibus-675503-gnome-shell-workaround.patch until gnome-shell is updated.
  - Fixed Bug 677856 - left ibus snooper when im client is switched.
  - Fixed Bug 673047 - abrt ibus_xkb_get_current_layout for non-XKB system
    Updated ibus-541492-xkb.patch


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20110408-1
changelog:
  - Updated to 1.3.99.20110408
    Fixed Bug 683484 - Timed out SetEngine when select an engine from panel.
    Fixed Bug 657165 - IBus for gnome-shell for Fedora 15.
  - Upstreamed ibus-657165-panel-libs.patch
  - Removed ibus-675503-gnome-shell-workaround.patch
  - Added ibus-xx-setup-frequent-lang.patch
  - Updated ibus-541492-xkb.patch
    Fixed Bug 696481 - no the variant maps without language codes
  - Added dependency of imsettings-gnome.
    Fixed Bug 696510 - need a dependency in ibus-gtk3 for imsettings-gnome


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20110419-1
changelog:
  - Updated to 1.3.99.20110419
  - Added ibus-HEAD.patch
    Fixed Bug 697471 - ibus-gconf zombie when restart ibus from ibus panel.
  - Updated ibus-541492-xkb.patch
    Fixed Bug 701202 - us(dvorak) does not show up in list
    Updated ibus-1.0.pc for ibus-xkb
    Showed XKB variant descriptions only without layout descriptions.
  - Updated ibus-xx-setup-frequent-lang.patch
    Updated UI strings


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20110817-3
changelog:
  - Fixed Bug 700472 Use a symbol icon instead of an image icon.
  - Updated ibus-HEAD.patch for upstream.
  - Removed ibus-435880-surrounding-text.patch as upstream.
  - Added ibus-711632-fedora-fallback-icon.patch
    Fixed SEGV with no icon in oxygen-gtk icon theme.
  - Added ibus-xx-bridge-hotkey.patch
    Triaged Bug 707370 SetEngine timeout
    Fixed Bug 731610 Keep IM state when text input focus changes
  - Added transitional ibus-gnome3 package.
    Fixed Bug 718110 Use a shell icon instead of pygtk2 icon.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20110817-4
changelog:
  - Updated ibus-gjs 3.1.91.20110908 and 3.0.2.20110908 for gnome-shell.
    Fixed preedit active segments on gnome-shell and X11 apps.
  - Added ibus-xx-g-s-disable-preedit.patch
    Disabled preedit on gnome-shell for a workaround.
  - Updated ibus.spec
    Fixed Bug 735879 pre/postun scripts


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-2
changelog:
  - Updated to 1.4.0
  - Updated ibus-gjs 3.0.2.20110928 for f15.
  - Updated ibus-gjs 3.2.0.20110928 for f16. (#740588)
  - Updated ibus-530711-preload-sys.patch
    Fixed not to show duplicated engine names in setup treeview (#740447)
  - Updated bus-gjs-xx-gnome-shell-3.1.4-build-failure.patch for f16.
  - Updated ibus-xx-bridge-hotkey.patch
    Fixed a XKB configuration without the input focus for f16 (#739165)
    Fixed not to show null strings in case of no variants (#738130)


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-9
changelog:
  - Updated ibus-HEAD.patch
    Fixed prev/next keys without global engine.
  - Updated ibus-xx-bridge-hotkey.patch for f16
    Fixed Bug 747902 - mouse and ctrl+space not working
    Fixed Bug 749770 - IME hotkey after Control + Space
  - Updated ibus-711632-fedora-fallback-icon.patch
    Fixed Bug 717831 - use old icon for desktops other than gnome


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-10
changelog:
  - Updated ibus-xx-bridge-hotkey.patch for f16
    Fixed no XKB languages from layout only. e.g. in(eng).
  - Updated ibus-541492-xkb.patch
    Fixed not to show 'eng' on GUI for in(eng).


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-11
changelog:
  - Updated ibus-541492-xkb.patch
    Fixed Bug 750484 - support reloading Xmodmap
  - Updated ibus-HEAD.patch
    Fixed Bug 753781 - ibus-x11 needs async for hangul ibus_commit_text.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-14
changelog:
  - Enabled dconf.
  - Updated ibus-HEAD.patch
    Fixed Bug 618229 - engine setup buton on ibus-setup.
  - Removed ibus-711632-fedora-fallback-icon.patch as upstreamed.
  - Updated ibus-xx-bridge-hotkey.patch
    Removed Enable/Disable buttons on ibus-setup


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-16
changelog:
  - Enhanced ibus-gnome3 shell lookup window.
  - Updated ibus-HEAD.patch from upstream
    Fixed Bug 769135 - ibus-x11 SEGV in _process_key_event_done.
  - Updated ibus-541492-xkb.patch
    Fixed Bug 757889 - ibus-setup SEGV without active engine.
    Fixed Bug 760213 - ibus-setup saves XKB variants correctly.
    Fixed Bug 769133 - ibus-engine-xkb returns FALSE for ASCII typings.
  - Updated ibus-xx-bridge-hotkey.patch for an enhancement.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-17
changelog:
  - Added ibus-771115-property-compatible.patch for f16
    Fixed Bug 771115 - IBusProperty back compatibility.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120203-1
changelog:
  - Updated to 1.4.99.20120203
  - Removed ibus-xx-bridge-hotkey.patch
  - Updated ibus-541492-xkb.patch to use libgnomekbd.
  - Updated ibus-xx-setup-frequent-lang.patch for 1.4.99.20120203


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120203-3
changelog:
  - Fixed ibus-setup on C locale
  - Fixed to show no registered engines from g-c-c.
  - Enabled Alt_R keybinding on ko locales for ibus gtk only.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120303-3
changelog:
  - Bumped to ibus-gjs 3.3.90.20120308 to work with gnome-shell 3.3.90
  - Fixed Bug 786906 - Added ifnarch ppc ppc64 s390 s390x
  - Updated ibus-HEAD.patch
    Fixed Bug 800897 - After doing "ctrl+space", ibus tray icon freezes


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120317-1
changelog:
  - Bumped to 1.4.99.20120317
    Fixed Bug 718668 - focus move is slow with ibus-gnome3
    Fixed Bug 749497 - Enhance IME descriptions in status icon active menu
  - Bumped to ibus-gjs 3.3.90.20120317
  - Added ibus-xx-no-use.diff
    Fixed Bug 803260 - Disable non-global input method mode
  - Updated ibus-HEAD.patch
    Fixed Bug 803250 - ibus lookup window font customization
    Fixed Bug 803177 - language id on ibus-ui-gtk3 switcher
  - Update ibus-530711-preload-sys.patch
    Fixed Bug 797023 - port preload engines


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120428-1
changelog:
  - Bumped to 1.4.99.20120428
    Fixed Bug 799571 - no IME list at the session login.
    Fixed Bug 810415 - ibus does not handle Ctrl+space with BUTTON_PRESS.
  - Bumped to ibus-gjs 3.4.1.20120428
    Fixed Bug 802052 - no modifiers trigger keys.
    Fixed Bug 803244 - IME switch Ctrl+space not working on shell text entry.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120428-2
changelog:
  - Updated ibus-HEAD.patch
  - Updated ibus-541492-xkb.patch
  - Updated ibus-xx-branding-switcher-ui.patch
    Fixed Bug 810211 - Cancel Control + space pressing Control key.
  - Updated ibus-xx-no-use.diff
    Enabled to customize trigger keys with non-modifier trigger keys.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120822-1
changelog:
  - Bumped to 1.4.99.20120822
  - Bumped to ibus-gjs 3.4.1.20120815
    Fixed Bug 845956 - ibus backward trigger key is not customized
    Fixed Bug 844580 - ibus-dconf does not load the system gvdb
  - Separated ibus-810211-no-switch-by-no-trigger.patch from ibus-HEAD.patch


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120822-2
changelog:
  - Updated ibus-530711-preload-sys.patch
  - Updated ibus-541492-xkb.patch
  - Updated ibus-xx-no-use.diff
    Fixed Bug 854161 - not able to add keymap with ibus-setup


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20121109-1
changelog:
  - Bumped to 1.4.99.20121109
  - Removed im-chooser, imsettings-gnome, gnome-icon-theme-symbolic
    dependencies in f18 because ibus gnome integration is done.
    Use ibus-keyboard instead of input-keyboard-symbolic.
  - Disabled ibus-gjs build because of ibus gnome integration.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.2-1
changelog:
  - Bumped to 1.5.2
  - Created noarch packages for python files due to .pyc and .pyo.
  - Added man pages.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.2-4
changelog:
  - Updated ibus-HEAD.patch for upstream.
  - Added ibus-xx-1.5.2.patch until 1.5.3 will be released.
  - Added ibus-xx-ctrl-space.patch for back compatible triggers.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.3-1
changelog:
  - Bumped to 1.5.3
  - Deleted ibus-xx-g-s-disable-preedit.patch as EOL.
  - Deleted ibus-gjs as EOL.
  - Removed imsettings-gnome, im-chooser, libgnomekbd dependencies.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.4-1
changelog:
  - Bumped to 1.5.4
  - Added ibus.conf.5
  - Added ibus-xkb-1.5.0.tar.gz for po files.
  - Added ibus-xx-f19-password.patch for back compatibility.
  - Added ibus-wayland in f20 or later.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.7-5
changelog:
  - Updated ibus-HEAD.patch from upstream.
    Added pl(qwertz).
    Fixed escape key with Ctrl-Shift-U.
    Updated pt-br compose table from the latest xorg.
    Do not sort ibus engines when they are saved by ibus-setup.
    Updated jp IBusKeymap.
    Added ibus reset-config and read-config sub-commands.
    Update ibus(1) for read-config and reset-config.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.7-6
changelog:
  - Updated ibus-HEAD.patch from upstream.
    Fixed ibus-setup SEGV when an engine is selected.
    Fixed ibus-setup deprecated warnings with the latest python3-gobject.
    Integrated the 'IBUS_SETUP_XID' environment variable for each engine setup.
    Set prgname 'ibus-setup' for ibus-setup.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.8-1
changelog:
  - Bumped to 1.5.8
  - Deleted ibus-810211-no-switch-by-no-trigger.patch
  - Deleted ibus-541492-xkb.patch
  - Deleted ibus-530711-preload-sys.patch
  - Deleted ibus-xx-setup-frequent-lang.patch
  - Deleted ibus-xx-f19-password.patch


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.9-6
changelog:
  - Updated ibus-xx-increase-timeout.patch to fix #1163722
  - Updated ibus-HEAD.patch for upstream #1747, #1748, #1753
    and gnome #703020, gnome #730628


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.10-2
changelog:
  - Updated ibus-HEAD.patch from upstream
    Added Swedish svdvorak
    I18N engine longnames and descriptions on ibus-setup
    Moved PropertyPanel at bottom right in KDE5
    Drew gray color on Handle PropertyPanel
    Enabled ibus engine full path icon in KDE5
    Updated translations


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.10-3
changelog:
  - Updated ibus-HEAD.patch from upstream
    Fixed to show shortcuts on ibus-setup.
    Bug 1214271 Fixed to enable IME with GTK3 applications in wayland.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.13-3
changelog:
  - Bug 1349732 - ibus not working at all in Gnome Wayland
  - Add ibus service file
  - Fix CSS color format and font size


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.14-3
changelog:
  - Fixed Bug 1380675 - Emoji leaves the candidates of @laugh when @laughing
  - Fixed Bug 1380690 - User is not able to select emojis from digit keys
  - Fixed Bug 1380691 - PageUp PageDown buttons on emoji lookup not working


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.14-5
changelog:
  - support scroll event in candidates panel
  - Fixed Bug 1403985 - Emoji typing is enabled during Unicode typing
  - Fixed Bug 1402494 - Font settings of ibus are ignored on non-Gnome


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.15-2
changelog:
  - Added ibus-HEAD.patch to get upstream patches
    Fixed ibus_emojier_run() SIGABRT with `ibus emoji`
    Enhanced theme color on emoji candidates


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.15-3
changelog:
  - Emoji dialog enhancements and bug fixes
    Fixed ibus_emoji_dict_load() API.
    Focus on emoji text entry by default
    Removed internal text buffer and use Gtk.Entry buffer instead.
    Implemented cursor left, right, home, end on emoji annotation preedit.
    Show localized emoji description from tts in emoji xml.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.15-4
changelog:
  - Implemented Ctrl-[f|b|n|p|h|e|a|u] for cursor operations on emoji dialog
  - Added XSetIOErrorHandler() for GNOME3 desktop


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.15-5
changelog:
  - Moved language setting on IBusEmojier to ibus-setup.
  - Enabled strcasecmp to match emoji annotations.
  - Added a build error message if emoji xml files are not found.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.15-6
changelog:
  - Enabled unicode_alt in EmojiOne json file
  - Enabled to type multiple code points on Emojier
  - Fixed IBusEmojiDialog_1_0_gir_LIBS for --as-needed LDFLAGS


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.15-8
changelog:
  - Dropped nodejs-emojione-json and import unicode-emoji instead
  - Created emoji tab in ibus-setup
  - Set default emoji font size from gsettings in ibus emoji command
  - Added an option of emoji partial match in ibus-setup
  - Hid emoji variants by default
  - Added ibus-emoji man page
  - emoji favorites category is updated by selecting emoji


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.16-2
changelog:
  - Added ctrl-c,v,x for annotations and ctrl-shift-c for emoji
  - Added Malay and Mongolian keymaps
  - Made all emoji dicts to fully qualified


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.16-9
changelog:
  - Fix scaling factor, mouse events on switcher, c-s-u on im-ibus, 
    propertypanel position and menu 
  - Add ibus-portal
  - Move ibus-emoji-dialog.vapi in the build
  - Fixed some SEGVs #1406699 #1432252


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.17-9
changelog:
  - Added panel extension for emoji keybinding not to depen on desktops
  - Showed Unicode code points on Unicode name list


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.18-5
changelog:
  - Disabled python2 since RHEL8
  - Run make check in %check except for GUI testings
  - Fixed Bug 1574855 - [abrt] ibus: ibus_engine_filter_key_event()


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.18-7
changelog:
  - Moved input focus on Emojier to engines' preedit
  - Removed ibus-xx-emoji-harfbuzz.patch not to change session emoji font


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.18-9
changelog:
  - Do not use combined characters on preedit for compose keys
  - Fixed an infinite loop of extension preedit with xterm


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.18-14
changelog:
  - Fixed Man page scan results for ibus
  - Added IBUS_DISCARD_PASSWORD env variable for password dialog in firefox
  - Added history annotation for previous emojis


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.19-3
changelog:
  - Fix Bug SEGV Choose an emoji by mouse from the emoji category list
  - Fix Bug 1618682 - SEGV with ASCII on emojier in Wayland
  - Support Shift-Space on emojier preedit
  - Do not move Emojier popup with the active candidate in Xorg
  - Do not clear Unicode data when emoji annotation lang is changed


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.19-5
changelog:
  - Resolves: #1713606 - Fix hangul preedit commit with mouse click
  - Resolves: #1682157 - Integrate ibus-desktop-testing and test cases


author: Mike FABIAN <mfabian@redhat.com> - 1.9.18-1
changelog:
  - update to 1.9.18
  - validate ibus-table.appdata.xml in %check
  - Update translations from zanata (pt_BR updated, es new)
  - Don't query user database if user define phrase and
    dynamic adjust are disabled (thanks to heiher)
  - Enable hash map based cache for user database enabled
    (thanks to heiher)
  - Import hash map based cache for table database (thanks to
    heiher)
  - Install appstream metadata to /usr/share/metainfo/ (thanks
    to jbicha)
  - Fix some appdata validation issues (thanks to jbicha)
  - Fix bug in Unihan_Variants.txt, 著 U+8457 is both
    simplified *and* traditional Chinese (thanks to heiher)


author: Mike FABIAN <mfabian@redhat.com> - 2.0.0-1
changelog:
  - Update to 2.0.0
  - Update translations because of the merge of the engines (de, pl, uk updated)
  - Update emoji annotations from CLDR
  - Do not hardcode icon names in desktop files
    (Resolves: https://github.com/mike-fabian/ibus-typing-booster/issues/17)
  - Change the default for “Unicode symbols and emoji predictions” to “False”
  - Merge all typing-booster engines into one
  - Change the UI of the setup tool to make it possible to select
    multiple input methods and dictionaries
  - Move the buttons to learn from a file and to delete learned data to the options tab
  - Use the same “About” dialog in the setup tool as in emoji-picker


author: Mike FABIAN <mfabian@redhat.com> - 2.0.2-1
changelog:
  - Update to 2.0.2
  - Better Tab handling, use Tab to switch to the next candidate, not to commit
  - Update to 2.0.1
  - Update translations from zanata (ja updated)
  - Update emoji annotations from CLDR
  - Fix some bugs in the usage of “prefix” for prefixes other than “/usr” (For FreeBSD)
  - Make itb_util.get_ime_help() work on FreeBSD
  - Update UnicodeData.txt to Unicode 11.0.0
  - Remove useless 't-nil vi-base': 'vi-base.mim', from M17N_INPUT_METHODS
  - Remove extra space in entry for sa-IAST input method to make it work
  - Show in the setup tool in the input listbox whether minput_open_im() succeeded.
  - Use the rocket icon emoji_u1f680.svg from the “Noto Color Emoji” font


author: Mike FABIAN <mfabian@redhat.com> - 2.1.0-1
changelog:
  - Update to 2.1.0
  - emoji-picker: Show a concise description of a selected emoji in the header bar
  - Update the setup UI when settings are changed outside of the setup UI
  - Migrate IBusConfig to GSettings (The old settings are
    unfortunately lost, so one has to open the setup tool
    and recreate ones favourite settings).
  - Read emoji data files always in UTF-8


author: Mike FABIAN <mfabian@redhat.com> - 2.1.0-3
changelog:
  - Make “make check“ test cases work again when building the rpm
    (To avoid that rpmdiff in the errata tool reports a problem)
  - Related: rhbz#1619153


author: Mike FABIAN <mfabian@redhat.com> - 2.1.0-5
changelog:
  - Prevent also BackSpace from reopening a preedit when the
    option “Arrow keys can reopen a preedit” is off
  - Resolves: rhbz#1925030


author: Mike FABIAN <mfabian@redhat.com> - 2.1.0-7
changelog:
  - Avoid verbatim bidi formatting characters in source comments
    to make rpminspect complain less.
  - Resolves: RHEL-2237


author: Jiri Vanek <jvanek@redhat.com> 1.7.1-16
changelog:
  - added patch1, patch4 and patch11 to fix CVE-2019-10182
  - added patch2 to fix CVE-2019-10181
  - added patch3 and patch33 to fix CVE-2019-10185
  - Resolves: rhbz#1724958 
  - Resolves: rhbz#1725928 
  - Resolves: rhbz#1724989


author: - Jiri Vanek <jvanek@redhat.com> -1.8.4-2
changelog:
  - added native launchers, via separate subpackage, but efectively changed main package to arched one
  - removed policyeditor man page, it was link to itself
  - Resolves: rhbz#1900043


author: - Jiri Vanek <jvanek@redhat.com> -1.8.4-4
changelog:
  - added patch2, fed2f5b-22402bb.patch containing important fixes from future 1.8.5
  - Resolves: rhbz#1900043


author: Richard W.M. Jones <rjones@redhat.com> - 0.31.3-1
changelog:
  - New upstream version 0.31.3.
  - This includes all the previous upstream patches, and reverts the
    check which broke processing of PE binaries.


author: Martin Gieseking <martin.gieseking@uos.de> - 0.32.3-1
changelog:
  - Updated to version 0.32.3.
  - Dropped patch to fix https://savannah.nongnu.org/bugs/?52319 (applied upstream)


author: Martin Kolman <mkolman@redhat.com> - 0.3.81-1
changelog:
  - Use macro for Python 3 requirement in spec file (mkolman)
  - Remove outdated dependency on python3-libreport (vslavik)
  - Fix a typo in Zanata CLI invocation (mkolman)


author: Martin Kolman <mkolman@redhat.com> - 0.3.81.5-1
changelog:
  - Disable multi TTY handler when running in SSH session (mkolman)
  - Add CLI option to disable multi TTY handler (mkolman)
  - Add PEP8 Speaks configuration (mkolman)
  - Add missing branch config to manifest file (jkonecny)
  - Add translation badge to the README file (jkonecny)
  - Remove unused PREFIX variable from Makefile (jkonecny)
  - Use new po-push instead of Zanata (jkonecny)
  - Add po-push using localization repository (jkonecny)
  - Use translation repository to pull the translations (jkonecny)


author: Tomas Popela <tpopela@redhat.com> - 1.0.2-1
changelog:
  - Bring Inkscape 1.0.1 into RHEL 8.8 and obsolete the previous 0.92.3 modular
    package. See https://issues.redhat.com/browse/RHELPLAN-121672
  - Resolves: rhbz#1891732


author: Colin Walters <walters@redhat.com> - 0.51.0-4
changelog:
  - Add patch to hopefully close race condition in systemd builds
  - Related to https://bugzilla.redhat.com/show_bug.cgi?id=1249051
  - And the test suite is failing but the logs are hidden under
    test-suite.log, so copy some code I had in dbus.spec to cat them.


author: Rob Crittenden <rcritten@redhat.com> - 0.1.0-2
changelog:
  - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires
  - Remove references to admin server in ipa-server-setupssl
  - Generate a client certificate for the XML-RPC server to connect to LDAP with
  - Create a keytab for Apache
  - Create an ldif with a test user
  - Provide a certmap.conf for doing SSL client authentication


author: Karl MacMillan <kmacmill@redhat.com> - 0.4.0-2
changelog:
  * Fri Sep 7 2007 Karl MacMillan <kmacmill@redhat.com> - 0.3.0-1
  - Added support for libipa-dna-plugin


author: Rob Crittenden <rcritten@redhat.com> - 0.4.1-2
changelog:
  - Broke invididual Requires and BuildRequires onto separate lines and
    reordered them
  - Added python-tgexpandingformwidget as a dependency
  - Require at least fedora-ds-base 1.1


author: Rob Crittenden <rcritten@redhat.com> 0.99-3
changelog:
  - Included LICENSE and README in all packages for documentation
  - Move user-modifiable content to /etc/ipa and linked back to
    /usr/share/ipa/html
  - Changed some references to /usr to the {_usr} macro and /etc
    to {_sysconfdir}
  - Added popt-devel to BuildRequires for Fedora 8 and higher and
    popt for Fedora 7
  - Package the egg-info for Fedora 9 and higher for ipa-python


author: Rob Crittenden <rcritten@redhat.com> 0.99-7
changelog:
  - Ensure that /etc/ipa exists before moving user-modifiable html files there
  - Put html files into /etc/ipa/html instead of /etc/ipa


author: Rob Crittenden <rcritten@redhat.com> 0.99-9
changelog:
  - Pull upstream changelog 641
  - Require minimum version of krb5-server on F-7 and F-8
  - Package some new files


author: Rob Crittenden <rcritten@redhat.com> 0.99-10
changelog:
  - Pull upstream changelog 678
  - Add new subpackage, ipa-server-selinux
  - Add Requires: authconfig to ipa-python (bz #433747)
  - Package i18n files


author: Rob Crittenden <rcritten@redhat.com> 0.99-11
changelog:
  - Pull upstream changelog 698
  - Fix ownership of /var/log/ipa_error.log during install (435119)
  - Add pwpolicy command and man page


author: Rob Crittenden <rcritten@redhat.com> - 1.0.0-2
changelog:
  - Fix Requires for krb5-server that was missing for Fedora versions > 9
  - Remove quotes around test for fedora version to package egg-info


author: Rob Crittenden <rcritten@redhat.com> - 1.0.0-4
changelog:
  - Add missing entry for /var/cache/ipa/kpasswd (444624)
  - Added patch to fix permissions problems with the Apache NSS database.
  - Added patch to fix problem with DNS querying where the query could be
    returned as the answer.
  - Fix spec error where patch1 was in the wrong section


author: Rob Crittenden <rcritten@redhat.com> - 1.0.0-5
changelog:
  - Set fedora-ds-base minimum version to 1.1.0.1-4 and mod_nss minimum
    version to 1.0.7-4 so we pick up the NSS fixes.
  - Add selinux-policy-base(post) to Requires (446496)


author: Rob Crittenden <rcritten@redhat.com> - 1.1.0-1
changelog:
  - Update to upstream version 1.1.0
  - Patch for indexing memberof attribute
  - Patch for indexing uidnumber and gidnumber
  - Patch to change DNA default values for replicas
  - Patch to fix uninitialized variable in ipa-getkeytab


author: Simo Sorce <ssorce@redhat.com> - 1.1.0-3
changelog:
  - Fix for CVE-2008-3274
  - Fix segfault in ipa-kpasswd in case getifaddrs returns a NULL interface
  - Add fix for bug #453185
  - Rebuild against openldap libraries, mozldap ones do not work properly
  - TurboGears is currently broken in rawhide. Added patch to not build
    the UI locales and removed them from the ipa-server files section.


author: Rob Crittenden <rcritten@redhat.com> - 1.2.0-1
changelog:
  - Update to upstream version 1.2.0
  - Set fedora-ds-base minimum version to 1.1.3 for winsync header
  - Set the minimum version for SELinux policy
  - Remove references to Fedora 7


author: Simo Sorce <ssorce@redhat.com> - 1.2.0-3
changelog:
  - Respin after the tarball has been re-released upstream
    New hash is 506c9c92dcaf9f227cba5030e999f177


author: Jason Gerard DeRose <jderose@redhat.com> - 1.99-8
changelog:
  - Removed python-cherrypy from BuildRequires and Requires
  - Added Requires python-assets, python-wehjit


author: Rob Crittenden <rcritten@redhat.com> - 1.99-23
changelog:
  - Change Requires from fedora-ds-base to 389-ds-base
  - Set minimum level of 389-ds-base to 1.2.6 for the replication
    version plugin.


author: Rob Crittenden <rcritten@redhat.com> - 1.99-27
changelog:
  - Set minimum version of certmonger to 0.26 (to pck up #621670)
  - Set minimum version of pki-silent to 1.3.4 (adds -key_algorithm)
  - Set minimum version of pki-ca to 1.3.6
  - Set minimum version of sssd to 1.2.1


author: Rob Crittenden <rcritten@redhat.com> - 1.99-28
changelog:
  - Drop conflicts on mod_nss
  - Require nss-pam-ldapd on F-14 or higher instead of nss_ldap (#606847)
  - Drop a slew of conditionals on older Fedora releases (< 12)
  - Add a few conditionals against RHEL 6
  - Add Requires of nss-tools on ipa-client


author: Rob Crittenden <rcritten@redhat.com> - 1.99-29
changelog:
  - Drop requires on python-configobj (not used any more)
  - Drop ipa-ldap-updater message, upgrades are done differently now


author: Simo Sorce <ssorce@redhat.com> - 1.99-39
changelog:
  - Remove dependency on nss_ldap/nss-pam-ldapd
  - The official client is sssd and that's what we use by default.


author: Rob Crittenden <rcritten@redhat.com> - 1.99-41
changelog:
  - Re-arrange doc and defattr to clean up rpmlint warnings
  - Remove conditionals on older releases
  - Move some man pages into admintools subpackage
  - Remove some explicit Requires in client that aren't needed
  - Consistent use of buildroot vs RPM_BUILD_ROOT


author: Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.2.beta.git80e87e7
changelog:
  - Remove unnecessary moving of v1 CA serial number file in post script
  - Add Obsoletes for server-selinxu subpackage
  - Using git snapshot 442d6ad30ce1156914e6245aa7502499e50ec0da


author: Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.1.beta2
changelog:
  - Set min version of 389-ds-base to 1.2.8
  - Set min version of mod_nss 1.0.8-10
  - Set min version of selinux-policy to 3.9.7-27
  - Add dogtag themes to Requires
  - Update to upstream freeipa-2.0.0.pre2


author: Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.1.rc1
changelog:
  - Set minimum version of sssd to 1.5.1
  - Update to upstream freeipa-2.0.0.rc1
  - Move server-only binaries from admintools subpackage to server


author: Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.4.rc2
changelog:
  - Update to upstream freeipa-2.0.0.rc2
  - Set minimum version of python-nss to 0.11 to make sure IPv6 support is in
  - Set minimum version of sssd to 1.5.1
  - Patch to include SuiteSpotGroup when setting up 389-ds instances
  - Move a lot of BuildRequires so this will build with ONLY_CLIENT enabled


author: Rob Crittenden <rcritten@redhat.com> - 2.0.1-1
changelog:
  - Update minimum selinux-policy to 3.9.16-18
  - Update minimum pki-ca and pki-selinux to 9.0.7
  - Update minimum 389-ds-base to 1.2.8.0-1
  - Update to upstream 2.0.1


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.1.3-6
changelog:
  - Introduce upgrade script to recover existing configuration after systemd migration
    as user has no means to recover FreeIPA from systemd migration
  - Upgrade script:
    - recovers symlinks in Dogtag instance install
    - recovers systemd configuration for FreeIPA's directory server instances
    - recovers freeipa.service
    - migrates directory server and KDC configs to use proper keytabs for systemd services


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.1.4-2
changelog:
  - Allow longer dirsrv startup with systemd:
    - IPAdmin class will wait until dirsrv instance is available up to 10 seconds
    - Helps with restarts during upgrade for ipa-ldap-updater
  - Fix pylint warnings from F16 and Rawhide


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.1.4-3
changelog:
  - Allow Web-based migration to work with tightened SE Linux policy (#769440)
  - Rebuild slapi plugins against re-enterant version of libldap


author: Martin Kosek <mkosek@redhat.com> - 2.1.4-4
changelog:
  - Fix ipa-replica-install crashes
  - Fix ipa-server-install and ipa-dns-install logging
  - Set minimum version of pki-ca to 9.0.17 to fix sslget problem
    caused by FEDORA-2011-17400 update (#771357)


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.1.4-5
changelog:
  - Force to use 389-ds 1.2.10-0.8.a7 or above
  - Improve upgrade script to handle systemd 389-ds change
  - Fix freeipa to work with python-ldap 2.4.6


author: Rob Crittenden <rcritten@redhat.com> - 2.1.90-0.2
changelog:
  - Update to upstream 2.2.0 beta 1 (2.1.90.rc1)
  - Set minimum n-v-r for pki-ca and pki-silent to 9.0.18.
  - Add Conflicts on mod_ssl
  - Update minimum n-v-r of 389-ds-base to 1.2.10.4
  - Update minimum n-v-r of sssd to 1.8.0
  - Update minimum n-v-r of slapi-nis to 0.38
  - Update minimum n-v-r of pki-* to 9.0.18
  - Update conflicts on bind-dyndb-ldap to < 1.1.0-0.9.b1
  - Update conflicts on bind to < 9.9.0-1
  - Drop requires on krb5-server-ldap
  - Add patch to remove escaping arguments to pkisilent


author: Rob Crittenden <rcritten@redhat.com> - 2.2.0-1
changelog:
  - Updated to upstream 2.2.0 GA
  - Update minimum n-v-r of certmonger to 0.53
  - Update minimum n-v-r of slapi-nis to 0.40
  - Add Requires in client to oddjob-mkhomedir and python-krbV
  - Update minimum selinux-policy to 3.10.0-110


author: Rob Crittenden <rcritten@redhat.com> - 3.0.0-0.8
changelog:
  - Updated to upstream 3.0.0 rc 1
  - Update BR for 389-ds-base to 1.2.11.14
  - Update BR for krb5 to 1.10
  - Update BR for samba4-devel to 4.0.0-139 (rc1)
  - Add BR for python-polib
  - Update BR and Requires on sssd to 1.9.0
  - Update Requires on policycoreutils to 2.1.12-5
  - Update Requires on 389-ds-base to 1.2.11.14
  - Update Requires on selinux-policy to 3.11.1-21
  - Update Requires on dogtag to 10.0.0-0.33.a1
  - Update Requires on certmonger to 0.60
  - Update Requires on tomcat to 7.0.29
  - Update minimum version of bind to 9.9.1-10.P3
  - Update minimum version of bind-dyndb-ldap to 1.1.0-0.16.rc1
  - Remove Requires on authconfig from python sub-package


author: Rob Crittenden <rcritten@redhat.com> - 3.0.0-0.10
changelog:
  - Updated to upstream 3.0.0 rc 2
  - Include new FF configuration extension
  - Set minimum Requires of selinux-policy to 3.11.1-33
  - Set minimum Requires dogtag to 10.0.0-0.43.b1
  - Add new optional strict sub-package to allow users to limit other
    package upgrades.


author: Rob Crittenden <rcritten@redhat.com> - 3.0.0-1
changelog:
  - Updated to upstream 3.0.0 GA
  - Set minimum for samba to 4.0.0-153.
  - Make sure server-trust-ad subpackage alternates winbind_krb5_locator.so
    plugin to /dev/null since they cannot be used when trusts are configured
  - Restrict krb5-server to 1.10.
  - Update BR for 389-ds-base to 1.3.0
  - Add directory /var/lib/ipa/pki-ca/publish for CRL published by pki-ca
  - Add Requires on zip for generating FF browser extension


author: Rob Crittenden <rcritten@redhat.com> - 3.1.0-1
changelog:
  - Updated to upstream 3.1.0 GA
  - Set minimum for sssd to 1.9.2
  - Set minimum for pki-ca to 10.0.0-1
  - Set minimum for 389-ds-base to 1.3.0
  - Set minimum for selinux-policy to 3.11.1-60
  - Remove unneeded dogtag package requires


author: Martin Kosek <mkosek@redhat.com> - 3.1.0-2
changelog:
  - Remove redundat Requires versions that are already in Fedora 17
  - Replace python-crypto Requires with m2crypto
  - Add missing Requires(post) for client and server-trust-ad subpackages
  - Restart httpd service when server-trust-ad subpackage is installed
  - Bump selinux-policy Requires to pick up PKI/LDAP port labeling fixes


author: Rob Crittenden <rcritten@redhat.com> - 3.1.2-1
changelog:
  - Update to upstream 3.1.2
  - CVE-2012-4546: Incorrect CRLs publishing
  - CVE-2012-5484: MITM Attack during Join process
  - CVE-2013-0199: Cross-Realm Trust key leak
  - Updated strict dependencies to 389-ds-base = 1.3.0.2 and
    pki-ca = 10.0.1


author: Martin Kosek <mkosek@redhat.com> - 3.2.0-0.1.pre1
changelog:
  - Update to upstream 3.2.0 Prerelease 1
  - Use upstream reference spec file as a base for Fedora spec file


author: Rob Crittenden <rcritten@redhat.com> - 3.2.0-0.3.beta1
changelog:
  - Add a Requires for java-atk-wrapper until we can determine which package
    should be pulling it in, dogtag or tomcat.


author: Rob Crittenden <rcritten@redhat.com> - 3.2.0-1
changelog:
  - Update to upstream 3.2.0 GA
  - ipa-client-install fails if /etc/ipa does not exist (#961483)
  - Certificate status is not visible in Service and Host page (#956718)
  - ipa-client-install removes needed options from ldap.conf (#953991)
  - Handle socket.gethostbyaddr() exceptions when verifying hostnames (#953957)
  - Add triggerin scriptlet to support OpenSSH 6.2 (#953617)
  - Require nss 3.14.3-12.0 to address certutil certificate import
    errors (#953485)
  - Require pki-ca 10.0.2-3 to pull in fix for sslget and mixed IPv4/6
    environments. (#953464)
  - ipa-client-install removes 'sss' from /etc/nsswitch.conf (#953453)
  - ipa-server-install --uninstall doesn't stop dirsrv instances (#953432)
  - Add requires for openldap-2.4.35-4 to pickup fixed SASL_NOCANON behavior for
    socket based connections (#960222)
  - Require libsss_nss_idmap-python
  - Add Conflicts on nss-pam-ldapd < 0.8.4. The mapping from uniqueMember to
    member is now done automatically and having it in the config file raises
    an error.
  - Add backup and restore tools, directory.
  - require at least systemd 38 which provides the journal (we no longer
    need to require syslog.target)
  - Update Requires on policycoreutils to 2.1.14-37
  - Update Requires on selinux-policy to 3.12.1-42
  - Update Requires on 389-ds-base to 1.3.1.0
  - Remove a Requires for java-atk-wrapper


author: Martin Kosek <mkosek@redhat.com> - 3.2.2-1
changelog:
  - Update to upstream 3.2.2
  - Drop ipa-server-selinux subpackage
  - Drop redundant directory /var/cache/ipa/sessions
  - Do not create /var/lib/ipa/pki-ca/publish, retain reference as ghost
  - Run ipa-upgradeconfig and server restart in posttrans to avoid inconsistency
    issues when there are still old parts of software (like entitlements plugin)


author: Martin Kosek <mkosek@redhat.com> - 3.3.0-2
changelog:
  - Remove ipa-server-selinux obsoletes as upgrades from version prior to
    3.3.0 are not allowed
  - Wrap server-trust-ad subpackage description better
  - Add (noreplace) flag for %{_sysconfdir}/tmpfiles.d/ipa.conf
  - Change permissions on default_encoding_utf8.so to fix ipa-python Provides


author: Martin Kosek <mkosek@redhat.com> - 3.3.0-4
changelog:
  - ipa-server-install fails if --subject parameter is other than default
    realm (#983075)
  - do not allow configuring bind-dyndb-ldap without persistent search (#967876)


author: Martin Kosek <mkosek@redhat.com> - 3.3.1-2
changelog:
  - Unable to remove replica by ipa-replica-manage (#1001662)
  - Before uninstalling a server, warn about active replicas (#998069)


author: Martin Kosek <mkosek@redhat.com> - 3.3.1-3
changelog:
  - Replica installation fails for RHEL 6.4 master (#1004680)
  - Server uninstallation crashes if DS is not available (#998069)


author: Martin Kosek <mkosek@redhat.com> - 3.3.1-5
changelog:
  - Remove dependency on python-paramiko (#1002884)
  - Broken redirection when deleting last entry of DNS resource
    record (#1006360)


author: Martin Kosek <mkosek@redhat.com> - 3.3.2-1
changelog:
  - Update to upstream 3.3.2 (#991064)
  - Add delegation info to MS-PAC (#915799)
  - Warn about incompatibility with AD when IPA realm and domain
    differs (#1009044)
  - Allow PKCS#12 files with empty password in install tools (#1002639)
  - Privilege "SELinux User Map Administrators" did not list
    permissions (#997085)
  - SSH key upload broken when client joins an older server (#1009024)


author: Martin Kosek <mkosek@redhat.com> - 3.3.2-2
changelog:
  - Deprecate --serial-autoincrement option (#1016645)
  - CA installation always failed on replica (#1005446)
  - Re-initializing a winsync connection exited with error (#994980)


author: Martin Kosek <mkosek@redhat.com> - 3.3.2-4
changelog:
  - Server install failure during client enrollment shouldn't
    roll back (#1023086)
  - nsds5ReplicaStripAttrs are not set on agreements (#1023085)
  - ipa-server conflicts with mod_ssl (#1018172)


author: Martin Kosek <mkosek@redhat.com> - 3.3.2-5
changelog:
  - Temporarily move ipa-backup and ipa-restore functionality
    back to make them available in public Beta (#1003933)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-3
changelog:
  - Installer did not detect different server and IPA domain (#1026845)
  - Allow kernel keyring CCACHE when supported (#1026861)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-5
changelog:
  - Trust add tries to add same value of --base-id for sub domain,
    causing an error (#1033068)
  - Improved error reporting for adding trust case (#1029856)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-6
changelog:
  - Remove "Listen 443 http" hack from deployed nss.conf (#1029046)
  - Re-adding existing trust fails (#1033216)
  - IPA uninstall exits with a samba error (#1033075)
  - Added RELRO hardening on /usr/libexec/ipa-otpd (#1026260)
  - Fixed ownership of /usr/share/ipa/ui/js (#1026260)
  - ipa-tests: support external names for hosts (#1032668)
  - ipa-client-install fail due fail to obtain host TGT (#1029354)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-8
changelog:
  - Fix status trust-add command status message (#910453)
  - NetBIOS was not trimmed at 15 characters (#1030517)
  - Harden CA subsystem certificate renewal on CA clones (#1040018)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-12
changelog:
  - Missing objectclasses when empty password passed to host-add (#1052979)
  - sudoOrder missing in sudoers (#1052983)
  - Missing examples in sudorule help (#1049464)
  - Client automount does not uninstall when fstore is empty (#910899)
  - Error not clear for invalid realm given to trust-fetch-domains (#1052981)
  - trust-fetch-domains does not add idrange for subdomains found (#1049926)
  - Add option to show if an AD subdomain is enabled/disabled (#1052973)
  - ipa-adtrust-install still failed with long NetBIOS names (#1030517)
  - Error not clear for invalid relam given to trustdomain-find (#1049455)
  - renewed client cert not recognized during IPA CA renewal (#1033273)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-13
changelog:
  - Do not add krbPwdPolicyReference for new accounts, hardcode it (#1045218)
  - Increase default timeout for IPA services (#1033273)
  - Error while running trustdomain-find (#1054376)
  - group-show lists SID instead of name for external groups (#1054391)
  - Fix IPA server NetBIOS name in samba configuration (#1030517)
  - dnsrecord-mod produces missing API version warning (#1054869)
  - Hide trust-resolve command as internal (#1052860)
  - Add Trust domain Web UI (#1054870)
  - ipasam cannot delete multiple child trusted domains (#1056120)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-16
changelog:
  - Fallback to global policy in ipa lockout plugin (#912725)
  - Migration does not add users to default group (#903232)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-18
changelog:
  - Display server name in ipa command's verbose mode (#1061703)
  - Remove sourcehostcategory from default HBAC rule (#1061187)
  - dnszone-add cannot add classless PTR zones (#1058688)
  - Move ipa-otpd socket directory to /var/run/krb5kdc (#1063850)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-20
changelog:
  - trustdomain-find with pkey-only fails (#1068611)
  - Invalid credential cache in trust-add (#1069182)
  - ipa-replica-install prints unexpected error (#1069722)
  - Too big font in input fields in details facet in Firefox (#1069720)
  - trust-add for POSIX AD does not fetch trustdomains (#1070925)
  - Misleading trust-add error message in some cases (#1070926)
  - Access is not rejected for disabled domain (#1070924)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-22
changelog:
  - ipa-replica-install never checks for 7389 port (#1075165)
  - Non-terminated string may be passed to LDAP search (#1075091)
  - ipa-sam may fail to translate group SID into GID (#1073829)
  - Excessive LDAP calls by ipa-sam during Samba FS operations (#1075132)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-26
changelog:
  - When IdM server trusts multiple AD forests, IPA client returns invalid group
    membership info (#1079498)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-28
changelog:
  - ipa-client-automount fails with incompatibility error when installed against
    older IPA server (#1083108)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-29
changelog:
  - Server installation fails using external signed certificates with
    "IndexError: list index out of range" (#1111320)
  - Add rhino to BuildRequires to fix Web UI build error


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-4
changelog:
  - Update Requires on pki-ca to 10.1.2-4 (#1129558)
  - build: increase java stack size for all arches
  - Add ipaSshPubkey and gidNumber to the ACI to read ID user overrides (#891984)
  - Fix dns zonemgr validation regression (#1056202)
  - Handle profile changes in dogtag-ipa-ca-renew-agent (#886645)
  - Do not wait for new CA certificate to appear in LDAP in ipa-certupdate
    (#886645)
  - Add bind-dyndb-ldap working dir to IPA specfile
  - Fail if certmonger can't see new CA certificate in LDAP in ipa-cacert-manage
    (#886645)
  - Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
  - Deadlock in schema compat plugin (#1161131)
  - ipactl stop should stop dirsrv last (#1161129)
  - Upgrade 3.3.5 to 4.1 failed (#1161128)
  - CVE-2014-7828 freeipa: password not required when OTP in use (#1160877)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-5
changelog:
  - Update slapi-nis dependency to pull 0.54-2 (#891984)
  - ipa-restore: Don't crash if AD trust is not installed (#951581)
  - Prohibit setting --rid-base for ranges of ipa-trust-ad-posix type (#1138791)
  - Trust setting not restored for CA cert with ipa-restore command (#1159011)
  - ipa-server-install fails when restarting named (#1162340)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-6
changelog:
  - Fix: DNS installer adds invalid zonemgr email (#1056202)
  - ipaplatform: Use the dirsrv service, not target (#951581)
  - Fix: DNS policy upgrade raises asertion error (#1161128)
  - Fix upgrade referint plugin (#1161128)
  - Upgrade: fix trusts objectclass violationi (#1161128)
  - group-add doesn't accept gid parameter (#1149124)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-7
changelog:
  - ipa-csreplica-manage connect fails (#1157735)
  - error message which is not understandable when IDNA2003 characters are
    present in --zonemgr (#1163849)
  - Fix warning message should not contain CLI commands (#1114013)
  - Renewing the CA signing certificate does not extend its validity period end
    (#1163498)
  - RHEL7.1 ipa-server-install --uninstall Could not set SELinux booleans for
    httpd (#1159330)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-8
changelog:
  - Improve otptoken help messages (#919228)
  - Ensure users exist when assigning tokens to them (#919228)
  - Enable QR code display by default in otptoken-add (#919228)
  - Show warning instead of error if CA did not start (#1158410)
  - CVE-2014-7850 freeipa: XSS flaw can be used to escalate privileges (#1165774)
  - Traceback when adding zone with long name (#1164859)
  - Backup & Restore mechanism (#951581)
  - ignoring user attributes in migrate-ds does not work if uppercase characters
    are returned by ldap (#1159816)
  - Allow ipa-getkeytab to optionally fetch existing keys (#1007367)
  - Failure when installing on dual stacked system with external ca (#1128380)
  - ipa-server should keep backup of CS.cfg (#1059135)
  - Tracebacks with latest build for --zonemgr cli option (#1167270)
  - webui: use domain name instead of domain SID in idrange adder dialog
    (#891984)
  - webui: normalize idview tab labels (#891984)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-9
changelog:
  - schema update on RHEL-6.6 using latest copy-schema-to-ca.py from RHEL-7.1
    build fails (#1167196)
  - Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
  - "ipa trust-add ... " cmd says : (Trust status: Established and verified)
    while in the logs we see "WERR_ACCESS_DENIED" during verification step.
    (#1144121)
  - POODLE: force using safe ciphers (non-SSLv3) in IPA client and server
    (#1156466)
  - Add support/hooks for a one-time password system like SecureID in IPA
    (#919228)
  - Tracebacks with latest build for --zonemgr cli option (#1167270)
  - ID Views: Support migration from the sync solution to the trust solution
    (#891984)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-11
changelog:
  - Throw zonemgr error message before installation proceeds (#1163849)
  - Winsync: Setup is broken due to incorrect import of certificate (#1169867)
  - Enable last token deletion when password auth type is configured (#919228)
  - ipa-otp-lasttoken loads all user's tokens on every mod/del (#1166641)
  - add --hosts and --hostgroup options to allow/retrieve keytab methods
    (#1007367)
  - Extend host-show to add the view attribute in set of default attributes
    (#1168916)
  - Prefer TCP connections to UDP in krb5 clients (#919228)
  - [WebUI] Not able to unprovisioning service in IPA 4.1 (#1168214)
  - webui: increase notification duration (#1171089)
  - RHEL7.1 ipa automatic CA cert renewal stuck in submitting state (#1166931)
  - RHEL7.1 ipa-cacert-manage cannot change external to self-signed ca cert
    (#1170003)
  - Improve validation of --instance and --backend options in ipa-restore
    (#951581)
  - RHEL7.1 ipa replica unable to replicate to rhel6 master (#1167964)
  - Disable TLS 1.2 in nss.conf until mod_nss supports it (#1156466)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-12
changelog:
  - RHEL7.1 ipa-cacert-manage renewed certificate from MS ADCS not compatible
    (#1169591)
  - CLI doesn't show SSHFP records with SHA256 added via nsupdate (regression)
    (#1172578)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-13
changelog:
  - Expand the token auth/sync windows (#919228)
  - Access is not rejected for disabled domain (#1172598)
  - krb5kdc crash in ldap_pvt_search (#1170695)
  - RHEL7.1 IPA server httpd avc denials after upgrade (#1164896)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-14
changelog:
  - IPA Replicate creation fails with error "Update failed! Status: [10 Total
    update abortedLDAP error: Referral]" (#1166265)
  - running ipa-server-install --setup-dns results in a crash (#1072502)
  - DNS zones are not migrated into forward zones if 4.0+ replica is added
    (#1175384)
  - gid is overridden by uid in default trust view (#1168904)
  - When migrating warn user if compat is enabled (#1177133)
  - Clean up debug log for trust-add (#1168376)
  - No error message thrown on restore(full kind) on replica from full backup
    taken on master (#1175287)
  - ipa-restore proceed even IPA not configured (#1175326)
  - Data replication not working as expected after data restore from full backup
    (#1175277)
  - IPA externally signed CA cert expiration warning missing from log (#1178128)
  - ipa-upgradeconfig fails in CA-less installs (#1181767)
  - IPA certs fail to autorenew simultaneouly (#1173207)
  - More validation required on ipa-restore's options (#1176034)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-16
changelog:
  - PassSync does not sync passwords due to missing ACIs (#1181093)
  - ipa-replica-manage list does not list synced domain (#1181010)
  - Do not assume certmonger is running in httpinstance (#1181767)
  - ipa-replica-manage disconnect fails without password (#1183279)
  - Put LDIF files to their original location in ipa-restore (#1175277)
  - DUA profile not available anonymously (#1184149)
  - IPA replica missing data after master upgraded (#1176995)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-17
changelog:
  - Wrong directories created on full restore (#1186398)
  - ipa-restore crashes if replica is unreachable (#1186396)
  - idoverrideuser-add option --sshpubkey does not work (#1185410)


author: Martin Kosek <mkosek@redhat.com> - 4.1.0-18
changelog:
  - Fix ipa-pwd-extop global configuration caching (#1187342)
  - group-detach does not add correct objectclasses (#1187540)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-18.1
changelog:
  - "an internal error has occurred" during ipa host-del --updatedns (#1198431)
  - Renamed patch 1013 to 0114, as it was merged upstream
  - Fax number not displayed for user-show when kinit'ed as normal user.
    (#1198430)
  - Replication agreement with replica not disabled when ipa-restore done without
    IPA installed (#1199060)
  - Limit deadlocks between DS plugin DNA and slapi-nis (#1199128)


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.1.0-18.2
changelog:
  - IPA extdom plugin fails when encountering large groups (#1193759)
  - CVE-2015-0283 ipa: slapi-nis: infinite loop in getgrnam_r() and getgrgid_r()
    (#1202998)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-18.3
changelog:
  - [ipa-python] ipalib.errors.LDAPError: failed to decode certificate:
    (SEC_ERROR_INVALID_ARGS) security library: invalid arguments. (#1194312)


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-0.1.alpha1
changelog:
  - Resolves: #805188  [RFE] "ipa migrate-ds" ldapsearches with scope=1
  - Resolves: #1019272 With 20000+ users, adding a user to a group intermittently
    throws Internal server error
  - Resolves: #1035494 Unable to add Kerberos principal via kadmin.local
  - Resolves: #1045153 ipa-managed-entries --list -p <badpassword> still requires
    DM password
  - Resolves: #1125950 ipa-server-install --uinstall doesn't remove port 7389
    from ldap_port_t
  - Resolves: #1132540 [RFE] Expose service delegation rules in UI and CLI
  - Resolves: #1145584 ipaserver/install/cainstance.py creates pkiuser not
    matching uidgid
  - Resolves: #1176036 IDM client registration failure in a high load environment
  - Resolves: #1183116 Remove Requires: subscription-manager
  - Resolves: #1186054 permission-add does not prompt to enter --right option in
    interactive mode
  - Resolves: #1187524 Replication agreement with replica not disabled when
    ipa-restore done without IPA installed
  - Resolves: #1188195 Fax number not displayed for user-show when kinit'ed as
    normal user.
  - Resolves: #1189034 "an internal error has occurred" during ipa host-del
    --updatedns
  - Resolves: #1193554 ipa-client-automount: failing with error LDAP server
    returned UNWILLING_TO_PERFORM. This likely means that minssf is enabled.
  - Resolves: #1193759 IPA extdom plugin fails when encountering large groups
  - Resolves: #1194312 [ipa-python] ipalib.errors.LDAPError: failed to decode
    certificate: (SEC_ERROR_INVALID_ARGS) security library: invalid arguments.
  - Resolves: #1194633 Default trust view can be deleted in lower case
  - Resolves: #1196455 ipa-server-install step [8/27]: starting certificate
    server instance - confusing CA staus message on TLS error
  - Resolves: #1198263 Limit deadlocks between DS plugin DNA and slapi-nis
  - Resolves: #1199527 [RFE] Use datepicker component for datetime fields
  - Resolves: #1200867 [RFE] Make OTP validation window configurable
  - Resolves: #1200883 [RFE] Switch apache to use mod_auth_gssapi
  - Resolves: #1202998 CVE-2015-1827 ipa: memory corruption when using
    get_user_grouplist() [rhel-7.2]
  - Resolves: #1204637 slow group operations
  - Resolves: #1204642 migrate-ds: slow add o users to default group
  - Resolves: #1208461 IPA CA master server update stuck on checking getStatus
    via https
  - Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
  - Resolves: #1211708 ipa-client-install gets stuck during NTP sync
  - Resolves: #1215197 ipa-client-install ignores --ntp-server option during time
    sync
  - Resolves: #1215200 ipa-client-install configures IPA server as NTP source
    even if IPA server has not ntpd configured
  - Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
  - Related:  #1204809 Rebase ipa to 4.2
    - Update to upstream 4.2.0.alpha1


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-0.2.alpha1
changelog:
  - Resolves: #1228671 pkispawn fails in ipa-ca-install and ipa-kra-install
  - Related:  #1204809 Rebase ipa to 4.2
    - Fix minimum version of slapi-nis
    - Require python-sss and python-sss-murmur (provided by sssd-1.13.0)


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-1
changelog:
  - Resolves: #846033  [RFE] Documentation for JSONRPC IPA API
  - Resolves: #989091  Ability to manage IdM/IPA directly from a standard LDAP
    client
  - Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
    users in IdM
  - Resolves: #1115294 [RFE] Add support for DNSSEC
  - Resolves: #1145748 [RFE] IPA running with One Way Trust
  - Resolves: #1199520 [RFE] Introduce single upgrade tool - ipa-server-upgrade
  - Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
  - Resolves: #1200694 [RFE] Support for multiple cert profiles
  - Resolves: #1200728 [RFE] Replicate PKI Profile information
  - Resolves: #1200735 [RFE] Allow issuing certificates for user accounts
  - Resolves: #1204054 SSSD database is not cleared between installs and
    uninstalls of ipa
  - Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
    Trusts
  - Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
  - Resolves: #1204504 [RFE] Add access control so hosts can create their own
    services
  - Resolves: #1206534 [RFE] Offer Kerberos over HTTP (kdcproxy) by default
  - Resolves: #1206613 [RFE] Configure IPA to be a trust agent by default
  - Resolves: #1209476 package ipa-client does not require package dbus-python
  - Resolves: #1211589 [RFE] Add option to skip the verify_client_version
  - Resolves: #1211608 [RFE] Generic support for unknown DNS RR types (RFC 3597)
  - Resolves: #1215735 ipa-replica-prepare automatically adds a DNS zone
  - Resolves: #1217010 OTP Manager field is not exposed in the UI
  - Resolves: #1222475 krb5kdc : segfault at 0 ip 00007fa9f64d82bb sp
    00007fffd68b2340 error 6 in libc-2.17.so
  - Related:  #1204809 Rebase ipa to 4.2
    - Update to upstream 4.2.0
    - Move /etc/ipa/kdcproxy to the server subpackage


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-2
changelog:
  - Resolves: #1131907 [ipa-client-install] cannot write certificate file
    '/etc/ipa/ca.crt.new': must be string or buffer, not None
  - Resolves: #1195775 unsaved changes dialog internally inconsistent
  - Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
    - Stageusedr-activate: show username instead of DN
  - Resolves: #1200694 [RFE] Support for multiple cert profiles
    - Prevent to rename certprofile profile id
  - Resolves: #1222047 IPA to AD Trust: IPA ERROR 4016: Remote Retrieve Error
  - Resolves: #1224769 copy-schema-to-ca.py does not overwrites schema files
    - copy-schema-to-ca: allow to overwrite schema files
  - Resolves: #1241941 kdc component installation of IPA failed
    - spec file: Update minimum required version of krb5
  - Resolves: #1242036 Replica install fails to update DNS records
    - Fix DNS records installation for replicas
  - Resolves: #1242884 Upgrade to 4.2.0 fails when enabling kdc proxy
    - Start dirsrv for kdcproxy upgrade


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-3
changelog:
  - Resolves: #1170770 [AD TRUST]IPA should detect inconsistent realm domains
    that conflicts with AD DC
    - trusts: Check for AD root domain among our trusted domains
  - Resolves: #1195339 ipa-client-install changes the label on various files
    which causes SELinux denials
    - sysrestore: copy files instead of moving them to avoind SELinux issues
  - Resolves: #1196656 [ipa-client][rhel71] enable debugging for spawned
    commands / ntpd -qgc $tmpfile hangs
    - enable debugging of ntpd during client installation
  - Resolves: #1205264 Migration UI Does Not Work When Anonymous Bind is Disabled
    - migration: Use api.env variables.
  - Resolves: #1212719 abort-clean-ruv subcommand should allow
    replica-certifyall: no
    - Allow value 'no' for replica-certify-all attr in abort-clean-ruv subcommand
  - Resolves: #1216935 ipa trust-add shows ipa: ERROR: an internal error has
    occurred
    - dcerpc: Expand explanation for WERR_ACCESS_DENIED
    - dcerpc: Fix UnboundLocalError for ccache_name
  - Resolves: #1222778 idoverride group-del can delete user and user-del can
    delete group
    - dcerpc: Add get_trusted_domain_object_type method
    - idviews: Restrict anchor to name and name to anchor conversions
    - idviews: Enforce objectclass check in idoverride*-del
  - Resolves: #1234919 Be able to request certificates without certmonger service
    running
    - cermonger: Use private unix socket when DBus SystemBus is not available.
    - ipa-client-install: Do not (re)start certmonger and DBus daemons.
  - Resolves: #1240939 Please add dependency on bind-pkcs11
    - Create server-dns sub-package.
    - ipaplatform: Add constants submodule
    - DNS: check if DNS package is installed
  - Resolves: #1242914 Bump minimal selinux-policy and add booleans to allow
    calling out oddjobd-activated services
    - selinux: enable httpd_run_ipa to allow communicating with oddjobd services
  - Resolves: #1243261 non-admin users cannot search hbac rules
    - fix hbac rule search for non-admin users
    - fix selinuxusermap search for non-admin users
  - Resolves: #1243652 Client has missing dependency on memcache
    - do not import memcache on client
  - Resolves: #1243835 [webui] user change password dialog does not work
    - webui: fix user reset password dialog
  - Resolves: #1244802 spec: selinux denial during kdcproxy user creation
    - Fix selinux denial during kdcproxy user creation
  - Resolves: #1246132 trust-fetch-domains: Do not chown keytab to the sssd user
    - oddjob: avoid chown keytab to sssd if sssd user does not exist
  - Resolves: #1246136 Adding a privilege to a permission avoids validation
    - Validate adding privilege to a permission
  - Resolves: #1246141 DNS Administrators cannot search in zones
    - DNS: Consolidate DNS RR types in API and schema
  - Resolves: #1246143 User plugin - user-find doesn't work properly with manager
    option
    - fix broken search for users by their manager


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-4
changelog:
  - Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
    users in IdM
    - store certificates issued for user entries as
    - user-show: add --out option to save certificates to file
  - Resolves: #1145748 [RFE] IPA running with One Way Trust
    - Fix upgrade of sidgen and extdom plugins
  - Resolves: #1195339 ipa-client-install changes the label on various files
    which causes SELinux denials
    - Use 'mv -Z' in specfile to restore SELinux context
  - Resolves: #1198796 Text in UI should describe differing LDAP vs Krb behavior
    for combinations of "User authentication types"
    - webui: add LDAP vs Kerberos behavior description to user auth
  - Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
    - ULC: Fix stageused-add --from-delete command
  - Resolves: #1200694 [RFE] Support for multiple cert profiles
    - certprofile-import: do not require profileId in profile data
    - Give more info on virtual command access denial
    - Allow SAN extension for cert-request self-service
    - Add profile for DNP3 / IEC 62351-8 certificates
    - Work around python-nss bug on unrecognised OIDs
  - Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
    - Validate vault's file parameters
    - Fixed missing KRA agent cert on replica.
  - Resolves: #1225866 display browser config options that apply to the browser.
    - webui: add Kerberos configuration instructions for Chrome
    - Remove ico files from Makefile
  - Resolves: #1246342 Unapply idview raises internal error
    - idviews: Check for the Default Trust View only if applying the view
  - Resolves: #1248102 [webui] regression - incorrect/no failed auth messages
    - webui: fix regressions failed auth messages
  - Resolves: #1248396 Internal error in DomainValidator.__search_in_dc
    - dcerpc: Fix UnboundLocalError for ccache_name
  - Resolves: #1249455 ipa trust-add failed CIFS server configuration does not
    allow access to \\pipe\lsarpc
    - Fix selector of protocol for LSA RPC binding string
    - dcerpc: Simplify generation of LSA-RPC binding strings
  - Resolves: #1250192 Error in ipa trust-fecth-domains
    - Fix incorrect type comparison in trust-fetch-domains
  - Resolves: #1251553 Winsync setup fails with unexpected error
    - replication: Fix incorrect exception invocation
  - Resolves: #1251854 ipa aci plugin is not parsing aci's correctly.
    - ACI plugin: correctly parse bind rules enclosed in
  - Resolves: #1252414 Trust agent install does not detect available replicas to
    add to master
    - adtrust-install: Correctly determine 4.2 FreeIPA servers


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-5
changelog:
  - Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
    - user-undel: Fix error messages.
  - Resolves: #1200694 [RFE] Support for multiple cert profiles
    - Prohibit deletion of predefined profiles
  - Resolves: #1232819 testing ipa-restore on fresh system install fails
    - Backup/resore authentication control configuration
  - Resolves: #1243331 pkispawn fails when migrating to 4.2 server from 3.0
    server
    - Require Dogtag PKI >= 10.2.6
  - Resolves: #1245225 Asymmetric vault drops traceback when the key is not
    proper
    - Asymmetric vault: validate public key in client
  - Resolves: #1248399 Missing DNSSEC related files in backup
    - fix typo in BasePathNamespace member pointing to ods exporter config
    - ipa-backup: archive DNSSEC zone file and kasp.db
  - Resolves: #1248405 PassSync should be disabled after ipa-winsync-migrate is
    finished
    - winsync-migrate: Add warning about passsync
    - winsync-migrate: Expand the man page
  - Resolves: #1248524 User can't find any hosts using "ipa host-find $HOSTNAME"
    - adjust search so that it works for non-admin users
  - Resolves: #1250093 ipa certprofile-import accepts invalid config
    - Require Dogtag PKI >= 10.2.6
  - Resolves: #1250107 IPA framework should not allow modifying trust on AD trust
    agents
    - trusts: Detect missing Samba instance
  - Resolves: #1250111 User lifecycle - preserved users can be assigned
    membership
    - ULC: Prevent preserved users from being assigned membership
  - Resolves: #1250145 Add permission for user to bypass caacl enforcement
    - Add permission for bypassing CA ACL enforcement
  - Resolves: #1250190 idrange is not added for sub domain
    - idranges: raise an error when local IPA ID range is being modified
    - trusts: harden trust-fetch-domains oddjobd-based script
  - Resolves: #1250928 Man page for ipa-server-install is out of sync
    - install: Fix server and replica install options
  - Resolves: #1251225 IPA default CAACL does not allow cert-request for services
    after upgrade
    - Fix default CA ACL added during upgrade
  - Resolves: #1251561 ipa vault-add Unknown option: ipavaultpublickey
    - validate mutually exclusive options in vault-add
  - Resolves: #1251579 ipa vault-add --user should set container owner equal to
    user on first run
    - Fixed vault container ownership.
  - Resolves: #1252517 cert-request rejects request with correct
    krb5PrincipalName SAN
    - Fix KRB5PrincipalName / UPN SAN comparison
  - Resolves: #1252555 ipa vault-find doesn't work for services
    - vault: Add container information to vault command results
    - Add flag to list all service and user vaults
  - Resolves: #1252556 Missing CLI param and ACL for vault service operations
    - Added CLI param and ACL for vault service operations.
  - Resolves: #1252557 certprofile: improve profile format documentation
    - certprofile-import: improve profile format documentation
    - certprofile: add profile format explanation
  - Resolves: #1253443 ipa vault-add creates vault with invalid type
    - vault: validate vault type
  - Resolves: #1253480 ipa vault-add-owner does not fail when adding an existing
    owner
    - baseldap: Allow overriding member param label in LDAPModMember
    - vault: Fix param labels in output of vault owner commands
  - Resolves: #1253511 ipa vault-find does not use criteria
    - vault: Fix vault-find with criteria
  - Resolves: #1254038 ipa-replica-install pk12util error returns exit status 10
    - install: Fix replica install with custom certificates
  - Resolves: #1254262 ipa-dnskeysync-replica crash cannot contact kdc
    - improve the handling of krb5-related errors in dnssec daemons
  - Resolves: #1254412 when dirsrv is off ,upgrade from 7.1 to 7.2 fails with
    starting CA and named-pkcs11.service
    - Server Upgrade: Start DS before CA is started.
  - Resolves: #1254637 Add ACI and permission for managing user userCertificate
    attribute
    - add permission: System: Manage User Certificates
  - Resolves: #1254641 Remove CSR allowed-extensions restriction
    - cert-request: remove allowed extensions check
  - Resolves: #1254693 vault --service does not normalize service principal
    - vault: normalize service principal in service vault operations
  - Resolves: #1254785 ipa-client-install does not properly handle dual stacked
    hosts
    - client: Add support for multiple IP addresses during installation.
    - Add dependency to SSSD 1.13.1
    - client: Add description of --ip-address and --all-ip-addresses to man page


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-6
changelog:
  - Resolves: #1249226 IPA dnssec-validation not working for AD dnsforwardzone
    - DNSSEC: fix forward zone forwarders checks
  - Resolves: #1250190 idrange is not added for sub domain
    - trusts: format Kerberos principal properly when fetching trust topology
  - Resolves: #1252334 User life cycle: missing ability to provision a stage user
    from a preserved user
    - Add user-stage command
  - Resolves: #1252863 After applying RHBA-2015-1554 errata, IPA service fails to
    start.
    - spec file: Add Requires(post) on selinux-policy
  - Resolves: #1254304 Changing vault encryption attributes
    - Change internal rsa_(public|private)_key variable names
    - Added support for changing vault encryption.
  - Resolves: #1256715 Executing user-del --preserve twice removes the user
    pernamently
    - improve the usability of `ipa user-del --preserve` command


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-7
changelog:
  - Resolves: #1256840 [webui] majority of required fields is no longer marked as
    required
    - fix missing information in object metadata
  - Resolves: #1256842 [webui] no option to choose trust type when creating a
    trust
    - webui: add option to establish bidirectional trust
  - Resolves: #1256853 Clear text passwords in KRA install log
    - Removed clear text passwords from KRA install log.
  - Resolves: #1257072 The "Standard Vault" MUST not be the default and must be
    discouraged
    - vault: change default vault type to symmetric
  - Resolves: #1257163 renaming certificatte profile with --rename option leads
    to integrity issues
    - certprofile: prevent rename (modrdn)


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-8
changelog:
  - Resolves: #1254689 Storing big file as a secret in vault raises traceback
    - vault: Limit size of data stored in vault
  - Resolves: #1255880 ipactl status should distinguish between different
    pki-tomcat services
    - ipactl: Do not start/stop/restart single service multiple times


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-9
changelog:
  - Resolves: #1257074 The KRA agent cert is stored in a PEM file that is not
    tracked
    - cert renewal: Include KRA users in Dogtag LDAP update
    - cert renewal: Automatically update KRA agent PEM file
  - Resolves: #1257163 renaming certificatte profile with --rename option leads
    to integrity issues
    - certprofile: remove 'rename' option
  - Resolves: #1257968 kinit stop working after ipa-restore
    - Backup: back up the hosts file
  - Resolves: #1258926 Remove 'DNSSEC is experimental' warnings
    - DNSSEC: remove "DNSSEC is experimental" warnings
  - Resolves: #1258929 Uninstallation of IPA leaves extra entry in /etc/hosts
    - Installer: do not modify /etc/hosts before user agreement
  - Resolves: #1258944 DNSSEC daemons may deadlock when processing more than 1
    zone
    - DNSSEC: backup and restore opendnssec zone list file
    - DNSSEC: remove ccache and keytab of ipa-ods-exporter
    - DNSSEC: prevent ipa-ods-exporter from looping after service auto-restart
    - DNSSEC: Fix deadlock in ipa-ods-exporter <-> ods-enforcerd interaction
    - DNSSEC: Fix HSM synchronization in ipa-dnskeysyncd when running on DNSSEC
      key master
    - DNSSEC: Fix key metadata export
    - DNSSEC: Wrap master key using RSA OAEP instead of old PKCS v1.5.
  - Resolves: #1258964 revert to use ldapi to add kra agent in KRA install
    - Using LDAPI to setup CA and KRA agents.
  - Resolves: #1259848 server closes connection and refuses commands after
    deleting user that is still logged in
    - ldap: Make ldap2 connection management thread-safe again
  - Resolves: #1259996 AttributeError: 'NameSpace' object has no attribute
    'ra_certprofile' while ipa-ca-install
    - load RA backend plugins during standalone CA install on CA-less IPA master


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-10
changelog:
  - Resolves: #1260663 crash of ipa-dnskeysync-replica component during
    ipa-restore
    - IPA Restore: allows to specify files that should be removed
  - Resolves: #1261806 Installing ipa-server package breaks httpd
    - Handle timeout error in ipa-httpd-kdcproxy
  - Resolves: #1262322 Failed to backup CS.cfg message in upgrade.
    - Server Upgrade: backup CS.cfg when dogtag is turned off


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-11
changelog:
  - Resolves: #1258965 ipa vault: set owner of vault container
    - baseldap: make subtree deletion optional in LDAPDelete
    - vault: add vault container commands
    - vault: set owner to current user on container creation
    - vault: update access control
    - vault: add permissions and administrator privilege
    - install: support KRA update
  - Resolves: #1261586 ipa config-mod addattr fails for ipauserobjectclasses
    - config: allow user/host attributes with tagging options
  - Resolves: #1262315 Unable to establish winsync replication
    - winsync: Add inetUser objectclass to the passsync sysaccount


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-12
changelog:
  - Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
    Trusts
    - winsync-migrate: Convert entity names to posix friendly strings
    - winsync-migrate: Properly handle collisions in the names of external groups
  - Resolves: #1261074 Adjust Firefox configuration to new extension signing
    policy
    - webui: use manual Firefox configuration for Firefox >= 40
  - Resolves: #1263337 IPA Restore failed with installed KRA
    - ipa-backup: Add mechanism to store empty directory structure
  - Resolves: #1264793 CVE-2015-5284 ipa: ipa-kra-install includes certificate
    and private key in world readable file [rhel-7.2]
    - install: fix KRA agent PEM file permissions
  - Resolves: #1265086 Mark IdM API Browser as experimental
    - WebUI: add API browser is experimental warning
  - Resolves: #1265277 Fix kdcproxy user creation
    - install: create kdcproxy user during server install
    - platform: add option to create home directory when adding user
    - install: fix kdcproxy user home directory
  - Resolves: #1265559 GSS failure after ipa-restore
    - destroy httpd ccache after stopping the service


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-13
changelog:
  - Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
    - Fix an integer underflow bug in libotp
  - Resolves: #1262996 ipa vault internal error on replica without KRA
    - install: always export KRA agent PEM file
    - vault: select a server with KRA for vault operations
  - Resolves: #1269777 IPA restore overwrites /etc/passwd and /etc/group files
    - do not overwrite files with local users/groups when restoring authconfig
  - Renamed patch 1011 to 0138, as it was merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-14
changelog:
  - Resolves: #1262996 ipa vault internal error on replica without KRA
    - upgrade: make sure ldap2 is connected in export_kra_agent_pem
  - Resolves: #1270608 IPA upgrade fails for server with CA cert signed by
    external CA
    - schema: do not derive ipaVaultPublicKey from ipaPublicKey


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15
changelog:
  - Resolves: #1252556 Missing CLI param and ACL for vault service operations
    - vault: fix private service vault creation


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-16
changelog:
  - Resolves: #1277696 IPA certificate auto renewal fail with "Invalid
    Credential"
    - cert renewal: make renewal of ipaCert atomic
  - Resolves: #1278330 installer options are not validated at the beginning of
    installation
    - install: fix command line option validation
  - Resolves: #1282845 sshd_config change on ipa-client-install can prevent sshd
    from starting up
    - client install: do not corrupt OpenSSH config with Match sections
  - Resolves: #1282935 ipa upgrade causes vault internal error
    - install: export KRA agent PEM file in ipa-kra-install
  - Resolves: #1283429 Default CA ACL rule is not created during
    ipa-replica-install
    - TLS and Dogtag HTTPS request logging improvements
    - Avoid race condition caused by profile delete and recreate
    - Do not erroneously reinit NSS in Dogtag interface
    - Add profiles and default CA ACL on migration
    - disconnect ldap2 backend after adding default CA ACL profiles
    - do not disconnect when using existing connection to check default CA ACLs
  - Resolves: #1283430 ipa-kra-install: fails to apply updates
    - suppress errors arising from adding existing LDAP entries during KRA
      install
  - Resolves: #1283748 Caching of ipaconfig does not work in framework
    - fix caching in get_ipa_config
  - Resolves: #1283943 IPA DNS Zone/DNS Forward Zone details missing after
    upgrade from RHEL 7.0 to RHEL 7.2
    - upgrade: fix migration of old dns forward zones
    - Fix upgrade of forwardzones when zone is in realmdomains
  - Resolves: #1284413 ipa-cacert-manage renew fails on nonexistent ldap
    connection
    - ipa-cacert-renew: Fix connection to ldap.
  - Resolves: #1284414 ipa-otptoken-import fails on nonexistent ldap connection
    - ipa-otptoken-import: Fix connection to ldap.
  - Resolves: #1286635 IPA server upgrade fails from RHEL 7.0 to RHEL 7.2 using
    "yum update ipa* sssd"
    - Set minimal required version for openssl
  - Resolves: #1286781 ipa-nis-manage does not update ldap with all NIS maps
    - Upgrade: Fix upgrade of NIS Server configuration
  - Resolves: #1289311 umask setting causes named-pkcs11 issue with directory
    permissions on /var/lib/ipa/dnssec
    - DNS: fix file permissions
    - Explicitly call chmod on newly created directories
    - Fix: replace mkdir with chmod
  - Resolves: #1290142 Broken 7.2.0 to 7.2.z upgrade - flawed version comparison
    - Fix version comparison
    - use FFI call to rpmvercmp function for version comparison
  - Resolves: #1292595 In IPA-AD trust environment some secondary IPA based Posix
    groups are missing
    - ipa-kdb: map_groups() consider all results
  - Resolves: #1293870 User should be notified for wrong password in password
    reset page
    - Fixed login error message box in LoginScreen page
  - Resolves: #1296196 Sysrestore did not restore state if a key is specified in
    mixed case
    - Allow to used mixed case for sysrestore
  - Resolves: #1296214 DNSSEC key purging is not handled properly
    - DNSSEC: Improve error reporting from ipa-ods-exporter
    - DNSSEC: Make sure that current state in OpenDNSSEC matches key state in
      LDAP
    - DNSSEC: Make sure that current key state in LDAP matches key state in BIND
    - DNSSEC: remove obsolete TODO note
    - DNSSEC: add debug mode to ldapkeydb.py
    - DNSSEC: logging improvements in ipa-ods-exporter
    - DNSSEC: remove keys purged by OpenDNSSEC from master HSM from LDAP
    - DNSSEC: ipa-dnskeysyncd: Skip zones with old DNSSEC metadata in LDAP
    - DNSSEC: ipa-ods-exporter: add ldap-cleanup command
    - DNSSEC: ipa-dnskeysyncd: call ods-signer ldap-cleanup on zone removal
    - DNSSEC: Log debug messages at log level DEBUG
  - Resolves: #1296216 ipa-server-upgrade fails if certmonger is not running
    - prevent crash of CA-less server upgrade due to absent certmonger
    - always start certmonger during IPA server configuration upgrade
  - Resolves: #1297811 The ipa -e skip_version_check=1 still issues
    incompatibility error when called against RHEL 6 server
    - ipalib: assume version 2.0 when skip_version_check is enabled
  - Resolves: #1298289 install fails when locale is "fr_FR.UTF-8"
    - Do not decode HTTP reason phrase from Dogtag
  - Resolves: #1300252 shared certificateProfiles container is missing on a
    freshly installed RHEL7.2 system
    - upgrade: unconditional import of certificate profiles into LDAP
  - Resolves: #1301674 --setup-dns and other options is forgotten for using an
    external PKI
    - installer: Propagate option values from components instead of copying them.
    - installer: Fix logic of reading option values from cache.
  - Resolves: #1301687 issues with migration from RHEL 6 self-signed to RHEL 7 CA
    IPA setup
    - ipa-ca-install: print more specific errors when CA is already installed
    - cert renewal: import all external CA certs on IPA CA cert renewal
    - CA install: explicitly set dogtag_version to 10
    - fix standalone installation of externally signed CA on IPA master
    - replica install: validate DS and HTTP server certificates
    - replica install: improvements in the handling of CA-related IPA config
      entries
  - Resolves: #1301901 [RFE] compat tree: show AD members of IPA groups
    - slapi-nis: update configuration to allow external members of IPA groups
  - Resolves: #1305533 ipa trust-add succeded but after that ipa trust-find
    returns "0 trusts matched"
    - upgrade: fix config of sidgen and extdom plugins
    - trusts: use ipaNTTrustPartner attribute to detect trust entries
    - Warn user if trust is broken
    - fix upgrade: wait for proper DS socket after DS restart
    - Insure the admin_conn is disconnected on stop
    - Fix connections to DS during installation
    - Fix broken trust warnings
  - Resolves: #1321092 Installers fail when there are multiple versions of the
    same certificate
    - certdb: never use the -r option of certutil
  - Related: #1317381 Crash during IPA upgrade due to slapd
    - spec file: update minimum required version of slapi-nis
  - Related: #1322691 CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112
    CVE-2016-2113 CVE-2016-2114 CVE-2016-2115 CVE-2016-2118 samba: various flaws
    [rhel-7.3]
    - Rebuild against newer Samba version


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605191449GITf8edf37
changelog:
  - Resolves: #837369 [RFE] Switch to client promotion to replica model
  - Resolves: #1199516 [RFE] Move replication topology to the shared tree
  - Resolves: #1206588 [RFE] Visualize FreeIPA server replication topology
  - Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
  - Resolves: #1212713 ipa-csreplica-manage: it could be nice to have also
    list-ruv / clean-ruv / abort-clean-ruv for o=ipaca backend
  - Resolves: #1267206 ipa-server-install uninstall should warn if no
    installation found
  - Resolves: #1295865 The Domain option is not correctly set in idmapd.conf when
    ipa-client-automount is executed.
  - Resolves: #1327092 URI details missing and OCSP-URI details are incorrectly
    displayed when certificate generated using IPA on RHEL 7.2up2.
  - Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
    because of missing dependencies
  - Related: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.3.1.201605191449GITf8edf37


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605191449GITf8edf37.1
changelog:
  - Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
    because of missing dependencies
    - Rebuild with krb5-1.14.1


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605241723GIT1b427d3
changelog:
  - Resolves: #1339233 CA installed on replica is always marked as renewal master
  - Related: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.3.1.201605241723GIT1b427d3


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605241723GIT1b427d3.1
changelog:
  - Resolves: #1339483 ipa-server-install fails with ERROR pkinit_cert_files
    - Fix incorrect rebase of patch 1001


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-0.1.alpha1
changelog:
  - Resolves: #712109 "krbExtraData not allowed" is logged in DS error log while
    setting password for default sudo binddn.
  - Resolves: #747612 [RFE] IPA should support and manage DNS sites
  - Resolves: #768316 [RFE] ipa-getkeytab should auto-detect the ipa server name
  - Resolves: #825391 [RFE] Replica installation should provide a means for
    inheriting nssldap security access settings
  - Resolves: #921497 Incorrect *.py[co] files placement
  - Resolves: #1029640 RHEL7 IPA to add DNA Plugin config for dnaRemote support
  - Resolves: #1029905 389 DS cache sizes not replicated to IPA replicas
  - Resolves: #1196958 IPA replica installation failing with high number of users
    (160000).
  - Resolves: #1219402 IPA suggests to uninstall a client when the user needs to
    uninstall a replica
  - Resolves: #1224057 [RFE] TGS authorization decisions in KDC based on
    Authentication Indicator
  - Resolves: #1234222 [WebUI] UI error message is not appropriate for "Kerberos
    principal expiration"
  - Resolves: #1234223 [WebUI] General invalid password error message appearing
    for "Locked user"
  - Resolves: #1254267 ipa-server-install failure applying ldap updates with
    limits exceeded
  - Resolves: #1258626 realmdomains-mod --add-domain command throwing error when
    doamin already is in forwardzone.
  - Resolves: #1259020 ipa-server-adtrust-install doesn't allow
    NetBIOS-name=EXAMPLE-TEST.COM (dash character)
  - Resolves: #1260993 DNSSEC signing enablement on dnszone should throw error
    message when DNSSEC master not installed
  - Resolves: #1262747 dnssec options missing in ipa-dns-install man page
  - Resolves: #1265900 Fail installation immediately after dirsrv fails to
    install using ipa-server-install
  - Resolves: #1265915 idoverrideuser-find fails if any SID anchor is not
    resolvable anymore
  - Resolves: #1268027 ipa-dnskeysync-replica crash with backtrace -
    LimitsExceeded: limits exceeded for this query
  - Resolves: #1269089 Certificate of managed-by host/service fails to resubmit
  - Resolves: #1269200 ipa-server crashing while trying to preserve admin user
  - Resolves: #1271321 Reduce ioblocktimeout and idletimeout defaults
  - Resolves: #1271579 Automember rule expressions disappear from tables on
    single expression delete
  - Resolves: #1275816 Incomplete ports for IPA ad-trust
  - Resolves: #1276351 [RFE] Remove
    /usr/share/ipa/updates/50-lockout-policy.update file from IPA releases
  - Resolves: #1277109 Add tool tips for Revert, Refresh, Undo, and Undo All in
    the IPA UI
  - Resolves: #1278426 Better error message needed for invalid ca-signing-algo
    option
  - Resolves: #1279932 ipa-client-install --request-cert needs workaround in
    anaconda chroot
  - Resolves: #1282521 Creating a user w/o private group fails when doing so in
    WebUI
  - Resolves: #1283879 ipa-winsync-migrate: Traceback message should be replaced
    by "IPA is not configured on this system"
  - Resolves: #1285071 ipa-kra-install fails on replica looking for admin cert
    file
  - Resolves: #1287194 [RFE] Support of UPN for trusted domains
  - Resolves: #1288967 Normalize Manager entry in ipa user-add
  - Resolves: #1289487 Priority field missing in Password Policy detail tab
  - Resolves: #1291140 ipa client should configure kpasswd_server directive in
    krb5.conf
  - Resolves: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.4.0.alpha1
  - Resolves: #1298848 [RFE] Centralized topology management
  - Resolves: #1300576 Browser setup page includes instructions for Internet
    Explorer
  - Resolves: #1301586 ipa host-del --updatedns should remove related dns
    entries.
  - Resolves: #1304618 Residual Files After IPA Server Uninstall
  - Resolves: #1305144 ipa-python does not require its dependencies
  - Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
  - Resolves: #1313798 Console output post ipa-winsync-migrate command should be
    corrected.
  - Resolves: #1314786 [RFE] External Trust with Active Directory domain
  - Resolves: #1319023 Include description for 'status' option in man page for
    ipactl command.
  - Resolves: #1319912 ipa-server-install does not completely change hostname and
    named-pkcs11 fails
  - Resolves: #1320891 IPA Error 3009: Validation error: Invalid 'ptrrecord':
    Reverse zone in-addr.arpa. requires exactly 4 IP address compnents, 5 given
  - Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
    revocation reasons
  - Resolves: #1328549 "ipa-kra-install" command reports incorrect message when
    it is executed on server already installed with KRA.
  - Resolves: #1329209 ipa-nis-manage enable: change service name from 'portmap'
    to 'rpcbind'
  - Resolves: #1329275 ipa-nis-manage command should include status option
  - Resolves: #1330843 'man ipa' should be updated with latest commands
  - Resolves: #1333755 ipa cert-request causes internal server error while
    requesting certificate
  - Resolves: #1337484 EOF is not handled for ipa-client-install command
  - Resolves: #1338031 Insufficient 'write' privilege on some attributes for the
    members of the role which has "User Administrators" privilege.
  - Resolves: #1343142 IPA DNS should do better verification of DNS zones
  - Resolves: #1347928 Frontpage exposes runtime error with no cookies enabled in
    browser


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-0.2.alpha1
changelog:
  - Resolves: #1348948 IPA server install fails with build
    ipa-server-4.4.0-0.el7.1.alpha1
    - Revert "Increased mod_wsgi socket-timeout"


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-1
changelog:
  - Resolves: #747612 [RFE] IPA should support and manage DNS sites
  - Resolves: #826790 Disabling password expiration (--maxlife=0 and --minlife=0)
    in the default global_policy in IPA sets user's password expiration
    (krbPasswordExpiration) to be 90 days
  - Resolves: #896699 ipa-replica-manage -H does not delete DNS SRV records
  - Resolves: #1084018 [RFE] Add IdM user password change support for legacy
    client compat tree
  - Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
    aliases)
    - Fix incorrect check for principal type when evaluating CA ACLs
  - Resolves: #1146860 [RFE] Offer OTP generation for host enrollment in the UI
  - Resolves: #1238190 ipasam unable to lookup group in directory yet manual
    search works
  - Resolves: #1250110 search by users which don't have read rights for all attrs
    in search_attributes fails
  - Resolves: #1263764 Show Certificate displays in useless format
  - Resolves: #1272491 [WebUI] Certificate action dropdown does not display all
    the options after adding new certificate
  - Resolves: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.4.0
  - Resolves: #1294503 IPA fails to issue 3rd party certs
  - Resolves: #1298242 [RFE] API compatibility - compatibility of clients
  - Resolves: #1298848 [RFE] Centralized topology management
  - Resolves: #1298966 [RFE] Extend Smart Card support
  - Resolves: #1315146 Multiple clients cannot join domain simultaneously:
    /var/run/httpd/ipa/clientcaches race condition?
  - Resolves: #1318903 ipa server install failing when SUBCA signs the cert
  - Resolves: #1319003 ipa-winsync-migrate: Traceback should be fixed with proper
    console output
  - Resolves: #1324055 IPA always qualify requests for admin
  - Resolves: #1328552 [RFE] Allow users to authenticate with alternative names
  - Resolves: #1334582 Inconsistent UI and CLI options for removing certificate
    hold
  - Resolves: #1346321 Exclude o=ipaca subtree from Retro Changelog (syncrepl)
  - Resolves: #1349281 Fix `Conflicts` with ipa-python
  - Resolves: #1350695 execution of copy-schema script fails
  - Resolves: #1351118 upgrade failed for RHEL-7.3 from RHEL-7.2.z
  - Resolves: #1351153 AVC seen on Replica during ipa-server upgrade test
    execution to 7.3
  - Resolves: #1351276 ipa-server-install with dns cannot resolve itself to
    create ipa-ca entry
  - Related: #1343422 [RFE] Add GssapiImpersonate option


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-2
changelog:
  - Resolves: #1356102 Server uninstall does not stop tracking lightweight sub-CA
    with certmonger
    - uninstall: untrack lightweight CA certs
  - Resolves: #1351807 ipa-nis-manage config.get_dn missing
    - ipa-nis-manage: Use server API to retrieve plugin status
  - Resolves: #1353452 ipa-compat-manage command failed,
    exception: NotImplementedError: config.get_dn()
    - ipa-compat-manage: use server API to retrieve plugin status
  - Resolves: #1353899 ipa-advise: object of type 'type' has no len()
    - ipa-advise: correct handling of plugin namespace iteration
  - Resolves: #1356134 'kinit -E' does not work for IPA user
    - kdb: check for local realm in enterprise principals
  - Resolves: #1353072 ipa unknown command vault-add
    - Enable vault-* commands on client
    - vault-add: set the default vault type on the client side if none was given
  - Resolves: #1353995 Default CA can be used without a CA ACL
    - caacl: expand plugin documentation
  - Resolves: #1356144 host-find should not print SSH keys by default, only
    SSH fingerprints
    - host-find: do not show SSH key by default
  - Resolves: #1353506 ipa migrate-ds command fails for IPA in RHEL 7.3
    - Removed unused method parameter from migrate-ds


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-2.1
changelog:
  - Resolves: #1274524 [RFE] Qualify up to 60 IdM replicas
  - Resolves: #1320838 [RFE] Support IdM Client in a DNS domain controlled by AD
  - Related: #1356134 'kinit -E' does not work for IPA user


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-3
changelog:
  - Resolves: #1296140 Remove redhat-access-plugin-ipa support
    - Obsolete and conflict redhat-access-plugin-ipa
  - Resolves: #1351119 Multiple issues while uninstalling ipa-server
    - server uninstall fails to remove krb principals
  - Resolves: #1351758 ipa commands not showing expected error messages
    - frontend: copy command arguments to output params on client
    - Show full error message for selinuxusermap-add-hostgroup
  - Resolves: #1352883 Traceback on adding default automember group and hostgroup
    set
    - allow 'value' output param in commands without primary key
  - Resolves: #1353888 Fix the help for ipa otp and other topics
    - schema: Fix subtopic -> topic mapping
  - Resolves: #1354348 ipa trustconfig-show throws internal error.
    - allow 'value' output param in commands without primary key
  - Resolves: #1354381 ipa trust-add with raw option gives internal error.
    - trust-add: handle `--all/--raw` options properly
  - Resolves: #1354493 Replica install fails with old IPA master
    - DNS install: Ensure that DNS servers container exists
  - Resolves: #1354628 ipa hostgroup-add-member does not return error message
    when adding itself as member
    - frontend: copy command arguments to output params on client
  - Resolves: #1355856 ipa otptoken-add --type=totp gives internal error
    - messages: specify message type for ResultFormattingError
  - Resolves: #1356063 "ipa radiusproxy-add" command needs to prompt to enter
    secret key
    - expose `--secret` option in radiusproxy-* commands
    - prevent search for RADIUS proxy servers by secret
  - Resolves: #1356099 Bug in the ipapwd plugin
    - Heap corruption in ipapwd plugin
  - Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
    client changes
    - Use server API in com.redhat.idm.trust-fetch-domains oddjob helper
  - Resolves: #1356964 Renaming a user removes all of his principal aliases
    - Preserve user principal aliases during rename operation


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-4
changelog:
  - Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
    aliases)
    - harden the check for trust namespace overlap in new principals
  - Resolves: #1351142 CLI is not using session cookies for communication with
    IPA API
    - Fix session cookies
  - Resolves: #1353888 Fix the help for ipa otp and other topics
    - help: Add dnsserver commands to help topic 'dns'
  - Resolves: #1354406 host-del updatedns options complains about missing ptr
    record for host
    - Host-del: fix behavior of --updatedns and PTR records
  - Resolves: #1355718 ipa-replica-manage man page example output differs actual
    command output
    - Minor fix in ipa-replica-manage MAN page
  - Resolves: #1358229 Traceback message should be fixed, seen while editing
    winsync migrated user information in Default trust view.
    - baseldap: Fix MidairCollision instantiation during entry modification
  - Resolves: #1358849 CA replica install logs to wrong log file
    - unite log file name of ipa-ca-install
  - Resolves: #1359130 ipa-server-install command fails to install IPA server.
    - DNS Locations: fix update-system-records unpacking error
  - Resolves: #1359237 AVC on dirsrv config caused by IPA installer
    - Use copy when replacing files to keep SELinux context
  - Resolves: #1359692 ipa-client-install join fail with traceback against
    RHEL-6.8 ipa-server
    - compat: fix ping call
  - Resolves: #1359738 ipa-replica-install --domain=<IPA primary domain> option
    does not work
    - replica-install: Fix --domain
  - Resolves: #1360778 Vault commands are available in CLI even when the server
    does not support them
    - Revert "Enable vault-* commands on client"
    - client: fix hiding of commands which lack server support
  - Related: #1281704 Rebase to softhsm 2.1.0
    - Remove the workaround for softhsm bug #1293340
  - Related: #1298288 [RFE] Improve performance in large environments.
    - Create indexes for krbCanonicalName attribute


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-5
changelog:
  - Resolves: #1353829 traceback message seen in ipaserver-uninstall.log file.
    - Do not initialize API in ipa-client-automount uninstall
  - Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
    client changes
    - idrange: fix unassigned global variable
  - Resolves: #1360792 Migrating users doesn't update krbCanonicalName
    - re-set canonical principal name on migrated users
  - Resolves: #1362012 ipa hbactest produces error about cannot concatenate 'str'
    and 'bool' objects
    - Fix ipa hbactest output
  - Resolves: #1362260 ipa vault-mod no longer allows defining salt
    - vault: add missing salt option to vault_mod
  - Resolves: #1362312 ipa vault-retrieve internal error when using the wrong
    public key
    - vault: Catch correct exception in decrypt
  - Resolves: #1362537 ipa-server-install fails to create symlink from
    /etc/ipa/kdcproxy/ to /etc/httpd/conf.d/
    - Correct path to HTTPD's systemd service directory
  - Resolves: #1363756 Increase length of passwords generated by installer
    - Increase default length of auto generated passwords


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-6
changelog:
  - Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
    - Revert "spec: add conflict with bind-chroot to freeipa-server-dns"
  - Resolves: #1341249 Subsequent external CA installation fails
    - install: fix external CA cert validation
  - Resolves: #1353831 ipa-server-install fails in container because of
    hostnamectl set-hostname
    - server-install: Fix --hostname option to always override api.env values
    - install: Call hostnamectl set-hostname only if --hostname option is used
  - Resolves: #1356091 ipa-cacert-manage --help and man differ
    - Improvements for the ipa-cacert-manage man and help
  - Resolves: #1360631 ipa-backup is not keeping the
    /etc/tmpfiles.d/dirsrv-<instance>.conf
    - ipa-backup: backup /etc/tmpfiles.d/dirsrv-<instance>.conf
  - Resolves: #1361047 ipa-replica-install --help usage line suggests the replica
    file is needed
    - Update ipa-replica-install documentation
  - Resolves: #1361545 ipa-client-install starts rhel-domainname.service but does
    not rpm-require it
    - client: RPM require initscripts to get *-domainname.service
  - Resolves: #1364197 caacl: error when instantiating rules with service
    principals
    - caacl: fix regression in rule instantiation
  - Resolves: #1364310 ipa otptoken-add bytes object has no attribute confirm
    - parameters: move the `confirm` kwarg to Param
  - Resolves: #1364464 Topology graph: ca and domain adders shows question marks
    instead of plus icon
    - Fix unicode characters in ca and domain adders
  - Resolves: #1365083 Incomplete output returned for command ipa vault-add
    - client: add missing output params to client-side commands
  - Resolves: #1365526 build fails during "make check"
    - ipa-kdb: Fix unit test after packaging changes in krb5


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-7
changelog:
  - Resolves: #1361119 UPN-based search for AD users does not match an entry in
    slapi-nis map cache
    - support multiple uid values in schema compatibility tree


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-8
changelog:
  - Resolves: #1298288 [RFE] Improve performance in large environments.
    - cert: speed up cert-find
  - Resolves: #1317379 [EXPERIMENTAL][RFE] Web UI: allow Smart Card
    authentication
    - service: add flag to allow S4U2Self
    - Add 'trusted to auth as user' checkbox
    - Added new authentication method
  - Resolves: #1353881 ipa-replica-install suggests about
    non-existent --force-ntpd option
    - Don't show --force-ntpd option in replica install
  - Resolves: #1354441 DNS forwarder check is too strict: unable to add
    sub-domain to already-broken domain
    - DNS: allow to add forward zone to already broken sub-domain
  - Resolves: #1356146 performance regression in CLI help
    - schema: Speed up schema cache
    - frontend: Change doc, summary, topic and NO_CLI to class properties
    - schema: Introduce schema cache format
    - schema: Generate bits for help load them on request
    - help: Do not create instances to get information about commands and topics
    - schema cache: Do not reset ServerInfo dirty flag
    - schema cache: Do not read fingerprint and format from cache
    - Access data for help separately
    - frontent: Add summary class property to CommandOverride
    - schema cache: Read server info only once
    - schema cache: Store API schema cache in memory
    - client: Do not create instance just to check isinstance
    - schema cache: Read schema instead of rewriting it when SchemaUpToDate
  - Resolves: #1360769 ipa-server-certinstall couldnt unlock private key file
    - server install: do not prompt for cert file PIN repeatedly
  - Resolves: #1364113 ipa-password: ipa: ERROR: RuntimeError: Unable to create
    cache directory: [Errno 13] Permission denied: '/home/test_user'
    - schema: Speed up schema cache
  - Resolves: #1366604 `cert-find` crashes on invalid certificate data
    - cert: do not crash on invalid data in cert-find
  - Resolves: #1366612 Middle replica uninstallation in line topology works
    without '--ignore-topology-disconnect'
    - Fail on topology disconnect/last role removal
  - Resolves: #1366626 caacl-add-service: incorrect error message when service
    does not exists
    - Fix ipa-caalc-add-service error message
  - Resolves: #1367022 The ipa-server-upgrade command failed when named-pkcs11
    does not happen to run during dnf upgrade
    - DNS server upgrade: do not fail when DNS server did not respond
  - Resolves: #1367759 [RFE] [webui] warn admin if there is only one IPA server
    with CA
    - Add warning about only one existing CA server
    - Set servers list as default facet in topology facet group
  - Resolves: #1367773 thin client ignores locale change
    - schema check: Check current client language against cached one


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-9
changelog:
  - Resolves: #1081561 CA not start during ipa server install in pure IPv6 env
    - Fix ipa-server-install in pure IPv6 environment
  - Resolves: #1318169 Tree-root domains in a trusted AD forest aren't marked as
    reachable via the forest root
    - trust: make sure ID range is created for the child domain even if it exists
    - ipa-kdb: simplify trusted domain parent search
  - Resolves: #1335567 Update Warning in IdM Web UI API browser
    - WebUI: add API browser is tech preview warning
  - Resolves: #1348560 Mulitple domain Active Directory Trust conflict
    - ipaserver/dcerpc: reformat to make the code closer to pep8
    - trust: automatically resolve DNS trust conflicts for triangle trusts
  - Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
    certificate revocation
    - cert-revoke: fix permission check bypass (CVE-2016-5404)
  - Resolves: #1353936 custodia.conf and server.keys file is world-readable.
    - Remove Custodia server keys from LDAP
    - Secure permissions of Custodia server.keys
  - Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
    converted from CA-less to CA-full
    - custodia: include known CA certs in the PKCS#12 file for Dogtag
    - custodia: force reconnect before retrieving CA certs from LDAP
  - Resolves: #1362333 ipa vault container owner cannot add vault
    - Fix: container owner should be able to add vault
  - Resolves: #1365546 External trust with root domain is transitive
    - trust: make sure external trust topology is correctly rendered
  - Resolves: #1365572 IPA server broken after upgrade
    - Require pki-core-10.3.3-7
  - Resolves: #1367864 Server assumes latest version of command instead of
    version 1 for old / 3rd party clients
    - rpcserver: assume version 1 for unversioned command calls
    - rpcserver: fix crash in XML-RPC system commands
  - Resolves: #1367773 thin client ignores locale change
    - schema cache: Fallback to 'en_us' when locale is not available
  - Resolves: #1368754 ipa server uninstall fails with Python "Global Name error"
    - Fail on topology disconnect/last role removal
  - Resolves: #1368981 ipa otptoken-add --type=hotp --key creates wrong OTP
    - otptoken, permission: Convert custom type parameters on server
  - Resolves: #1369414 ipa server-del fails with Python stack trace
    - Handled empty hostname in server-del command
  - Resolves: #1369761 ipa-server must depend on a version of httpd that support
    mod_proxy with UDS
    - Require httpd 2.4.6-31 with mod_proxy Unix socket support
  - Resolves: #1370512 Received ACIError instead of DuplicatedError in
    stageuser_tests
    - Raise DuplicatedEnrty error when user exists in delete_container
  - Resolves: #1371479 cert-find --all does not show information about revocation
    - cert: add missing param values to cert-find output
  - Renamed patch 1011 to 0100, as it was merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-10
changelog:
  - Resolves: #1355753 adding two way non transitive(external) trust displays
    internal error on the console
    - Always fetch forest info from root DCs when establishing two-way trust
    - factor out `populate_remote_domain` method into module-level function
    - Always fetch forest info from root DCs when establishing one-way trust
  - Resolves: #1356101 Lightweight sub-CA certs are not tracked by certmonger
    after `ipa-replica-install`
    - Track lightweight CAs on replica installation
  - Resolves: #1357488 ipa command stuck forever on higher versioned client with
    lower versioned server
    - compat: Save server's API version in for pre-schema servers
    - compat: Fix ping command call
    - schema cache: Store and check info for pre-schema servers
  - Resolves: #1363905 man page for ipa-replica-manage has a typo in -c flag
    - Fix man page ipa-replica-manage: remove duplicate -c option
      from --no-lookup
  - Resolves: #1367865 webui: cert_revoke should use --cacn to set correct CA
    when revoking certificate
    - cert: include CA name in cert command output
    - WebUI add support for sub-CAs while revoking certificates
  - Resolves: #1368424 Unable to view certificates issued by Sub CA in Web UI
    - Add support for additional options taken from table facet
    - WebUI: Fix showing certificates issued by sub-CA
  - Resolves: #1368557 dnsrecord-add does not prompt for missing record parts
    internactively
    - dns: normalize record type read interactively in dnsrecord_add
    - dns: prompt for missing record parts in CLI
    - dns: fix crash in interactive mode against old servers
  - Resolves: #1370519 Certificate revocation in service-del and host-del isn't
    aware of Sub CAs
    - cert: fix cert-find --certificate when the cert is not in LDAP
    - Make host/service cert revocation aware of lightweight CAs
  - Resolves: #1371901 Use OAEP padding with custodia
    - Use RSA-OAEP instead of RSA PKCS#1 v1.5
  - Resolves: #1371915 When establishing external two-way trust, forest root
    Administrator account is used to fetch domain info
    - do not use trusted forest name to construct domain admin principal
  - Resolves: #1372597 Incorrect CA ACL evaluation of SAN DNS names in
    certificate request
    - Fix CA ACL Check on SubjectAltNames
  - Resolves: #1373272 CLI always sends default command version
    - cli: use full name when executing a command
  - Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
    - Fix ipa-certupdate for CA-less installation
  - Resolves: #1373540 client-install with IPv6 address fails on link-local
    address (always)
    - Fix parse errors with link-local addresses


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-11
changelog:
  - Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
    - Fix regression introduced in ipa-certupdate


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-12
changelog:
  - Resolves: #1373910 IPA server upgrade fails with DNS timed out errors.
  - Resolves: #1375269 ipa trust-fetch-domains throws internal error


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-13
changelog:
  - Resolves: #1318616 CA fails to start after doing ipa-ca-install --external-ca
    - Keep NSS trust flags of existing certificates
  - Resolves: #1360813 ipa-server-certinstall does not update all certificate
    stores and doesn't set proper trust permissions
    - Add cert checks in ipa-server-certinstall
  - Resolves: #1371479 cert-find --all does not show information about revocation
    - cert: add revocation reason back to cert-find output
  - Resolves: #1375133 WinSync users who have First.Last casing creates users who
    can have their password set
    - ipa passwd: use correct normalizer for user principals
  - Resolves: #1377858 Users with 2FA tokens are not able to login to IPA servers
    - Properly handle LDAP socket closures in ipa-otpd
  - Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
    - Make httpd publish its CA certificate on DL1


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14
changelog:
  - Resolves: #1378353 Replica install fails with old IPA master sometimes during
    replication process
    - spec file: bump minimal required version of 389-ds-base
  - Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
    - Fix missing file that fails DL1 replica installation
  - Resolves: #1387782 WebUI: Services are not displayed correctly after upgrade
    - WebUI: services without canonical name are shown correctly
  - Resolves: #1389709 Traceback seen in error_log when trustdomain-del is run
    - trustdomain-del: fix the way how subdomain is searched


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.1
changelog:
  - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
    by abusing password policy
    - password policy: Add explicit default password policy for hosts and
      services
  - Resolves: #1395311 CVE-2016-9575 ipa: Insufficient permission check in
    certprofile-mod
    - certprofile-mod: correctly authorise config update


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.2
changelog:
  - Resolves: #1382812 Creation of replica for disconnected environment is
    failing with CA issuance errors; Need good steps.
    - gracefully handle setting replica bind dn group on old masters
  - Resolves: #1397439 ipa-ca-install on promoted replica hangs on creating a
    temporary CA admin
    - replication: ensure bind DN group check interval is set on replica config
    - add missing attribute to ipaca replica during CA topology update
  - Resolves: #1401088 IPA upgrade of replica without DNS fails during restart of
    named-pkcs11
    - bindinstance: use data in named.conf to determine configuration status


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.3
changelog:
  - Resolves: #1398670 Check IdM Topology for broken record caused by replication
    conflict before upgrading it
    - Check for conflict entries before raising domain level


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.4
changelog:
  - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
    by abusing password policy
    - ipa-kdb: search for password policies globally
  - Renamed patches 1011 and 1012 to 0151 and 0150, as they were merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.5
changelog:
  - Resolves: #1365858 ipa-ca-install fails on replica when IPA Master is
    installed without CA
    - Set up DS TLS on replica in CA-less topology
  - Resolves: #1398600 IPA replica install fails with dirsrv errors.
    - Do not configure PKI ajp redirection to use "::1"
  - Resolves: #1413137 CVE-2017-2590 ipa: Insufficient permission check for
    ca-del, ca-disable and ca-enable commands
    - ca: correctly authorise ca-del, ca-enable and ca-disable


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.6
changelog:
  - Resolves: #1416454 replication race condition prevents IPA to install
    - wait_for_entry: use only DN as parameter
    - Wait until HTTPS principal entry is replicated to replica
    - Use proper logging for error messages


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.7
changelog:
  - Resolves: #1419735 ipa-replica-install fails promotecustodia.create_replica
    with cert errors (untrusted)
    - added ssl verification using IPA trust anchor
  - Resolves: #1428472 batch param compatibility is incorrect
    - compat: fix `Any` params in `batch` and `dnsrecord`
  - Renamed patches 1011 and 1012 to 0159 and 0157, as they were merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-1.el7
changelog:
  - Resolves: #828866 [RFE] enhance --subject option for ipa-server-install
  - Resolves: #1160555 ipa-server-install: Cannot handle double hyphen "--" in
    hostname
  - Resolves: #1286288 Insufficient 'write' privilege to the 'ipaExternalMember'
    attribute
  - Resolves: #1321652 ipa-server-install fails when using external certificates
    that encapsulate RDN components in double quotes
  - Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
    revocation reasons
  - Resolves: #1340880 ipa-server-install: improve prompt on interactive
    installation
  - Resolves: #1353841 ipa-replica-install fails to install when resolv.conf
    incomplete entries
  - Resolves: #1356104 cert-show command does not display Subject Alternative
    Names
  - Resolves: #1357511 Traceback message seen when ipa is provided with invalid
    configuration file name
  - Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
    converted from CA-less to CA-full
  - Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
  - Resolves: #1367572 improve error message in ipa migrate-ds: mention ipa
    config-mod --enable-migration=TRUE
  - Resolves: #1367868 Add options to retrieve lightweight CA certificate/chain
  - Resolves: #1371927 Implement ca-enable/disable commands.
  - Resolves: #1372202 Add Users into User Group editors fails to show Full names
  - Resolves: #1373091 Adding an auth indicator from the CLI creates an extra
    check box in the UI
  - Resolves: #1375596 Ipa-server WebUI - long user/group name show wrong error
    message
  - Resolves: #1375905 "Normal" group type in the UI is confusing
  - Resolves: #1376040 IPA client ipv6 - invalid --ip-address shows traceback
  - Resolves: #1376630 IDM admin password gets written to
    /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
  - Resolves: #1376729 ipa-server-install script option --no_hbac_allow should
    match other options
  - Resolves: #1378461 IPA Allows Password Reuse with History value defined when
    admin resets the password.
  - Resolves: #1379029 conncheck failing intermittently during single step
    replica installs
  - Resolves: #1379858 [RFE] better debugging for ipa-replica-conncheck
  - Resolves: #1384310 ipa dnsrecord-add fails with Keyerror stack trace
  - Resolves: #1392778 Update man page for ipa-adtrust-install by
    removing --no-msdcs option
  - Resolves: #1392858 Rebase to FreeIPA 4.5+
    - Rebase to 4.5.0
  - Resolves: #1399133 Delete option shouldn't be available for hosts applied to
    view.
  - Resolves: #1399190 [RFE] Certificates issued by externally signed IdM CA
    should contain full trust chain
  - Resolves: #1400416 RFE: Provide option to take backup of IPA server before
    uninstalling IPA server
  - Resolves: #1400529 cert-request is not aware of Kerberos principal aliases
  - Resolves: #1401526 IPA WebUI certificates are grayed out on overview page but
    not on details page
  - Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
  - Resolves: #1404750 ipa-client-install fails to get CA cert via LDAP when
    non-FQDN name of IPA server is first in /etc/hosts
  - Resolves: #1409628 [RFE] Semi-automatic integration with external DNS using
    nsupdate
  - Resolves: #1413742 Backport request for bug/issue Change IP address
    validation errors to warnings
  - Resolves: #1415652 IPA replica install log shows password in plain text
  - Resolves: #1427897 different behavior regarding system wide certs in master
    and replica.
  - Resolves: #1430314 The ipa-managed-entries command failed, exception:
    AttributeError: ldap2


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-2.el7
changelog:
  - Resolves: #1432630 python2-jinja2 needed for python2-ipaclient
    - Remove csrgen
  - Resolves: #1432903 Set GssProxy options to enable caching of ldap tickets
    - Add options to allow ticket caching


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-3.el7
changelog:
  - Resolves: #800545 [RFE] Support SUDO command rename
    - Reworked the renaming mechanism
    - Allow renaming of the sudorule objects
  - Resolves: #872671 IPA WebUI login for AD Trusted User fails
    - WebUI: check principals in lowercase
    - WebUI: add method for disabling item in user dropdown menu
    - WebUI: Add support for login for AD users
  - Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
    certificates on smart cards (pkinit)
    - ipa-kdb: add ipadb_fetch_principals_with_extra_filter()
    - IPA certauth plugin
    - ipa-kdb: do not depend on certauth_plugin.h
    - spec file: bump krb5-devel BuildRequires for certauth
  - Resolves: #1264370 RFE: disable last successful authentication by default in
    ipa.
    - Set "KDC:Disable Last Success" by default
  - Resolves: #1318186 Misleading error message during external-ca IPA master
    install
    - certs: do not implicitly create DS pin.txt
    - httpinstance: clean up /etc/httpd/alias on uninstall
  - Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
    CA certificate chain in ... incomplete"
    - certs: do not implicitly create DS pin.txt
    - httpinstance: clean up /etc/httpd/alias on uninstall
  - Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
    - configure: fix --disable-server with certauth plugin
    - rpcserver.login_x509: Actually return reply from __call__ method
    - spec file: Bump requires to make Certificate Login in WebUI work
  - Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
    - extdom: do reverse search for domain separator
    - extdom: improve cert request
  - Resolves: #1430363 [RFE] HBAC rule names command rename
    - Reworked the renaming mechanism
    - Allow renaming of the HBAC rule objects
  - Resolves: #1433082 systemctl daemon-reload needs to be called after
    httpd.service.d/ipa.conf is manipulated
    - tasks: run `systemctl daemon-reload` after httpd.service.d updates
  - Resolves: #1434032 Run ipa-custodia with custom SELinux context
    - Use Custodia 0.3.1 features
  - Resolves: #1434384 RPC client should use HTTP persistent connection
    - Use connection keep-alive
    - Add debug logging for keep-alive
    - Increase Apache HTTPD's default keep alive timeout
  - Resolves: #1434729 man ipa-cacert-manage install needs clarification
    - man ipa-cacert-manage install needs clarification
  - Resolves: #1434910 replica install against IPA v3 master fails with ACIError
    - Fixing replica install: fix ldap connection in domlvl 0
  - Resolves: #1435394 Ipa-kra-install fails with weird output when backspace is
    used during typing Directory Manager password
    - ipapython.ipautil.nolog_replace: Do not replace empty value
  - Resolves: #1435397 ipa-replica-install can't install replica file produced by
    ipa-replica-prepare on 4.5
    - replica prepare: fix wrong IPA CA nickname in replica file
  - Resolves: #1435599 WebUI: in self-service Vault menu item is shown even if
    KRA is not installed
    - WebUI: Fix showing vault in selfservice view
  - Resolves: #1435718 As a ID user I cannot call a command with --rights option
    - ldap2: use LDAP whoami operation to retrieve bind DN for current connection
  - Resolves: #1436319 "Truncated search results" pop-up appears in user details
    in WebUI
    - WebUI: Add support for suppressing warnings
    - WebUI: suppress truncation warning in select widget
  - Resolves: #1436333 Uninstall fails with No such file or directory:
    '/var/run/ipa/services.list'
    - Create temporaty directories at the begining of uninstall
  - Resolves: #1436334 WebUI: Adding certificate mapping data using certificate
    fails
    - WebUI: Allow to add certs to certmapping with CERT LINES around
  - Resolves: #1436338 CLI doesn't work after ipa-restore
    - Backup ipa-specific httpd unit-file
    - Backup CA cert from kerberos folder
  - Resolves: #1436342 Bump samba version, required for FIPS mode and privilege
    separation
    - Bump samba version for FIPS and priv. separation
  - Resolves: #1436642 [ipalib/rpc.py] - "maximum recursion depth exceeded" with
    ipa vault commands
    - Avoid growing FILE ccaches unnecessarily
    - Handle failed authentication via cookie
    - Work around issues fetching session data
    - Prevent churn on ccaches
  - Resolves: #1436657 Add workaround for pki_pin for FIPS
    - Generate PIN for PKI to help Dogtag in FIPS
  - Resolves: #1436714 [vault] cache KRA transport cert
    - Simplify KRA transport cert cache
  - Resolves: #1436723 cert-find does not find all certificates without
    sizelimit=0
    - cert: do not limit internal searches in cert-find
  - Resolves: #1436724 Renewal of IPA RA fails on replica
    - dogtag-ipa-ca-renew-agent-submit: fix the is_replicated() function
  - Resolves: #1436753 Master tree fails to install
    - httpinstance.disable_system_trust: Don't fail if module 'Root Certs' is not
      available


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-4.el7
changelog:
  - Resolves: #1434032 Run ipa-custodia with custom SELinux context
    - Require correct custodia version


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-5.el7
changelog:
  - Resolves: #1318186 Misleading error message during external-ca IPA master
    install
    - httpinstance: make sure NSS database is backed up
  - Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
    CA certificate chain in ... incomplete"
    - httpinstance: make sure NSS database is backed up
  - Resolves: #1393726 Enumerate all available request type options in ipa
    cert-request help
    - Hide request_type doc string in cert-request help
  - Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
    - spec file: bump libsss_nss_idmap-devel BuildRequires
    - server: make sure we test for sss_nss_getlistbycert
  - Resolves: #1437378 ipa-adtrust-install produced an error and failed on
    starting smb when hostname is not FQDN
    - adtrust: make sure that runtime hostname result is consistent with the
      configuration
  - Resolves: #1437555 ipa-replica-install with DL0 fails to get annonymous
    keytab
    - Always check and create anonymous principal during KDC install
    - Remove duplicate functionality in upgrade
  - Resolves: #1437946 Upgrade to FreeIPA 4.5.0 does not configure anonymous
    principal for PKINIT
    - Upgrade: configure PKINIT after adding anonymous principal
    - Remove unused variable from failed anonymous PKINIT handling
    - Split out anonymous PKINIT test to a separate method
    - Ensure KDC is propery configured after upgrade
  - Resolves: #1437951 Remove pkinit-related options from server/replica-install
    on DL0
    - Fix the order of cert-files check
    - Don't allow setting pkinit-related options on DL0
    - replica-prepare man: remove pkinit option refs
    - Remove redundant option check for cert files
  - Resolves: #1438490 CA-less installation fails on publishing CA certificate
    - Get correct CA cert nickname in CA-less
    - Remove publish_ca_cert() method from NSSDatabase
  - Resolves: #1438838 Avoid arch-specific path in /etc/krb5.conf.d/ipa-certmap
    - IPA-KDB: use relative path in ipa-certmap config snippet
  - Resolves: #1439038 Allow erasing ipaDomainResolutionOrder attribute
    - Allow erasing ipaDomainResolutionOrder attribute


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-6.el7
changelog:
  - Resolves: #1382053 Need to have validation for idrange names
    - idrange-add: properly handle empty --dom-name option
  - Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
    helper when installing replica
    - dsinstance: reconnect ldap2 after DS is restarted by certmonger
    - httpinstance: avoid httpd restart during certificate request
    - dsinstance, httpinstance: consolidate certificate request code
    - install: request service certs after host keytab is set up
    - renew agent: revert to host keytab authentication
    - renew agent, restart scripts: connect to LDAP after kinit
  - Resolves: #1436987 ipasam: gidNumber attribute is not created in the trusted
    domain entry
    - ipa-sam: create the gidNumber attribute in the trusted domain entry
    - Upgrade: add gidnumber to trusted domain entry
  - Resolves: #1438679 [ipa-replica-install] - IncorrectPasswordException:
    Incorrect client security database password
    - Add pki_pin only when needed
  - Resolves: #1438348 Console output message while adding trust should be
    mapped with texts changed in Samba.
    - ipaserver/dcerpc: unify error processing
  - Resolves: #1438366 ipa trust-fetch-domains: ValidationError: invalid
    'Credentials': Missing credentials for cross-forest communication
    - trust: always use oddjobd helper for fetching trust information
  - Resolves: #1441192 Add the name of URL parameter which will be check for
    username during cert login
    - WebUI: cert login: Configure name of parameter used to pass username
  - Resolves: #1437879 [copr] Replica install failing
    - Create system users for FreeIPA services during package installation
  - Resolves: #1441316 WebUI cert auth fails after ipa-adtrust-install
    - Fix s4u2self with adtrust


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-7.el7
changelog:
  - Resolves: #1431520 ipa cert-find runs a large number of searches, so IPA
    WebUI is slow to display user details page
    - cert: defer cert-find result post-processing
  - Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
    helper when installing replica
    - server-install: No double Kerberos install
  - Resolves: #1437502 ipa-replica-install fails with requirement to
    use --force-join that is a client install option.
    - Add the force-join option to replica install
    - replicainstall: better client install exception handling
  - Resolves: #1437953 Server CA-less impossible option check
    - server-install: remove broken no-pkinit check
  - Resolves: #1441160 FreeIPA client <= 4.4 fail to parse 4.5 cookies
    - Add debug log in case cookie retrieval went wrong
  - Resolves: #1441548 ipa server install fails with --external-ca option
    - ext. CA: correctly write the cert chain
  - Resolves: #1441718 Conversion of CA-less server to CA fails on CA instance
    spawn
    - Fix CA-less to CA-full upgrade
  - Resolves: #1442133 Do not link libkrad, liblber, libldap_r and
    libsss_nss_idmap to every binary in IPA
    - configure: fix AC_CHECK_LIB usage
  - Resolves: #1442815 Replica install fails during migration from older IPA
    master
    - Fix RA cert import during DL0 replication
  - Related: #1442004 Building IdM/FreeIPA internally on all architectures -
    filtering unsupported packages
    - Build all subpackages on all architectures


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-8.el7
changelog:
  - Resolves: #1443869 Command "openssl pkcs12 ..." failed during IPA upgrade
    - Fix CAInstance.import_ra_cert for empty passwords


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-9.el7
changelog:
  - Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
    certificates on smart cards (pkinit)
    - spec file: bump krb5 Requires for certauth fixes
  - Resolves: #1438729 Configure local PKINIT on DL0 or when '--no-pkinit' option
    is used
    - separate function to set ipaConfigString values on service entry
    - Allow for configuration of all three PKINIT variants when deploying KDC
    - API for retrieval of master's PKINIT status and publishing it in LDAP
    - Use only anonymous PKINIT to fetch armor ccache
    - Stop requesting anonymous keytab and purge all references of it
    - Use local anchor when armoring password requests
    - Upgrade: configure local/full PKINIT depending on the master status
    - Do not test anonymous PKINIT after install/upgrade
  - Resolves: #1442427 ipa.ipaserver.install.plugins.adtrust.
    update_tdo_gidnumber: ERROR Default SMB Group not found
    - upgrade: adtrust update_tdo_gidnumber plugin must check if adtrust is
      installed
  - Resolves: #1442932 ipa restore fails to restore IPA user
    - restore: restart/reload gssproxy after restore
  - Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
    - Fix CA/server cert validation in FIPS
  - Resolves: #1444947 Deadlock between topology and schema-compat plugins
    - compat-manage: behave the same for all users
    - Move the compat plugin setup at the end of install
    - compat: ignore cn=topology,cn=ipa,cn=etc subtree
  - Resolves: #1445358 ipa vault-add raises TypeError
    - vault: piped input for ipa vault-add fails
  - Resolves: #1445382 ipa vault-retrieve fails to retrieve data from vault
    - Vault: Explicitly default to 3DES CBC
  - Resolves: #1445432 uninstall ipa client automount failed with RuntimeWarning
    - automount install: fix checking of SSSD functionality on uninstall
  - Resolves: #1446137 pki_client_database_password is shown in
    ipaserver-install.log
    - Hide PKI Client database password in log file


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-10.el7
changelog:
  - Resolves: #1438833 [ipa-replica-install] - 406 Client Error: Failed to
    validate message: Incorrect number of results (0) searching forpublic key for
    host
    - Make sure remote hosts have our keys
  - Resolves: #1442815 Replica install fails during migration from older IPA
    master
    - Refresh Dogtag RestClient.ca_host property
    - Remove the cachedproperty class
  - Resolves: #1444787 Update warning message when KRA installation fails
    - kra install: update installation failure message
  - Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
    - ipa-server-install with external CA: fix pkinit cert issuance
  - Resolves: #1445397 GET in KerberosSession.finalize_kerberos_acquisition()
    must use FreeIPA CA
    - kerberos session: use CA cert with full cert chain for obtaining cookie
  - Resolves: #1447375 ipa-client-install: extra space in pkinit_anchors
    definition
    - ipa-client-install: remove extra space in pkinit_anchors definition
  - Resolves: #1447703 Fix SELinux contex of http.keytab during upgrade
    - Use proper SELinux context with http.keytab


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-12.el7
changelog:
  - Resolves: #1447284 Upgrade from ipa-4.1 fails when enabling KDC proxy
    - python2-ipalib: add missing python dependency
    - installer service: fix typo in service entry
    - upgrade: add missing suffix to http instance
  - Resolves: #1444791 Update man page of ipa-kra-install
    - ipa-kra-install manpage: document domain-level 1
  - Resolves: #1441493 ipa cert-show raises stack traces when
    --certificate-out=/tmp
    - cert-show: writable files does not mean dirs
  - Resolves: #1441192 Add the name of URL parameter which will be check for
    username during cert login
    - Bump version of ipa.conf file
  - Resolves: #1378797 Web UI must check OCSP and CRL during smartcard login
    - Turn on NSSOCSP check in mod_nss conf
  - Resolves: #1322963 Errors from AD when trying to sign ipa.csr, conflicting
    template on
    - renew agent: respect CA renewal master setting
    - server upgrade: always fix certmonger tracking request
    - cainstance: use correct profile for lightweight CA certificates
    - renew agent: allow reusing existing certs
    - renew agent: always export CSR on IPA CA certificate renewal
    - renew agent: get rid of virtual profiles
    - ipa-cacert-manage: add --external-ca-type
  - Resolves: #1441593 error adding authenticator indicators to host
    - Fixing adding authenticator indicators to host
  - Resolves: #1449525 Set directory ownership in spec file
    - Added plugins directory to ipaclient subpackages
    - ipaclient: fix missing RPM ownership
  - Resolves: #1451279 otptoken-add-yubikey KeyError: 'ipatokenotpdigits'
    - otptoken-add-yubikey: When --digits not provided use default value


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-13.el7
changelog:
  - Resolves: #1451804 "AttributeError: 'tuple' object has no attribute 'append'"
    error observed during ipa upgrade with latest package.
    - ipa-server-install: fix uninstall
  - Resolves: #1445390 ipa-[ca|kra]-install with invalid DM password break
    replica
    - ca install: merge duplicated code for DM password
    - installutils: add DM password validator
    - ca, kra install: validate DM password


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-14.el7
changelog:
  - Resolves: #1438731 Extend ipa-server-certinstall and ipa-certupdate to
    handle PKINIT certificates/anchors
    - certdb: add named trust flag constants
    - certdb, certs: make trust flags argument mandatory
    - certdb: use custom object for trust flags
    - install: trust IPA CA for PKINIT
    - client install: fix client PKINIT configuration
    - install: introduce generic Kerberos Augeas lens
    - server install: fix KDC PKINIT configuration
    - ipapython.ipautil.run: Add option to set umask before executing command
    - certs: do not export keys world-readable in install_key_from_p12
    - certs: do not export CA certs in install_pem_from_p12
    - server install: fix KDC certificate validation in CA-less
    - replica install: respect --pkinit-cert-file
    - cacert manage: support PKINIT
    - server certinstall: support PKINIT
  - Resolves: #1444432 CA-less pkinit not installable with --pkinit-cert-file
    option
    - certs: do not export CA certs in install_pem_from_p12
    - server install: fix KDC certificate validation in CA-less
  - Resolves: #1451228 ipa-kra-install fails when primary KRA server has been
    decommissioned
    - ipa-kra-install: fix pkispawn setting for pki_security_domain_hostname
  - Resolves: #1451712 KRA installation fails on server that was originally
    installed as CA-less
    - ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
  - Resolves: #1441499 ipa cert-show does not raise error if no file name
    specified
    - ca/cert-show: check certificate_out in options
  - Resolves: #1449522 Deprecate `ipa pkinit-anonymous` command in FreeIPA 4.5+
    - Remove pkinit-anonymous command
  - Resolves: #1449523 Provide an API command to retrieve PKINIT status
    in the FreeIPA topology
    - Allow for multivalued server attributes
    - Refactor the role/attribute member reporting code
    - Add an attribute reporting client PKINIT-capable servers
    - Add the list of PKINIT servers as a virtual attribute to global config
    - Add `pkinit-status` command
    - test_serverroles: Get rid of MockLDAP and use ldap2 instead
  - Resolves: #1452216 Replica installation grants HTTP principal access in WebUI
    - Fix rare race condition with missing ccache file
  - Resolves: #1455045 Simple service uninstallers must be able to handle
    missing service files gracefully
    - only stop/disable simple service if it is installed
  - Resolves: #1455541 after upgrade login from web ui breaks
    - krb5: make sure KDC certificate is readable
  - Resolves: #1455862 "ipa: ERROR: an internal error has occurred" on executing
    command "ipa cert-request --add" after upgrade
    - Change python-cryptography to python2-cryptography


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-15.el7
changelog:
  - Resolves: #1442233 IPA client commands fail when pointing to replica
    - httpinstance: wait until the service entry is replicated
  - Resolves: #1456769 ipaAnchorUUID index incorrectly configured and then
    not indexed
    - Fix index definition for ipaAnchorUUID
  - Resolves: #1438016 gssapi errors after IPA server upgrade
    - Avoid possible endless recursion in RPC call
    - rpc: preparations for recursion fix
    - rpc: avoid possible recursion in create_connection
  - Resolves: #1446087 services entries missing krbCanonicalName attribute.
    - Changing cert-find to do not use only primary key to search in LDAP.
  - Resolves: #1452763 ipa certmaprule change not reflected in krb5kdc workers
    - ipa-kdb: reload certificate mapping rules periodically
  - Resolves: #1455541 after upgrade login from web ui breaks
    - kdc.key should not be visible to all
  - Resolves: #1435606 Add pkinit_indicator option to KDC configuration
    - ipa-kdb: add pkinit authentication indicator in case of a successful
      certauth
  - Resolves: #1455945 Enabling OCSP checks in mod_nss breaks certificate
    issuance when ipa-ca records are not resolvable
    - Turn off OCSP check
  - Resolves: #1454483 rhel73 ipa ui - cannot del server - IPA Error 903 -
    server_del - TypeError: 'NoneType' object is not iterable
    - fix incorrect suffix handling in topology checks


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-16.el7
changelog:
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces
    - Only warn when specified server IP addresses don't match intf
  - Resolves: #1438016 gssapi errors after IPA server upgrade
    - Bump version of python-gssapi
  - Resolves: #1457942 certauth: use canonical principal for lookups
    - ipa-kdb: use canonical principal in certauth plugin
  - Resolves: #1459153 Do not send Max-Age in ipa_session cookie to avoid
    breaking older clients
    - Add code to be able to set default kinit lifetime
    - Revert setting sessionMaxAge for old clients


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-17.el7
changelog:
  - Resolve: #1455946 Provide a tooling automating the configuration
    of Smart Card authentication on a FreeIPA master
    - server certinstall: update KDC master entry
    - pkinit manage: introduce ipa-pkinit-manage
    - server upgrade: do not enable PKINIT by default
    - Extend the advice printing code by some useful abstractions
    - Prepare advise plugin for smart card auth configuration
  - Resolve: #1461053 allow to modify list of UPNs of a trusted forest
    - trust-mod: allow modifying list of UPNs of a trusted forest
    - WebUI: add support for changing trust UPN suffixes


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-18.el7
changelog:
  - Resolves: #1449189 ipa-kra-install timeouts on replica
    - kra: promote: Get ticket before calling custodia


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-19.el7
changelog:
  - Resolves: #1462112 ipaserver installation fails in FIPS mode: OpenSSL
    internal error, assertion failed: Digest MD4 forbidden in FIPS mode!
    - ipa-sam: replace encode_nt_key() with E_md4hash()
    - ipa_pwd_extop: do not generate NT hashes in FIPS mode
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces
    - Fix local IP address validation
    - ipa-dns-install: remove check for local ip address
    - refactor CheckedIPAddress class
    - CheckedIPAddress: remove match_local param
    - Remove ip_netmask from option parser
    - replica install: add missing check for non-local IP address
    - Remove network and broadcast address warnings


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-20.el7
changelog:
  - Resolves: #1452216 Replica installation grants HTTP principal
    access in WebUI
    - Make sure we check ccaches in all rpcserver paths


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7
changelog:
  - Resolves: #1469246 Replica install fails to configure IPA-specific
    temporary files/directories
    - replica install: drop-in IPA specific config to tmpfiles.d
  - Resolves: #1469480 bind package is not automatically updated during
    ipa-server upgrade process
    - Bumped Required version of bind-dyndb-ldap and bind package


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1
changelog:
  - Resolves: #1455946 Provide a tooling automating the configuration
    of Smart Card authentication on a FreeIPA master
    - smart-card advises: configure systemwide NSS DB also on master
    - smart-card advises: add steps to store smart card signing CA cert
    - Allow to pass in multiple CA cert paths to the smart card advises
    - add a class that tracks the indentation in the generated advises
    - delegate the indentation handling in advises to dedicated class
    - advise: add an infrastructure for formatting Bash compound statements
    - delegate formatting of compound Bash statements to dedicated classes
    - Fix indentation of statements in Smart card advises
    - Use the compound statement formatting API for configuring PKINIT
    - smart card advises: use a wrapper around Bash `for` loops
    - smart card advise: use password when changing trust flags on HTTP cert
    - smart-card-advises: ensure that krb5-pkinit is installed on client
  - Resolves: #1475238 Use CommonNameToSANDefault in default profile
    (new installs only)
    - Add CommonNameToSANDefault to default cert profile
  - Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s
    during search in cn=ad,cn=trusts,dc=example,dc=com
    - NULL LDAP context in call to ldap_search_ext_s during search


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1.1
changelog:
  - Resolves: #1475238 Use CommonNameToSANDefault in default profile
    (new installs only)
    - Restore old version of caIPAserviceCert for upgrade only


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1.2
changelog:
  - Resolves: #1477703 IPA upgrade fails for latest ipa package
      - Restore old version of caIPAserviceCert for upgrade only


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-21.el7.2
changelog:
  - Resolves: #1477178 - [ipa-replica-install] - 406 Client Error: Failed to
    validate message: Incorrect number of results (0) searching forpublic
    key for host
      - Always check peer has keys before connecting
  - Resolves: #1482802 - Unable to set ca renewal master on replica
      - Fix ipa config-mod --ca-renewal-master
  - Resolves: #1486283 - TypeError in renew_ca_cert prevents from swiching
    back to self-signed CA
      - Backport PR 988 to ipa-4-5 Fix Certificate renewal (with ext ca)
  - Resolves: #1480102 - ipa-server-upgrade failes with "This entry already exists"
      - Backport PR 1008 to ipa-4-5 Fix ipa-server-upgrade: This entry already exists
  - Resolves: #1484826 - FreeIPA/IdM installations which were upgraded from
    versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
    thus startup of Web UI fails
      - Adds whoami DS plugin in case that plugin is missing
  - Resolves: #1478251 - IPA WebUI does not work after upgrade from IPA 4.4 to 4.5
      - Fixing how sssd.conf is updated when promoting a client to replica
  - Resolves: #1461177 - ipa-otptoken-import - XML file is missing PBKDF2
    parameters!
      - ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace
  - Resolves: #1484428 - Updating from RHEL 7.3 fails with Server-Cert not found
    (ipa-server-upgrade)
      - Backport 4-5: Fix ipa-server-upgrade with server cert tracking


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-21.el7.2.2
changelog:
  - Resolves: #1477367 ipa-server-upgrade timeouts on wait_for_open ports
    expecting IPA services listening on IPv6 ports
      - Make sure upgrade also checks for IPv6 stack
      - control logging of host_port_open from caller
      - log progress of wait_for_open_ports
  - Resolves: #1477243 ipa help command returns traceback when no cache
    is present
      - Store help in Schema before writing to disk
      - Disable pylint in get_help function because of type confusion.


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.4-1.el7
changelog:
  - Use OpenJDK 8 to bootstrap on AArch64 until RH1482244 is resolved in
    buildroot
  - Resolves: #1470177 - Rebase IPA to latest 4.5.x version
  - Resolves: #1398594 ipa topologysuffix-verify should only warn about
    maximum number of replication agreements.
  - Resolves: #1404236 Web UI: Change "Host Based" and "Role Based"
    to "Host-Based" and "Role-Based"
  - Resolves: #1409786 Second phase of --external-ca ipa-server-install
    setup fails when dirsrv is not running
  - Resolves: #1451576 ipa cert-request failed to generate certificate from csr
  - Resolves: #1452086 Pagination Size under Customization in IPA WebUI
    accepts negative values
  - Resolves: #1458169 --force-join option is not mentioned in
    ipa-replica-install man page
  - Resolves: #1463186 IPA shouldn't allow objectclass if not all in lower case
  - Resolves: #1478322 user-show command fails when sizelimit is configured
    to number <= number of entity which is user member of
  - Resolves: #1496775 Enterprise principals should be able to trigger
    a refresh of the trusted domain data in the KDC
  - Resolves: #1502533 Changing cert-find to go through the proxy
    instead of using the port 8080
  - Resolves: #1502663 pkinit-status command fails after an upgrade from
    a pre-4.5 IPA
  - Resolves: #1498168 Error when trying to modify a PTR record
  - Resolves: #1457876 ipa-backup fails silently
  - Resolves: #1493531 In case full PKINIT configuration is failing during
    server/replica install the error message should be more meaningful.
  - Resolves: #1449985 Suggest CA installation command in KRA installation
    warning


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.4-2.el7
changelog:
  - Resolves: #1461177 ipa-otptoken-import  - XML file is missing PBKDF2
    parameters!
  - Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s during
    search in cn=ad, cn=trusts,dc=example,dc=com
  - Resolves: #1467887 iommu platform support for ipxe
  - Resolves: #1477178 [ipa-replica-install] - 406 Client Error: Failed to
    validate message: Incorrect number of results (0) searching forpublic key for
    host
  - Resolves: #1478251 IPA WebUI does not work after upgrade from IPA 4.4 to
    4.5
  - Resolves: #1480102 ipa-server-upgrade failes with "This entry already
    exists"
  - Resolves: #1482802 Unable to set ca renewal master on replica
  - Resolves: #1484428 Updating from RHEL 7.3 fails with Server-Cert not found
    (ipa-server-upgrade)
  - Resolves: #1484826 FreeIPA/IdM installations which were upgraded from
    versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
    thus startup of Web UI fails
  - Resolves: #1486283 TypeError in renew_ca_cert prevents from swiching back
    to self-signed CA
  - Resolves: #1469246 Replica install fails to configure IPA-specific
    temporary files/directories
  - Resolves: #1469480 bind package is not automatically updated during
    ipa-server upgrade process
  - Resolves: #1475238 Use CommonNameToSANDefault in default profile (new
    installs only)
  - Resolves: #1477703 IPA upgrade fails for latest ipa package


author: Rob Crittenden <rcritten@redhat.com> - 4.5.4-3.el7
changelog:
  - Drop workaround for building on AArch64 (#1482244)
  - Temporarily reduce Requires on python-netaddr to 0.7.5-7 (#1506485)


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.4-4.el7
changelog:
  - Resolves: #1388135 [RFE] limit the retro changelog to dns subtree.
    - ldap: limit the retro changelog to dns subtree
  - Resolves: #1427798 Use X509v3 Basic Constraints "CA:TRUE" instead
    of "CA:FALSE" IPA CA CSR
    - Include the CA basic constraint in CSRs when renewing a CA
  - Resolves: #1493145 ipa-replica-install might fail because of an already
    existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
    - Checks if replica-s4u2proxy.ldif should be applied
  - Resolves: #1493150 [RFE] set nsslapd-ignore-time-skew: on by default
    - ds: ignore time skew during initial replication step
    - ipa-replica-manage: implicitly ignore initial time skew in force-sync
  - Resolves: #1500218 Replica installation at domain-level 0 fails against
    upgraded ipa-server
    - Fix ipa-replica-conncheck when called with --principal
  - Resolves: #1506188 server-del doesn't remove dns-server configuration
    from ldap


author: Thomas Woerner <twoerner@redhat.com> - 4.7.0-3.el8
changelog:
  - Resolves: #1614301 Remove --no-sssd and --noac options
  - Resolves: #1613879 Disable Domain Level 0
    - New patch sets to disable domain level 0
    - New adapted patch to disable DL0 specific tests (pytest_ipa vs.
      pytest_plugins)
    - Adapted branding patch in ipa-replica-install.1 due to DL0 removal


author: Thomas Woerner <twoerner@redhat.com> - 4.7.0-3.1.el8
changelog:
  - Resolves: #1609883 ipaserver/plugins/cert.py: Add reason to raise of
    errors.NotFound
  - Resolves: #1615765 do-not-use-RC4-in-FIPS-mode
    - Move fips_enabled to a common library to share across different plugins
    - ipasam: do not use RC4 in FIPS mode


author: Thomas Woerner <twoerner@redhat.com> - 4.7.1-3.el8
changelog:
  - New command automember-find-orphans to find and remove orphan automemeber
    rules has been added
    Resolves: RHBZ#1638373
  - Moved ipa/idm logos and background to redhat-logos-ipa-80.4:
    header-logo.png, login-screen-background.jpg, login-screen-logo.png,
    product-name.png
    New requirement to redhat-logos-ipa >= 80.4 in ipa-server-common
    Resolves: RHBZ#1626507


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.1-4.el8
changelog:
  - Fix mapping of BUILTIN\Guests to 'nobody' group during upgrade
    to not use generated Samba config at this point
  - Related: rhbz#1623895


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.1-5.el8
changelog:
  - Fixed: rhbz#1643445 - External CA step 2 fails with pki_client_database_dir is missing
  - Fixed: rhbz#1642834 - Smart card advise script uses hard-coded Python interpreter


author: Thomas Woerner <twoerner@redhat.com> - 4.7.1-7.el8
changelog:
  - Fix misleading errors during client install rollback
    Resolves: RHBZ#1658283
  - ipa-advise: update url of cacerdir_rehash tool
    Resolves: RHBZ#1658287
  - Handle NTP configuration in a replica server installation
    Resolves: RHBZ#1651679
  - Fix defects found by static analysis
    Resolves: RHBZ#1658182
  - ipa-replica-install --setup-adtrust: check for package ipa-server-trust-ad
    Resolves: RHBZ#1658294
  - ipaldap: invalid modlist when attribute encoding can vary
    Resolves: RHBZ#1658302
  - Allow ipaapi and Apache user to access SSSD IFP
    Resolves: RHBZ#1639910
  - Add sysadm_r to default SELinux user map order
    Resolves: RHBZ#1658303
  - certdb: ensure non-empty Subject Key Identifier and validate server cert sig
    Resolves: RHBZ#1641988
  - ipa-replica-install: password and admin-password options mutually exclusive
    Resolves: RHBZ#1658309
  - ipa upgrade: handle double-encoded certificates
    Resolves: RHBZ#1658310
  - PKINIT: fix ipa-pkinit-manage enable|disable
    Resolves: RHBZ#1658313
  - Enable LDAP debug output in client to display TLS errors in join
    Resolves: RHBZ#1658316
  - rpc: always read response
    Resolves: RHBZ#1639890
  - ipa vault-retrieve: fix internal error
    Resolves: RHBZ#1658485
  - Move ipa's systemd tmpfiles from /var/run to /run
    Resolves: RHBZ#1658487
  - Fix authselect invocations to work with 1.0.2
    Resolves: RHBZ#1654291
  - ipa-client-automount and NFS unit name changes
    Resolves: RHBZ#1645501
  - Fix compile issue with new 389-ds
    Resolves: RHBZ#1659448


author: Christian Heimes <cheimes@redhat.com> - 4.7.1-8
changelog:
  - Create systemd-user HBAC service and rule
    Resolves: RHBZ#1664974
  - ipaserver/dcerpc: fix exclusion entry with a forest trust domain info returned
    Resolves: RHBZ#1664023


author: Rob Crittenden <rcritten@redhat.com> - 4.7.1-11
changelog:
  - Handle NFS configuration file changes. nfs-utils moved the
    configuration file from /etc/sysconfig/nfs to /etc/nfs.conf.
    Resolves: RHBZ#1676981


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.1-12
changelog:
  - Remove strict dependencies to krb5-server version in order to allow
    update of krb5 to 1.17 and change dependency to KDB DAL version.
    Resolves: RHBZ#1700121


author: Thomas Woerner <twoerner@redhat.com> - 4.7.90-1
changelog:
  - Update to 4.7.90-pre1
    Related: RHBZ#1684528
  - Removed patches 0002 to 0031 as these are upsteram and part of 4.7.90-pre1
  - Added new patches 0001-revert-minssf-defaults.patch and
    0001-Correct-default-fontawesome-path-broken-by-da2cf1c5.patch


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.90-3
changelog:
  - Fix upgrade issue with AD trust when no trust yet established
    Fixes: RHBZ#1708874
    Related: RHBZ#1684528


author: Thomas Woerner <twoerner@redhat.com> - 4.8.0-1
changelog:
  - New upstream release 4.8.0
    - New subpackage: freeipa-client-samba
    - Added command ipa-cert-fix with man page
    - New sysconfdir sysconfig/certmonger
  - Updated pki_version, certmonger_version, sssd_version and kdcproxy_version
    Related: RHBZ#1684528


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.8.0-3
changelog:
  - Make sure ipa-server depends on krb5-kdb-version to pick up
    right MIT Kerberos KDB ABI
    Related: RHBZ#1700121
  - User field separator uses '$$' within ipaSELInuxUserMapOrder
    Fixes: RHBZ#1729099


author: Thomas Woerner <twoerner@redhat.com> - 4.8.0-5
changelog:
  - Remove posixAccount from service_find search filter
    Resolves: RHBZ#1731437
  - Fix repeated uninstallation of ipa-client-samba crashes
    Resolves: RHBZ#1732529
  - WebUI: Add PKINIT status field to 'Configuration' page
    Resolves: RHBZ#1518153


author: Thomas Woerner <twoerner@redhat.com> - 4.8.2-1
changelog:
  - Rebase to upstream release 4.8.2
    - Removed upstream patches 0001 to 0010 that are part of version 4.8.2
    - Updated branding patch
    Resolves: RHBZ#1748987


author: Thomas Woerner <twoerner@redhat.com> - 4.8.2-3
changelog:
  - Use default ssh host key algorithms
    Resolves: RHBZ#1756432
  - Do not run trust upgrade code if master lacks Samba bindings
    Resolves: RHBZ#1757064
  - Finish group membership management UI
    Resolves: RHBZ#1773528


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.8.2-4
changelog:
  - CVE-2019-14867: Denial of service in IPA server due to wrong use of ber_scanf()
    Resolves: RHBZ#1767304
  - CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
    Resolves: RHBZ#1776939


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.8.3-1
changelog:
  - Rebase to security release 4.8.3 (CVE-2019-14867, CVE-2019-10195)
    Resolves: RHBZ#1767304
    Resolves: RHBZ#1776939
  - Support KDC ticket policies for authentication indicators
    Resolves: RHBZ#1777564


author: Thomas Woerner <twoerner@redhat.com> - 4.8.3-2
changelog:
  - Use default crypto policy for TLS and enable TLS 1.3 support
    Resolves: RHBZ#1777809
  - Covscan fixes
    Resolves: RHBZ#1777920
  - Change pki_version to 10.8.0
    Related: RHBZ#1748987


author: Thomas Woerner <twoerner@redhat.com> - 4.8.4-1
changelog:
  - Rebase to upstream release 4.8.4
    - Removed upstream patches 0001 to 0008 that are part of version 4.8.3-3
    Resolves: RHBZ#1782658
    Resolves: RHBZ#1782169
    Resolves: RHBZ#1783046
    Related: RHBZ#1748987


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.8.4-3
changelog:
  - Depend on krb5-kdb-version-devel for BuildRequires
  - Update nss dependency to 3.44.0-4
  - Reset per-indicator Kebreros policy
    Resolves: RHBZ#1784761


author: Thomas Woerner <twoerner@redhat.com> - 4.8.4-5
changelog:
  - Fixed weekday in 4.8.4-2 changelog date
    Related: RHBZ#1784003
  - adtrust: print DNS records for external DNS case after role is enabled
    Resolves: RHBZ#1665051
  - AD user without override receive InternalServerError with API
    Resolves: RHBZ#1782572
  - ipa-client-automount fails after repeated installation/uninstallation
    Resolves: RHBZ#1790886
  - install/updates: move external members past schema compat update
    Resolves: RHBZ#1803165
  - kdb: make sure audit_as_req callback signature change is preserved
    Resolves: RHBZ#1803786


author: Thomas Woerner <twoerner@redhat.com> - 4.8.6-1
changelog:
  - Upstream release FreeIPA 4.8.6
  - New SELinux sub package to provide own module
  - Depend on selinux-policy-devel 3.14.3-43 for build due to a makefile issue in
    SELinux external policy support
    Related: RHBZ#1818765


author: Thomas Woerner <twoerner@redhat.com> - 4.8.7-1
changelog:
  - Upstream release FreeIPA 4.8.7
  - Require new samba build 4.12.3-0
    Related: RHBZ#1818765
  - New client-epn sub package
    Resolves: RHBZ#913799


author: Thomas Woerner <twoerner@redhat.com> - 4.8.7-3
changelog:
  - [WebUI] IPA Error 3007: RequirmentError" while adding members in
    "User ID overrides" tab
    Resolves: RHBZ#1757045
  - EPN does not ship its default configuration ( /etc/ipa/epn.conf ) in
    freeipa-client-epn
    Resolves: RHBZ#1847999
  - FreeIPA - Utilize 256-bit AJP connector passwords
    Resolves: RHBZ#1849914
  - ipa: typo issue in ipanthomedirectoryrive deffinition
    Resolves: RHBZ#1851411


author: Thomas Woerner <twoerner@redhat.com> - 4.8.7-6
changelog:
  - selinux don't audit rules deny fetching trust topology
    Resolves: RHBZ#1845596
  - fix iPAddress cert issuance for >1 host/service
    Resolves: RHBZ#1846352
  - Specify cert_paths when calling PKIConnection
    Resolves: RHBZ#1849155
  - Update crypto policy to allow AD-SUPPORT when installing IPA
    Resolves: RHBZ#1851139
  - Add version to ipa-idoverride-memberof obsoletes
    Related: RHBZ#1846434


author: Thomas Woerner <twoerner@redhat.com> - 4.8.7-8
changelog:
  - [WebUI] IPA Error 3007: RequirmentError" while adding members in
    "User ID overrides" tab (updated)
    Resolves: RHBZ#1757045
  - ipa-client-install: use the authselect backup during uninstall
    Resolves: RHBZ#1810179
  - Replace SSLCertVerificationError with CertificateError for py36
    Resolves: RHBZ#1858318
  - Fix AVC denial during ipa-adtrust-install --add-agents
    Resolves: RHBZ#1859213


author: Thomas Woerner <twoerner@redhat.com> - 4.8.7-9
changelog:
  - CAless installation: set the perms on KDC cert file
    Resolves: RHBZ#1863616
  - EPN: handle empty attributes
    Resolves: RHBZ#1866938
  - IPA-EPN: enhance input validation
    Resolves: RHBZ#1866291
  - EPN: enhance input validation
    Resolves: RHBZ#1863079
  - Require new samba build 4.12.3-52
    Related: RHBZ#1868558
  - Require new selinux-policy build 3.14.3-52
    Related: RHBZ#1869311


author: Thomas Woerner <twoerner@redhat.com> - 4.9.0-0.rc1
changelog:
  - Upstream pre release FreeIPA 4.9.0rc1
    Resolves: RHBZ#1891832
  - Requirements and design for libpwquality integration
    Resolves: RHBZ#1340463
  - When parsing options require name/value pairs
    Resolves: RHBZ#1357495
  - WebUI: Fix issue with opening links in new tab/window
    Resolves: RHBZ#1484088
  - Use a state to determine if a 389-ds upgrade is in progress
    Resolves: RHBZ#1569011
  - Unlock user accounts after a password reset and replicate that unlock to
    all IdM servers
    Resolves: RHBZ#1784657
  - Set the certmonger subject with a string, not an object
    Resolves: RHBZ#1810148
  - Implement ACME certificate enrolment
    Resolves: RHBZ#1851835
  - [WebUI] Backport jQuery patches from newer versions of the library (e.g.
    3.5.0)
    Resolves: RHBZ#1859249
  - It is not possible to edit KDC database when the FreeIPA server is running
    Resolves: RHBZ#1875001
  - Fix nsslapd-db-lock tuning of BDB backend
    Resolves: RHBZ#1882340
  - ipa-kdb: support subordinate/superior UPN suffixes
    Resolves: RHBZ#1891056
  - wgi/plugins.py: ignore empty plugin directories
    Resolves: RHBZ#1894800


author: Thomas Woerner <twoerner@redhat.com> - 4.9.0-0.1.rc1
changelog:
  - Fix requirement for python3-kdcproxy, add no autoreqprov for ipatests sub
    package
    Related: RHBZ#1891832


author: Thomas Woerner <twoerner@redhat.com> - 4.9.0-0.2.rc2
changelog:
  - Upstream pre release FreeIPA 4.9.0rc2
    Related: RHBZ#1891832
  - Synchronize spec file with upstream and Fedora
    Related: RHBZ#1891832
  - Traceback while doing ipa-backup
    Resolves: RHBZ#1901068
  - ipa-client-install changes system wide ssh configuration
    Resolves: RRBZ#1544379
  - ipa-kdb: support subordinate/superior UPN suffixes
    Resolves: RHBZ#1891056
  - KRA Transport and Storage Certificates do not renew
    Resolves: RHBZ#1872603
  - Move where the restore state is marked during IPA server upgrade
    Resolves: RHBZ#1569011
  - Intermittent IdM Client Registration Failures
    Resolves: RHBZ#1812871
  - Nightly test failure in test_acme.py::TestACME::test_third_party_certs
    (updates-testing)
    Resolves: RHBZ#1903025
  - Add IPA RA Agent to ACME group on the CA
    Resolves: RHBZ#1902727


author: Thomas Woerner <twoerner@redhat.com> - 4.9.5-1
changelog:
  - Upstream release FreeIPA 4.9.5
    Related: RHBZ#1945038
  - IPA to allow setting a new range type
    Resolves: RHBZ#1688267
  - ipa-server-install displays debug output when --debug output is not
    specified.
    Resolves: RHBZ#1943151
  - ACME fails to generate a cert on migrated RHEL8.4 server
    Resolves: RHBZ#1934991
  - Switch ipa-client to use the JSON API
    Resolves: RHBZ#1937856
  - IDM - Allow specifying permanent logging settings for BIND
    Resolves: RHBZ#1951511
  - Cache LDAP data within a request
    Resolves: RHBZ#1953656
  - ipa-server-upgrade is failing while upgrading rhel8.3 to rhel8.4
    Resolves: RHBZ#1957768


author: Thomas Woerner <twoerner@redhat.com> - 4.9.6-1
changelog:
  - Upstream release FreeIPA 4.9.6
    Related: RHBZ#1945038
  - Revise PKINIT upgrade code
    Resolves: RHBZ#1886837
  - ipa-cert-fix man page: add note about certmonger renewal
    Resolves: RHBZ#1780317
  - Certificate Serial Number issue
    Resolves: RHBZ#1919384


author: Thomas Woerner <twoerner@redhat.com> - 4.9.6-2
changelog:
  - IPA server in debug mode fails to run because time.perf_counter_ns is
    Python 3.7+
    Resolves: RHBZ#1974822
  - Add checks to prevent assigning authentication indicators to internal IPA
    services
    Resolves: RHBZ#1979625
  - Unable to set ipaUserAuthType with stageuser-add
    Resolves: RHBZ#1979605


author: Thomas Woerner <twoerner@redhat.com> - 4.9.6-3
changelog:
  - man page: update ipa-server-upgrade.1
    Resolves: RHBZ#1973273
  - Fall back to krbprincipalname when validating host auth indicators
    Resolves: RHBZ#1979625
  - Add dependency for sssd-winbind-idmap to server-trust-ad
    Resolves: RHBZ#1982211


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.9.6-7
changelog:
  - Hardening for CVE-2020-25717
  - Harden processing of trusted domains' users in S4U operations
  - Resolves: RHBZ#2021443


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.8-3
changelog:
  - Config plugin: return EmptyModlist when no change is applied.
    Resolves: RHBZ#2031825
  - Custodia: use a stronger encryption algo when exporting keys.
    Resolves: RHBZ#2032806
  - ipa-kdb: do not remove keys for hardened auth-enabled users.
    Resolves: RHBZ#2033342
  - ipa-pki-proxy.conf: provide access to /kra/admin/kra/getStatus
    Resolves: RHBZ#2049167
  - Backport latest test fxes in python3 ipatests.
    Resolves: RHBZ#2048509
  - Removed unused patch files that were part of 4.9.8 rebase.


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.8-4
changelog:
  - Don't always override the port in import_included_profiles
    Fixes: RHBZ#2022483
  - Remove ipa-join errors from behind the debug option
    Fixes: RHBZ#2048558
  - Enable the ccache sweep timer during installation
    Fixes: RHBZ#2051575


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.8-5
changelog:
  - ipatests: remove additional check for failed units.
    Resolves: RHBZ#2053024
  - ipa-cldap: fix memory leak.
    Resolves: RHBZ#2032738


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.8-8
changelog:
  - Backport latest test fixes in python3-ipatests
    Resolves: RHBZ#2060841
  - extdom: user getorigby{user|group}name if available
    Resolves: RHBZ#2062379
  - Set the mode on ipaupgrade.log during RPM post snipppet
    Resolves: RHBZ#2061957
  - test_krbtpolicy: skip SPAKE-related tests in FIPS mode
    Resolves: RHBZ#1909630


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.10-1
changelog:
  - Rebase to upstream release 4.9.10
    Remove upstream patches 0002 to 0016 that are part of version 4.9.10
    Remove patches 1101 that is part of version 4.9.10
    Rename patch 0001 to 1002 as it will be used in future RHEL 8 releases
    Add patches 0001 and 0002 to fix build on RHEL 8.7
    Resolves: RHBZ#2079466
    Resolves: RHBZ#2063155
    Resolves: RHBZ#1958777
    Resolves: RHBZ#2068088
    Resolves: RHBZ#2004646
    Resolves: RHBZ#782917
    Resolves: RHBZ#2059396
    Resolves: RHBZ#2092015


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.10-2
changelog:
  - Preserve user: fix the confusing summary
    Resolves: RHBZ#2022028
  - Only calculate LDAP password grace when the password is expired
    Related: RHBZ#782917


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.10-6
changelog:
  - webui: Allow grace login limit
    Resolves: RHBZ#2109243
  - check_repl_update: in progress is a boolean
    Resolves: RHBZ#2117303
  - Disabling gracelimit does not prevent LDAP binds
    Resolves: RHBZ#2109236
  - Set passwordgracelimit to match global policy on group pw policies
    Resolves: RHBZ#2115475


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.10-8
changelog:
  - ipa man page format the EXAMPLES section
    Resolves: RHBZ#2129895
  - Fix canonicalization issue in Web UI
    Resolves: RHBZ#2127035
  - Remove idnssoaserial argument from dns zone API. 
    Resolves: RHBZ#2108630
  - Warn for permissions with read/write/search/compare and no attrs
    Resolves: RHBZ#2098187
  - Add PKINIT support to ipa-client-install
    Resolves: RHBZ#2075452
  - Generate CNAMEs for TXT+URI location krb records
    Resolves: RHBZ#2104185
  - Vault: fix interoperability issues with older RHEL systems
    Resolves: RHBZ#2144737
  - Fix typo on ipaupgrade.log chmod during RPM %post snipppet
    Resolves: RHBZ#2140994


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.11-1
changelog:
  - Rebase ipa to 4.9.11
    Resolves: RHBZ#2141316
  - updates: fix memberManager ACI to allow managers from a specified group
    Resolves: RHBZ#2056009
  - Defer creating the final krb5.conf on clients
    Resolves: RHBZ#2148259
  - Exclude installed policy module file from RPM verification
    Resolves: RHBZ#2149567
  - Spec file: ipa-client depends on krb5-pkinit-openssl
    Resolves: RHBZ#2149889


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.12-1
changelog:
  - Rebase ipa to 4.9.12
    Resolves: RHBZ#2196425
  - user or group name: explain the supported format
    Resolves: RHBZ#2150217


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.12-4
changelog:
  - kdb: Use-krb5_pac_full_sign_compat() when available
    Resolves: RHBZ#2176406
  - OTP: fix-data-type-to-avoid-endianness-issue
    Resolves: RHBZ#2218293
  - Upgrade: fix replica agreement
    Resolves: RHBZ#2216551
  - Upgrade: add PKI drop-in file if missing
    Resolves: RHBZ#2215336
  - Use the python-cryptography parser directly in cert-find
    Resolves: RHBZ#2164349
  - Backport test updates
    Resolves: RHBZ#221884


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.12-6
changelog:
  - ipa-kdb: fix error handling of is_master_host()
    Resolves: RHBZ#2214638
  - ipatests: enable firewall rule for http service on acme client
    Resolves: RHBZ#2230256
  - User plugin: improve error related to non existing idp
    Resolves: RHBZ#2224572
  - Prevent admin user from being deleted
    Resolves: RHBZ#1821181
  - Fix memory leak in the OTP last token plugin
    Resolves: RHBZ#2227783


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.12-7
changelog:
  - ipatests: fix test_topology
    Resolves: RHBZ#2232351
  - Installer: activate nss and pam services in sssd.conf
    Resolves: RHBZ#2216532


author: Julien Rische <jrische@redhat.com> - 4.9.13-3
changelog:
  - ipa-kdb: Detect and block Bronze-Bit attacks
    Resolves: RHEL-9984
  - Fix for CVE-2023-5455
    Resolves: RHEL-12578


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-4
changelog:
  - Improve server affinity for CA-less deployments
    Resolves: RHEL-22283
  - host: update system: Manage Host Keytab permission
    Resolves: RHEL-22286
  - adtrustinstance: make sure NetBIOS name defaults are set properly
    Resolves: RHEL-21938
  - ipatests: Fix healthcheck report when nsslapd accesslog logbuffering is set to off
    Resolves: RHEL-19672


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-5
changelog:
  - kdb: PAC generator: do not fail if canonical principal is missing
    Resolves: RHEL-23630
  - ipa-kdb: Fix memory leak during PAC verification
    Resolves: RHEL-22644
  - Fix session cookie access
    Resolves: RHEL-23622
  - Do not ignore staged users in sidgen plugin
    Resovlves: RHEL-23626
  - ipa-kdb: Disable Bronze-Bit check if PAC not available
    Resolves: RHEL-22313
  - krb5kdc: Fix start when pkinit and otp auth type are enabled
    Resolves: RHEL-4874
  - hbactest was not collecting or returning messages
    Resolves: RHEL-12780


author: Julien Rische <jrische@redhat.com> - 4.9.13-6
changelog:
  - ipa-kdb: Rework ipadb_reinit_mspac()
    Resolves: RHEL-25742
  - ipatests: wait for replica update in test_dns_locations
    Resolves: RHEL-22373
  - ipatests: fix tasks.wait_for_replication() method
    Resolves: RHEL-25708


author: Julien Rische <jrische@redhat.com> - 4.9.13-7
changelog:
  - ipa-kdb: Fix double free in ipadb_reinit_mspac()
    Resolves: RHEL-25742
  - kra: set RSA-OAEP as default wrapping algo when FIPS is enabled
    Resolves: RHEL-12153
  - Vault: improve vault server archival/retrieval calls error handling
    Resolves: RHEL-12153
  - Vault: add support for RSA-OAEP wrapping algo
    Resolves: RHEL-12153


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-8
changelog:
  - rpcserver: validate Kerberos principal name before running kinit
    Resolves: RHEL-26153
  - Vault: add additional fallback to RSA-OAEP wrapping algo
    Resolves: RHEL-28259


author: Rafael Jeffman <rjeffman@redhat.com> - 9.4.13-9
changelog:
  - dcerpc: invalidate forest trust intfo cache when filtering out realm domains
    Resolves: RHEL-28559
  - Backport latests test fixes in python3-tests
    ipatests: add xfail for autoprivate group test with override
    ipatests: remove xfail thanks to sssd 2.9.4
    ipatests: adapt for new automembership fixup behavior
    ipatests: Fixes for test_ipahealthcheck_ipansschainvalidation testcases
    test_xmlrpc: adopt to automember plugin message changes in 389-ds
    Resolves: RHEL-29908


author: Julien Rische <jrische@redhat.com> - 4.9.13-10
changelog:
  - kdb: apply combinatorial logic for ticket flags (CVE-2024-3183)
    Resolves: RHEL-29927
  - kdb: fix vulnerability in GCD rules handling (CVE-2024-2698)
    Resolves: RHEL-29692


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-9
changelog:
  - Allow the admin user to be disabled
    Resolves: RHEL-34756
  - ipa-otptoken-import: open the key file in binary mode
    Resolves: RHEL-39616
  - ipa-crlgen-manage: manage the cert status task execution time
    Resolves: RHEL-30280
  - idrange-add: add a warning because 389ds restart is required
    Resolves: RHEL-28996
  - PKINIT certificate: fix renewal on hidden replica
    Resolves: RHEL-4913, RHEL-45908


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-13
changelog:
  - Add ipa-idrange-fix
    Resolves: RHEL-56920
  - Unconditionally add MS-PAC to global config on update
    Resolves: RHEL-49437
  - ipatests: Update ipa-adtrust-install test
    Resolves: RHEL-40894
  - Require python-qrcode version 5.3 or later
    Related: RHEL-15090


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-16
changelog:
  - Add a- heck into ipa-cert-fix tool to avoid updating certs if CA is close to expire
    Resolves: RHEL-4941
  - Fix rpminspect's 'patches' warnings
    Resolves: RHEL-22497


author: Rob Crittenden <rcritten@redhat.com> - 0.12-1
changelog:
  - Update to upstream 0.12 (#2139529)
  - Verify that the number of krb5kdc worker processes is aligned to the
    number of configured CPUs (#2052930)
  - IPADNSSystemRecordsCheck displays warning message for 2 expected
    ipa-ca AAAA records (#2099484)


author: François Cami <fcami@redhat.com> - 0.2-4
changelog:
  - Fix ipa-healthcheck.sh installation path (rhbz#1729188)
  - Create and own log directory (rhbz#1729188)


author: François Cami <fcami@redhat.com> - 0.3-1
changelog:
  - Update to upstream 0.3 (#1701351)
  - Add logrotate configs + depend on anacron and logrotate (#1729207)


author: Rob Crittenden <rcritten@redhat.com> - 0.4-1
changelog:
  - Rebase to upstream 0.4 (#1770346)
  - Create subpackage to split out core processing (#1771710)
  - Correct URL (#1773512)
  - Errors not translated to strings (#1752849)
  - JSON output not indented by default (#1729043)
  - Add dependencies to checks to avoid false-positives (#1727900)
  - Verify expected DNS records (#1695125)


author: Rob Crittenden <rcritten@redhat.com> - 0.4-5
changelog:
  - Remove the Obsoletes < 0.4 and add same-version Requires to each
    subpackage so that upgrades from 0.3 will work (#1852244)


author: Rob Crittenden <rcritten@redhat.com> - 0.4-6
changelog:
  - The core subpackage can be installed standalone, drop the Requires
    on the base package. (#1852244)
  - Add Conflicts < 0.4 to to core to allow downgrading with
    --allowerasing (#1852244)


author: Rob Crittenden <rcritten@redhat.com> - 0.7-1
changelog:
  - Update to upstream 0.7 (#1891850)
  - Include Directory Server healthchecks (#1824193)
  - Document that default output format is JSON (#1780328)
  - Fix return value on exit with --input-file (#1866558)
  - Fix examples in man page (#1809215)
  - Replace man page reference to output-format with output-type (#1780303)
  - Add dependencies on services to avoid false positives (#1780510)


author: Rob Crittenden <rcritten@redhat.com> - 0.7-5
changelog:
  - Return a user-friendly message when no issues are found (#1780062)
  - Report on FIPS status (#1781107)
  - Detect mismatches beteween certificates in LDAP and filesystem (#1886770)
  - Verify owner/perms for important log files (#1780020)


author: Rob Crittenden <rcritten@redhat.com> - 0.7-7
changelog:
  - ipa-healthcheck command takes some extra time to complete when dirsrv
    instance is stopped (#1776687)
  - ipa-healthcheck complains about pki.server.healthcheck errors even CA
    is not configured on the replica (#1983060)


author: Rob Crittenden <rcritten@redhat.com> - 0.7-8
changelog:
  - Suppress the CRLManager check false positive when a CA is not
    configured (#1983060)
  - Fix the backport of the pki.server.healthcheck suppression (#1983060)


author: Rob Crittenden <rcritten@redhat.com> - 0.12-5
changelog:
  - Pull in lint fixes. Prevents exception when testing for AD trust (RHEL-79081)
  - Add direct requires on python3-libsss_nss_idmap.


author: François Cami <fcami@fedoraproject.org> - 3.0.3-3
changelog:
  - Drop static library support (#1081486).
  - iperf3-devel subpackage must require iperf3.
  - iperf3-devel should only contain the unversioned shared library.
  - Call ldconfig since we are installing a shared library now.
  - Removed INSTALL file.


author: Michal Ruprich <mruprich@redhat.com> - 3.5-2
changelog:
  - Resolves: #1647413 - iperf3 with option --sctp in client mode fails with error 'iperf3: unrecognized option --sctp'


author: Michal Ruprich <mruprich@redhat.com> - 3.5-4
changelog:
  - Resolves: #1665142 - [RFE] enable SCTP support in iperf3
  - Resolves: #1656429 - option --udp-counters-64bit shown in --help output but not in man page
  - Resolves: #1700497 - [RFE] enable SSL support in iperf3


author: Václav Doležal <vdolezal@redhat.com> - 1.8.18-17
changelog:
  - Disable retry of pre-session "Get cipher suites" command as some
    BMCs are ignoring it (#1831158)


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.18-18
changelog:
  - Protect against negative values to memmove that caused
    "ipmitool sol activate" to crash against an IBM DataPower appliance
    (#1951480)
    Cherry-picked from upstream PR#78.


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.18-19
changelog:
  - Backport upstream PR 120 to fix segfault on invalid unit types
    Resolves: rhbz#2224578
  - Add vendor ID for NVIDIA BMCs
    Resolves: rhbz#2218358
  - Add upstream ipmievd patch to check received msg id against expectation
    Fixes problem where SEL response is not recognized correctly
    when SEL request times out
    Resolves: rhbz#2224569


author: Ryan O'Hara <rohara@redhat.com> - 1.29-7
changelog:
  - Add 
    CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=x86-64 -mtune=generic -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CFLAGS ; 
    CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=x86-64 -mtune=generic -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CXXFLAGS ; 
    FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=x86-64 -mtune=generic -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib/gfortran/modules}" ; export FFLAGS ; 
    FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=x86-64 -mtune=generic -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib/gfortran/modules}" ; export FCFLAGS ; 
    LDFLAGS="${LDFLAGS:--Wl,-z,relro  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld}" ; export LDFLAGS (#1543790)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1:1.2.1-4
changelog:
  - Python 2 binary package renamed to python2-isomd5sum
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Brian C. Lane <bcl@redhat.com> - 1:1.2.2-1
changelog:
  - Don't put DESTDIR in the isomd5sum.pc file
  - New Version 1.2.2 (bcl)
  - Fix aligned alloc parameters and overflow on 32bit size_t (#1497458) (squimrel)
  - Fix memory leak (squimrel)
  - Add pkgconfig file (squimrel)
  - Remove line-breaks from error messages (squimrel)
  - Make library C++ compatible (squimrel)
  - Constify function signatures (squimrel)
  - Revert checkCallback function signature (squimrel)


author: Brian C. Lane <bcl@redhat.com> - 1:1.2.3-1
changelog:
  - New Version 1.2.3 (bcl)
  - Fix 32bit bug on large files (squimrel)
  - Don't put DESTDIR in the isomd5sum.pc file (bcl)


author: Petr Viktorin <pviktori@redhat.com> - 2.0.2-8
changelog:
  - Be more explicit about Python build dependencies
    (Require python2-devel, tell autotools that PYTHON is python2)


author: Mat Booth <mat.booth@redhat.com> - 2.9.8-1
changelog:
  - Update to latest upstream release, fixes CVE-2018-14718 CVE-2018-147189
    CVE-2018-19360 CVE-2018-19361 CVE-2018-19362 CVE-2018-12022 CVE-2018-12023
    CVE-2018-14720 CVE-2018-14721


author: Red Hat PKI Team <rhcs-maint@redhat.com> - 2.10.0-1
changelog:
  - Update to latest upstream release
  - Fixes: CVE-2019-14540
  - Fixes: CVE-2019-16335
  - Resolves: rhbz#1760274
  - Resolves: rhbz#1760278


author: Red Hat PKI Team <rhcs-maint@redhat.com> - 2.11.4-6
changelog:
  - Drop jackson-module-afterburner, jackson-module-guice, jackson-module-mrbean,
    jackson-module-osgi, jackson-module-paranamer, and jackson-module-javadoc


author: Jie Kang <jkang@redhat.com> - 1.2.1-3
changelog:
  - Remove osgiversion-maven-plugin build requirement
  - Remove javadoc plugin not needed in Fedora builds


author: Marek Goldmann <mgoldman@redhat.com> - 1.11-1
changelog:
  - Upstream release 1.11 RHBZ#962761
  - CVE-2013-2035 HawtJNI: predictable temporary file name leading to local arbitrary code execution RHBZ#962614


author: Josef Ridky <jridky@redhat.com> - 2.0.14-5
changelog:
  - Fix CVE-2021-26927 (#1933860)
  - Fix CVE-2021-26926 (#1922316)
  - Fix CVE-2021-3272 (#1922283)
  - Fix CVE-2020-27828 (#1905692)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b04-0.1.ea
changelog:
  - Update to shenandoah-jdk8u382-b04 (EA)
  - Sync the copy of the portable specfile with the latest update
  - Resolves: rhbz#2217710


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b05-1
changelog:
  - Update to shenandoah-jdk8u372-b05 (GA)
  - Sync the copy of the portable specfile with the latest update
  - Add note at top of spec file about rebuilding
  - Use tapsets from the misc tarball
  - Make sure root installation directory is created first
  - Use in-place substitution for all but the first of the tapset changes
  - The 'prelease' variable should refer to 'portablerelease', not 'rpmrelease'
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2221106


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.392.b08-1
changelog:
  - For non debug subpackages, ghosted all alternatives (rhbz1649776)
  - For non system JDKs, if-outed versionless provides.
  - Aligned versions to be %{epoch}:%{version}-%{release} instead of chaotic
  - Related: RHEL-13641


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.392.b08-2
changelog:
  - Update to shenandoah-jdk8u392-b08 (GA)
  - Sync the copy of the portable specfile with the latest update
  - Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Regenerate PR2462 patch following JDK-8315135
  - Bump version of bundled libpng to 1.6.39
  - Add backport of JDK-8312489 heading upstream for 8u402 (see OPENJDK-2095)
  - Add missing JFR, alt-java, jre-* and java-* alternative ghosts
  - Move jcmd to the headless package
  - ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
  - Resolves: RHEL-12309
  - Resolves: RHEL-13600
  - Resolves: RHEL-13628
  - Resolves: RHEL-13635
  - Resolves: RHEL-13641
  - Resolves: RHEL-13612
  - Resolves: RHEL-13621


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.392.b08-5
changelog:
  - Restore %{epoch}:%{javaver} versioning to jre, java, jre-headless, java-headless, java-devel & java-sdk
  - Resolves: RHEL-19636


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.402.b06-0.2.ea
changelog:
  - Update to shenandoah-jdk8u402-b06 (GA)
  - Sync the copy of the portable specfile with the latest update
  - Drop local copy of JDK-8312489 which is now included upstream
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
  - Resolves: RHEL-21477
  - Resolves: RHEL-20975


author: Omair Majid <omajid@redhat.com> 1:1.8.0.0-0.5.b87
changelog:
  - Update to b87
  - Remove all rhino support; use nashorn instead
  - Remove upstreamed/unapplied patches


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.0-0.11.b89
changelog:
  - prelink dependence excluded also for aaech64
  - arm64 added to jitarches
  - added source100 config.guess to repalce the outdated one in-tree
  - added source101 config.sub  to repalce the outdated one in-tree
  - added patch2011 system-libjpegAARCH64.patch (as aarch64-port is little bit diferent)
  - added patch2031 system-lcmsAARCH64.patch (as aarch64-port is little bit diferent)
  - added gcc-c++ build depndece so builddep will  result to better situation


author: Deepak Bhole <dbhole@redhat.com> - 1:1.8.0.0-0.15.b89
changelog:
  - Added a missing includes patch (#302/%{name}-arm64-missing-includes.patch)
  - Added --disable-precompiled-headers for arm64 build


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.0-0.26.b129
changelog:
  - Add -headless subpackage based on java-1.7.0-openjdk
  - Add abrt connector support
  - Add -accessibility subpackage


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.0-0.31.b132
changelog:
  - updated to rc4 aarch64 tarball
  - outdated removed: patch2031 system-lcmsAARCH64.patch patch2011 system-libjpeg-aarch64.patch
    patch2021 system-libpng-aarch64.patch


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.0-2.b132
changelog:
  - Include version information in desktop files
  - Move desktop files from tarball to top level source


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.11-11.b12
changelog:
  - backporting old fixes:
  - get rid of jre-abrt, uniquesuffix, parallel install, jsa files,
    config(norepalce) bug, -fstack-protector-strong, OrderWithRequires,
    nss config, multilib arches, provides/requires excludes
  - some additional cosmetic changes


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.11-12.b12
changelog:
  - bumped release to build by previous release.
  - forcing rebuild by jdk8
  - uncommenting forgotten comment on tzdb link


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.11-17.b12
changelog:
  - added build requires and requires for headles  _datadir/javazi-1.8/tzdb.dat
  - restriction of tzdata provider, so we will be aware of another possible failure


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-1.b01
changelog:
  - updated to u40-b01
  - adapted  rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
  - adapted  jdk8042159-allow_using_system_installed_lcms2.patch
  - removed patch8 set-active-window.patch
  - removed patch9 javadoc-error-jdk-8029145.patch
  - removed patch10 javadoc-error-jdk-8037484.patch
  - removed patch99 applet-hole.patch - itw 1.5.1 is able to ive without it


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-5.b26
changelog:
  - Update aarch64 hotspot to jdk7u40-b02 to match the rest of the JDK
  - commented out patch2 (obsolated by 666)
  - all ppc64 added to jitarches


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-12.b02
changelog:
  - added patch12,removeSunEcProvider-RH1154143
  - xdump excluded from ppc64le (rh1156151)
  - Add check for src.zip completeness. See RH1130490 (by sgehwolf@redhat.com)
  - Resolves: rhbz#1125260


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-13.b02
changelog:
  - preparing for parallel debug+normal build
  - files and scripelts moved to extendable macros as first step to dual build
  - install and build may be done in loop for both release and slowdebug
  - debugbuild off untill its completed


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-15.b02
changelog:
  - enabled debug packages
  - removed all provides duplicating package name
  - comments about files moved inside files section (to prevent different javadoc postuns)
   - see (RH1160693)


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-17.b12
changelog:
  - obsoleted gcj and sindoc. rh1149674 and rh1149675
  - removed backup/restore on images and docs in favor of reconfigure in different directory


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-20.b25
changelog:
  - bumped to b25
  - removed upstreamed patch11 hotspot-build-j-directive.patch
  - policies repacked to stop spamming yum update
  - added and used source20 repackReproduciblePolycies.sh
  - added mehanism to force priority size


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.40-21.b25
changelog:
  - Fix building with gcc 5 by ignoring return-local-addr warning
  - Include additional debugging info for java class files and test that they are
    present


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-24.b25
changelog:
  - added patch501 1182011_JavaPrintApiDoesNotPrintUmlautCharsWithPostscriptOutputCorrectly.patch
  - added patch502 1182694_javaApplicationMenuMisbehave.patch
  - both upstreamed, will be gone with u60


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.45-30.b13
changelog:
  - updated to security u45
  - removed patch6: disable-doclint-by-default.patch
  - added patch d318d83c4e74.patch
  - added  rhbz1206656_fix_current_stack_pointer.patch
  - renamed PStack-808293.patch -> java-1.8.0-openjdk-PStack-808293.patch
  - renamed remove-intree-libraries.sh -> java-1.8.0-openjdk-remove-intree-libraries.sh
  - renamed to preven conflix with jdk7


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.45-35.b13
changelog:
  - Omit jsa files from power64 file list as well, as they are never generated
  - moved to boot build by openjdk8
  - Use the template interpreter on ppc64le


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.45-36.b13
changelog:
  - Patch hotspot to not use undefined code rather than passing
    -fno-tree-vrp via CFLAGS.
    Resolves: RHBZ#1208369
  - Add upstream patch for DNS nameserver issue with IPv6 addresses.
    Resolves: RHBZ#1210739


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.45-37.b13
changelog:
  - added runtime requires for tzdata
  - Remove reference to tz.properties which is no longer used (by gnu.andrew)


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.60-1.b16
changelog:
  - updated to u60b16
  - deleted upstreamed patches:
     patch501 1182011_JavaPrintApiDoesNotPrintUmlautCharsWithPostscriptOutputCorrectly.patch
     patch502 1182694_javaApplicationMenuMisbehave.patch
     patch504 1210739_dns_naming_ipv6_addresses.patch
     patch402 atomic_linux_zero.inline.hpp.patch
     patch401 fix_ZERO_ARCHDEF_ppc.patch
     patch400 ppc_stack_overflow_fix.patch
     patch204 zero-interpreter-fix.patch
  - added Patch506 gif4.1.patch to allow build agaisnt giflib > 4.1


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.60-2.b16
changelog:
  - Patch503 d318d83c4e74.patch, patch505 1208369_memory_leak_gcc5.patch (and patch506 gif4.1.patch)
     moved out of "if with_systemtap" block


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.60-2.b24
changelog:
  - updated to security u60-b24
  - moved to openjdk instead of jdk8 topdir in sources
  - removed upstreamed patch99 java-1.8.0-openjdk-linux-4.x.patch
  - removed upstreamed patch503 pr2444.patch
  - removed upstreamed patch505 1208369_memory_leak_gcc5.patch
  - removed upstreamed patch506: gif4.1.patch
   - note: usptream version is suspicious
    GIFLIB_MAJOR >= 5 SplashStreamGifInputFunc, NULL
    ELSE SplashStreamGifInputFunc
   - but the condition seems to be viceversa


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.60-3.b24
changelog:
  - added one more md5sum test (thanx to Severin!)
   - I guess one more missing
  - doubled slash in md5sum test in post


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.60-14.b24
changelog:
  - updated aarch64 tarball to contain whole forest of latest jdk8-aarch64-jdk8u60-b24.2.tar.xz
  - using this forest instead of only hotspot
  - generate_source_tarball.sh - temporarily excluded repos="hotspot" compression of download
  - not only openjdk/hotspot is replaced, by wholeopenjdk
  - ln -s openjdk jdk8 done after replacing of openjdk
  - patches 9999 601 and 602 exclded for aarch64


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.60-15.b28
changelog:
  - moved to single source integration forest
  - removed patch patch9999 enableArm64.patch
  - removed patch patch600  %{name}-rh1191652-hotspot.patch


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.65-2.b17
changelog:
  - added and applied patch605 soundFontPatch.patch as repalcement for removed sound font links
  - removed hardcoded soundfont links


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.65-7.b17
changelog:
  - changed way of generating the sources. As result:
  - "updated" to aarch64-jdk8u65-b17 (from aarch64-port/jdk8u60)
  - used aarch64-port-jdk8u60-aarch64-jdk8u65-b17.tar.xz as new sources


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.65-8.b17
changelog:
  - used extracted lua scripts.
  - now depnding on copy-jdk-configs
  - config files persisting in pre instead of %pretrans


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.65-9.b17
changelog:
  - extracted lua scripts moved from pre where they don't work to pretrans
  - requirement on copy-jdk-configs made Week.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.65-11.b17
changelog:
  - Define our own optimisation flags based on the optflags macro and pass to OpenJDK build cflags/cxxflags.
  - Remove -fno-devirtualize as we are now on GCC 5 where the GCC bug it worked around is fixed.
  - Pass __global_ldflags to --with-extra-ldflags so Fedora linker flags are used in the build.
  - Also Pass ourcppflags to the OpenJDK build cflags as it wrongly uses them for the HotSpot C++ build.
  - Add PR2428, PR2462 & S8143855 patches to fix build issues that arise.
  - Resolves: rhbz#1283949
  - Resolves: rhbz#1120792


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.65-12.b17
changelog:
  -removed patch4 java-1.8.0-openjdk-PStack-808293.patch
  -removed patch13 libjpeg-turbo-1.4-compat.patch


author: jvanek <jvanek@redhat.com> - 1:1.8.0.72-1.b15
changelog:
  - updated to aarch64-jdk8u72-b15 (from aarch64-port/jdk8u)
  - used aarch64-port-jdk8u-aarch64-jdk8u72-b15.tar.xz as new sources
  - removed already upstreamed patch501 8146566.patch


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-5.b15
changelog:
  - Explicitly set the C++ standard to use, as the default has changed to C++ 2014 in GCC 6.
  - Turn off -Werror due to format warnings in HotSpot and -std usage warnings in SCTP.
  - Run tests under the check stage and use the debug build first.


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.72-5.b15
changelog:
  - Add -fno-delete-null-pointer-checks -fno-guess-branch-probability flags to resolve x86/x86_64 crash.


author: jvanek <jvanek@redhat.com> - 1:1.8.0.72-10.b15
changelog:
  - returning accidentlay removed hunk from renamed and so wrongly merged remove_aarch64_jvm.cfg_divergence.patch


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-11.b15
changelog:
  - Add patches to allow the SunEC provider to be built with the system NSS install.
  - Re-generate source tarball so it includes ecc_impl.h.
  - Adjust tarball generation script to allow ecc_impl.h to be included.
  - Bring over NSS changes from java-1.7.0-openjdk spec file (NSS_CFLAGS/NSS_LIBS)
  - Remove patch which disables the SunEC provider as it is now usable.
  - Correct spelling mistakes in tarball generation script.
  - Move completely unrelated AArch64 gcc 6 patch into separate file.
  - Resolves: rhbz#1019554 (fedora bug)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-5.b16
changelog:
  - Fix regression introduced on s390 by large code cache change.
  - Update to u72b16.
  - Drop 8147805 and jvm.cfg fix which are applied upstream.


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.72-12.b15
changelog:
  - Use a simple backport for PR2462/8074839.
  - Don't backport the crc check for pack.gz. It's not tested well upstream.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-2.b03
changelog:
  - Avoid WithSeed versions of NSS functions as they do not fully process the seed
  - List current java.security md5sum so that java.security is replaced and ECC gets enabled.
  - Resolves: rhbz#1245810


author: jvanek <jvanek@redhat.com> - 1:1.8.0.77-2.b03
changelog:
  - added patch400  jdk8-archivedJavadoc.patch
  - added javadoc-zip(-debug) subpackage with compressed javadoc


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Use basename of test file to avoid misinterpretation of full path as a package
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Enable a full bootstrap on JIT archs. Full build held back by Zero archs anyway.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Add 8132051 port to Zero.
  - Turn on bootstrap build for all to ensure we are now good to go.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Revert settings to production defaults so we can at least get a build.
  - Switch to a slowdebug build to try and unearth remaining issue on s390x.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Turn off -Werror so s390 can build in slowdebug mode.
  - Add fix for formatting issue found by previous s390 build.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Temporarily remove power64 from JIT arches to see if endian issue appears on Zero.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Add additional fix to Zero patch to properly handle result on 64-bit big-endian
  - Revert debugging options (aarch64 back to JIT, product build, no -Wno-error)
  - Enable full bootstrap on all architectures to check we are good to go.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Roll back release number as release 1 never succeeded, even with tests disabled.
  - Resolves: rhbz#1325423


author: jvanek <jvanek@redhat.com> - 1:1.8.0.91-4.b14
changelog:
  - updated to aarch64-shenandoah-jdk8u71-b15-beta02 (from aarch64-port/jdk8u-shenandoah) of hotspot
  - used aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u71-b15-beta02.tar.xz as new sources for hotspot
  - reverted  nss version fix


author: jvanek <jvanek@redhat.com> - 1:1.8.0.91-6.b14
changelog:
  - Enable weak reference discovery in ShenandoahMarkCompact. Otherwise we never process any weak references in full-gc.


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.92-1.b14
changelog:
  - updated to u92
  - removed upstreamed patches 8132051-aarch64.patch, 8143855.patch, criticalShenandoahFix.patch, rhbz1206656_fix_current_stack_pointer.patch
  - 8132051-zero.patch, remove_aarch64_template_for_gcc6.patch
  - jdwpCrash.abrt.patch renamed to 8044762-pr2960.patch
  - httpsFix1329342.patch renamed to pr2934-sunec_provider_throwing_keyexception_withine.separator_current_nss_thus_initialise_the_random_number_generator_and_feed_the_seed_to_it.patch
  - added known regresisonos fixes for u92 scheduled for next u (519-525)


author: jvanek <jvanek@redhat.com> - 1:1.8.0.101-1.b14
changelog:
  - updated to aarch64-jdk8u101-b14 (from aarch64-port/jdk8u)
  - updated to aarch64-shenandoah-jdk8u101-b14-shenandoah-merge-2016-07-25 (from aarch64-port/jdk8u-shenandoah) of hotspot
  - used aarch64-port-jdk8u-aarch64-jdk8u101-b14.tar.xz as new sources
  - used aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u101-b14-shenandoah-merge-2016-07-25.tar.xz as new sources for hotspot
  - priority lowered for ine zero digit, tip moved to 999
  - added jdk6260348-pr3066-gtk_laf_jtextcomponent_not_respecting_desktop_caret_blink_rate.patch, pr3083-rh1346460-for_ssl_debug_return_null_instead_of_exception_when_theres_no_ecc_provider.patch, 8159244-pr3074.patch, corba_typo_fix.patch
  renamed: jdk8-archivedJavadoc.patch -> jdk8154313-generated_javadoc_scattered_all_over_the_place.patch, pr2991-rh1341258.patch -> 8158260-pr2991-rh1341258.patch
  - not added 8147771-additional_hunk.patch, already in b14


author: jvanek <jvanek@redhat.com> - 1:1.8.0.101-2.b14
changelog:
  - added patch532 hotspot-1358661.patch - to fix performance of bimorphic inlining may be bypassed by type speculation
  - added patch301 bz1204159_java8.patch - to fix systemtap on multiple jdks


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-3.b14
changelog:
  - Replace patch for S8162384 with upstream version. Document correctly along with SystemTap RH1204159 patch.
  - Resolves: rhbz#1358661
  - Replace patch for S8157306 with upstream version, documented & applied on all archs with conditional in patch
  - Resolves: rhbz#1360863


author: jvanek <jvanek@redhat.com> - 1:1.8.0.102-1.b14
changelog:
  - updated to aarch64-jdk8u102-b14 (from aarch64-port/jdk8u)
  - updated to aarch64-shenandoah-jdk8u102-b14 (from aarch64-port/jdk8u-shenandoah) of hotspot
  - used aarch64-port-jdk8u-aarch64-jdk8u102-b14.tar.xz as new sources
  - used aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u102-b14.tar.xz as new sources for hotspot
  - removed upstreamed patches 519, 520 and 605
  - updated to systemtap 3, removed related patches 300 and 301
  - jjs provides moved to headless


author: jvanek <jvanek@redhat.com> - 1:1.8.0.102-2.b14
changelog:
  - declared check_sum_presented_in_spec and used in prep and check
  - it is checking that latest packed java.security is mentioned in listing
  - @prefix@ in tapsetfiles substitued by prefix as necessary to work with systemtap3 (rhbz1371005)


author: jvanek <jvanek@redhat.com> - 1:1.8.0.111-1.b16
changelog:
  - updated to aarch64-jdk8u111-b16 (from aarch64-port/jdk8u)
  - updated to aarch64-shenandoah-jdk8u111-b16 (from aarch64-port/jdk8u-shenandoah) of hotspot
  - used aarch64-port-jdk8u-aarch64-jdk8u111-b16.tar.xz as new sources
  - used aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u111-b16.tar.xz as new sources for hotspot
  - adapted patches


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.111-2.b16
changelog:
  - added dont-add-unnecessary-debug-links.patch
  - added hotspot-assembler-debuginfo.patch
  - returned accidentally removed  hotspot-remove-debuglink.patch
  - eu-readelfs on libraries improved, added gdb call


author: jvanek <jvanek@redhat.com - 1:1.8.0.111-3.b16
changelog:
  - added patch207 - PR3183.patch
  - java SSL/TLS implementation: should follow the policies of system-wide crypto policy


author: jvanek <jvanek@redhat.com> - 1:1.8.0.121-1.b14
changelog:
  - updated to aarch64-jdk8u121-b14 (from openjdk8-forests/latest-aarch64)
  - updated to aarch64-shenandoah-jdk8u121-b14 (from openjdk8-forests/latest-shenandoah) of hotspot
  - used openjdk8-forests-latest-aarch64-aarch64-jdk8u121-b14.tar.xz as new sources
  - used openjdk8-forests-latest-shenandoah-aarch64-shenandoah-jdk8u121-b14.tar.xz as new sources for hotspot
  - deleted:    8044762-pr2960.patch 8049226-pr2960.patch 8154210.patch 8158260-pr2991-rh1341258.patch 8159244-pr3074.patch
  - adapted java-1.8.0-openjdk-size_t.patch pr1834-rh1022017-reduce_ellipticcurvesextension_to_provide_only_three_nss_supported_nist_curves_23_24_25.patch rh1163501-increase_2048_bit_dh_upper_bound_fedora_infrastructure_in_dhparametergenerator.patch
  - updated from internal (rhel) repo  OPENJDK_URL_DEFAULT=ssh://t...redhat.com//...ty/
  - with custom PR2126=/.../pr2126.patch (removed newly added brainpool curves)
  - withspecial values of PROJECT_NAME="openjdk8-forests", REPO_NAME="latest-aarch64"
  - with correct tag VERSION="aarch64-jdk8u121-b14"
  - and for shenandoah hotspot used custom repo REPO_NAME=latest-shenandoah
  - with correct tag VERSION="aarch64-shenandoah-jdk8u121-b14"
  - complete changes to  generate_source_tarball.sh  update_package.sh NOT commited (willbe regenerated from official repos soon)


author: jvanek <jvanek@redhat.com> - 1:1.8.0.121-2.b14
changelog:
  - revertrd patch535, excludeECDHE-1415137.patch and related changes
  - issue casued by nss, see rhbz#1415137 c#35


author: jvanek <jvanek@redhat.com> - 1:1.8.0.121-5.b14
changelog:
  - patch 536 reordered to 537
  - added patch 536 - Backport "8170888: [linux] Experimental support for cgroup memory limits in container (ie Docker) environments"
  - added patch 538 - 1423421: Javadoc crashes when method name ends with "Property"
  - rhbz#1423751 - added -fno-split-loops worakround sigsew when building with GCC7 (probably bug in jdk's JIT )


author: jvanek <jvanek@redhat.com> - 1:1.8.0.121-7.b14
changelog:
  - fixed the config(noreplace) issue with various left files lke java.security (rhbz#1183793)
  - by calling new c-j-c hooks
  - removed self-tail-bitting check check_sum_presented_in_spec
  - release 6+7 to verify update path


author: jvanek <jvanek@redhat.com> - 1:1.8.0.121-9.b14
changelog:
  - updated to latest stable shenandoah hotspot
  - updated to properly tagged upstream forest (no update, just rename)
  - fixed update package to verify PR2126 patch and work with sha512


author: jvanek <jvanek@redhat.com> - 1:1.8.0.121-11.b14
changelog:
  - sync from rhel, reordered patches, enabled shenanoah on aarch64
  - Patch OpenJDK to check the system cacerts database directly
  - Remove unneeded symlink to the system cacerts database
  - Drop outdated openssl dependency from when the RPM built the cacerts database
  - udpated to latest stable shenandoah hotspot


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.131-1.b12
changelog:
  - updated to aarch64-jdk8u131-b12 (from aarch64-port/jdk8u)
  - updated to aarch64-shenandoah-jdk8u131-b12-shenandoah-merge-2017-04-20 (from aarch64-port/jdk8u-shenandoah) of hotspot
  - used aarch64-port-jdk8u-aarch64-jdk8u131-b12.tar.xz as new sources
  - used aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u131-b12-shenandoah-merge-2017-04-20.tar.xz as new sources for hotspot


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.131-3.b12
changelog:
  - source999 moved to source1
  - added two pathces 8181055-pr3394-rh1448880.patch and 8175813/PR3394/RH1448880
  - enabled (commented out) system NSS via patch1000, rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.144-1.b01
changelog:
  - Update to aarch64-jdk8u144-b01 and aarch64-shenandoah-jdk8u144-b01.
  - Exclude 8175887 from Shenandoah builds as it has been included in that repo.
  - Added 8164293-pr3412-rh1459641.patch backport from 8u development tree
  - get rid of bin/* and lib/*, fixed rhbz1480777
  - adapted to rpm 4.14: all expanding macros changed to define, all %1 and %1 replaced by %{?1}, all expandable macros parameter preffixed by --
  - get rid of generated filelists all except javafx and demos


author: jvanek <jvanek@redhat.com> - 1:1.8.0.144-7.b01
changelog:
  - updated to aarch64-shenandoah-jdk8u144-b02-shenandoah-merge-2017-10-02 (from aarch64-port/jdk8u-shenandoah) of hotspot
  - used aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u144-b02-shenandoah-merge-2017-10-02.tar.xz as new sources for hotspot


author: jvanek <jvanek@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - updated to aarch64-jdk8u151-b12 (from aarch64-port/jdk8u)
  - updated to aarch64-shenandoah-jdk8u151-b12 (from aarch64-port/jdk8u-shenandoah) of hotspot
  - used aarch64-port-jdk8u-aarch64-jdk8u151-b12.tar.xz as new sources
  - used aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u151-b12.tar.xz as new sources for hotspot
  - tapset updated to 3.6pre02
  - policies adapted to new limited/unlimited schmea
  - above acomapnied by c-j-c 3.3
  - alligned patches and added PPC ones (thanx to gnu_andrew)
  - added patch209: 8035496-hotspot.patch
  - added patch210: suse_linuxfilestore.patch


author: jvanek <jvanek@redhat.com> - 1:1.8.0.161-0.b14
changelog:
  - updated to u161, rmeoved upstreamed patches
  - removed patch555 8164293-pr3412-rh1459641.patch
  - removed patch550 8175813-pr3394-rh1448880.patch
  - removed patch547 8173941-pr3326.patch
  - removed patch532 8162384-pr3122-rh1358661.patch
  - removed patch535 8153711-pr3313-rh1284948.patch
  - removed patch561 8075484-pr3473-rh1490713.patch
  - removed patch554 8175887-pr3415.patch


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.162-1.b12
changelog:
  - Update to aarch64-jdk8u162-b12 and aarch64-shenandoah-jdk8u162-b12.
  - Remove upstreamed patches for 8181055/PR3394/RH1448880,
  -  8181419/PR3413/RH1463144, 8145913/PR3466/RH1498309,
  -  8168318/PR3466/RH1498320, 8170328/PR3466/RR1498321 and
  -  8181810/PR3466/RH1498319.


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.171-1.b10
changelog:
  - Update to aarch64-jdk8u171-b10 and aarch64-shenandoah-jdk8u171-b10.
  - Fix jconsole.desktop.in subcategory, replacing "Monitor" with "Profiling" (PR3550) (gnu_andrew)
  - Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add misisng ones (gnu_andrew)


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.171-6.b10
changelog:
  - aligning with java-openjdk in fedora:
  - removed fx binding
  - config files to etc
  - slowdebug instead simply debug subpackage
  - purged provides
  - many macros renamed
  - typos correction
  - bumped jstack (may be wrong)


author: Jiri Vanek <jvanek@redhat.com> - 1:10.0.1.10-7
changelog:
  - quoted sed expressions, changed possibly confussing # by @
  - added vendor(origin) into icons
  - removed last trace of relative symlinks
  - added BuildRequires of javapackages-tools to fix build failure after Requires change to javapackages-filesystem


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.172-1.b11
changelog:
  - updated to u172-b11
  - removed patches:
  - patch207 8200556-pr3566.patch
  - patch104 pr3458-rh1540242.patch
  - patch209 8035496-hotspot.patch
  - patch700 pr3573-fix_TCK_crash_with_shenandoah_in_shenandoahsupport_cpp_in_case_of_dead_brnach_in_is_independent.patch
  - fixed issue with atkwrapper wrongly palced broken symlink
  - fixed libjvm path for system tap
  - returned patch104 pr3458-rh1540242.patch


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-5.b11
changelog:
  - Sync with IcedTea 3.8.0.
  - Label architecture-specific fixes with architecture concerned
  - x86: S8199936, PR3533: HotSpot generates code with unaligned stack, crashes on SSE operations (-mstackrealign workaround)
  - PR3539, RH1548475: Pass EXTRA_LDFLAGS to HotSpot build
  - 8171000, PR3542, RH1402819: Robot.createScreenCapture() crashes in wayland mode
  - 8197546, PR3542, RH1402819: Fix for 8171000 breaks Solaris + Linux builds
  - 8185723, PR3553: Zero: segfaults on Power PC 32-bit
  - 8186461, PR3557: Zero's atomic_copy64() should use SPE instructions on linux-powerpcspe
  - PR3559: Use ldrexd for atomic reads on ARMv7.
  - 8187577, PR3578: JVM crash during gc doing concurrent marking
  - 8201509, PR3579: Zero: S390 31bit atomic_copy64 inline assembler is wrong
  - 8165489, PR3589: Missing G1 barrier in Unsafe_GetObjectVolatile
  - PR3591: Fix for bug 3533 doesn't add -mstackrealign to JDK code
  - 8184309, PR3596: Build warnings from GCC 7.1 on Fedora 26


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-5.b11
changelog:
  - Update Shenandoah tarball to include 2018-05-15 merge.
  - Split PR3458/RH1540242 fix into AArch64 & Zero sections, so former can be skipped on Shenandoah builds.
  - Drop PR3573 patch applied upstream.
  - Restrict 8187577 fix to non-Shenandoah builds, as it's included in the new tarball.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-6.b11
changelog:
  - Remove build flags exemption for aarch64 now the platform is more mature and can bootstrap OpenJDK with these flags.
  - Remove duplicate -fstack-protector-strong; it is provided by the RHEL cflags.
  - Add missing changelog credits


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-11.b11
changelog:
  - Add additional fix (PR3601) to fix -Wreturn-type failures introduced by 8061651
  - Backport 8064786 (PR3601) to fix -Wreturn-type failure on debug builds.
  - Bring in PR3519 from IcedTea 3.7.0 to fix remaining -Wreturn-type failure on AArch64.
  - Sync with IcedTea 3.8.0 patches to use -Wreturn-type.
  - Add backports of 8141570, 8143245, 8197981 & 8062808.
  - Drop pr3458-rh1540242-zero.patch which is covered by 8143245.


author: Jiri Vanek <jvanek@redhat.com> - 11:1.8.0.172-16.b11
changelog:
  - added Recommends gtk2 for main package
  - added Suggests lksctp-tools, pcsc-lite-devel, cups for headless package
  - see RHBZ1598152


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-0.b03
changelog:
  - Update to aarch64-jdk8u181-b03 and aarch64-shenandoah-jdk8u181-b03.
  - Remove AArch64 patch for PR3458/RH1540242 as applied upstream.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-4.b04
changelog:
  - Add "8206406, PR3610, RH1597825: StubCodeDesc constructor publishes partially-constructed objects on StubCodeDesc::_list"


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-5.b04
changelog:
  - Add "8146115, PR3508, RH1463098: Improve docker container detection and resource configuration usage"


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-6.b13
changelog:
  - Update to aarch64-jdk8u181-b13 and aarch64-shenandoah-jdk8u181-b13.
  - Remove 8187577/PR3578 now applied upstream.


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.181.b13-8
changelog:
  - Adjust system NSS patch, pr1983-rh1565658-support_using_the_system_installation_of_nss_with_the_sunec_provider_jdk8.patch, so as to filter
    -Wl,--as-needed. Resolves RHBZ#1622186.
  - Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.181.b13-9
changelog:
  - Adjust system jpeg patch, jdk8043805-allow_using_system_installed_libjpeg.patch, so as to filter
    -Wl,--as-needed. Resolves RHBZ#1622186.
  - Resolves: rhbz#1633817


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.181.b15-1
changelog:
  - fixed unexpanded arch in policy tool desktop file
  - fixed versions (8->1.8.0) of images used in desktop files
  - Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.181.b15-2
changelog:
  - Update(s) from upstreamed patches:
    - 8036003-dont-add-unnecessary-debug-links.patch =>
      jdk8036003-add_with_native_debug_symbols_configure_flag.patch
    - rh1176206-jdk.patch =>
      jdk8150954-pr2866-rh1176206-screenshot_xcomposite_jdk.patch =>
      Deleted rh1176206-root.patch as thats no longer needed with
      upstream 8150954.
    - Refreshed jdk8165852-pr3468-mount_point_not_found_for_a_file_which_is_present_in_overlayfs.patch from upstream.
    - Refreshed jdk8201495-zero_reduce_limits_of_max_heap_size_for_boot_JDK_on_s390.patch from upstream.
    - 8207057-pr3613-hotspot-assembler-debuginfo.patch =>
      jdk8207057-pr3613-no_debug_info_for_assembler_files_hotspot.patch and
      jdk8207057-pr3613-no_debug_info_for_assembler_files_root.patch. From JDK 8u
      review.
  - Renamed pr2842-02.patch => jdk8148351-pr2842-02-only_display_resolved_symlink_for_compiler_do_not_change_path.patch.
  - Renamed spec-only patch:
    pr3183.patch => pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch
  - Renamed java-1.8.0-openjdk-size_t.patch =>
    jdk8201495-zero_reduce_limits_of_max_heap_size_for_boot_JDK_on_s390.patch
  - Moved SunEC provider via system NSS to RPM specific patches section.
  - Moved upstream 8u patches to appropriate sections (8u192/8u202).
  - Removed rh1214835.patch since it's invalid. See:
    https://icedtea.classpath.org/bugzilla/show_bug.cgi?id=2304#c3
  - Use --with-native-debug-symbols=internal which JDK-8036003 adds.
  - Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.181.b15-3
changelog:
  - Renamed more patches for clarity:
    include-all-srcs.patch => jdk8044235-src_zip_should_include_all_sources.patch
    java-1.8.0-openjdk-rh1191652-hotspot-aarch64.patch => jdk8073139-pr2236-rh1191652--use_ppc64le_as_the_arch_directory_on_that_platform_and_report_it_in_os_arch_aarch64_forest.patch
    java-1.8.0-openjdk-rh1191652-jdk.patch => jdk8073139-pr1758-rh1191652-ppc64_le_says_its_arch_is_ppc64_not_ppc64le_jdk.patch
    java-1.8.0-openjdk-rh1191652-root.patch => jdk8073139-pr1758-rh1191652-ppc64_le_says_its_arch_is_ppc64_not_ppc64le_root.patch
  - Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.181.b15-4
changelog:
  - Add fixes for optimization gaps (annocheck issues):
    - 8210761: libjsig is being compiled without optimization
    - 8210647: libsaproc is being compiled without optimization
    - 8210416: [linux] Poor StrictMath performance due to non-optimized compilation
    - 8210425: [x86] sharedRuntimeTrig/sharedRuntimeTrans compiled without optimization
               8u upstream and aarch64/jdk8u upstream versions.
  - Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.181.b15-5
changelog:
  - Add explicit requirement for libXcomposite which is used when performing
    screenshots from Java.
  - Add explicit BR unzip required for building OpenJDK.
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b15-0
changelog:
  - Move to single OpenJDK tarball build, based on aarch64/shenandoah-jdk8u.
  - Update to aarch64-shenandoah-jdk8u181-b15.
  - Drop 8165489-pr3589.patch which was only applied to aarch64/jdk8u builds.
  - Split ppc64 Shenandoah fix into separate patch file with its own bug ID (PR3620).
  - Update pr3539-rh1548475.patch to apply after 8187045.
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b16-0
changelog:
  - Update to aarch64-shenandoah-jdk8u181-b16.
  - Drop PR3619 & PR3620 Shenandoah patches which should now be fixed upstream.
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b10.
  - Drop 8146115/PR3508/RH1463098 applied upstream.
  - Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.181.b15-6
changelog:
  - Refreshed upstreamed patches (from 8u202):
    - jdk8044235-src_zip_should_include_all_sources.patch: src.zip should include all sources.
    - jdk8073139-pr2236-rh1191652--use_ppc64le_as_the_arch_directory_on_that_platform_and_report_it_in_os_arch_aarch64_forest.patch,
      jdk8073139-pr1758-rh1191652-ppc64_le_says_its_arch_is_ppc64_not_ppc64le_jdk.patch,
      jdk8073139-pr1758-rh1191652-ppc64_le_says_its_arch_is_ppc64_not_ppc64le_root.patch: PPC64LE JVM reporting issues.
  - Moved both patch series to 8u202 sections.
  - Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.181.b15-7
changelog:
  - Add patch jdk8210425-rh1632174-03-compile_with_o2_and_ffp_contract_off_as_for_fdlibm_zero.patch:
    - Annother fix for optimization gaps (annocheck issues)
    - Zero 8u version fix was missing. Hence, only shows up on Zero arches.
  - Resolves: rhbz#1633817


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.191.b12-1
changelog:
  - updated to aarch64-shenandoah-jdk8u191-b12
  - deleted 8146115-pr3508-rh1463098.patch, pr3619.patch, pr3620.patch - should be upstreamed
  - create pr3634-fix_shenandoah_for_size_t_on_s390.patch to fix build failure on s390
  - Resolves: rhbz#1633817


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.191.b12-8
changelog:
  - added Patch583 jdk8172850-rh1640127-01-register_allocator_crash.patch
  - added Patch584 jdk8209639-rh1640127-02-coalesce_attempted_spill_non_spillable.patch
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b12-9
changelog:
  - Fix patch organisation in the spec file:
  -   * Move ECC patches back to upstreamable section
  -   * Move system cacerts & crypto policy patches to upstreamable section
  -   * Merge "Local fixes" and "RPM fixes" which amount to the same thing
  -   * Move system libpng & lcms patches back to 8u upstreamable section
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b12-9
changelog:
  - Note why PR1834/RH1022017 is not suitable to go upstream in its current form.
  - Resolves: rhbz#1661577


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b12-12
changelog:
  - Add backport of JDK-8029661 which adds TLSv1.2 support to the PKCS11 provider.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b13-0
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b13.
  - Update tarball generation script in preparation for PR3667/RH1656676 SunEC changes.
  - Use remove-intree-libraries.sh to remove the remaining SunEC code for now.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b14-0
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b14.
  - Adjust JDK-8073139/PR1758/RH1191652 to apply following 8155627 backport.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b14-0
changelog:
  - Introduce sa_arches for architectures with sa-jdi.jar and include aarch64
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b14-1
changelog:
  - Add 8131048 & 8164920 (PR3574/RH1498936) to provide a CRC32 intrinsic for PPC64.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.192.b12-0
changelog:
  - Update to aarch64-shenandoah-jdk8u192-b12.
  - Remove patches included upstream
    - JDK-8031668/PR2842
    - JDK-8148351/PR2842
    - JDK-6260348/PR3066
    - JDK-8061305/PR3335/RH1423421
    - JDK-8188030/PR3459/RH1484079
    - JDK-8205104/PR3539/RH1548475
    - JDK-8185723/PR3553
    - JDK-8186461/PR3557
    - JDK-8201509/PR3579
    - JDK-8075942/PR3602
    - JDK-8203182/PR3603
    - JDK-8206406/PR3610/RH1597825
    - JDK-8206425
    - JDK-8036003
    - JDK-8201495/PR2415
    - JDK-8150954/PR2866/RH1176206
  - Re-generate patches (mostly due to upstream build changes)
    - JDK-8073139/PR1758/RH1191652
    - JDK-8143245/PR3548 (due to JDK-8202600)
    - JDK-8197429/PR3546/RH1536622 (due to JDK-8189170)
    - JDK-8199936/PR3533
    - JDK-8199936/PR3591
    - JDK-8207057/PR3613
    - JDK-8210761/RH1632174 (due to JDK-8207402)
    - PR3559 (due to JDK-8185723/JDK-8186461/JDK-8201509)
    - PR3593 (due to JDK-8081202)
    - RH1566890/CVE-2018-3639 (due to JDK-8189170)
    - RH1649664 (due to JDK-8196516)
  - Add 8160748 for AArch64 which is missing from upstream 8u version.
  - Add port of 8189170 to AArch64 which is missing from upstream 8u version.
  - Resolves: rhbz#1661577


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.201.b09-1
changelog:
  - Add backport of JDK-8145096 (PR3693) to fix undefined behaviour issues on newer GCCs
  - Resolves: rhbz#1661577


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.201.b09-5
changelog:
  - Update patch for RH1566890.
    - Renamed rh1566890_speculative_store_bypass_so_added_more_per_task_speculation_control_CVE_2018_3639 to
      rh1566890-CVE_2018_3639-speculative_store_bypass.patch
    - Added dependent patch,
      rh1566890-CVE_2018_3639-speculative_store_bypass_toggle.patch
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.201.b13-1
changelog:
  - Update to aarch64-shenandoah-jdk8u201-b13.
  - Drop JDK-8160748 & JDK-8189170 AArch64 patches now applied upstream.
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.202.b08-1
changelog:
  - Update to aarch64-shenandoah-jdk8u202-b08.
  - Remove patches included upstream
    - JDK-8211387/PR3559
    - JDK-8207057/PR3613
    - JDK-8165852/PR3468
    - JDK-8073139/PR1758/RH1191652
    - JDK-8044235
    - JDK-8172850/RH1640127
    - JDK-8209639/RH1640127
    - JDK-8131048/PR3574/RH1498936
    - JDK-8164920/PR3574/RH1498936
  - Re-generate patches
    - JDK-8210647/RH1632174
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b02-1
changelog:
  - Update to aarch64-shenandoah-jdk8u212-b02.
  - Remove patches included upstream
    - JDK-8197429/PR3546/RH153662{2,3}
    - JDK-8184309/PR3596
    - JDK-8210647/RH1632174
    - JDK-8029661/PR3642/RH1477159
    - JDK-8145096/PR3693
  - Re-generate patches
    - JDK-8203030
  - Add casts to resolve s390 ambiguity in calls to log2_intptr
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b04-2
changelog:
  - Add JDK-8223219 to avoid -fstack-protector overriding -fstack-protector-strong
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b04-3
changelog:
  - Remove additions to EXTRA_CFLAGS and EXTRA_CPP_FLAGS which are now made by upstream.
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b04-4
changelog:
  - Update to aarch64-shenandoah-jdk8u212-b04-shenandoah-merge-2019-04-30.
  - Update version logic to handle -shenandoah* tag suffix.
  - Drop PR3634 as applied upstream.
  - Adjust 8214206 fix for S390 as BinaryMagnitudeSeq moved to shenandoahNumberSeq.cpp
  - Update 8214206 to use log2_long rather than casting to intptr_t, which may be smaller than size_t.
  - Resolves: rhbz#1688365
  - Resolves: rhbz#1688382


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b04-5
changelog:
  - Handle milestone as variables so we can alter it easily and set the docs zip filename appropriately.
  - Drop unused use_shenandoah_hotspot variable.
  - Resolves: rhbz#1724452


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.212.b04-5
changelog:
  - Don't produce javadoc/javadoc-zip sub packages for the debug variant build.
  - Don't perform a bootcycle build for the debug variant build.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b04-5
changelog:
  - Obsolete javadoc-debug and javadoc-debug-zip packages via javadoc and javadoc-zip respectively.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b01-1
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b01.
  - Refactor PR2888 after inclusion of 8129988 upstream. Now includes PR3575.
  - Drop 8171000 & 8197546 as applied upstream.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b01-1
changelog:
  - Drop unnecessary build requirement on gtk2-devel, as OpenJDK searches for Gtk+ at runtime.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b01-1
changelog:
  - Add missing build requirements for libXext-devel and libXrender-devel, previously masked by Gtk2+ dependency.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b01-1
changelog:
  - fontconfig build requirement should be fontconfig-devel, previously masked by Gtk2+ dependency
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b02-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b02.
  - Drop 8064786/PR3599 & 8210416/RH1632174 as applied upstream (8064786 silently in 8176100).
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b03.
  - Drop 8210425 patches applied upstream. Still need to add AArch64 version in aarch64/shenandoah-jdk8u.
  - Re-generate JDK-8141570 & JDK-8143245 patches due to 8210425 zeroshark.make changes.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b04.
  - Drop remaining JDK-8210425/RH1632174 patch now AArch64 part is upstream.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b07-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b07 and Shenandoah merge 2019-06-13.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b08-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b08.
  - Adjust PR3083/RH134640 to apply after JDK-8182999
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b09-1
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b10-2
changelog:
  - Backport FIPS mode patch to java-1.8.0-openjdk, simplifying provider removal.
  - Resolves: rhbz#1655466


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b10-2
changelog:
  - nss.fips.cfg needs to be moved to %{etcjavadir} and symlinked into the JDK, like nss.cfg
  - Resolves: rhbz#1655466


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b10-3
changelog:
  - SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the name in the config file.
  - Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with nss.cfg.
  - Resolves: rhbz#1750752


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b01.
  - Switch to EA mode.
  - Drop JDK-8210761/RH1632174 as now upstream.
  - Drop JDK-8223219 as now upstream.
  - JDK-8226870 removed clhsdb and hdsdb from the JRE bin directory, so we should do likewise.
  - Add alternatives support for these two new SDK binaries.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b05.
  - Drop upstreamed patch JDK-8141570/PR3548.
  - Adjust context of JDK-8143245/PR3548 to apply against upstream JDK-8141570.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-1
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b09.
  - Switch to GA mode for final release.
  - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Resolves: rhbz#1753423


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-4
changelog:
  - Remove CVE-2018-3639 mitigation due to performance regression and
      OpenJDK position on speculative execution vulnerabilities.
      https://mail.openjdk.java.net/pipermail/vuln-announce/2019-July/000002.html
  - Resolves: rhbz#1750419


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-5
changelog:
  - Revert SSBD removal for now, until appropriate messaging has been decided.
  - Resolves: rhbz#1750419


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-6
changelog:
  - Update generate_source_tarball.sh script to use the PR3756 patch and retain the secp256k1 curve.
  - Regenerate source tarball using the updated script and add the -'4curve' suffix.
  - Resolves: rhbz#1746879


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b05.
  - Attempt to fix Shenandoah formatting failures on S390, introduced by JDK-8232102.
  - Revise b05 snapshot to include JDK-8236178.
  - Add additional Shenandoah formatting fixes revealed by successful -Wno-error=format run
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b07-1
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b07.
  - Switch to GA mode for final release.
  - Remove Shenandoah S390 patch which is now included upstream as JDK-8236829.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b08-1
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b08.
  - Remove local copies of JDK-8031111 & JDK-8132111 as replaced by upstream versions.
  - Resolves: rhbz#1785753


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b08-2
changelog:
  - Sync SystemTap & desktop files with upstream IcedTea release 3.11.0 using new script
  - Resolves: rhbz#1737112


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b08-2
changelog:
  - Sync SystemTap & desktop files with upstream IcedTea release 3.15.0, removing previous workarounds
  - Resolves: rhbz#1737112


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b08-3
changelog:
  - Add JDK-8165996/PR3506 & JDK-8195607/PR3776 to support NSS SQLite databases.
  - Resolves: rhbz#1760437


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b08-4
changelog:
  - Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
  - Resolves: rhbz#1737112


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u252-b01.
  - Switch to EA mode.
  - Adjust JDK-8199936/PR3533 patch following JDK-8227397 configure change
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u252-b03.
  - Adjust PR2974/RH1337583 & PR3083/RH1346460 following context changes in JDK-8230978
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b09-1
changelog:
  - Update to aarch64-shenandoah-jdk8u252-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1810557


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b09-5
changelog:
  - Add support for fastdebug builds on x86_64 only.
  - Drop redundant slowdebug/debug sed invocation on the docs zip filename as it is only now built for non-debug.
  - Resolves: rhbz#1836067


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b09-7
changelog:
  - Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to disable).
  - Resolves: rhbz#1655466


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b01.
  - Switch to EA mode.
  - Adjust JDK-8143245/PR3548 patch following context changes due to JDK-8203287 for JFR
  - Adjust RH1648644 following context changes due to introduction of JFR packages
  - Add jfr binary to devel package and alternatives set
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b02-0.2.ea
changelog:
  - Enable JFR in our builds, ahead of upstream default.
  - Only enable JFR for JIT builds, as it is not supported with Zero.
  - Turn off JFR on x86 for now due to assert(SerializePageShiftCount == count) crash.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b02-0.2.ea
changelog:
  - Introduce jfr_arches for architectures which support JFR.
  - Fix path to jfr.jar.
  - Use sa_arches for libsaproc.so inclusion.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b05-0.2.ea
changelog:
  - Use RSA as default for keytool, as DSA is disabled in all crypto policies except LEGACY
  - Resolves: rhbz#1582504


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b07-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b07.
  - Require tzdata 2020a so system tzdata matches resource updates in b07
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.1.ea
changelog:
  - With JDK-8248399 fixed, a broken jfr binary is no longer installed on architectures without JFR.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.3.ea
changelog:
  - Restructure the build so a minimal initial build is then used for the final build (with docs)
  - This reduces pressure on the system JDK and ensures the JDK being built can do a full build
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b10-1
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u262 release.
  - Fix typo in jfr_arches which leads to ppc64 being wrongly excluded.
  - Split JDK-8042159 patch into per-repo patches as upstream.
  - Update JDK-8042159 JDK patch to apply after JDK-8238002 changes to Awt2dLibraries.gmk
  - Resolves: rhbz#1838811


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.262.b10-3
changelog:
  - ASSEMBLY_EXCEPTION LICENSE THIRD_PARTY_README moved to fully versioned dirs
  - Resolves: rhbz#1831665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.265.b01-1
changelog:
  - Update to aarch64-shenandoah-jdk8u265-b01.
  - Update release notes for 8u265 release.
  - Resolves: rhbz#1860453


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.265.b01-2
changelog:
  - Add backport of JDK-8223482 so PKCS#11 FIPS provider does not offer unsupported ciphers.
  - Resolves: rhbz#1860965


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.265.b01-3
changelog:
  - Add backport of JDK-8251117 to allow key length to be retrieved from PKCS#11 FIPS keys
  - Resolves: rhbz#1860993


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b01.
  - Switch to EA mode.
  - Add debugging output for build.
  - JFR must now be explicitly disabled when unwanted (e.g. x86), following switch of upstream default.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b02-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b02.
  - Remove JDK-8154313 backport now applied upstream.
  - Change target from 'zip-docs' to 'docs-zip', which is the naming used upstream.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b04.
  - Update tarball generation script to use PR3795, following inclusion of JDK-8177334
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b05.
  - Add additional s390 size_t case in g1ConcurrentMarkObjArrayProcessor.cpp introduced by JDK-8057003
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b05-shenandoah-merge-2020-08-28.
  - Add additional s390 log2_intptr case in shenandoahUtils.cpp introduced by JDK-8245464
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.3.ea
changelog:
  - Enable JFR on x86, now we have JDK-8252096: Shenandoah: adjust SerialPageShiftCount for x86_32 and JFR
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b06-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b06.
  - Update tarball generation script to use PR3799, following inclusion of JDK-8245468 (TLSv1.3)
  - Remove JDK-8165996/PR3506/RH1760437 & JDK-8251117/RH1860990 as now applied upstream.
  - Replace JDK-8223482/RH1860965 with RH1860986 (disable TLSv1.3 when using the NSS-FIPS provider)
  - Resolves: rhbz#1876665


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.272.b09-0.2.ea
changelog:
  - Set vendor property and vendor URLs
  - Made URLs to be preconfigured by OS
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b09-0.2.ea
changelog:
  - Include a test in the RPM to check the build has the correct vendor information.
  - Use 'oj_' prefix on new vendor globals to avoid a conflict with RPM's vendor value.
  - Improve quoting of vendor name
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-1
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u272 release.
  - Add backport of JDK-8254177 to update to tzdata 2020b
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - Delay tzdata 2020b dependency until tzdata update has shipped.
  - Adjust JDK-8062808/PR3548 following constantPool.hpp context change in JDK-8243302
  - Adjust PR3593 following g1StringDedupTable.cpp context change in JDK-8240124 & JDK-8244955
  - This tarball is embargoed until 2020-10-20 @ 1pm PT.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-2
changelog:
  - Add backport of JDK-8215727: "Restore JFR thread sampler loop to old / previous behaviour"
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-4
changelog:
  - Bump release number to build on RHEL 8.4.0 branch.
  - Resolves: rhbz#1876665
  - Resolves: rhbz#1889414


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-6
changelog:
  - Add backport of JDK-8223940: "Private key not supported by chosen signature algorithm" to handle lack of provider RSAPSS support
  - Resolves: rhbz#1892216


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.275.b01-2
changelog:
  - Update to aarch64-shenandoah-jdk8u275-b01 (GA)
  - Update release notes for 8u275.
  - Remove JDK-8223940/RH1892216 backport now included in upstream 8u275.
  - Remove JDK-8236512/RH1889414 backport now included in upstream 8u275.
  - Resolves: rhbz#1895060


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.275.b01-3
changelog:
  - added patch600, rh1750419-redhat_alt_java.patch
  - Replaced alt-java palceholder by real pathced alt-java
  - remove patch529 rh1566890-CVE_2018_3639-speculative_store_bypass.patch
  - remove patch531 rh1566890-CVE_2018_3639-speculative_store_bypass_toggle.patch
  - both suprassed by new patch
  - Resolves: rhbz#1750419


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b01 (EA)
  - Update release notes for 8u282-b01.
  - Switch to EA mode.
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - Remove PR3601, covered upstream by JDK-8062808.
  - Remove upstreamed JDK-8197981/PR3548, JDK-8062808/PR3548, JDK-8254177 & JDK-8215727.
  - Extend RH1750419 alt-java fix to include external debuginfo, following JDK-8252395
  - Resolves: rhbz#1903904


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b02-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b02 (EA)
  - Update release notes for 8u282-b02.
  - Resolves: rhbz#1903904


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b02-0.2.ea
changelog:
  - Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always occurs.
  - Resolves: rhbz#1906862


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b03 (EA)
  - Update release notes for 8u282-b03.
  - Resolves: rhbz#1903904


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b04 (EA)
  - Update release notes for 8u282-b04.
  - Remove upstreamed patch PR3519
  - Resolves: rhbz#1903904


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b05 (EA)
  - Update release notes for 8u282-b05 and make some minor corrections.
  - Resolves: rhbz#1903904


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b06-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b06 (EA)
  - Update release notes for 8u282-b06.
  - Resolves: rhbz#1903904


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b07-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b07 (EA)
  - Update release notes for 8u282-b07.
  - Fix placement issue in release notes, caught by comparing with vanilla version.
  - Resolves: rhbz#1903904


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b08-1
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b08 (GA)
  - Update release notes for 8u282-b08.
  - Resolves: rhbz#1908967


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b08-2
changelog:
  - Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode
  - Resolves: rhbz#1913868


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b01-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b01 (EA)
  - Update release notes for 8u292-b01.
  - Switch to EA mode.
  - Update tarball generation script to use PR3822 which handles
      JDK-8233228 & JDK-8035166 changes
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b02-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b02 (EA)
  - Update release notes for 8u292-b02.
  - Remove RH1868759 patch as this is now resolved upstream by JDK-8258833.
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b03-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b03 (EA)
  - Update release notes for 8u292-b03.
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b04-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b04 (EA)
  - Update release notes for 8u292-b04.
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b05 (EA)
  - Update release notes for 8u292-b05.
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.3.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b05-shenandoah-merge-2021-03-11 (EA)
  - Update release notes for 8u292-b05-shenandoah-merge-2021-03-11.
  - Re-organise S/390 patches for upstream submission, separating 8u upstream from Shenandoah fixes.
  - Add new formatting case found in memprofiler.cpp on debug builds to PR3593 patch.
  - Extend s390 patch to fix issue caused by JDK-8252660 backport and lack of JDK-8188813 in 8u.
  - Revise JDK-8252660 s390 failure to make _soft_max_size a jlong so pointer types are accurate.
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b06-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b06 (EA)
  - Update release notes for 8u292-b06.
  - Require tzdata 2020f due to JDK-8259048
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b07-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b07 (EA)
  - Update release notes for 8u292-b07.
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b08-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b08 (EA)
  - Update release notes for 8u292-b08.
  - Require tzdata 2021a due to JDK-8260356
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b09-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b09 (EA)
  - Update release notes for 8u292-b09.
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b10-2
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b10 (GA)
  - Update release notes for 8u292-b10.
  - This tarball is embargoed until 2021-04-20 @ 1pm PT.
  - Resolves: rhbz#1938201


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b01-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b01 (EA)
  - Update release notes for 8u302-b01.
  - Switch to EA mode.
  - Resolves: rhbz#1967812


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.302.b01-0.1.ea
changelog:
  - adapted to newst cjc to fix issue with rpm 4.17
  - Disable copy-jdk-configs for Flatpak builds
  - removed cjc backward comaptiblity, to fix when both rpm 4.16 and 4.17 are in transaction
  - Resolves: rhbz#1953923


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b01-0.2.ea
changelog:
  - Cleanup architecture handling in preparation for extending set of fastdebug architectures
  - Fixed not-including fastdebug build in case of --without fastdebug
  - Resolves: rhbz#1969254


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b02-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b02 (EA)
  - Update release notes for 8u302-b02.
  - Resolves: rhbz#1967812


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b03-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b03 (EA)
  - Update release notes for 8u302-b03.
  - Resolves: rhbz#1967812


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b03-shenandoah-merge-2021-06-23 (EA)
  - Update release notes for 8u302-b03-shenandoah-merge-2021-06-23.
  - Resolves: rhbz#1967812


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b03-0.3.ea
changelog:
  - Introduced nm based check to verify alt-java on x86_64 is patched, and no other alt-java or java is patched
  - Patch600, rh1750419-redhat_alt_java.patch, amended to die, if it is used wrongly
  - Introduced ssbd_arches with currently only valid arch of x86_64 to separate real alt-java architectures
  - Resolves: rhbz#1966233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b04-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b04 (EA)
  - Update release notes for 8u302-b04.
  - Resolves: rhbz#1967812


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b05-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b05 (EA)
  - Update release notes for 8u302-b05.
  - Resolves: rhbz#1967812


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b05-0.1.ea
changelog:
  - Use the "reverse" build loop (debug first) as the main and only build loop to get more diagnostics.
  - Resolves: rhbz#1966233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b05-0.2.ea
changelog:
  - Remove restriction on disabling product build, as debug packages no longer have javadoc packages.
  - Fix name of javadoc debug packages in Obsoletes declarations and add version where it was removed.
  - Resolves: rhbz#1966233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b06-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b06 (EA)
  - Update release notes for 8u302-b06.
  - Resolves: rhbz#1967812


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b07 (EA)
  - Update release notes for 8u302-b07.
  - Resolves: rhbz#1967812


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b08-1
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b08 (EA)
  - Update release notes for 8u302-b08.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-07-20 @ 1pm PT.
  - Resolves: rhbz#1972395


author: Martin Balao <mbalao@redhat.com> - 1:1.8.0.302.b08-2
changelog:
  - Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library.
  - Resolves: rhbz#1971679


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b08-2
changelog:
  - Port FIPS system detection support to OpenJDK 8u
  - Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled in configure.
  - Remove unneeded Requires on NSS as it will now be dynamically linked and detected by RPM.
  - Resolves: rhbz#1971679


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b01 (EA)
  - Update release notes for 8u312-b01.
  - Switch to EA mode.
  - Remove "-clean" suffix as no 8u312 builds are unclean.
  - Related: rhbz#1999937


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b02-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b02 (EA)
  - Update release notes for 8u312-b02.
  - Related: rhbz#1999937


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b03 (EA)
  - Update release notes for 8u312-b03.
  - Related: rhbz#1999937


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b04 (EA)
  - Update release notes for 8u312-b04.
  - Related: rhbz#1999937


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b05 (EA)
  - Update release notes for 8u312-b05.
  - Resolves: rhbz#1999937


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.2.ea
changelog:
  - Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
  - Resolves: rhbz#1994659


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.3.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b05-shenandoah-merge-2021-10-07
  - Update release notes for 8u312-b05-shenandoah-merge-2021-10-07.
  - Related: rhbz#1999937


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b07-3
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b07 (EA)
  - Update release notes for 8u312-b07.
  - Switch to GA mode for final release.
  - Resolves: rhbz#2012339


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.312.b07-4
changelog:
  - Use 'sql:' prefix in nss.fips.cfg as F35+ no longer ship the legacy
    secmod.db file as part of nss
  - Resolves: rhbz#2023532


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b07-5
changelog:
  - Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
  - Related: rhbz#2022815


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b01 (EA)
  - Update release notes for 8u322-b01.
  - Switch to EA mode.
  - Related: rhbz#2022815


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b02-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b02 (EA)
  - Update release notes for 8u322-b02.
  - Related: rhbz#2022815


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b03 (EA)
  - Update release notes for 8u322-b03.
  - Related: rhbz#2022815


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b04 (EA)
  - Update release notes for 8u322-b04.
  - Require tzdata 2021c as of JDK-8274407.
  - Related: rhbz#2022815


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b05 (EA)
  - Update release notes for 8u322-b05.
  - Require tzdata 2021e as of JDK-8275766.
  - Update tarball generation script to use git following shenandoah-jdk8u's move to github
  - Resolves: rhbz#2022815


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-2
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b06 (EA)
  - Update release notes for 8u322-b06.
  - Switch to GA mode for final release.
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-3
changelog:
  - Fix FIPS issues in native code and with initialisation of java.security.Security
  - Resolves: rhbz#2021263


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-4
changelog:
  - Refactor build functions so we can build just HotSpot without any attempt at installation.
  - Introduce architecture restriction logic for the gdb test. (RH2041970)
  - Pass compiler flags to the ADLC build (JDK-8281098)
  - Adjust JDK8199936/PR3533 -mstackrealign patch to instead pass -mincoming-stack-boundary=2 -mpreferred-stack-boundary=4
  - Explicitly list JIT architectures rather than relying on those with slowdebug builds
  - Disable the serviceability agent on Zero architectures even when the architecture itself is supported
  - Add backport of JDK-8257794 to fix bogus assert on slowdebug x86-32 Zero builds
  - Sync minor placement differences with Fedora & RHEL 9
  - Resolves: rhbz#2022815


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-5
changelog:
  - Separate crypto policy initialisation from FIPS initialisation, now they are no longer interdependent
  - Resolves: rhbz#2052817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-6
changelog:
  - Detect NSS at runtime for FIPS detection
  - Turn off build-time NSS linking and go back to an explicit Requires on NSS
  - Resolves: rhbz#2052828


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.322.b06-8
changelog:
  - alternatives creation moved to posttrans
  - Thus fixing the old reisntall issue:
  - https://bugzilla.redhat.com/show_bug.cgi?id=1200302
  - https://bugzilla.redhat.com/show_bug.cgi?id=1976053
  - Resolves: rhbz#2008192


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.322.b06-11
changelog:
  - Storing and restoring alterntives during update manually
  - Fixing Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives and select (as auto) system JDK/JRE
  -- The move of alternatives creation to posttrans to fix:
  -- Bug 1200302 - dnf reinstall breaks alternatives
  -- Had caused the alternatives to be removed, and then created again,
  -- instead of being added, and then removing the old, and thus persisting
  -- the selection in family
  -- Thus this fix, is storing the family of manually selected master, and if
  -- stored, then it is restoring the family of the master
  - Resolves: rhbz#2008192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u332-b01 (EA)
  - Update release notes for shenandoah-8u332-b01.
  - Switch to EA mode.
  - Remove JDK-8279077 patch now upstream.
  - Related: rhbz#2047536


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b06-0.1.ea
changelog:
  - Update to shenandoah-jdk8u332-b06 (EA)
  - Update release notes for shenandoah-8u332-b06.
  - Resolves: rhbz#2047536


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b06-0.2.ea
changelog:
  - Allow the default keystore to be configured using security.systemCACerts
  - Use of the property can now be disabled using -Djava.security.disableSystemCACerts=true
  - Resolves: rhbz#2055274


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b09-3
changelog:
  - Update to shenandoah-jdk8u332-b09 (GA)
  - Update release notes for 8u332-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#2074646


author: Francisco Ferrari Bihurriet <fferrari@redhat.com> - 1:1.8.0.332.b09-4
changelog:
  - RH2007331: SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode
  - Resolves: rhbz#2102431


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b09-5
changelog:
  - Rebase FIPS patches from fips branch and simplify by using a single patch from that repository
  - * RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
  - * RH2090378: Revert to disabling system security properties and FIPS mode support together
  - Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
  - Rebase PR2888/RH2055274 cacerts patch so it applies after the current FIPS patch
  - Perform configuration changes (e.g. nss.cfg, nss.fips.cfg, tzdb.dat) in installjdk
  - Enable system security properties in the RPM (now disabled by default in the FIPS repo)
  - Improve security properties test to check both enabled and disabled behaviour
  - Run security properties test with property debugging on
  - Explicitly require crypto-policies during build and runtime for system security properties
  - Resolves: rhbz#2097152
  - Resolves: rhbz#2100675


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.342.b06-0.1.ea
changelog:
  - Update to shenandoah-jdk8u342-b06 (EA)
  - Update release notes for shenandoah-8u342-b06.
  - Switch to EA mode for 8u342 pre-release builds.
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Use "git apply" with patches in the tarball script to allow binary diffs
  - Remove redundant "REPOS" variable from tarball script
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Resolves: rhbz#2083265


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.342.b07-2
changelog:
  - Update to shenandoah-jdk8u342-b07 (GA)
  - Update release notes for 8u342-b07.
  - Switch to GA mode for final release.
  - Resolves: rhbz#2106507


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.345.b01-2
changelog:
  - Update to shenandoah-jdk8u345-b01 (GA)
  - Update release notes for 8u345-b01.
  - Resolves: rhbz#2112403


author: Stephan Bergmann <sbergman@redhat.com> - 1:1.8.0.345.b01-3
changelog:
  - Disable copy-jdk-configs for Flatpak builds
  - Fix flatpak builds by exempting them from bootstrap
  - Resolves: rhbz#2102733


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.345.b01-4
changelog:
  - Sync system cacerts support with RHEL 9, disabling using -Dsecurity.systemCACerts=
  - Move cacerts replacement to install section and retain original of this and tzdb.dat
  - Related: rhbz#2055274


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.345.b01-5
changelog:
  - Switch to static builds, reducing system dependencies and making build more portable
  - Resolves: rhbz#2048542


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b07-0.2.ea
changelog:
  - Update to shenandoah-jdk8u352-b07 (EA)
  - Update release notes for shenandoah-8u352-b07.
  - Switch to EA mode for 8u352 pre-release builds.
  - Rebase FIPS patch against 8u352-b07
  - Resolves: rhbz#2130612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b08-2
changelog:
  - Update to shenandoah-jdk8u352-b08 (GA)
  - Update release notes for shenandoah-8u352-b08.
  - Switch to GA mode for final release.
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Add test to ensure timezones can be translated
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b01-0.3.ea
changelog:
  - Update to shenandoah-jdk8u362-b01 (EA)
  - Update release notes for shenandoah-8u362-b01.
  - Switch to EA mode for 8u362 pre-release builds.
  - Drop JDK-8195607/PR3776/RH1760437 now this is upstream
  - Related: rhbz#2150193


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b07-0.3.ea
changelog:
  - Update to shenandoah-jdk8u362-b07 (EA)
  - Update release notes for shenandoah-8u362-b07.
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Drop tzdata patches for 2022d & 2022e (JDK-8294357 & JDK-8295173) which are now upstream
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
  - Drop JDK-8255559/RH2124390 patch which is now upstream
  - Resolves: rhbz#2150193


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b08-3
changelog:
  - Update to shenandoah-jdk8u352-b08 (GA)
  - Update release notes for shenandoah-8u352-b08.
  - Fix broken links and missing release notes in older releases.
  - Drop RH1163501 patch which is not upstream or in 11, 17 & 19 packages and seems obsolete
    - Patch was broken by inclusion of "JDK-8293554: Enhanced DH Key Exchanges"
    - Patch was added for a specific corner case of a 4096-bit DH key on a Fedora host that no longer exists
    - Fedora now appears to be using RSA and the JDK now supports ECC in preference to large DH keys
  - Resolves: rhbz#2160111


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b09-3
changelog:
  - Update cacerts patch to fix OPENJDK-1433 SecurityManager issue
  - Update to shenandoah-jdk8u352-b09 (GA)
  - Update release notes for shenandoah-8u352-b09.
  - Resolves: rhbz#2162715


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b09-4
changelog:
  - On portable architectures, replace build section with extraction of existing builds from portables
  - Rewrite ELF files so the source file path is correct and debugsources can be assembled
  - Resolves: rhbz#2150203


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.372.b07-2
changelog:
  - Update to shenandoah-jdk8u372-b07 (GA)
  - Update release notes for shenandoah-8u372-b07.
  - Require tzdata 2023c due to inclusion of JDK-8305113 in 8u372-b07
  - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
  - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
  - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
  - Drop JDK-8275535/RH2053256 patch which is now upstream
  - Include JDK-8271199 backport early ahead of 8u382 (RH2175317)
  - Drop hack for difference in local and portable build version
  - Replace local copies of JDK portable binaries with build dependencies
  - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
  - Resolves: rhbz#2185182
  - Resolves: rhbz#2189328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.372.b07-3
changelog:
  - Revert "Restore native build for x86 as there is no portable build"
  - Retain portable_build-arches with x86-32 added for reference
  - Remove NEWS.
  - Related: rhbz#2189328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.372.b07-4
changelog:
  - Include the java-1.8.0-openjdk-portable.spec file with instructions on how to rebuild.
  - Remove duplicate use of README.md inside the *-src package (it is no longer about sources)
  - Related: rhbz#2189328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u382-b01 (EA)
  - Switch to EA mode.
  - Remove JDK-8271199 patch which is now upstream.
  - Add version of bundled zlib (bumped from 1.2.11 to 1.2.13 with this update)
  - Introduce 'prelease' for the portable release versioning, to handle EA builds
  - Sync the copy of the portable specfile with the latest update
  - Related: rhbz#2217710


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:1.8.0.412.b01-0.2.ea
changelog:
  - Invoke xz in multi-threaded mode
  - generate_source_tarball.sh: Add WITH_TEMP environment variable
  - generate_source_tarball.sh: Multithread xz on all available cores
  - generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
  - generate_source_tarball.sh: Update comment about tarball naming
  - generate_source_tarball.sh: Reformat comment header
  - generate_source_tarball.sh: Reformat and update help output
  - generate_source_tarball.sh: Do a shallow clone, for speed
  - generate_source_tarball.sh: Eliminate some removal prompting
  - generate_source_tarball.sh: Make tarball reproducible
  - generate_source_tarball.sh: Prefix temporary directory with temp-
  - generate_source_tarball.sh: Remove temporary directory exit conditions
  - generate_source_tarball.sh: Set compile-command in Emacs
  - generate_source_tarball.sh: Remove REPO_NAME from FILE_NAME_ROOT
  - generate_source_tarball.sh: Move PROJECT_NAME and REPO_NAME checks
  - generate_source_tarball.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - generate_source_tarball.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: shellcheck: Do not use -a (SC2166)
  - generate_source_tarball.sh: shellcheck: Do not use $ on arithmetic variables (SC2004)
  - Use backward-compatible patch syntax
  - generate_source_tarball.sh: Ignore -ga tags with OPENJDK_LATEST
  - generate_source_tarball.sh: Remove trailing period in echo
  - generate_source_tarball.sh: Use long-style argument to grep
  - generate_source_tarball.sh: Add license
  - generate_source_tarball.sh: Add indentation instructions for Emacs
  - Related: RHEL-30931


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b01-0.2.ea
changelog:
  - Turn off xz multi-threading on i686 as it fails with an out of memory error
  - Move to upstream tag style (shenandoah8ux-by) in preparation for eventually moving back to official sources
  - generate_source_tarball.sh: Rename JCONSOLE_JS_PATCH{,_DEFAULT} to JCONSOLE_PATCH{,_DEFAULT} for brevity
  - generate_source_tarball.sh: Adapt OPENJDK_LATEST logic to work with 8u Shenandoah fork
  - generate_source_tarball.sh: Adapt version logic to work with 8u
  - generate_source_tarball.sh: Add quoting for SCRIPT_DIR and JCONSOLE_PATCH (SC2086)
  - generate_source_tarball.sh: Update examples in header for clarity
  - generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
  - generate_source_tarball.sh: Only add --depth=1 on non-local repositories
  - Move maintenance scripts to a scripts subdirectory
  - icedtea_sync.sh: Update with a VCS mode that retrieves sources from a Mercurial repository
  - discover_trees.sh: Set compile-command and indentation instructions for Emacs
  - discover_trees.sh: shellcheck: Do not use -o (SC2166)
  - discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: Add authorship
  - icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
  - icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
  - icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: Set compile-command and indentation instructions for Emacs
  - openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
  - openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
  - Remove obsolete file generate_singlerepo_source_tarball.sh
  - Remove obsolete file get_sources.sh
  - Remove obsolete file update_main_sources.sh
  - generate_source_tarball.sh: Handle an existing checkout
  - generate_source_tarball.sh: Sync indentation with java-21-openjdk version
  - generate_source_tarball.sh: Support using a subdirectory via TO_COMPRESS
  - Sync patch set with portable build
  - Related: RHEL-30931


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b07-0.2.ea
changelog:
  - Update to shenandoah-jdk8u412-b07 (EA)
  - Require tzdata 2024a due to upstream inclusion of JDK-8322725
  - Only require tzdata 2023d for now as 2024a is unavailable in buildroot
  - Sync the copy of the portable specfile with the latest update
  - Related: RHEL-30931


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b08-2
changelog:
  - Update to shenandoah-jdk8u412-b08 (GA)
  - Update release notes for shenandoah-8u412-b08.
  - Complete release note for Certainly roots
  - Switch to GA mode.
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
  - Resolves: RHEL-32396


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.422.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u422-b01 (EA)
  - Update release notes for shenandoah-8u422-b01.
  - Switch to EA mode.
  - Sync the copy of the portable specfile with the latest update
  - Restore NEWS file and rename remove-intree-libraries.sh so portable can be rebuilt
  - Document policy repacking script and rename to correct spelling and style
  - Limit Java only tests to one architecture using jdk_test_arch
  - Related: RHEL-46866
  - Resolves: RHEL-47067
  - Resolves: RHEL-47087


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.422.b05-1.1
changelog:
  - Update to shenandoah-jdk8u422-b05 (GA)
  - Update release notes for shenandoah-8u422-b05.
  - Rebase PR2462 patch following patched hunk being removed by JDK-8322106
  - Switch to GA mode.
  - Sync the copy of the portable specfile with the latest update
  - Actually require tzdata 2024a now it is available in the buildroot
  - Add missing build dependencies on zlib-devel and tar
  - Update LCMS version to match JDK-8245400
  - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **
  - Resolves: RHEL-46866
  - Resolves: RHEL-47001


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.432.b06-1
changelog:
  - Update to shenandoah-jdk8u432-b06 (GA)
  - Update release notes for shenandoah-8u432-b06.
  - Drop JDK-828109{6,7,8}/PR3836 patch following integration of upstream version
  - Regenerate JDK-8199936/PR3533 patch following JDK-828109{6,7,8} integration
  - Bump version of bundled zlib to 1.3.1 following JDK-8324632
  - Include backport of JDK-8328999 to update giflib to 5.2.2
  - Bump version of bundled giflib to 5.2.2 following JDK-8328999
  - Add build scripts to repository to ease remembering all CentOS & RHEL targets and options
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-58791
  - Resolves: RHEL-62278
  - Resolves: RHEL-61285
  - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b05-0.2.ea
changelog:
  - Update to 8u442-b05 (EA).
  - Update release notes for 8u442-b05.
  - Switch to EA mode for pre-release.
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-73995


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b05-0.3.ea
changelog:
  - Add zero_arches to the portable_build_arches now that the portable build bundles libffi
  - Temporarily workaround libffi.so not being in lib/%{archinstall} by copying it
  - Exclude libffi.so from the debugedit run
  - Add a simple -version check on both the JDK and JRE bin/java
  - Add libffi.so to the filelist, including expanding the lib/%{archinstall} contents as with jre/lib
  - Sync the copy of the portable specfile and new patches with the latest update
  - Resolves: RHEL-74303


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b06-2
changelog:
  - Update to 8u442-b06 (GA)
  - Update release notes for 8u442-b06.
  - Switch to GA mode for final release
  - Revise JDK-8141590 backport to install libffi.so* in lib as well as jre/lib
  - Sync the copy of the portable specfile with the latest update
  - Remove libffi.so copying workaround now the portable build installs it in lib
  - Add bundled libffi.so to _privatelibs
  - Remove libffi.so copy if we are building on the same platform as the portable
  - Resolves: RHEL-73542
  - Related: RHEL-74303


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.452.b09-1
changelog:
  - Update to 8u452-b09 (GA)
  - Update release notes for 8u452-b09.
  - Remove long option documentation from JDK-8335912/JDK-8337499 as not present in 8u
  - Require tzdata 2025a due to upstream inclusion of JDK-8347965
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-04-15 @ 1pm PT. **
  - Resolves: RHEL-86973
  - Resolves: RHEL-86616


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.462.b08-1
changelog:
  - Update to 8u462-b08 (GA)
  - Update release notes for 8u462-b08.
  - Require tzdata 2025b due to upstream inclusion of JDK-8352716
  - Add early backport of JDK-8339414
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **
  - Resolves: RHEL-101654
  - Resolves: RHEL-102307
  - Resolves: RHEL-102907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-4
changelog:
  - Include the java-11-openjdk-portable.spec file with instructions on how to rebuild.
  - Related: rhbz#2189327


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.8-1
changelog:
  - Update to jdk-11.0.20.0+8 (GA)
  - Update release notes to 11.0.20.0+8
  - Drop local inclusion of JDK-8274864 & JDK-8305113 as they are included in 11.0.20+1
  - Bump tzdata requirement to 2023c now it is available in the buildroot
  - Bump bundled LCMS version to 2.15 as in jdk-11.0.20+1.
  - Bump bundled HarfBuzz version to 7.0.1 as in jdk-11.0.20+7
  - Use tapsets from the misc tarball
  - Introduce 'prelease' for the portable release versioning, to handle EA builds
  - Make sure root installation directory is created first
  - Use in-place substitution for all but the first of the tapset changes
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2217713
  - Resolves: rhbz#2196318
  - Resolves: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.8-2
changelog:
  - Sync the copy of the portable specfile with the latest update
  - Add note at top of spec file about rebuilding
  - Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.8-3
changelog:
  - Fix tzdata requirement copy-and-paste error that led to two BuildRequires and no Requires
  - Resolves: rhbz#2224411


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.1.1-1
changelog:
  - Update to jdk-11.0.20.1+1 (GA)
  - Add backport of JDK-8312489 already upstream in 11.0.22 (see OPENJDK-2095)
  - Add backport of JDK-8243210 already upstream in 11.0.21 (see RH2229269)
  - Update openjdk_news script to specify subdirectory last
  - Add missing discover_trees script required by openjdk_news
  - Resolves: rhbz#2236589


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.21.0.9-2
changelog:
  - Update to jdk-11.0.21+9 (GA)
  - Sync the copy of the portable specfile with the latest update
  - Re-generate FIPS patch against 11.0.21+1 following backport of JDK-8155246
  - Re-generate SHA3 patch following backport of JDK-8242151
  - Bump libpng version to 1.6.39 following JDK-8305815
  - Bump HarfBuzz version to 7.2.0 following JDK-8307301
  - Bump freetype version to 2.13.0 following JDK-8306881
  - Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Apply all patches using -p1
  - Drop local backport of JDK-8243210 which is upstream from 11.0.21+2
  - Add missing JFR alternative ghost
  - Move jcmd to the headless package
  - ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
  - Resolves: RHEL-12222
  - Resolves: RHEL-13546
  - Resolves: RHEL-13553
  - Resolves: RHEL-13559
  - Resolves: RHEL-13566
  - Resolves: RHEL-13572


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.22.0.7-1
changelog:
  - Update to jdk-11.0.22+7 (GA)
  - Sync the copy of the portable specfile with the latest update
  - Drop local copy of JDK-8312489 which is now included upstream
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
  - Resolves: RHEL-20981


author: Jiri Vanek <jvanek@redhat.com> - 1:10.0.0.46-8
changelog:
  - removed accessibility sub-packages
  - kept applied patch and properties files
  - debug sub-packages renamed to slowdebug


author: Jiri Vanek <jvanek@redhat.com> - 1:10.0.1.10-1
changelog:
  - updated to security update 1
  - jexec unlinked from path
  - used java-openjdk as boot jdk
  - aligned provides/requires
  - renamed zip javadoc


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:10.0.1.10-2
changelog:
  - Removed unneeded patches:
    PStack-808293.patch
    multiple-pkcs11-library-init.patch
    ppc_stack_overflow_fix.patch
  - Added patches for s390 Zero builds:
    JDK-8201495-s390-java-opts.patch
    JDK-8201509-s390-atomic_store.patch
  - Renamed patches for clarity:
    aarch64BuildFailure.patch => JDK-8200556-aarch64-slowdebug-crash.patch
    systemCryptoPolicyPR3183.patch => pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch
    bootcycle_jobs.patch => JDK-8201788-bootcycle-images-jobs.patch
    system-nss-ec-rh1565658.patch => pr1983-rh1565658-support_using_the_system_installation_of_nss_with_the_sunec_provider_jdk11.patch


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:10.0.1.10-3
changelog:
  - Inject build flags properly. See RHBZ#1571359
  - Added patch JDK-8202262-libjsig.so-extra-link-flags.patch
    since libjsig.so doesn't get linker flags injected properly.


author: Jiri Vanek <jvanek@redhat.com> - 1:10.0.1.10-7
changelog:
  - quoted sed expressions, changed possibly confusing # by @
  - added vendor(origin) into icons
  - removed last trace of relative symlinks
  - added BuildRequires of javapackages-tools to fix build failure after Requires change to javapackages-filesystem


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.16-1
changelog:
  - Initial version of JDK 11 ea based on tag jdk-11+16.
  - Removed patches no longer needed or upstream:
    sorted-diff.patch (see JDK-8198844)
    JDK-8201788-bootcycle-images-jobs.patch
    JDK-8201509-s390-atomic_store.patch
    JDK-8202262-libjsig.so-extra-link-flags.patch (never was an issue on 11)
    JDK-8193802-npe-jar-getVersionMap.patch
  - Updated and renamed patches:
    java-openjdk-s390-size_t.patch => JDK-8203030-s390-size_t.patch
  - Updated patches for JDK 11:
    pr1983-rh1565658-support_using_the_system_installation_of_nss_with_the_sunec_provider_jdk11.patch


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.16-2
changelog:
  - Disable Aarch64 slowdebug build (see JDK-8204331).
  - s390x doesn't have the SA even though it's a JIT arch.


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.ea.19-1
changelog:
  - updated sources to jdk-11+19
  - added patch6 systemLcmsAndJpgFixFor-f0aeede1b855.patch to fix regression of system libraries after f0aeede1b855 commit
  - adapted pr1983-rh1565658-support_using_the_system_installation_of_nss_with_the_sunec_provider_jdk11.patch to accommodate changes after f0aeede1b855 commit


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.ea.20-1
changelog:
  - removed patch6 JDK-8205616-systemLcmsAndJpgFixFor-rev_f0aeede1b855.patch
  - improved a bit generate_source_tarball.sh to serve also for systemtap
  - thus deleted generate_tapsets.sh
  - simplified and cleared update_package.sh
  - moved to single source jdk - from shenandoah/jdk11
  - bumped to latest jdk11+20
  - adapted PR2126 to jdk11+20
  - adapted handling of systemtap sources to new style
  - (no (misleading) version inside (full version is in name), thus different sed on tapsets and different directory)
  - shortened summaries and descriptions to around 80 chars
  - Hunspell spell checked
  - license fixed to correct jdk11 (sgehwolf)
  - more correct handling of internal libraries (sgehwolf)
  - added lib/security/public_suffix_list.dat as +20 have added it (JDK-8201815)
  - added test for shenandaoh GC presence where expected
  - Removed workaround for broken aarch64 slowdebug build
  - Removed all defattrs
  - Removed no longer necessary cleanup of diz and  debuginfo files


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.ea.22-1
changelog:
  - added Recommends gtk3 for main package
  - changed BuildRequires from gtk2-devel to gtk3-devel (it can be more likely dropped)
  - added Suggests lksctp-tools, pcsc-lite-devel, cups for headless package
  - see RHBZ1598152
  - added trick to catch hs_err files (sgehwolf)
  - updated to shenandaoh-jdk-11+22


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.22-8
changelog:
  - Adjust system NSS patch, pr1983-rh1565658-support_using_the_system_installation_of_nss_with_the_sunec_provider_jdk11.patch, so
    as to filter -Wl,--as-needed from linker flags. Fixes FTBFS issue.


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.ea.28-2
changelog:
  - jfr/*jfc files listed for all arches
  - lib/classlist do not exists s390, ifarch-ed via jit_arches out


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.22-6
changelog:
  - Add patch, JDK-8210416-RHBZ-1624122-fdlibm-opt-fix.patch, so as to
    optimize compilation of fdlibm library.
  - Add patch, JDK-8210425-RHBZ-1624122-sharedRuntimeTrig-opt-fix.patch, so
    as to optimize compilation of sharedRuntime{Trig,Trans}.cpp
  - Add patch, JDK-8210647-RHBZ-1624122-libsaproc-opt-fix.patch, so as to
    optimize compilation of libsaproc (extra c flags won't override
    optimization).
  - Add patch, JDK-8210703-RHBZ-1624122-vmStructs-opt-fix.patch, so as to
    optimize compilation of vmStructs.cpp (part of libjvm.so).
  - No longer filter -O flags from C flags coming from
    redhat-rpm-config.


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.28-5
changelog:
  - Add patch, RHBZ-1628612-JDK-8210461-workaround-disable-aarch64-intrinsic.patch,
    so as to disable dsin/dcos math intrinsics on aarch64. Work-around for
    JDK-8210461.


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.28-6
changelog:
  - Add patch, RHBZ-1630996-JDK-8210858-workaround-disable-aarch64-intrinsic-log.patch,
    so as to disable log math intrinsic on aarch64. Work-around for
    JDK-8210858


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.28-9
changelog:
  - Rework changes from 1:11.0.ea.22-6. RHBZ#1632174 supercedes
    RHBZ-1624122.
  - Add patch, jdk8210416-rh1632174-compile_fdlibm_with_o2_ffp_contract_off_on_gcc_clang_arches.patch, so as to
    optimize compilation of fdlibm library.
  - Add patch, jdk8210425-rh1632174-sharedRuntimeTrig_sharedRuntimeTrans_compiled_without_optimization.patch, so
    as to optimize compilation of sharedRuntime{Trig,Trans}.cpp
  - Add patch, jdk8210647-rh1632174-libsaproc_is_being_compiled_without_optimization.patch, so as to
    optimize compilation of libsaproc (extra c flags won't override
    optimization).
  - Add patch, jdk8210761-rh1632174-libjsig_is_being_compiled_without_optimization.patch, so as to
    optimize compilation of libjsig.
  - Add patch, jdk8210703-rh1632174-vmStructs_cpp_no_longer_compiled_with_o0, so as to
    optimize compilation of vmStructs.cpp (part of libjvm.so).
  - Reinstate filtering of opt flags coming from redhat-rpm-config.


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.0.28-1
changelog:
  - Identify as GA version and no longer as early access (EA).
  - JDK 11 has been released for GA on 2018-09-25.


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.1.13-3
changelog:
  - Use upstream's version of Aarch64 intrinsics disable patch:
    - Removed:
      RHBZ-1628612-JDK-8210461-workaround-disable-aarch64-intrinsic.patch
      RHBZ-1630996-JDK-8210858-workaround-disable-aarch64-intrinsic-log.patch
    - Superceded by:
      jdk8211105-aarch64-disable_cos_sin_and_log_intrinsics.patch


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.1.13-6
changelog:
  - fixed tck failures of arraycopy and process exec with shenandoah on
  - added patch585 rh1648995-shenandoah_array_copy_broken_by_not_always_copy_forward_for_disjoint_arrays.patch


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.1.13-9
changelog:
  - for non debug supackages, ghosted all masters and slaves (rhbz1649776)
  - for tech-preview packages, if-outed versionless provides. Aligned versions to be %{epoch}:%{version}-%{release} instead of chaotic
  - Removed all slowdebug provides (rhbz1655938); for tech-preview packages also removed all internal provides


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.1.13-11
changelog:
  - Update to shenandoah-jdk-11.0.1+13-20190101
  - Update tarball generation script in preparation for PR3681/RH1656677 SunEC changes.
  - Use remove-intree-libraries.sh to remove the remaining SunEC code for now.
  - Fix PR1983 SunEC patch so that ecc_impl.h is patched rather than added
  - Add missing RH1022017 patch to reduce curves reported by SSL to those we support.
  - Remove RH1648995; fixed upstream
  - Resolves: rhbz#1659143


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.2.7-0
changelog:
  - Update to shenandoah-jdk-11.0.2+7 (January 2019 CPU)
  - Drop JDK-8211105/RH1628612/RH1630996 applied upstream.
  - Drop JDK-8209639/RH1640127 applied upstream.
  - Re-generate JDK-8210416/RH1632174 following JDK-8209786
  - Resolves: rhbz#1666532
  - Resolves: rhbz#1659143


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.2.7-1
changelog:
  - Add PR3695 to allow the system crypto policy to be turned off.
  - Correct original system crypto policy patch to refer to OpenJDK 11 bug (PR3694)
  - Resolves: rhbz#1666532


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.2.7-2
changelog:
  - Add explicit requirement for libXcomposite which is used when performing
    screenshots from Java.
  - Add explicit BR unzip required for building OpenJDK.
  - Resolves: rhbz#1666532


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.3.6-1
changelog:
  - Update to shenandoah-jdk-11.0.3+6 (April 2019 EA)
  - Drop JDK-8210416/RH1632174 applied upstream.
  - Drop JDK-8210425/RH1632174 applied upstream.
  - Drop JDK-8210647/RH1632174 applied upstream.
  - Drop JDK-8210761/RH1632174 applied upstream.
  - Drop JDK-8210703/RH1632174 applied upstream.
  - Add cast to resolve s390 ambiguity in call to log2_intptr
  - Resolves: rhbz#1693468


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.3.7-2
changelog:
  - Don't package lib/client and lib/client/classes.jsa which don't exist (see RH1643469)
  - Resolves: rhbz#1693468


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.3.7-3
changelog:
  - Fix requires/provides for the non-system JDK case. JDK 11 is not a system JDK at this point.
  - Resolves: rhbz#1693468


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.3.7-4
changelog:
  - Don't build the test images needlessly.
  - Don't produce javadoc/javadoc-zip sub packages for the debug variant build.
  - Don't perform a bootcycle build for the debug variant build.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.3.7-5
changelog:
  - Handle milestone as variables so we can alter it easily and set the docs zip filename appropriately.
  - Resolves: rhbz#1724452


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.4.7-0.2.ea
changelog:
  - Make use of Recommends and Suggests dependent on RHEL 8+ environment.
  - Drop unnecessary build requirement on gtk3-devel, as OpenJDK searches for Gtk+ at runtime.
  - Resolves: rhbz#1724452


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.4.7-0.2.ea
changelog:
  - Add missing build requirement for libXrender-devel, previously masked by Gtk3+ dependency
  - Resolves: rhbz#1724452


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.4.7-0.2.ea
changelog:
  - Add missing build requirement for libXrandr-devel, previously masked by Gtk3+ dependency
  - Resolves: rhbz#1724452


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.4.7-0.2.ea
changelog:
  - fontconfig build requirement should be fontconfig-devel, previously masked by Gtk3+ dependency
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.4.11-1
changelog:
  - Update to shenandoah-jdk-11.0.4+11 (GA)
  - Switch to GA mode for final release.
  - Resolves: rhbz#1724452


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.4.11-4
changelog:
  - Backport JDK-8230923 so arguments are passed to security providers.
  - Update RH1655466 patch with changes in OpenJDK 8 version.
  - SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the name in the config file.
  - Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with nss.cfg.
  - No need to substitute path to nss.fips.cfg as java.security file supports a java.home variable.
  - Resolves: rhbz#1751845


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.5.1-0.1.ea
changelog:
  - Update to shenandoah-jdk-11.0.5+1 (EA)
  - Switch to EA mode for 11.0.5 pre-release builds.
  - Drop JDK-8223482 which is included upstream in 11.0.5+1.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.5.10-1
changelog:
  - Update to shenandoah-jdk-11.0.5+10 (GA)
  - Switch to GA mode for final release.
  - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Resolves: rhbz#1753423


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.5.10-4
changelog:
  - Remove CVE-2018-3639 mitigation due to performance regression and
      OpenJDK position on speculative execution vulnerabilities.
      https://mail.openjdk.java.net/pipermail/vuln-announce/2019-July/000002.html
  - Resolves: rhbz#1784116


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.5.10-5
changelog:
  - Revert SSBD removal for now, until appropriate messaging has been decided.
  - Resolves: rhbz#1784116


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.5.10-6
changelog:
  - Update generate_source_tarball.sh script to use the PR3751 patch and retain the secp256k1 curve.
  - Regenerate source tarball using the updated script and add the -'4curve' suffix.
  - Resolves: rhbz#1746875


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.6.1-0.1.ea
changelog:
  - Update to shenandoah-jdk-11.0.6+1 (EA)
  - Switch to EA mode for 11.0.6 pre-release builds.
  - Add support for jfr binary.
  - Drop JDK-8230923 now applied upstream.
  - Resolves: rhbz#1785753


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.6.10-1
changelog:
  - Update to shenandoah-jdk-11.0.6+10 (GA)
  - Switch to GA mode for final release.
  - Add JDK-8236039 backport to resolve OpenShift blocker
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.6.10-2
changelog:
  - Add JDK-8237396 backport to resolve Shenandoah TCK breakage in traversal mode.
  - Resolves: rhbz#1785753


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.6.10-3
changelog:
  - Sync SystemTap & desktop files with upstream IcedTea release 3.11.0 using new script
  - Resolves: rhbz#1737115


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.6.10-4
changelog:
  - Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
  - Resolves: rhbz#1737115


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.7.1-0.1.ea
changelog:
  - Update to shenandoah-jdk-11.0.7+1 (EA)
  - Switch to EA mode for 11.0.7 pre-release builds.
  - Drop JDK-8236039 backport now applied upstream.
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.7.10-1
changelog:
  - Update to shenandoah-jdk-11.0.7+10 (GA)
  - Switch to GA mode for final release.
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.1-0.1.ea
changelog:
  - Update to shenandoah-jdk-11.0.8+1 (EA)
  - Switch to EA mode for 11.0.8 pre-release builds.
  - Drop JDK-8237396 & JDK-8228407 backports now applied upstream.
  - Resolves: rhbz#1838811


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.8.2-0.2.ea
changelog:
  - Build static-libs-image and add resulting files via -static-libs
    sub-package.
  - Resolves: rhbz#1839084


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.4-0.1.ea
changelog:
  - Update to shenandoah-jdk-11.0.8+4 (EA)
  - Require tzdata 2020a due to resource changes in JDK-8243541
  - Resolves: rhbz#1838811


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.8.4-0.3.ea
changelog:
  - Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to disable).
  - Resolves: rhbz#1725961


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.8.5-0.2.ea
changelog:
  - Disable stripping of debug symbols for static libraries part of
    the -static-libs sub-package.
  - Resolves: rhbz#1839084


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.8.6-0.3.ea
changelog:
  - Symlink hunk moved behind the main copy logic, to be more user-friendly with multiple installs
  - Resolves: rhbz#1820172


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.7-0.2.ea
changelog:
  - java-11-openjdk doesn't have a JRE tree, so don't try and copy alt-java there...
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.7-0.3.ea
changelog:
  - Use RSA as default for keytool, as DSA is disabled in all crypto policies except LEGACY
  - Resolves: rhbz#1842572


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.9-0.1.ea
changelog:
  - Update to shenandoah-jdk-11.0.8+9 (EA)
  - Update release notes for 11.0.8 release.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.10-1
changelog:
  - Update to shenandoah-jdk-11.0.8+10 (GA)
  - Switch to GA mode for final release.
  - Update release notes with last minute fix (JDK-8248505).
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.10-2
changelog:
  - Backport JDK-8251117 to allow key length to be retrieved from PKCS#11 FIPS keys
  - Resolves: rhbz#1860990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.10-3
changelog:
  - Add JDK-8252258 to return default vendor to the original value of 'Oracle Corporation'
  - Include a test in the RPM to check the build has the correct vendor information.
  - Resolves: rhbz#1868406


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.10-4
changelog:
  - Disable TLSv1.3 when the FIPS crypto policy and the NSS-FIPS provider are in use.
  - Resolves: rhbz#1860986


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.10-5
changelog:
  - Use 'oj_' prefix on new vendor globals to avoid a conflict with RPM's vendor value.
  - Resolves: rhbz#1868406


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.10-6
changelog:
  - Add patch to cancel PKCS#11 operations on failure (RH1868754)
  - Add patch to allow the PKCS11 provider access to the SunJCE provider (RH1868740)
  - Resolves: rhbz#1868740
  - Resolves: rhbz#1868754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.1-0.0.ea
changelog:
  - Update to shenandoah-jdk-11.0.9+1 (EA)
  - Switch to EA mode for 11.0.9 pre-release builds.
  - JDK-8245832 increases the set of static libraries, so try and include them all with a wildcard.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.1-0.1.ea
changelog:
  - Cleanup architecture and JVM feature handling in preparation for using upstreamed Shenandoah.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.2-0.1.ea
changelog:
  - Update to jdk-11.0.9+2 (EA)
  - With Shenandoah now upstream in OpenJDK 11, we can use jdk-updates/jdk11 directly
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.2-0.2.ea
changelog:
  - Following JDK-8005165, class data sharing can be enabled on all JIT architectures
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.3-0.1.ea
changelog:
  - Update to jdk-11.0.9+3 (EA)
  - Remove JDK-8251117/RH1860990 as now applied upstream.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.6-0.1.ea
changelog:
  - Update to jdk-11.0.9+6 (EA)
  - Update tarball generation script to use PR3802, handling JDK-8233228 & JDK-8177334
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.8-0.1.ea
changelog:
  - Update to jdk-11.0.9+8 (EA)
  - Remove JDK-8252258/RH1868406 now applied upstream.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.10-0.2.ea
changelog:
  - Add patch to allow the PKCS11 provider access to the SunJCE provider with the security manager enabled
  - Resolves: rhbz#1883849


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.9.10-0.3.ea
changelog:
  - Set vendor property and vendor URLs
  - Made URLs to be preconfigured by OS
  - Moved vendor_version_string to a better place
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.11-1
changelog:
  - Update to jdk-11.0.9+11
  - Update release notes for 11.0.9 release.
  - Add backport of JDK-8254177 to update to tzdata 2020b
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - This tarball is embargoed until 2020-10-20 @ 1pm PT.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.11-3
changelog:
  - Bump release number to build on RHEL 8.4.0 branch.
  - Resolves: rhbz#1876665
  - Resolves: rhbz#1889497
  - Resolves: rhbz#1883849


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.9.11-4
changelog:
  - Move all license files to NVR-specific JVM directory.
  - This bad placement was killing parallel installability and thus having a bad impact on leapp, if used.
  - Resolves: rhbz#1889481


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.9.11-5
changelog:
  - Update to jdk-11.0.9.1+1
  - RPM version stays at 11.0.9.11 so as to not break upgrade path.
  - Adds a single patch for JDK-8250861.
  - Resolves: rhbz#1895274


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.9.11-7
changelog:
  - removed patch6, rh1566890-CVE_2018_3639-speculative_store_bypass.patch, surpassed by new patch
  - added patch600, rh1750419-redhat_alt_java.patch, suprassing removed patch
  - no longer copying of java->alt-java as it is created by  patch600
  - Resolves: rhbz#1784116


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.9.11-9
changelog:
  - Redefined linux -> __linux__ and __x86_64 -> __x86_64__ in RH1750419 patch
  - Resolves: rhbz#1784116


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.11-9
changelog:
  - Introduced ssbd_arches to denote architectures with SSBD mitigation (currently only x86_64)
  - Introduced nm-based check to verify alt-java on ssbd_arches is patched, and no other alt-java or java binaries are patched
  - RH1750419 patch amended to emit a warning on architectures where alt-java is the same as java
  - Resolves: rhbz#1784116


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.10.0+1
  - Update release notes to 11.0.10.0+1
  - Use JEP-322 Time-Based Versioning so we can handle a future 11.0.9.1-like release correctly.
  - Still use 11.0.x rather than 11.0.x.0 for file naming, as the trailing zero is omitted from tags.
  - Revert configure and built_doc_archive hacks to build 11.0.9.1 from 11.0.9.0 sources, and synced with RHEL version.
  - Cleanup debug package descriptions and version number placement.
  - Switch to EA mode for 11.0.10 pre-release builds.
  - Drop JDK-8222286, JDK-8236512 & JDK-8254177 as applied upstream
  - Use system harfbuzz now this is supported.
  - Use system tzdata2020b now it's available.
  - Adjust RH1842572 patch due to context change from JDK-8213400
  - Resolves: rhbz#1903908


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.8-0.1.ea
changelog:
  - Update to jdk-11.0.10.0+8
  - Update release notes to 11.0.10.0+8.
  - Update tarball generation script to use PR3818 which handles JDK-8171279 changes
  - Drop JDK-8250861 as applied upstream.
  - Resolves: rhbz#1903908


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.9-1
changelog:
  - Update to jdk-11.0.10.0+9
  - Update release notes to 11.0.10.0+9
  - Switch to GA mode for final release.
  - Resolves: rhbz#1908972


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.9-2
changelog:
  - Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode
  - Resolves: rhbz#1894083


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.10.0.9-3
changelog:
  - Removed lib-style provides for fastdebug_suffix_unquoted
  - Fixed missing condition for fastdebug packages being counted as debug ones
  - Fix typo in variable
  - Resolves: rhbz#1908972


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.9-3
changelog:
  - Fix debug and fastdebug descriptions to emphasise the difference is optimisation or no optimisation.
  - Resolves: rhbz#1908972


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.9-4
changelog:
  - Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always occurs.
  - Resolves: rhbz#1915071


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.9-7
changelog:
  - Update tapsets from IcedTea 6.x repository with fix for JDK-8015774 changes (_heap->_heaps)
  - Update icedtea_sync.sh with a VCS mode that retrieves sources from a Mercurial repository
  - Resolves: rhbz#1814915


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.9-8
changelog:
  - Perform static library build on a separate source tree with bundled image libraries
  - Make static library build optional
  - Based on initial work by Severin Gehwolf
  - Resolves: rhbz#1930513


author: Jayashree Huttanagoudar <jhuttana@redhat.com> - 1:11.0.10.0.9-10
changelog:
  - Fix issue where CheckVendor.java test erroneously passes when it should fail.
  - Add proper quoting so '&' is not treated as a special character by the shell.
  - Resolves: rhbz#1942310


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.1-0.2.ea
changelog:
  - Update to jdk-11.0.11.0+1
  - Update release notes to 11.0.11.0+1
  - Switch to EA mode for 11.0.11 pre-release builds.
  - Require tzdata 2020f to match upstream change JDK-8259048
  - Remove RH1868754 patch as this is now resolved upstream by JDK-8258833
  - Remove RH1868740 & RH1883849 patches as these are now resolved by JDK-8259319
  - Resolves: rhbz#1942310


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.9-3
changelog:
  - Update to jdk-11.0.11.0+9
  - Update release notes to 11.0.11.0+9
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-04-20 @ 1pm PT.
  - Resolves: rhbz#1938201


author: Martin Balao <mbalao@redhat.com> - 1:11.0.11.0.9-4
changelog:
  - Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library.
  - Resolves: rhbz#1929465


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.9-4
changelog:
  - Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled in configure.
  - Remove unneeded Requires on NSS as it will now be dynamically linked and detected by RPM.
  - Resolves: rhbz#1929465


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.1-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+1
  - Update release notes to 11.0.12.0+1
  - Switch to EA mode for 11.0.12 pre-release builds.
  - Update ECC patch following JDK-8226374 (bug ID yet to be confirmed)
  - Resolves: rhbz#1967374


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.1-0.3.ea
changelog:
  - Remove explicit compiler flags which should be handled by the upstream build
    (-std=gnu++98, -fno-delete-null-pointer-checks, -fno-lifetime-dse)
  - Resolves: rhbz#1966234


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.2-0.1.ea
changelog:
  - Use the "reverse" build loop (debug first) as the main and only build loop to get more diagnostics.
  - Remove restriction on disabling product build, as debug packages no longer have javadoc packages.
  - Resolves: rhbz#1966234


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.4-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+4
  - Update release notes to 11.0.12.0+4
  - Correct bug ID JDK-8264846 to intended ID of JDK-8264848
  - Resolves: rhbz#1967374


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.6-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+6
  - Update release notes to 11.0.12.0+6
  - Skip 11.0.12.0+5 as 11.0.12.0+6 only adds a test change
  - Resolves: rhbz#1967374


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-1
changelog:
  - Update to jdk-11.0.12.0+7
  - Update release notes to 11.0.12.0+7
  - Switch to GA mode for final release.
  - Resolves: rhbz#1972395


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.12.0.7-2
changelog:
  - Add patch in order to fix java.library.path issue on aarch64 (JDK-8269668)
  - Resolves: rhbz#1994104


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-4
changelog:
  - Extend the default security policy to accomodate PKCS11 accessing jdk.internal.misc.
  - Resolves: rhbz#1997357


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-7
changelog:
  - Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
  - Resolves: rhbz#1991003


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-8
changelog:
  - Restructure the build so a minimal initial build is then used for the final build (with docs)
  - This reduces pressure on the system JDK and ensures the JDK being built can do a full build
  - Related: rhbz#1999938


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.13.0+1
  - Update release notes to 11.0.13.0+1
  - Update tarball generation script to use git following OpenJDK 11u's move to github
  - Switch to EA mode for 11.0.13 pre-release builds.
  - Remove "-clean" suffix as no 11.0.13 builds are unclean.
  - Drop JDK-8269668 patch which is now applied upstream.
  - Related: rhbz#1999938


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.8-3
changelog:
  - Update to jdk-11.0.13.0+8
  - Update release notes to 11.0.13.0+8
  - Switch to GA mode for final release.
  - Resolves: rhbz#2012335


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.13.0.8-4
changelog:
  - Replaced hardcoded 11 by featurever where appropriate
  - Fixed comment of `for slowdebug` to correct `any debug`
  - Related: rhbz#2022821


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.8-5
changelog:
  - Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
  - Related: rhbz#2022821


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.14.0+1
  - Update release notes to 11.0.14.0+1
  - Switch to EA mode for 11.0.14 pre-release builds.
  - Rename blacklisted.certs to blocked.certs following JDK-8253866
  - Rebase RH1996182 login patch and drop redundant security policy extension after JDK-8269034
  - Related: rhbz#2022821


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.9-2
changelog:
  - Update to jdk-11.0.14.0+9
  - Update release notes to 11.0.14.0+9
  - Switch to GA mode for final release.
  - Resolves: rhbz#2039366


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.14.0.9-3
changelog:
  - Use 'sql:' prefix in nss.fips.cfg as F35+ no longer ship the legacy
    secmod.db file as part of nss
  - Resolves: rhbz#2023534


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.9-4
changelog:
  - Fix FIPS issues in native code and with initialisation of java.security.Security
  - Resolves: rhbz#2021559


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.9-5
changelog:
  - Refactor build functions so we can build just HotSpot without any attempt at installation.
  - Sync gdb test with java-1.8.0-openjdk.
  - Improve architecture restrictions for the gdb test.
  - Replace -mstackrealign with -mincoming-stack-boundary=2 -mpreferred-stack-boundary=4 on x86_32 for stack alignment
  - Explicitly list JIT architectures rather than relying on those with slowdebug builds
  - Disable the serviceability agent on Zero architectures even when the architecture itself is supported
  - Add backport of JDK-8257794 to fix bogus assert on slowdebug x86-32 Zero builds
  - Related: rhbz#2052809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.9-6
changelog:
  - Separate crypto policy initialisation from FIPS initialisation, now they are no longer interdependent
  - Resolves: rhbz#2052816


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.1.1-1
changelog:
  - Update to jdk-11.0.14.1+1
  - Update release notes to 11.0.14.1+1
  - Require tzdata 2021e as of JDK-8275766.
  - Resolves: rhbz#2052809
  - Resolves: rhbz#1966234


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.1.1-6
changelog:
  - Detect NSS at runtime for FIPS detection
  - Turn off build-time NSS linking and go back to an explicit Requires on NSS
  - Resolves: rhbz#2052827


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.15.0+1
  - Update release notes to 11.0.15.0+1
  - Switch to EA mode for 11.0.15 pre-release builds.
  - Related: rhbz#2048549


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.8-0.1.ea
changelog:
  - Update to jdk-11.0.15.0+8
  - Update release notes to 11.0.15.0+8
  - Rebase RH1996182 FIPS patch after JDK-8254410
  - Resolves: rhbz#2048549


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.10-3
changelog:
  - Update to jdk-11.0.15.0+10
  - Update release notes to 11.0.15.0+10
  - Switch to GA mode for release
  - Resolves: rhbz#2073593


author: Francisco Ferrari Bihurriet <fferrari@redhat.com> - 1:11.0.15.0.10-5
changelog:
  - RH2007331: SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode
  - Resolves: rhbz#2102430


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.10-6
changelog:
  - Rebase FIPS patches from fips branch and simplify by using a single patch from that repository
  - * RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
  - * RH2090378: Revert to disabling system security properties and FIPS mode support together
  - Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
  - Enable system security properties in the RPM (now disabled by default in the FIPS repo)
  - Improve security properties test to check both enabled and disabled behaviour
  - Run security properties test with property debugging on
  - Resolves: rhbz#2099838
  - Resolves: rhbz#2090378


