# changelog

author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-33.el7
changelog:
  - kvm-block-qemu-iotests-for-vhdx-read-sample-dynamic-imag.patch [bz#879234]
  - kvm-block-qemu-iotests-add-quotes-to-TEST_IMG-usage-io-p.patch [bz#879234]
  - kvm-block-qemu-iotests-fix-_make_test_img-to-work-with-s.patch [bz#879234]
  - kvm-block-qemu-iotests-add-quotes-to-TEST_IMG.base-usage.patch [bz#879234]
  - kvm-block-qemu-iotests-add-quotes-to-TEST_IMG-usage-in-0.patch [bz#879234]
  - kvm-block-qemu-iotests-removes-duplicate-double-quotes-i.patch [bz#879234]
  - kvm-block-vhdx-minor-comments-and-typo-correction.patch [bz#879234]
  - kvm-block-vhdx-add-header-update-capability.patch [bz#879234]
  - kvm-block-vhdx-code-movement-VHDXMetadataEntries-and-BDR.patch [bz#879234]
  - kvm-block-vhdx-log-support-struct-and-defines.patch [bz#879234]
  - kvm-block-vhdx-break-endian-translation-functions-out.patch [bz#879234]
  - kvm-block-vhdx-update-log-guid-in-header-and-first-write.patch [bz#879234]
  - kvm-block-vhdx-code-movement-move-vhdx_close-above-vhdx_.patch [bz#879234]
  - kvm-block-vhdx-log-parsing-replay-and-flush-support.patch [bz#879234]
  - kvm-block-vhdx-add-region-overlap-detection-for-image-fi.patch [bz#879234]
  - kvm-block-vhdx-add-log-write-support.patch [bz#879234]
  - kvm-block-vhdx-write-support.patch [bz#879234]
  - kvm-block-vhdx-remove-BAT-file-offset-bit-shifting.patch [bz#879234]
  - kvm-block-vhdx-move-more-endian-translations-to-vhdx-end.patch [bz#879234]
  - kvm-block-vhdx-break-out-code-operations-to-functions.patch [bz#879234]
  - kvm-block-vhdx-fix-comment-typos-in-header-fix-incorrect.patch [bz#879234]
  - kvm-block-vhdx-add-.bdrv_create-support.patch [bz#879234]
  - kvm-block-vhdx-update-_make_test_img-to-filter-out-vhdx-.patch [bz#879234]
  - kvm-block-qemu-iotests-for-vhdx-add-write-test-support.patch [bz#879234]
  - kvm-block-vhdx-qemu-iotest-log-replay-of-data-sector.patch [bz#879234]
  - Resolves: bz#879234
    ([RFE] qemu-img: Add/improve support for VHDX format)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-34.el7
changelog:
  - kvm-block-stream-Don-t-stream-unbacked-devices.patch [bz#965636]
  - kvm-qemu-io-Let-open-pass-options-to-block-driver.patch [bz#1004347]
  - kvm-qcow2.py-Subcommand-for-changing-header-fields.patch [bz#1004347]
  - kvm-qemu-iotests-Remaining-error-propagation-adjustments.patch [bz#1004347]
  - kvm-qemu-iotests-Add-test-for-inactive-L2-overlap.patch [bz#1004347]
  - kvm-qemu-iotests-Adjust-test-result-039.patch [bz#1004347]
  - kvm-virtio-net-don-t-update-mac_table-in-error-state.patch [bz#1048671]
  - kvm-qcow2-Zero-initialise-first-cluster-for-new-images.patch [bz#1032904]
  - Resolves: bz#1004347
    (Backport qcow2 corruption prevention patches)
  - Resolves: bz#1032904
    (qemu-img can not create libiscsi qcow2_v3 image)
  - Resolves: bz#1048671
    (virtio-net: mac_table change isn't recovered in error state)
  - Resolves: bz#965636
    (streaming with no backing file should not do anything)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-35.el7
changelog:
  - kvm-option-Add-assigned-flag-to-QEMUOptionParameter.patch [bz#1033490]
  - kvm-qcow2-refcount-Snapshot-update-for-zero-clusters.patch [bz#1033490]
  - kvm-qemu-iotests-Snapshotting-zero-clusters.patch [bz#1033490]
  - kvm-block-Image-file-option-amendment.patch [bz#1033490]
  - kvm-qcow2-cache-Empty-cache.patch [bz#1033490]
  - kvm-qcow2-cluster-Expand-zero-clusters.patch [bz#1033490]
  - kvm-qcow2-Save-refcount-order-in-BDRVQcowState.patch [bz#1033490]
  - kvm-qcow2-Implement-bdrv_amend_options.patch [bz#1033490]
  - kvm-qcow2-Correct-bitmap-size-in-zero-expansion.patch [bz#1033490]
  - kvm-qcow2-Free-only-newly-allocated-clusters-on-error.patch [bz#1033490]
  - kvm-qcow2-Add-missing-space-in-error-message.patch [bz#1033490]
  - kvm-qemu-iotest-qcow2-image-option-amendment.patch [bz#1033490]
  - kvm-qemu-iotests-New-test-case-in-061.patch [bz#1033490]
  - kvm-qemu-iotests-Preallocated-zero-clusters-in-061.patch [bz#1033490]
  - Resolves: bz#1033490
    (Cannot upgrade/downgrade qcow2 images)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-36.el7
changelog:
  - kvm-Add-support-statement-to-help-output.patch [bz#972773]
  - kvm-__com.redhat_qxl_screendump-add-docs.patch [bz#903910]
  - kvm-vl-Round-memory-sizes-below-2MiB-up-to-2MiB.patch [bz#999836]
  - kvm-seccomp-exit-if-seccomp_init-fails.patch [bz#1044845]
  - kvm-redhat-qemu-kvm.spec-require-python-for-build.patch [bz#1034876]
  - kvm-redhat-qemu-kvm.spec-require-iasl.patch [bz#1034876]
  - kvm-configure-make-iasl-option-actually-work.patch [bz#1034876]
  - kvm-redhat-qemu-kvm.spec-add-cpp-as-build-dependency.patch [bz#1034876]
  - kvm-acpi-build-disable-with-no-acpi.patch [bz#1045386]
  - kvm-ehci-implement-port-wakeup.patch [bz#1039513]
  - kvm-qdev-monitor-Fix-crash-when-device_add-is-called-wit.patch [bz#1026712 bz#1046007]
  - kvm-block-vhdx-improve-error-message-and-.bdrv_check-imp.patch [bz#1035001]
  - kvm-docs-updated-qemu-img-man-page-and-qemu-doc-to-refle.patch [bz#1017650]
  - kvm-enable-pvticketlocks-by-default.patch [bz#1052340]
  - kvm-fix-boot-strict-regressed-in-commit-6ef4716.patch [bz#997817]
  - kvm-vl-make-boot_strict-variable-static-not-used-outside.patch [bz#997817]
  - Resolves: bz#1017650
    (need to update qemu-img man pages on "VHDX" format)
  - Resolves: bz#1026712
    (Qemu core dumpd when boot guest with driver name as "virtio-pci")
  - Resolves: bz#1034876
    (export acpi tables to guests)
  - Resolves: bz#1035001
    (VHDX: journal log should not be replayed by default, but rather via qemu-img check -r all)
  - Resolves: bz#1039513
    (backport remote wakeup for ehci)
  - Resolves: bz#1044845
    (QEMU seccomp sandbox - exit if seccomp_init() fails)
  - Resolves: bz#1045386
    (qemu-kvm: hw/i386/acpi-build.c:135: acpi_get_pm_info: Assertion `obj' failed.)
  - Resolves: bz#1046007
    (qemu-kvm aborted when hot plug PCI device to guest with romfile and rombar=0)
  - Resolves: bz#1052340
    (pvticketlocks: default on)
  - Resolves: bz#903910
    (RHEL7 does not have equivalent functionality for __com.redhat_qxl_screendump)
  - Resolves: bz#972773
    (RHEL7: Clarify support statement in KVM help)
  - Resolves: bz#997817
    (-boot order and -boot once regressed since RHEL-6)
  - Resolves: bz#999836
    (-m 1 crashes)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-37.el7
changelog:
  - kvm-bitmap-use-long-as-index.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_set_dirty_flags-result-is.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_set_dirty_range-return-vo.patch [bz#997559]
  - kvm-exec-use-accessor-function-to-know-if-memory-is-dirt.patch [bz#997559]
  - kvm-memory-create-function-to-set-a-single-dirty-bit.patch [bz#997559]
  - kvm-exec-drop-useless-if.patch [bz#997559]
  - kvm-exec-create-function-to-get-a-single-dirty-bit.patch [bz#997559]
  - kvm-memory-make-cpu_physical_memory_is_dirty-return-bool.patch [bz#997559]
  - kvm-memory-all-users-of-cpu_physical_memory_get_dirty-us.patch [bz#997559]
  - kvm-memory-set-single-dirty-flags-when-possible.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_set_dirty_range-always-di.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_mask_dirty_range-always-c.patch [bz#997559]
  - kvm-memory-use-bit-2-for-migration.patch [bz#997559]
  - kvm-memory-make-sure-that-client-is-always-inside-range.patch [bz#997559]
  - kvm-memory-only-resize-dirty-bitmap-when-memory-size-inc.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_clear_dirty_flag-result-i.patch [bz#997559]
  - kvm-bitmap-Add-bitmap_zero_extend-operation.patch [bz#997559]
  - kvm-memory-split-dirty-bitmap-into-three.patch [bz#997559]
  - kvm-memory-unfold-cpu_physical_memory_clear_dirty_flag-i.patch [bz#997559]
  - kvm-memory-unfold-cpu_physical_memory_set_dirty-in-its-o.patch [bz#997559]
  - kvm-memory-unfold-cpu_physical_memory_set_dirty_flag.patch [bz#997559]
  - kvm-memory-make-cpu_physical_memory_get_dirty-the-main-f.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_get_dirty-is-used-as-retu.patch [bz#997559]
  - kvm-memory-s-mask-clear-cpu_physical_memory_mask_dirty_r.patch [bz#997559]
  - kvm-memory-use-find_next_bit-to-find-dirty-bits.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_set_dirty_range-now-uses-.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_clear_dirty_range-now-use.patch [bz#997559]
  - kvm-memory-s-dirty-clean-in-cpu_physical_memory_is_dirty.patch [bz#997559]
  - kvm-memory-make-cpu_physical_memory_reset_dirty-take-a-l.patch [bz#997559]
  - kvm-exec-Remove-unused-global-variable-phys_ram_fd.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_set_dirty_tracking-should.patch [bz#997559]
  - kvm-memory-move-private-types-to-exec.c.patch [bz#997559]
  - kvm-memory-split-cpu_physical_memory_-functions-to-its-o.patch [bz#997559]
  - kvm-memory-unfold-memory_region_test_and_clear.patch [bz#997559]
  - kvm-use-directly-cpu_physical_memory_-api-for-tracki.patch [bz#997559]
  - kvm-refactor-start-address-calculation.patch [bz#997559]
  - kvm-memory-move-bitmap-synchronization-to-its-own-functi.patch [bz#997559]
  - kvm-memory-syncronize-kvm-bitmap-using-bitmaps-operation.patch [bz#997559]
  - kvm-ram-split-function-that-synchronizes-a-range.patch [bz#997559]
  - kvm-migration-synchronize-memory-bitmap-64bits-at-a-time.patch [bz#997559]
  - Resolves: bz#997559
    (Improve live migration bitmap handling)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-38.el7
changelog:
  - kvm-intel-hda-fix-position-buffer.patch [bz#947785]
  - kvm-The-calculation-of-bytes_xfer-in-qemu_put_buffer-is-.patch [bz#1003467]
  - kvm-migration-Fix-rate-limit.patch [bz#1003467]
  - kvm-audio-honor-QEMU_AUDIO_TIMER_PERIOD-instead-of-wakin.patch [bz#1017636]
  - kvm-audio-Lower-default-wakeup-rate-to-100-times-second.patch [bz#1017636]
  - kvm-audio-adjust-pulse-to-100Hz-wakeup-rate.patch [bz#1017636]
  - kvm-pc-Fix-rhel6.-3dnow-3dnowext-compat-bits.patch [bz#918907]
  - kvm-add-firmware-to-machine-options.patch [bz#1038603]
  - kvm-switch-rhel7-machine-types-to-big-bios.patch [bz#1038603]
  - kvm-add-bios-256k.bin-from-seabios-bin-1.7.2.2-10.el7.no.patch [bz#1038603]
  - kvm-pci-fix-pci-bridge-fw-path.patch [bz#1034518]
  - kvm-hw-cannot_instantiate_with_device_add_yet-due-to-poi.patch [bz#1031098]
  - kvm-qdev-Document-that-pointer-properties-kill-device_ad.patch [bz#1031098]
  - kvm-Add-back-no-hpet-but-ignore-it.patch [bz#1044742]
  - Resolves: bz#1003467
    (Backport migration fixes from post qemu 1.6)
  - Resolves: bz#1017636
    (PATCH: fix qemu using 50% host cpu when audio is playing)
  - Resolves: bz#1031098
    (Disable device smbus-eeprom)
  - Resolves: bz#1034518
    (boot order wrong with q35)
  - Resolves: bz#1038603
    (make seabios 256k for rhel7 machine types)
  - Resolves: bz#1044742
    (Cannot create guest on remote RHEL7 host using F20 virt-manager, libvirt's qemu -no-hpet detection is broken)
  - Resolves: bz#918907
    (provide backwards-compatible RHEL specific machine types in QEMU - CPU features)
  - Resolves: bz#947785
    (In rhel6.4 guest  sound recorder doesn't work when  playing audio)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-39.el7
changelog:
  - kvm-Revert-qdev-monitor-Fix-crash-when-device_add-is-cal.patch [bz#669524]
  - kvm-Revert-qdev-Do-not-let-the-user-try-to-device_add-wh.patch [bz#669524]
  - kvm-qdev-monitor-Clean-up-qdev_device_add-variable-namin.patch [bz#669524]
  - kvm-qdev-monitor-Fix-crash-when-device_add-is-called.2.patch.patch [bz#669524]
  - kvm-qdev-monitor-Avoid-qdev-as-variable-name.patch [bz#669524]
  - kvm-qdev-monitor-Inline-qdev_init-for-device_add.patch [bz#669524]
  - kvm-qdev-Do-not-let-the-user-try-to-device_add-when-it.2.patch.patch [bz#669524]
  - kvm-qdev-monitor-Avoid-device_add-crashing-on-non-device.patch [bz#669524]
  - kvm-qdev-monitor-Improve-error-message-for-device-nonexi.patch [bz#669524]
  - kvm-exec-change-well-known-physical-sections-to-macros.patch [bz#1003535]
  - kvm-exec-separate-sections-and-nodes-per-address-space.patch [bz#1003535]
  - Resolves: bz#1003535
    (qemu-kvm core dump when boot vm with more than 32 virtio disks/nics)
  - Resolves: bz#669524
    (Confusing error message from -device <unknown dev>)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-40.el7
changelog:
  - kvm-avoid-a-bogus-COMPLETED-CANCELLED-transition.patch [bz#1053699]
  - kvm-introduce-MIG_STATE_CANCELLING-state.patch [bz#1053699]
  - kvm-vvfat-use-bdrv_new-to-allocate-BlockDriverState.patch [bz#1041301]
  - kvm-block-implement-reference-count-for-BlockDriverState.patch [bz#1041301]
  - kvm-block-make-bdrv_delete-static.patch [bz#1041301]
  - kvm-migration-omit-drive-ref-as-we-have-bdrv_ref-now.patch [bz#1041301]
  - kvm-xen_disk-simplify-blk_disconnect-with-refcnt.patch [bz#1041301]
  - kvm-nbd-use-BlockDriverState-refcnt.patch [bz#1041301]
  - kvm-block-use-BDS-ref-for-block-jobs.patch [bz#1041301]
  - kvm-block-Make-BlockJobTypes-const.patch [bz#1041301]
  - kvm-blockjob-rename-BlockJobType-to-BlockJobDriver.patch [bz#1041301]
  - kvm-qapi-Introduce-enum-BlockJobType.patch [bz#1041301]
  - kvm-qapi-make-use-of-new-BlockJobType.patch [bz#1041301]
  - kvm-mirror-Don-t-close-target.patch [bz#1041301]
  - kvm-mirror-Move-base-to-MirrorBlockJob.patch [bz#1041301]
  - kvm-block-Add-commit_active_start.patch [bz#1041301]
  - kvm-commit-Support-commit-active-layer.patch [bz#1041301]
  - kvm-qemu-iotests-prefill-some-data-to-test-image.patch [bz#1041301]
  - kvm-qemu-iotests-Update-test-cases-for-commit-active.patch [bz#1041301]
  - kvm-commit-Remove-unused-check.patch [bz#1041301]
  - kvm-blockdev-use-bdrv_getlength-in-qmp_drive_mirror.patch [bz#921890]
  - kvm-qemu-iotests-make-assert_no_active_block_jobs-common.patch [bz#921890]
  - kvm-block-drive-mirror-Check-for-NULL-backing_hd.patch [bz#921890]
  - kvm-qemu-iotests-Extend-041-for-unbacked-mirroring.patch [bz#921890]
  - kvm-qapi-schema-Update-description-for-NewImageMode.patch [bz#921890]
  - kvm-block-drive-mirror-Reuse-backing-HD-for-sync-none.patch [bz#921890]
  - kvm-qemu-iotests-Fix-test-041.patch [bz#921890]
  - kvm-scsi-bus-fix-transfer-length-and-direction-for-VERIF.patch [bz#1035644]
  - kvm-scsi-disk-fix-VERIFY-emulation.patch [bz#1035644]
  - kvm-block-ensure-bdrv_drain_all-works-during-bdrv_delete.patch [bz#1041301]
  - kvm-use-recommended-max-vcpu-count.patch [bz#998708]
  - kvm-pc-Create-pc_compat_rhel-functions.patch [bz#1049706]
  - kvm-pc-Enable-x2apic-by-default-on-more-recent-CPU-model.patch [bz#1049706]
  - kvm-Build-all-subpackages-for-RHEV.patch [bz#1007204]
  - Resolves: bz#1007204
    (qemu-img-rhev  qemu-kvm-rhev-tools are not built for qemu-kvm-1.5.3-3.el7)
  - Resolves: bz#1035644
    (rhel7.0host + windows guest + virtio-win + 'chkdsk' in the guest gives qemu assertion in scsi_dma_complete)
  - Resolves: bz#1041301
    (live snapshot merge (commit) of the active layer)
  - Resolves: bz#1049706
    (MIss CPUID_EXT_X2APIC in Westmere cpu model)
  - Resolves: bz#1053699
    (Backport Cancelled race condition fixes)
  - Resolves: bz#921890
    (Core dump when block mirror with "sync" is "none" and mode is "absolute-paths")
  - Resolves: bz#998708
    (qemu-kvm: maximum vcpu should be recommended maximum)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-41.el7
changelog:
  - kvm-help-add-id-suboption-to-iscsi.patch [bz#1019221]
  - kvm-scsi-disk-add-UNMAP-limits-to-block-limits-VPD-page.patch [bz#1037503]
  - kvm-qdev-Fix-32-bit-compilation-in-print_size.patch [bz#1034876]
  - kvm-qdev-Use-clz-in-print_size.patch [bz#1034876]
  - Resolves: bz#1019221
    (Iscsi miss id sub-option in help output)
  - Resolves: bz#1034876
    (export acpi tables to guests)
  - Resolves: bz#1037503
    (fix thin provisioning support for block device backends)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-43.el7
changelog:
  - kvm-piix-gigabyte-alignment-for-ram.patch [bz#1026548]
  - kvm-pc_piix-document-gigabyte_align.patch [bz#1026548]
  - kvm-q35-gigabyle-alignment-for-ram.patch [bz#1026548]
  - kvm-virtio-bus-remove-vdev-field.patch [bz#983344]
  - kvm-virtio-pci-remove-vdev-field.patch [bz#983344]
  - kvm-virtio-bus-cleanup-plug-unplug-interface.patch [bz#983344]
  - kvm-virtio-blk-switch-exit-callback-to-VirtioDeviceClass.patch [bz#983344]
  - kvm-virtio-serial-switch-exit-callback-to-VirtioDeviceCl.patch [bz#983344]
  - kvm-virtio-net-switch-exit-callback-to-VirtioDeviceClass.patch [bz#983344]
  - kvm-virtio-scsi-switch-exit-callback-to-VirtioDeviceClas.patch [bz#983344]
  - kvm-virtio-balloon-switch-exit-callback-to-VirtioDeviceC.patch [bz#983344]
  - kvm-virtio-rng-switch-exit-callback-to-VirtioDeviceClass.patch [bz#983344]
  - kvm-virtio-pci-add-device_unplugged-callback.patch [bz#983344]
  - kvm-block-use-correct-filename-for-error-report.patch [bz#1051438]
  - Resolves: bz#1026548
    (i386: pc: align gpa<->hpa on 1GB boundary)
  - Resolves: bz#1051438
    (Error message contains garbled characters when unable to open image due to bad permissions (permission denied).)
  - Resolves: bz#983344
    (QEMU core dump and host will reboot when do hot-unplug a virtio-blk disk which use  the switch behind switch)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-44.el7
changelog:
  - kvm-Partially-revert-rhel-Drop-cfi.pflash01-and-isa-ide-.patch [bz#1032346]
  - kvm-Revert-pc-Disable-the-use-flash-device-for-BIOS-unle.patch [bz#1032346]
  - kvm-memory-Replace-open-coded-memory_region_is_romd.patch [bz#1032346]
  - kvm-memory-Rename-readable-flag-to-romd_mode.patch [bz#1032346]
  - kvm-isapc-Fix-non-KVM-qemu-boot-read-write-memory-for-is.patch [bz#1032346]
  - kvm-add-kvm_readonly_mem_enabled.patch [bz#1032346]
  - kvm-support-using-KVM_MEM_READONLY-flag-for-regions.patch [bz#1032346]
  - kvm-pc_sysfw-allow-flash-pflash-memory-to-be-used-with-K.patch [bz#1032346]
  - kvm-fix-double-free-the-memslot-in-kvm_set_phys_mem.patch [bz#1032346]
  - kvm-sysfw-remove-read-only-pc_sysfw_flash_vs_rom_bug_com.patch [bz#1032346]
  - kvm-pc_sysfw-remove-the-rom_only-property.patch [bz#1032346]
  - kvm-pc_sysfw-do-not-make-it-a-device-anymore.patch [bz#1032346]
  - kvm-hw-i386-pc_sysfw-support-two-flash-drives.patch [bz#1032346]
  - kvm-i440fx-test-qtest_start-should-be-paired-with-qtest_.patch [bz#1032346]
  - kvm-i440fx-test-give-each-GTest-case-its-own-qtest.patch [bz#1032346]
  - kvm-i440fx-test-generate-temporary-firmware-blob.patch [bz#1032346]
  - kvm-i440fx-test-verify-firmware-under-4G-and-1M-both-bio.patch [bz#1032346]
  - kvm-piix-fix-32bit-pci-hole.patch [bz#1032346]
  - kvm-qapi-Add-backing-to-BlockStats.patch [bz#1041564]
  - kvm-pc-Disable-RDTSCP-unconditionally-on-rhel6.-machine-.patch [bz#918907]
  - kvm-pc-Disable-RDTSCP-on-AMD-CPU-models.patch [bz#1056428 bz#874400]
  - kvm-block-add-.bdrv_reopen_prepare-stub-for-iscsi.patch [bz#1030301]
  - Resolves: bz#1030301
    (qemu-img can not merge live snapshot to backing file(r/w backing file via libiscsi))
  - Resolves: bz#1032346
    (basic OVMF support (non-volatile UEFI variables in flash, and fixup for ACPI tables))
  - Resolves: bz#1041564
    ([NFR] qemu: Returning the watermark for all the images opened for writing)
  - Resolves: bz#1056428
    ("rdtscp" flag defined on Opteron_G5 model and cann't be exposed to guest)
  - Resolves: bz#874400
    ("rdtscp" flag defined on Opteron_G5 model and cann't be exposed to guest)
  - Resolves: bz#918907
    (provide backwards-compatible RHEL specific machine types in QEMU - CPU features)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-45.el7
changelog:
  - kvm-vfio-pci-Fail-initfn-on-DMA-mapping-errors.patch [bz#1044815]
  - kvm-vfio-Destroy-memory-regions.patch [bz#1052030]
  - kvm-docs-qcow2-compat-1.1-is-now-the-default.patch [bz#1048092]
  - kvm-hda-codec-disable-streams-on-reset.patch [bz#947812]
  - kvm-QEMUBH-make-AioContext-s-bh-re-entrant.patch [bz#1009297]
  - kvm-qxl-replace-pipe-signaling-with-bottom-half.patch [bz#1009297]
  - Resolves: bz#1009297
    (RHEL7.0 guest gui can not be used in dest host after migration)
  - Resolves: bz#1044815
    (vfio initfn succeeds even if IOMMU mappings fail)
  - Resolves: bz#1048092
    (manpage of qemu-img contains error statement about compat option)
  - Resolves: bz#1052030
    (src qemu-kvm core dump after hotplug/unhotplug GPU device and do local migration)
  - Resolves: bz#947812
    (There's a shot voice after  'system_reset'  during playing music inside rhel6 guest w/ intel-hda device)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-46.el7
changelog:
  - kvm-block-fix-backing-file-segfault.patch [bz#748906]
  - kvm-block-Move-initialisation-of-BlockLimits-to-bdrv_ref.patch [bz#748906]
  - kvm-raw-Fix-BlockLimits-passthrough.patch [bz#748906]
  - kvm-block-Inherit-opt_transfer_length.patch [bz#748906]
  - kvm-block-Update-BlockLimits-when-they-might-have-change.patch [bz#748906]
  - kvm-qemu_memalign-Allow-small-alignments.patch [bz#748906]
  - kvm-block-Detect-unaligned-length-in-bdrv_qiov_is_aligne.patch [bz#748906]
  - kvm-block-Don-t-use-guest-sector-size-for-qemu_blockalig.patch [bz#748906]
  - kvm-block-rename-buffer_alignment-to-guest_block_size.patch [bz#748906]
  - kvm-raw-Probe-required-direct-I-O-alignment.patch [bz#748906]
  - kvm-block-Introduce-bdrv_aligned_preadv.patch [bz#748906]
  - kvm-block-Introduce-bdrv_co_do_preadv.patch [bz#748906]
  - kvm-block-Introduce-bdrv_aligned_pwritev.patch [bz#748906]
  - kvm-block-write-Handle-COR-dependency-after-I-O-throttli.patch [bz#748906]
  - kvm-block-Introduce-bdrv_co_do_pwritev.patch [bz#748906]
  - kvm-block-Switch-BdrvTrackedRequest-to-byte-granularity.patch [bz#748906]
  - kvm-block-Allow-waiting-for-overlapping-requests-between.patch [bz#748906]
  - kvm-block-use-DIV_ROUND_UP-in-bdrv_co_do_readv.patch [bz#748906]
  - kvm-block-Make-zero-after-EOF-work-with-larger-alignment.patch [bz#748906]
  - kvm-block-Generalise-and-optimise-COR-serialisation.patch [bz#748906]
  - kvm-block-Make-overlap-range-for-serialisation-dynamic.patch [bz#748906]
  - kvm-block-Fix-32-bit-truncation-in-mark_request_serialis.patch [bz#748906]
  - kvm-block-Allow-wait_serialising_requests-at-any-point.patch [bz#748906]
  - kvm-block-Align-requests-in-bdrv_co_do_pwritev.patch [bz#748906]
  - kvm-lock-Fix-memory-leaks-in-bdrv_co_do_pwritev.patch [bz#748906]
  - kvm-block-Assert-serialisation-assumptions-in-pwritev.patch [bz#748906]
  - kvm-block-Change-coroutine-wrapper-to-byte-granularity.patch [bz#748906]
  - kvm-block-Make-bdrv_pread-a-bdrv_prwv_co-wrapper.patch [bz#748906]
  - kvm-block-Make-bdrv_pwrite-a-bdrv_prwv_co-wrapper.patch [bz#748906]
  - kvm-iscsi-Set-bs-request_alignment.patch [bz#748906]
  - kvm-blkdebug-Make-required-alignment-configurable.patch [bz#748906]
  - kvm-blkdebug-Don-t-leak-bs-file-on-failure.patch [bz#748906]
  - kvm-qemu-io-New-command-sleep.patch [bz#748906]
  - kvm-qemu-iotests-Filter-out-qemu-io-prompt.patch [bz#748906]
  - kvm-qemu-iotests-Test-pwritev-RMW-logic.patch [bz#748906]
  - kvm-block-bdrv_aligned_pwritev-Assert-overlap-range.patch [bz#748906]
  - kvm-block-Don-t-call-ROUND_UP-with-negative-values.patch [bz#748906]
  - Resolves: bz#748906
    (qemu fails on disk with 4k sectors and cache=off)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-47.el7
changelog:
  - kvm-seccomp-add-mkdir-and-fchmod-to-the-whitelist.patch [bz#1026314]
  - kvm-seccomp-add-some-basic-shared-memory-syscalls-to-the.patch [bz#1026314]
  - kvm-scsi-Support-TEST-UNIT-READY-in-the-dummy-LUN0.patch [bz#1004143]
  - kvm-usb-add-vendor-request-defines.patch [bz#1039530]
  - kvm-usb-move-usb_-hi-lo-helpers-to-header-file.patch [bz#1039530]
  - kvm-usb-add-support-for-microsoft-os-descriptors.patch [bz#1039530]
  - kvm-usb-add-microsoft-os-descriptors-compat-property.patch [bz#1039530]
  - kvm-usb-hid-add-microsoft-os-descriptor-support.patch [bz#1039530]
  - kvm-configure-add-option-to-disable-fstack-protect.patch [bz#1044182]
  - kvm-exec-always-use-MADV_DONTFORK.patch [bz#1004197]
  - kvm-pc-Save-size-of-RAM-below-4GB.patch [bz#1048080]
  - kvm-acpi-Fix-PCI-hole-handling-on-build_srat.patch [bz#1048080]
  - kvm-Add-check-for-cache-size-smaller-than-page-size.patch [bz#1017096]
  - kvm-XBZRLE-cache-size-should-not-be-larger-than-guest-me.patch [bz#1047448]
  - kvm-Don-t-abort-on-out-of-memory-when-creating-page-cach.patch [bz#1047448]
  - kvm-Don-t-abort-on-memory-allocation-error.patch [bz#1047448]
  - kvm-Set-xbzrle-buffers-to-NULL-after-freeing-them-to-avo.patch [bz#1038540]
  - kvm-migration-fix-free-XBZRLE-decoded_buf-wrong.patch [bz#1038540]
  - kvm-block-resize-backing-file-image-during-offline-commi.patch [bz#1047254]
  - kvm-block-resize-backing-image-during-active-layer-commi.patch [bz#1047254]
  - kvm-block-update-block-commit-documentation-regarding-im.patch [bz#1047254]
  - kvm-block-Fix-bdrv_commit-return-value.patch [bz#1047254]
  - kvm-block-remove-QED-.bdrv_make_empty-implementation.patch [bz#1047254]
  - kvm-block-remove-qcow2-.bdrv_make_empty-implementation.patch [bz#1047254]
  - kvm-qemu-progress-Drop-unused-include.patch [bz#997878]
  - kvm-qemu-progress-Fix-progress-printing-on-SIGUSR1.patch [bz#997878]
  - kvm-Documentation-qemu-img-Mention-SIGUSR1-progress-repo.patch [bz#997878]
  - Resolves: bz#1004143
    ("test unit ready failed" on LUN 0 delays boot when a virtio-scsi target does not have any disk on LUN 0)
  - Resolves: bz#1004197
    (Cannot hot-plug nic in windows VM when the vmem is larger)
  - Resolves: bz#1017096
    (Fail to migrate while the size of migrate-compcache less then 4096)
  - Resolves: bz#1026314
    (qemu-kvm hang when use '-sandbox on'+'vnc'+'hda')
  - Resolves: bz#1038540
    (qemu-kvm aborted while cancel migration then restart it (with page delta compression))
  - Resolves: bz#1039530
    (add support for microsoft os descriptors)
  - Resolves: bz#1044182
    (Relax qemu-kvm stack protection to -fstack-protector-strong)
  - Resolves: bz#1047254
    (qemu-img failed to commit image)
  - Resolves: bz#1047448
    (qemu-kvm core  dump in src host when do migration with "migrate_set_capability xbzrle on and migrate_set_cache_size 10000G")
  - Resolves: bz#1048080
    (Qemu-kvm NUMA emulation failed)
  - Resolves: bz#997878
    (Kill -SIGUSR1 `pidof qemu-img convert` can not get progress of qemu-img)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-48.el7
changelog:
  - kvm-spec-disable-qom-cast-debug.patch [bz#1063942]
  - kvm-fix-guest-physical-bits-to-match-host-to-go-beyond-1.patch [bz#989677]
  - kvm-monitor-Cleanup-mon-outbuf-on-write-error.patch [bz#1065225]
  - Resolves: bz#1063942
    (configure qemu-kvm with --disable-qom-cast-debug)
  - Resolves: bz#1065225
    (QMP socket breaks on unexpected close)
  - Resolves: bz#989677
    ([HP 7.0 FEAT]: Increase KVM guest supported memory to 4TiB)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-49.el7
changelog:
  - kvm-xhci-add-support-for-suspend-resume.patch [bz#1012365]
  - kvm-qcow2-remove-n_start-and-n_end-of-qcow2_alloc_cluste.patch [bz#1049176]
  - kvm-qcow2-fix-offset-overflow-in-qcow2_alloc_clusters_at.patch [bz#1049176]
  - kvm-qcow2-check-for-NULL-l2meta.patch [bz#1055848]
  - kvm-qemu-iotests-add-test-for-qcow2-preallocation-with-d.patch [bz#1055848]
  - Resolves: bz#1012365
    (xhci usb storage lost in guest after wakeup from S3)
  - Resolves: bz#1049176
    (qemu-img core dump when using "-o preallocation=metadata,cluster_size=2048k" to create image of libiscsi lun)
  - Resolves: bz#1055848
    (qemu-img core dumped when cluster size is larger than the default value with opreallocation=metadata specified)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-50.el7
changelog:
  - kvm-mempath-prefault-fix-off-by-one-error.patch [bz#1069039]
  - kvm-qemu-option-has_help_option-and-is_valid_option_list.patch [bz#1065873]
  - kvm-qemu-img-create-Support-multiple-o-options.patch [bz#1065873]
  - kvm-qemu-img-convert-Support-multiple-o-options.patch [bz#1065873]
  - kvm-qemu-img-amend-Support-multiple-o-options.patch [bz#1065873]
  - kvm-qemu-img-Allow-o-help-with-incomplete-argument-list.patch [bz#1065873]
  - kvm-qemu-iotests-Check-qemu-img-command-line-parsing.patch [bz#1065873]
  - Resolves: bz#1065873
    (qemu-img silently ignores options with multiple -o parameters)
  - Resolves: bz#1069039
    (-mem-prealloc option behaviour is opposite to expected)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-51.el7
changelog:
  - kvm-qmp-access-the-local-QemuOptsLists-for-drive-option.patch [bz#1026184]
  - kvm-qxl-add-sanity-check.patch [bz#751937]
  - kvm-Fix-two-XBZRLE-corruption-issues.patch [bz#1063417]
  - kvm-qdev-monitor-set-DeviceState-opts-before-calling-rea.patch [bz#1037956]
  - kvm-vfio-blacklist-loading-of-unstable-roms.patch [bz#1037956]
  - kvm-block-Set-block-filename-sizes-to-PATH_MAX-instead-o.patch [bz#1072339]
  - Resolves: bz#1026184
    (QMP: querying -drive option returns a NULL parameter list)
  - Resolves: bz#1037956
    (bnx2x: boot one guest to do vfio-pci with all PFs assigned in same group meet QEMU segmentation fault (Broadcom BCM57810 card))
  - Resolves: bz#1063417
    (google stressapptest vs Migration)
  - Resolves: bz#1072339
    (RHEV: Cannot start VMs that have more than 23 snapshots.)
  - Resolves: bz#751937
    (qxl triggers assert during iofuzz test)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-52.el7
changelog:
  - kvm-target-i386-Move-hyperv_-static-globals-to-X86CPU.patch [bz#1004773]
  - kvm-Fix-uninitialized-cpuid_data.patch [bz#1057173]
  - kvm-fix-coexistence-of-KVM-and-Hyper-V-leaves.patch [bz#1004773]
  - kvm-make-availability-of-Hyper-V-enlightenments-depe.patch [bz#1004773]
  - kvm-make-hyperv-hypercall-and-guest-os-id-MSRs-migra.patch [bz#1004773]
  - kvm-make-hyperv-vapic-assist-page-migratable.patch [bz#1004773]
  - kvm-target-i386-Convert-hv_relaxed-to-static-property.patch [bz#1057173]
  - kvm-target-i386-Convert-hv_vapic-to-static-property.patch [bz#1057173]
  - kvm-target-i386-Convert-hv_spinlocks-to-static-property.patch [bz#1057173]
  - kvm-target-i386-Convert-check-and-enforce-to-static-prop.patch [bz#1004773]
  - kvm-target-i386-Cleanup-foo-feature-handling.patch [bz#1057173]
  - kvm-add-support-for-hyper-v-timers.patch [bz#1057173]
  - Resolves: bz#1004773
    (Hyper-V guest OS id and hypercall MSRs not migrated)
  - Resolves: bz#1057173
    (KVM Hyper-V Enlightenment - New feature - hv-time (QEMU))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-53.el7
changelog:
  - kvm-dataplane-Fix-startup-race.patch [bz#1069541]
  - kvm-QMP-Relax-__com.redhat_drive_add-parameter-checking.patch [bz#1057471]
  - kvm-all-exit-in-case-max-vcpus-exceeded.patch [bz#993429]
  - kvm-block-gluster-code-movements-state-storage-changes.patch [bz#1031526]
  - kvm-block-gluster-add-reopen-support.patch [bz#1031526]
  - kvm-virtio-net-add-feature-bit-for-any-header-s-g.patch [bz#990989]
  - kvm-spec-Add-README.rhel6-gpxe-source.patch [bz#1073774]
  - kvm-pc-Add-RHEL6-e1000-gPXE-image.patch [bz#1073774]
  - kvm-loader-rename-in_ram-has_mr.patch [bz#1064018]
  - kvm-pc-avoid-duplicate-names-for-ROM-MRs.patch [bz#1064018]
  - kvm-qemu-img-convert-Fix-progress-output.patch [bz#1073728]
  - kvm-qemu-iotests-Test-progress-output-for-conversion.patch [bz#1073728]
  - kvm-iscsi-Use-bs-sg-for-everything-else-than-disks.patch [bz#1067784]
  - kvm-block-Fix-bs-request_alignment-assertion-for-bs-sg-1.patch [bz#1067784]
  - kvm-qemu_file-use-fwrite-correctly.patch [bz#1005103]
  - kvm-qemu_file-Fix-mismerge-of-use-fwrite-correctly.patch [bz#1005103]
  - Resolves: bz#1005103
    (Migration should fail when migrate guest offline to a file which is specified to a readonly directory.)
  - Resolves: bz#1031526
    (Can not commit snapshot when disk is using glusterfs:native backend)
  - Resolves: bz#1057471
    (fail to do hot-plug with "discard = on" with "Invalid parameter 'discard'" error)
  - Resolves: bz#1064018
    (abort from conflicting genroms)
  - Resolves: bz#1067784
    (qemu-kvm: block.c:850: bdrv_open_common: Assertion `bs->request_alignment != 0' failed. Aborted (core dumped))
  - Resolves: bz#1069541
    (Segmentation fault when boot guest with dataplane=on)
  - Resolves: bz#1073728
    (progress bar doesn't display when converting with -p)
  - Resolves: bz#1073774
    (e1000 ROM cause migrate fail  from RHEL6.5 host to RHEL7.0 host)
  - Resolves: bz#990989
    (backport inline header virtio-net optimization)
  - Resolves: bz#993429
    (kvm: test maximum number of vcpus supported (rhel7))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-54.el7
changelog:
  - kvm-qdev-monitor-Set-properties-after-parent-is-assigned.patch [bz#1046248]
  - kvm-block-Update-image-size-in-bdrv_invalidate_cache.patch [bz#1048575]
  - kvm-qcow2-Keep-option-in-qcow2_invalidate_cache.patch [bz#1048575]
  - kvm-qcow2-Check-bs-drv-in-copy_sectors.patch [bz#1048575]
  - kvm-block-bs-drv-may-be-NULL-in-bdrv_debug_resume.patch [bz#1048575]
  - kvm-iotests-Test-corruption-during-COW-request.patch [bz#1048575]
  - Resolves: bz#1046248
    (qemu-kvm crash when send "info qtree" after hot plug a device with invalid addr)
  - Resolves: bz#1048575
    (Segmentation fault occurs after migrate guest(use scsi disk and add stress) to des machine)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-55.el7
changelog:
  - kvm-scsi-Change-scsi-sense-buf-size-to-252.patch [bz#1058173]
  - kvm-scsi-Fix-migration-of-scsi-sense-data.patch [bz#1058173]
  - Resolves: bz#1058173
    (qemu-kvm core dump booting guest with scsi-generic disk attached when using built-in iscsi driver)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-56.el7
changelog:
  - kvm-configure-Fix-bugs-preventing-Ceph-inclusion.patch [bz#1078809]
  - Resolves: bz#1078809
    (can not boot qemu-kvm-rhev with rbd image)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-57.el7
changelog:
  - kvm-virtio-net-fix-guest-triggerable-buffer-overrun.patch [bz#1078308]
  - Resolves: bz#1078308
    (EMBARGOED CVE-2014-0150 qemu: virtio-net: fix guest-triggerable buffer overrun [rhel-7.0])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-58.el7
changelog:
  - kvm-pc-Use-cpu64-rhel6-CPU-model-by-default-on-rhel6-mac.patch [bz#1080170]
  - kvm-target-i386-Copy-cpu64-rhel6-definition-into-qemu64.patch [bz#1078607 bz#1080170]
  - Resolves: bz#1080170
    (intel 82576 VF not work in windows 2008 x86 - Code 12 [TestOnly])
  - Resolves: bz#1080170
    (Default CPU model for rhel6.* machine-types is different from RHEL-6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-59.el7
changelog:
  - kvm-qemu-iotests-add-.-check-cloop-support.patch [bz#1066691]
  - kvm-qemu-iotests-add-cloop-input-validation-tests.patch [bz#1066691]
  - kvm-block-cloop-validate-block_size-header-field-CVE-201.patch [bz#1079455]
  - kvm-block-cloop-prevent-offsets_size-integer-overflow-CV.patch [bz#1079320]
  - kvm-block-cloop-refuse-images-with-huge-offsets-arrays-C.patch [bz#1079455]
  - kvm-block-cloop-refuse-images-with-bogus-offsets-CVE-201.patch [bz#1079455]
  - kvm-size-off-by-one.patch [bz#1066691]
  - kvm-qemu-iotests-Support-for-bochs-format.patch [bz#1066691]
  - kvm-bochs-Unify-header-structs-and-make-them-QEMU_PACKED.patch [bz#1066691]
  - kvm-bochs-Use-unsigned-variables-for-offsets-and-sizes-C.patch [bz#1079339]
  - kvm-bochs-Check-catalog_size-header-field-CVE-2014-0143.patch [bz#1079320]
  - kvm-bochs-Check-extent_size-header-field-CVE-2014-0142.patch [bz#1079315]
  - kvm-bochs-Fix-bitmap-offset-calculation.patch [bz#1066691]
  - kvm-vpc-vhd-add-bounds-check-for-max_table_entries-and-b.patch [bz#1079455]
  - kvm-vpc-Validate-block-size-CVE-2014-0142.patch [bz#1079315]
  - kvm-vdi-add-bounds-checks-for-blocks_in_image-and-disk_s.patch [bz#1079455]
  - kvm-vhdx-Bounds-checking-for-block_size-and-logical_sect.patch [bz#1079346]
  - kvm-curl-check-data-size-before-memcpy-to-local-buffer.-.patch [bz#1079455]
  - kvm-qcow2-Check-header_length-CVE-2014-0144.patch [bz#1079455]
  - kvm-qcow2-Check-backing_file_offset-CVE-2014-0144.patch [bz#1079455]
  - kvm-qcow2-Check-refcount-table-size-CVE-2014-0144.patch [bz#1079455]
  - kvm-qcow2-Validate-refcount-table-offset.patch [bz#1066691]
  - kvm-qcow2-Validate-snapshot-table-offset-size-CVE-2014-0.patch [bz#1079455]
  - kvm-qcow2-Validate-active-L1-table-offset-and-size-CVE-2.patch [bz#1079455]
  - kvm-qcow2-Fix-backing-file-name-length-check.patch [bz#1066691]
  - kvm-qcow2-Don-t-rely-on-free_cluster_index-in-alloc_refc.patch [bz#1079339]
  - kvm-qcow2-Avoid-integer-overflow-in-get_refcount-CVE-201.patch [bz#1079320]
  - kvm-qcow2-Check-new-refcount-table-size-on-growth.patch [bz#1066691]
  - kvm-qcow2-Fix-types-in-qcow2_alloc_clusters-and-alloc_cl.patch [bz#1066691]
  - kvm-qcow2-Protect-against-some-integer-overflows-in-bdrv.patch [bz#1066691]
  - kvm-qcow2-Fix-new-L1-table-size-check-CVE-2014-0143.patch [bz#1079320]
  - kvm-dmg-coding-style-and-indentation-cleanup.patch [bz#1066691]
  - kvm-dmg-prevent-out-of-bounds-array-access-on-terminator.patch [bz#1066691]
  - kvm-dmg-drop-broken-bdrv_pread-loop.patch [bz#1066691]
  - kvm-dmg-use-appropriate-types-when-reading-chunks.patch [bz#1066691]
  - kvm-dmg-sanitize-chunk-length-and-sectorcount-CVE-2014-0.patch [bz#1079325]
  - kvm-dmg-use-uint64_t-consistently-for-sectors-and-length.patch [bz#1066691]
  - kvm-dmg-prevent-chunk-buffer-overflow-CVE-2014-0145.patch [bz#1079325]
  - kvm-block-vdi-bounds-check-qemu-io-tests.patch [bz#1066691]
  - kvm-block-Limit-request-size-CVE-2014-0143.patch [bz#1079320]
  - kvm-qcow2-Fix-copy_sectors-with-VM-state.patch [bz#1066691]
  - kvm-qcow2-Fix-NULL-dereference-in-qcow2_open-error-path-.patch [bz#1079333]
  - kvm-qcow2-Fix-L1-allocation-size-in-qcow2_snapshot_load_.patch [bz#1079325]
  - kvm-qcow2-Check-maximum-L1-size-in-qcow2_snapshot_load_t.patch [bz#1079320]
  - kvm-qcow2-Limit-snapshot-table-size.patch [bz#1066691]
  - kvm-parallels-Fix-catalog-size-integer-overflow-CVE-2014.patch [bz#1079320]
  - kvm-parallels-Sanity-check-for-s-tracks-CVE-2014-0142.patch [bz#1079315]
  - kvm-fix-machine-check-propagation.patch [bz#740107]
  - Resolves: bz#1066691
    (qemu-kvm: include leftover patches from block layer security audit)
  - Resolves: bz#1079315
    (CVE-2014-0142 qemu-kvm: qemu: crash by possible division by zero [rhel-7.0])
  - Resolves: bz#1079320
    (CVE-2014-0143 qemu-kvm: Qemu: block: multiple integer overflow flaws [rhel-7.0])
  - Resolves: bz#1079325
    (CVE-2014-0145 qemu-kvm: Qemu: prevent possible buffer overflows [rhel-7.0])
  - Resolves: bz#1079333
    (CVE-2014-0146 qemu-kvm: Qemu: qcow2: NULL dereference in qcow2_open() error path [rhel-7.0])
  - Resolves: bz#1079339
    (CVE-2014-0147 qemu-kvm: Qemu: block: possible crash due signed types or logic error [rhel-7.0])
  - Resolves: bz#1079346
    (CVE-2014-0148 qemu-kvm: Qemu: vhdx: bounds checking for block_size and logical_sector_size [rhel-7.0])
  - Resolves: bz#1079455
    (CVE-2014-0144 qemu-kvm: Qemu: block: missing input validation [rhel-7.0])
  - Resolves: bz#740107
    ([Hitachi 7.0 FEAT]  KVM: MCA Recovery for KVM guest OS memory)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7
changelog:
  - kvm-qcow2-fix-dangling-refcount-table-entry.patch [bz#1081793]
  - kvm-qcow2-link-all-L2-meta-updates-in-preallocate.patch [bz#1081393]
  - Resolves: bz#1081393
    (qemu-img will prompt that 'leaked clusters were found' while creating images with '-o preallocation=metadata,cluster_size<=1024')
  - Resolves: bz#1081793
    (qemu-img core dumped when creating a qcow2 image base on block device(iscsi or libiscsi))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-61.el7
changelog:
  - kvm-iscsi-fix-indentation.patch [bz#1083413]
  - kvm-iscsi-correctly-propagate-errors-in-iscsi_open.patch [bz#1083413]
  - kvm-block-iscsi-query-for-supported-VPD-pages.patch [bz#1083413]
  - kvm-block-iscsi-fix-segfault-if-writesame-fails.patch [bz#1083413]
  - kvm-iscsi-recognize-invalid-field-ASCQ-from-WRITE-SAME-c.patch [bz#1083413]
  - kvm-iscsi-ignore-flushes-on-scsi-generic-devices.patch [bz#1083413]
  - kvm-iscsi-always-query-max-WRITE-SAME-length.patch [bz#1083413]
  - kvm-iscsi-Don-t-set-error-if-already-set-in-iscsi_do_inq.patch [bz#1083413]
  - kvm-iscsi-Remember-to-set-ret-for-iscsi_open-in-error-ca.patch [bz#1083413]
  - kvm-qemu_loadvm_state-shadow-SeaBIOS-for-VM-incoming-fro.patch [bz#1027565]
  - kvm-uhci-UNfix-irq-routing-for-RHEL-6-machtypes-RHEL-onl.patch [bz#1085701]
  - kvm-ide-Correct-improper-smart-self-test-counter-reset-i.patch [bz#1087980]
  - Resolves: bz#1027565
    (fail to reboot guest after migration from RHEL6.5 host to RHEL7.0 host)
  - Resolves: bz#1083413
    (qemu-kvm: iSCSI: Failure. SENSE KEY:ILLEGAL_REQUEST(5) ASCQ:INVALID_FIELD_IN_CDB(0x2400))
  - Resolves: bz#1085701
    (Guest hits call trace migrate from RHEL6.5 to RHEL7.0 host with -M 6.1 & balloon & uhci device)
  - Resolves: bz#1087980
    (CVE-2014-2894 qemu-kvm: QEMU: out of bounds buffer accesses, guest triggerable via IDE SMART [rhel-7.1])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-62.el7
changelog:
  - kvm-pc-add-hot_add_cpu-callback-to-all-machine-types.patch [bz#1094285]
  - Resolves: bz#1094285
    (Hot plug CPU not working with RHEL6  machine types running on RHEL7 host.)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-63.el7
changelog:
  - kvm-char-restore-read-callback-on-a-reattached-hotplug-c.patch [bz#1038914]
  - kvm-qcow2-Free-preallocated-zero-clusters.patch [bz#1052093]
  - kvm-qemu-iotests-Discard-preallocated-zero-clusters.patch [bz#1052093]
  - kvm-XBZRLE-Fix-qemu-crash-when-resize-the-xbzrle-cache.patch [bz#1066338]
  - kvm-Provide-init-function-for-ram-migration.patch [bz#1066338]
  - kvm-Init-the-XBZRLE.lock-in-ram_mig_init.patch [bz#1066338]
  - kvm-XBZRLE-Fix-one-XBZRLE-corruption-issues.patch [bz#1066338]
  - kvm-Count-used-RAMBlock-pages-for-migration_dirty_pages.patch [bz#1074913]
  - kvm-virtio-net-fix-buffer-overflow-on-invalid-state-load.patch [bz#1095678]
  - kvm-virtio-net-out-of-bounds-buffer-write-on-invalid-sta.patch [bz#1095690]
  - kvm-virtio-net-out-of-bounds-buffer-write-on-load.patch [bz#1095685]
  - kvm-virtio-out-of-bounds-buffer-write-on-invalid-state-l.patch [bz#1095695]
  - kvm-virtio-avoid-buffer-overrun-on-incoming-migration.patch [bz#1095738]
  - kvm-virtio-scsi-fix-buffer-overrun-on-invalid-state-load.patch [bz#1095742]
  - kvm-virtio-validate-config_len-on-load.patch [bz#1095783]
  - kvm-virtio-validate-num_sg-when-mapping.patch [bz#1095766]
  - kvm-virtio-allow-mapping-up-to-max-queue-size.patch [bz#1095766]
  - kvm-usb-sanity-check-setup_index-setup_len-in-post_load.patch [bz#1095747]
  - kvm-usb-sanity-check-setup_index-setup_len-in-post_l2.patch [bz#1095747]
  - kvm-vmstate-reduce-code-duplication.patch [bz#1095716]
  - kvm-vmstate-add-VMS_MUST_EXIST.patch [bz#1095716]
  - kvm-vmstate-add-VMSTATE_VALIDATE.patch [bz#1095716]
  - kvm-hpet-fix-buffer-overrun-on-invalid-state-load.patch [bz#1095707]
  - kvm-hw-pci-pcie_aer.c-fix-buffer-overruns-on-invalid-sta.patch [bz#1095716]
  - kvm-usb-fix-up-post-load-checks.patch [bz#1096829]
  - kvm-qcow-correctly-propagate-errors.patch [bz#1097230]
  - kvm-qcow1-Make-padding-in-the-header-explicit.patch [bz#1097230]
  - kvm-qcow1-Check-maximum-cluster-size.patch [bz#1097230]
  - kvm-qcow1-Validate-L2-table-size-CVE-2014-0222.patch [bz#1097230]
  - kvm-qcow1-Validate-image-size-CVE-2014-0223.patch [bz#1097237]
  - kvm-qcow1-Stricter-backing-file-length-check.patch [bz#1097237]
  - Resolves: bz#1038914
    (Guest can't receive any character transmitted from host after hot unplugging virtserialport then hot plugging again)
  - Resolves: bz#1052093
    (qcow2 corruptions (leaked clusters after installing a rhel7 guest using virtio_scsi))
  - Resolves: bz#1066338
    (Reduce the migrate cache size during migration causes qemu segment fault)
  - Resolves: bz#1074913
    (migration can not finish with 1024k 'remaining ram' left after hotunplug 4 nics)
  - Resolves: bz#1095678
    (CVE-2013-4148 qemu-kvm: qemu: virtio-net: buffer overflow on invalid state load [rhel-7.1])
  - Resolves: bz#1095685
    (CVE-2013-4149 qemu-kvm: qemu: virtio-net: out-of-bounds buffer write on load [rhel-7.1])
  - Resolves: bz#1095690
    (CVE-2013-4150 qemu-kvm: qemu: virtio-net: out-of-bounds buffer write on invalid state load [rhel-7.1])
  - Resolves: bz#1095695
    (CVE-2013-4151 qemu-kvm: qemu: virtio: out-of-bounds buffer write on invalid state load [rhel-7.1])
  - Resolves: bz#1095707
    (CVE-2013-4527 qemu-kvm: qemu: hpet: buffer overrun on invalid state load [rhel-7.1])
  - Resolves: bz#1095716
    (CVE-2013-4529 qemu-kvm: qemu: hw/pci/pcie_aer.c: buffer overrun on invalid state load [rhel-7.1])
  - Resolves: bz#1095738
    (CVE-2013-6399 qemu-kvm: qemu: virtio: buffer overrun on incoming migration [rhel-7.1])
  - Resolves: bz#1095742
    (CVE-2013-4542 qemu-kvm: qemu: virtio-scsi: buffer overrun on invalid state load [rhel-7.1])
  - Resolves: bz#1095747
    (CVE-2013-4541 qemu-kvm: qemu: usb: insufficient sanity checking of setup_index+setup_len in post_load [rhel-7.1])
  - Resolves: bz#1095766
    (CVE-2013-4535 CVE-2013-4536 qemu-kvm: qemu: virtio: insufficient validation of num_sg when mapping [rhel-7.1])
  - Resolves: bz#1095783
    (CVE-2014-0182 qemu-kvm: qemu: virtio: out-of-bounds buffer write on state load with invalid config_len [rhel-7.1])
  - Resolves: bz#1096829
    (CVE-2014-3461 qemu-kvm: Qemu: usb: fix up post load checks [rhel-7.1])
  - Resolves: bz#1097230
    (CVE-2014-0222 qemu-kvm: Qemu: qcow1: validate L2 table size to avoid integer overflows [rhel-7.1])
  - Resolves: bz#1097237
    (CVE-2014-0223 qemu-kvm: Qemu: qcow1: validate image size to avoid out-of-bounds memory access [rhel-7.1])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-64.el7
changelog:
  - kvm-zero-initialize-KVM_SET_GSI_ROUTING-input.patch [bz#1098976]
  - kvm-skip-system-call-when-msi-route-is-unchanged.patch [bz#1098976]
  - Resolves: bz#1098976
    (2x RHEL 5.10 VM running on RHEL 7 KVM have low TCP_STREAM throughput)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-65.el7
changelog:
  - kvm-Allow-mismatched-virtio-config-len.patch [bz#1113009]
  - Resolves: bz#1113009
    (Migration failed with virtio-blk from RHEL6.5.0 host to RHEL7.0 host)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-66.el7
changelog:
  - kvm-xhci-fix-overflow-in-usb_xhci_post_load.patch [bz#1074219]
  - kvm-migration-qmp_migrate-keep-working-after-syntax-erro.patch [bz#1086598]
  - kvm-seccomp-add-shmctl-mlock-and-munlock-to-the-syscall-.patch [bz#1026314]
  - kvm-exit-when-no-kvm-and-vcpu-count-160.patch [bz#1076326]
  - kvm-Disallow-outward-migration-while-awaiting-incoming-m.patch [bz#1086987]
  - kvm-block-Ignore-duplicate-or-NULL-format_name-in-bdrv_i.patch [bz#1088695 bz#1093983]
  - kvm-block-vhdx-account-for-identical-header-sections.patch [bz#1097020]
  - kvm-aio-Fix-use-after-free-in-cancellation-path.patch [bz#1095877]
  - kvm-scsi-disk-Improve-error-messager-if-can-t-get-versio.patch [bz#1021788]
  - kvm-scsi-Improve-error-messages-more.patch [bz#1021788]
  - kvm-memory-Don-t-call-memory_region_update_coalesced_ran.patch [bz#1096645]
  - kvm-kvmclock-Ensure-time-in-migration-never-goes-backwar.patch [bz#1098602]
  - kvm-kvmclock-Ensure-proper-env-tsc-value-for-kvmclock_cu.patch [bz#1098602]
  - Resolves: bz#1021788
    (the error message "scsi generic interface too old" is wrong more often than not)
  - Resolves: bz#1026314
    (qemu-kvm hang when use '-sandbox on'+'vnc'+'hda')
  - Resolves: bz#1074219
    (qemu core dump when install a RHEL.7 guest(xhci) with migration)
  - Resolves: bz#1076326
    (qemu-kvm does not quit when booting guest w/ 161 vcpus and "-no-kvm")
  - Resolves: bz#1086598
    (migrate_cancel wont take effect on previouly wrong migrate -d cmd)
  - Resolves: bz#1086987
    (src qemu crashed when starting migration in inmigrate mode)
  - Resolves: bz#1088695
    (there are four "gluster" in qemu-img supported format list)
  - Resolves: bz#1093983
    (there are three "nbd" in qemu-img supported format list)
  - Resolves: bz#1095877
    (segmentation fault in qemu-kvm due to use-after-free of a SCSIGenericReq (host device pass-through))
  - Resolves: bz#1096645
    ([FJ7.0 Bug] RHEL7.0 guest attaching 150 or more virtio-blk disks fails to start up)
  - Resolves: bz#1097020
    ([RFE] qemu-img: Add/improve Disk2VHD tools creating VHDX images)
  - Resolves: bz#1098602
    (kvmclock: Ensure time in migration never goes backward (backport))


author: Jeff E. Nelson <jen@redhat.com> - 1.5.3-67.el7
changelog:
  - kvm-vl.c-Output-error-on-invalid-machine-type.patch [bz#990724]
  - kvm-migration-dump-vmstate-info-as-a-json-file-for-stati.patch [bz#1118707]
  - kvm-vmstate-static-checker-script-to-validate-vmstate-ch.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-add-dump1-and-dump2-fil.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-incompat-machine-types.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-add-version-error-in-ma.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-version-mismatch-inside.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-minimum_version_id-chec.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-a-section.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-a-field.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-last-field-in-a-.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-change-description-name.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-Fields.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-Description.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-Description-insi.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-a-subsection.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-Subsections.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-add-substructure-for-us.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-add-size-mismatch-insid.patch [bz#1118707]
  - kvm-aio-fix-qemu_bh_schedule-bh-ctx-race-condition.patch [bz#1116728]
  - kvm-block-Improve-driver-whitelist-checks.patch [bz#999789]
  - kvm-vmdk-Fix-format-specific-information-create-type-for.patch [bz#1029271]
  - kvm-virtio-pci-Report-an-error-when-msix-vectors-init-fa.patch [bz#1095645]
  - kvm-scsi-Report-error-when-lun-number-is-in-use.patch [bz#1096576]
  - kvm-util-Split-out-exec_dir-from-os_find_datadir.patch [bz#1017685]
  - kvm-rules.mak-fix-obj-to-a-real-relative-path.patch [bz#1017685]
  - kvm-rules.mak-allow-per-object-cflags-and-libs.patch [bz#1017685]
  - kvm-block-use-per-object-cflags-and-libs.patch [bz#1017685]
  - kvm-vmdk-Fix-creating-big-description-file.patch [bz#1039791]
  - Resolves: bz#1017685
    (Gluster etc. should not be a dependency of vscclient and libcacard)
  - Resolves: bz#1029271
    (Format specific information (create type) was wrong when create it specified subformat='streamOptimized')
  - Resolves: bz#1039791
    (qemu-img creates truncated VMDK image with subformat=twoGbMaxExtentFlat)
  - Resolves: bz#1095645
    (vectors of virtio-scsi-pci will be 0 when set vectors>=129)
  - Resolves: bz#1096576
    (QEMU core dumped when boot up two scsi-hd disk on the same virtio-scsi-pci controller in Intel host)
  - Resolves: bz#1116728
    (Backport qemu_bh_schedule() race condition fix)
  - Resolves: bz#1118707
    (VMstate static checker: backport -dump-vmstate feature to export json-encoded vmstate info)
  - Resolves: bz#990724
    (qemu-kvm failing when invalid machine type is provided)
  - Resolves: bz#999789
    (qemu should give a more friendly prompt when didn't specify read-only for VMDK format disk)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-68.el7
changelog:
  - kvm-virtio-net-Do-not-filter-VLANs-without-F_CTRL_VLAN.patch [bz#1065724]
  - kvm-virtio-net-add-vlan-receive-state-to-RxFilterInfo.patch [bz#1065724]
  - kvm-virtio-rng-check-return-value-of-virtio_load.patch [bz#1116941]
  - kvm-qapi-treat-all-negative-return-of-strtosz_suffix-as-.patch [bz#1074403]
  - Resolves: bz#1065724
    (rx filter incorrect when guest disables VLAN filtering)
  - Resolves: bz#1074403
    (qemu-kvm can not give any warning hint when set sndbuf with negative value)
  - Resolves: bz#1116941
    (Return value of virtio_load not checked in virtio_rng_load)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-69.el7
changelog:
  - kvm-rdma-bug-fixes.patch [bz#1107821]
  - kvm-virtio-serial-report-frontend-connection-state-via-m.patch [bz#1122151]
  - kvm-char-report-frontend-open-closed-state-in-query-char.patch [bz#1122151]
  - kvm-acpi-fix-tables-for-no-hpet-configuration.patch [bz#1129552]
  - kvm-mirror-Fix-resource-leak-when-bdrv_getlength-fails.patch [bz#1130603]
  - kvm-blockjob-Add-block_job_yield.patch [bz#1130603]
  - kvm-mirror-Go-through-ready-complete-process-for-0-len-i.patch [bz#1130603]
  - kvm-qemu-iotests-Test-BLOCK_JOB_READY-event-for-0Kb-imag.patch [bz#1130603]
  - kvm-block-make-top-argument-to-block-commit-optional.patch [bz#1130603]
  - kvm-qemu-iotests-Test-0-length-image-for-mirror.patch [bz#1130603]
  - kvm-mirror-Fix-qiov-size-for-short-requests.patch [bz#1130603]
  - Resolves: bz#1107821
    (rdma migration: seg if destination isn't listening)
  - Resolves: bz#1122151
    (Pass close from qemu-ga)
  - Resolves: bz#1129552
    (backport "acpi: fix tables for no-hpet configuration")
  - Resolves: bz#1130603
    (advertise active commit to libvirt)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-70.el7
changelog:
  - kvm-Enforce-stack-protector-usage.patch [bz#1064260]
  - kvm-pc-increase-maximal-VCPU-count-to-240.patch [bz#1134408]
  - kvm-gluster-Add-discard-support-for-GlusterFS-block-driv.patch [bz#1136534]
  - kvm-gluster-default-scheme-to-gluster-and-host-to-localh.patch [bz#1088150]
  - kvm-qdev-properties-system.c-Allow-vlan-or-netdev-for-de.patch [bz#996011]
  - kvm-vl-process-object-after-other-backend-options.patch [bz#1128095]
  - Resolves: bz#1064260
    (Handle properly --enable-fstack-protector option)
  - Resolves: bz#1088150
    (qemu-img coredumpd when try to create a gluster format image)
  - Resolves: bz#1128095
    (chardev 'chr0' isn't initialized when we try to open rng backend)
  - Resolves: bz#1134408
    ([HP 7.1 FEAT] Increase qemu-kvm's VCPU limit to 240)
  - Resolves: bz#1136534
    (glusterfs backend does not support discard)
  - Resolves: bz#996011
    (vlan and queues options cause core dumped when qemu-kvm process quit(or ctrl+c))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-71.el7
changelog:
  - kvm-spice-move-qemu_spice_display_-from-spice-graphics-t.patch [bz#1054077]
  - kvm-spice-move-spice_server_vm_-start-stop-calls-into-qe.patch [bz#1054077]
  - kvm-spice-stop-server-for-qxl-hard-reset.patch [bz#1054077]
  - kvm-qemu-Adjust-qemu-wakeup.patch [bz#1064156]
  - kvm-vmstate_xhci_event-fix-unterminated-field-list.patch [bz#1122147]
  - kvm-vmstate_xhci_event-bug-compat-with-RHEL-7.0-RHEL-onl.patch [bz#1122147]
  - kvm-pflash_cfi01-write-flash-contents-to-bdrv-on-incomin.patch [bz#1139702]
  - kvm-ide-test-Add-enum-value-for-DEV.patch [bz#1123372]
  - kvm-ide-test-Add-FLUSH-CACHE-test-case.patch [bz#1123372]
  - kvm-ide-Fix-segfault-when-flushing-a-device-that-doesn-t.patch [bz#1123372]
  - kvm-IDE-Fill-the-IDENTIFY-request-consistently.patch [bz#852348]
  - kvm-ide-Add-resize-callback-to-ide-core.patch [bz#852348]
  - Resolves: bz#1054077
    (qemu crash when reboot win7 guest with spice display)
  - Resolves: bz#1064156
    ([qxl] The guest show black screen while resumed guest which managedsaved in pmsuspended status.)
  - Resolves: bz#1122147
    (CVE-2014-5263 vmstate_xhci_event: fix unterminated field list)
  - Resolves: bz#1123372
    (qemu-kvm crashed when doing iofuzz testing)
  - Resolves: bz#1139702
    (pflash (UEFI varstore) migration shortcut for libvirt [RHEL])
  - Resolves: bz#852348
    (fail to block_resize local data disk with IDE/AHCI disk_interface)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-72.el7
changelog:
  - kvm-vbe-make-bochs-dispi-interface-return-the-correct-me.patch [bz#1139118]
  - kvm-vbe-rework-sanity-checks.patch [bz#1139118]
  - kvm-spice-display-add-display-channel-id-to-the-debug-me.patch [bz#1139118]
  - kvm-spice-make-sure-we-don-t-overflow-ssd-buf.patch [bz#1139118]
  - Resolves: bz#1139118
    (CVE-2014-3615 qemu-kvm: Qemu: crash when guest sets high resolution [rhel-7.1])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-73.el7
changelog:
  - kvm-scsi-disk-fix-bug-in-scsi_block_new_request-introduc.patch [bz#1105880]
  - Resolves: bz#1105880
    (bug in scsi_block_new_request() function introduced by upstream commit 137745c5c60f083ec982fe9e861e8c16ebca1ba8)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-74.el7
changelog:
  - kvm-ide-Add-wwn-support-to-IDE-ATAPI-drive.patch [bz#1131316]
  - kvm-vmdk-Allow-vmdk_create-to-work-with-protocol.patch [bz#1098086]
  - kvm-block-make-vdi-bounds-check-match-upstream.patch [bz#1098086]
  - kvm-vdi-say-why-an-image-is-bad.patch [bz#1098086]
  - kvm-block-do-not-abuse-EMEDIUMTYPE.patch [bz#1098086]
  - kvm-cow-correctly-propagate-errors.patch [bz#1098086]
  - kvm-block-Use-correct-width-in-format-strings.patch [bz#1098086]
  - kvm-vdi-remove-double-conversion.patch [bz#1098086]
  - kvm-block-vdi-Error-out-immediately-in-vdi_create.patch [bz#1098086]
  - kvm-vpc-Implement-.bdrv_has_zero_init.patch [bz#1098086]
  - kvm-block-vpc-use-QEMU_PACKED-for-on-disk-structures.patch [bz#1098086]
  - kvm-block-allow-bdrv_unref-to-be-passed-NULL-pointers.patch [bz#1098086]
  - kvm-block-vdi-use-block-layer-ops-in-vdi_create-instead-.patch [bz#1098086]
  - kvm-block-use-the-standard-ret-instead-of-result.patch [bz#1098086]
  - kvm-block-vpc-use-block-layer-ops-in-vpc_create-instead-.patch [bz#1098086]
  - kvm-block-iotest-update-084-to-test-static-VDI-image-cre.patch [bz#1098086]
  - kvm-block-add-helper-function-to-determine-if-a-BDS-is-i.patch [bz#1122925]
  - kvm-block-extend-block-commit-to-accept-a-string-for-the.patch [bz#1122925]
  - kvm-block-add-backing-file-option-to-block-stream.patch [bz#1122925]
  - kvm-block-add-__com.redhat_change-backing-file-qmp-comma.patch [bz#1122925]
  - Resolves: bz#1098086
    (RFE: Supporting creating vmdk/vdi/vpc format disk with protocols (glusterfs))
  - Resolves: bz#1122925
    (Maintain relative path to backing file image during live merge (block-commit))
  - Resolves: bz#1131316
    (fail to specify wwn for virtual IDE CD-ROM)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-75.el7
changelog:
  - kvm-target-i386-Broadwell-CPU-model.patch [bz#1116117]
  - kvm-pc-Add-Broadwell-CPUID-compatibility-bits.patch [bz#1116117]
  - kvm-virtio-balloon-fix-integer-overflow-in-memory-stats-.patch [bz#1142290]
  - Resolves: bz#1116117
    ([Intel 7.1 FEAT] Broadwell new instructions support for KVM - qemu-kvm)
  - Resolves: bz#1142290
    (guest is stuck when setting balloon memory with large guest-stats-polling-interval)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-76.el7
changelog:
  - kvm-usb-hcd-xhci-QOM-Upcast-Sweep.patch [bz#980747]
  - kvm-usb-hcd-xhci-QOM-parent-field-cleanup.patch [bz#980747]
  - kvm-uhci-egsm-fix.patch [bz#1046873]
  - kvm-usb-redir-fix-use-after-free.patch [bz#1046574 bz#1088116]
  - kvm-xhci-remove-leftover-debug-printf.patch [bz#980833]
  - kvm-xhci-add-tracepoint-for-endpoint-state-changes.patch [bz#980833]
  - kvm-xhci-add-port-to-slot_address-tracepoint.patch [bz#980833]
  - kvm-usb-parallelize-usb3-streams.patch [bz#1075846]
  - kvm-xhci-Init-a-transfers-xhci-slotid-and-epid-member-on.patch [bz#1075846]
  - kvm-xhci-Add-xhci_epid_to_usbep-helper-function.patch [bz#980833]
  - kvm-xhci-Fix-memory-leak-on-xhci_disable_ep.patch [bz#980833]
  - kvm-usb-Also-reset-max_packet_size-on-ep_reset.patch [bz#1075846]
  - kvm-usb-Fix-iovec-memleak-on-combined-packet-free.patch [bz#1075846]
  - kvm-usb-hcd-xhci-Remove-unused-sstreamsm-member-from-XHC.patch [bz#980747]
  - kvm-usb-hcd-xhci-Remove-unused-cancelled-member-from-XHC.patch [bz#980747]
  - kvm-usb-hcd-xhci-Report-completion-of-active-transfer-wi.patch [bz#980747]
  - kvm-usb-hcd-xhci-Update-endpoint-context-dequeue-pointer.patch [bz#980747]
  - kvm-xhci-Add-a-few-missing-checks-for-disconnected-devic.patch [bz#980833]
  - kvm-usb-Add-max_streams-attribute-to-endpoint-info.patch [bz#1111450]
  - kvm-usb-Add-usb_device_alloc-free_streams.patch [bz#1111450]
  - kvm-xhci-Call-usb_device_alloc-free_streams.patch [bz#980833]
  - kvm-uhci-invalidate-queue-on-device-address-changes.patch [bz#1111450]
  - kvm-xhci-iso-fix-time-calculation.patch [bz#949385]
  - kvm-xhci-iso-allow-for-some-latency.patch [bz#949385]
  - kvm-xhci-switch-debug-printf-to-tracepoint.patch [bz#980747]
  - kvm-xhci-use-DPRINTF-instead-of-fprintf-stderr.patch [bz#980833]
  - kvm-xhci-child-detach-fix.patch [bz#980833]
  - kvm-usb-add-usb_pick_speed.patch [bz#1075846]
  - kvm-xhci-make-port-reset-trace-point-more-verbose.patch [bz#980833]
  - kvm-usb-initialize-libusb_device-to-avoid-crash.patch [bz#1111450]
  - kvm-target-i386-get-CPL-from-SS.DPL.patch [bz#1097363]
  - kvm-trace-use-unique-Red-Hat-version-number-in-simpletra.patch [bz#1088112]
  - kvm-trace-add-pid-field-to-simpletrace-record.patch [bz#1088112]
  - kvm-simpletrace-add-support-for-trace-record-pid-field.patch [bz#1088112]
  - kvm-simpletrace-add-simpletrace.py-no-header-option.patch [bz#1088112]
  - kvm-trace-extract-stap_escape-function-for-reuse.patch [bz#1088112]
  - kvm-trace-add-tracetool-simpletrace_stap-format.patch [bz#1088112]
  - kvm-trace-install-simpletrace-SystemTap-tapset.patch [bz#1088112]
  - kvm-trace-install-trace-events-file.patch [bz#1088112]
  - kvm-trace-add-SystemTap-init-scripts-for-simpletrace-bri.patch [bz#1088112]
  - kvm-simpletrace-install-simpletrace.py.patch [bz#1088112]
  - kvm-trace-add-systemtap-initscript-README-file-to-RPM.patch [bz#1088112]
  - kvm-rdma-Fix-block-during-rdma-migration.patch [bz#1152969]
  - Resolves: bz#1046574
    (fail to passthrough the USB speaker redirected from usb-redir with xhci controller)
  - Resolves: bz#1046873
    (fail to be recognized the hotpluging usb-storage device with xhci controller in win2012R2 guest)
  - Resolves: bz#1075846
    (qemu-kvm core dumped when hotplug/unhotplug USB3.0 device multi times)
  - Resolves: bz#1088112
    ([Fujitsu 7.1 FEAT]:QEMU: capturing trace data all the time using ftrace-based tracing)
  - Resolves: bz#1088116
    (qemu crash when device_del usb-redir)
  - Resolves: bz#1097363
    (qemu ' KVM internal error. Suberror: 1'  when  query cpu frequently during pxe boot in Intel "Q95xx" host)
  - Resolves: bz#1111450
    (Guest crash when hotplug usb while disable virt_use_usb)
  - Resolves: bz#1152969
    (Qemu-kvm got stuck when migrate to wrong RDMA ip)
  - Resolves: bz#949385
    (passthrough USB speaker to win2012 guest fail to work well)
  - Resolves: bz#980747
    (flood with 'xhci: wrote doorbell while xHC stopped or paused' when redirected USB Webcam from usb-host with xHCI controller)
  - Resolves: bz#980833
    (xhci: FIXME: endpoint stopped w/ xfers running, data might be lost)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-77.el7
changelog:
  - kvm-seccomp-add-semctl-to-the-syscall-whitelist.patch [bz#1026314]
  - kvm-Revert-kvmclock-Ensure-proper-env-tsc-value-for-kvmc.patch [bz#1098602 bz#1130428]
  - kvm-Revert-kvmclock-Ensure-time-in-migration-never-goes-.patch [bz#1098602 bz#1130428]
  - kvm-Introduce-cpu_clean_all_dirty.patch [bz#1098602 bz#1130428]
  - kvm-kvmclock-Ensure-proper-env-tsc-value-for-kvmclock.v2.patch [bz#1098602 bz#1130428]
  - kvm-kvmclock-Ensure-time-in-migration-never-goes-back.v2.patch [bz#1098602 bz#1130428]
  - Resolves: bz#1026314
    (BUG: qemu-kvm hang when use '-sandbox on'+'vnc'+'hda')
  - Resolves: bz#1098602
    (kvmclock: Ensure time in migration never goes backward (backport))
  - Resolves: bz#1130428
    (After migration of RHEL7.1 guest with "-vga qxl", GUI console is hang)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-78.el7
changelog:
  - kvm-slirp-udp-fix-NULL-pointer-dereference-because-of-un.patch [bz#1144820]
  - kvm-hw-pci-fix-error-flow-in-pci-multifunction-init.patch [bz#1049734]
  - kvm-rhel-Drop-machine-type-pc-q35-rhel7.0.0.patch [bz#1111107]
  - kvm-virtio-scsi-Plug-memory-leak-on-virtio_scsi_push_eve.patch [bz#1088822]
  - kvm-virtio-scsi-Report-error-if-num_queues-is-0-or-too-l.patch [bz#1089606]
  - kvm-virtio-scsi-Fix-memory-leak-when-realize-failed.patch [bz#1089606]
  - kvm-virtio-scsi-Fix-num_queue-input-validation.patch [bz#1089606]
  - kvm-Revert-linux-aio-use-event-notifiers.patch [bz#1104748]
  - kvm-specfile-Require-glusterfs-api-3.6.patch [bz#1155518]
  - Resolves: bz#1049734
    (PCI: QEMU crash on illegal operation: attaching a function to a non multi-function device)
  - Resolves: bz#1088822
    (hot-plug a virtio-scsi disk via 'blockdev-add' always cause QEMU quit)
  - Resolves: bz#1089606
    (QEMU will not reject invalid number of queues (num_queues = 0) specified for virtio-scsi)
  - Resolves: bz#1104748
    (48% reduction in IO performance for KVM guest, io=native)
  - Resolves: bz#1111107
    (Remove Q35 machine type from qemu-kvm)
  - Resolves: bz#1144820
    (CVE-2014-3640 qemu-kvm: qemu: slirp: NULL pointer deref in sosendto() [rhel-7.1])
  - Resolves: bz#1155518
    (qemu-kvm: undefined symbol: glfs_discard_async)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-79.el7
changelog:
  - kvm-libcacard-link-against-qemu-error.o-for-error_report.patch [bz#1088176]
  - kvm-error-Add-error_abort.patch [bz#1088176]
  - kvm-blockdev-Fail-blockdev-add-with-encrypted-images.patch [bz#1088176]
  - kvm-blockdev-Fix-NULL-pointer-dereference-in-blockdev-ad.patch [bz#1088176]
  - kvm-qemu-iotests-Test-a-few-blockdev-add-error-cases.patch [bz#1088176]
  - kvm-block-Add-errp-to-bdrv_new.patch [bz#1088176]
  - kvm-qemu-img-Avoid-duplicate-block-device-IDs.patch [bz#1088176]
  - kvm-block-Catch-duplicate-IDs-in-bdrv_new.patch [bz#1088176]
  - kvm-qemu-img-Allow-source-cache-mode-specification.patch [bz#1138691]
  - kvm-qemu-img-Allow-cache-mode-specification-for-amend.patch [bz#1138691]
  - kvm-qemu-img-clarify-src_cache-option-documentation.patch [bz#1138691]
  - kvm-qemu-img-fix-rebase-src_cache-option-documentation.patch [bz#1138691]
  - kvm-qemu-img-fix-img_compare-flags-error-path.patch [bz#1138691]
  - kvm-ac97-register-reset-via-qom.patch [bz#1141667]
  - kvm-virtio-blk-Factor-common-checks-out-of-virtio_blk_ha.patch [bz#1085232]
  - kvm-virtio-blk-Bypass-error-action-and-I-O-accounting-on.patch [bz#1085232]
  - kvm-virtio-blk-Treat-read-write-beyond-end-as-invalid.patch [bz#1085232]
  - kvm-ide-Treat-read-write-beyond-end-as-invalid.patch [bz#1085232]
  - kvm-ide-only-constrain-read-write-requests-to-drive-size.patch [bz#1085232]
  - Resolves: bz#1085232
    (Ilegal guest requests on block devices pause the VM)
  - Resolves: bz#1088176
    (QEMU fail to check whether duplicate ID for block device drive using 'blockdev-add' to hotplug)
  - Resolves: bz#1138691
    (Allow qemu-img to bypass the host cache (check, compare, convert, rebase, amend))
  - Resolves: bz#1141667
    (Qemu crashed if reboot guest after hot remove AC97 sound device)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-80.el7
changelog:
  - kvm-dump-RHEL-specific-fix-for-CPUState-bug-introduced-b.patch [bz#1161563]
  - kvm-dump-guest-memory-Check-for-the-correct-return-value.patch [bz#1157798]
  - kvm-dump-const-qualify-the-buf-of-WriteCoreDumpFunction.patch [bz#1157798]
  - kvm-dump-add-argument-to-write_elfxx_notes.patch [bz#1157798]
  - kvm-dump-add-API-to-write-header-of-flatten-format.patch [bz#1157798]
  - kvm-dump-add-API-to-write-vmcore.patch [bz#1157798]
  - kvm-dump-add-API-to-write-elf-notes-to-buffer.patch [bz#1157798]
  - kvm-dump-add-support-for-lzo-snappy.patch [bz#1157798]
  - kvm-RPM-spec-build-qemu-kvm-with-lzo-and-snappy-enabled-.patch [bz#1157798]
  - kvm-dump-add-members-to-DumpState-and-init-some-of-them.patch [bz#1157798]
  - kvm-dump-add-API-to-write-dump-header.patch [bz#1157798]
  - kvm-dump-add-API-to-write-dump_bitmap.patch [bz#1157798]
  - kvm-dump-add-APIs-to-operate-DataCache.patch [bz#1157798]
  - kvm-dump-add-API-to-write-dump-pages.patch [bz#1157798]
  - kvm-dump-Drop-qmp_dump_guest_memory-stub-and-build-for-a.patch [bz#1157798]
  - kvm-dump-make-kdump-compressed-format-available-for-dump.patch [bz#1157798]
  - kvm-Define-the-architecture-for-compressed-dump-format.patch [bz#1157798]
  - kvm-dump-add-query-dump-guest-memory-capability-command.patch [bz#1157798]
  - kvm-dump-Drop-pointless-error_is_set-DumpState-member-er.patch [bz#1157798]
  - kvm-dump-fill-in-the-flat-header-signature-more-pleasing.patch [bz#1157798]
  - kvm-dump-simplify-write_start_flat_header.patch [bz#1157798]
  - kvm-dump-eliminate-DumpState.page_shift-guest-s-page-shi.patch [bz#1157798]
  - kvm-dump-eliminate-DumpState.page_size-guest-s-page-size.patch [bz#1157798]
  - kvm-dump-select-header-bitness-based-on-ELF-class-not-EL.patch [bz#1157798]
  - kvm-dump-hoist-lzo_init-from-get_len_buf_out-to-dump_ini.patch [bz#1157798]
  - kvm-dump-simplify-get_len_buf_out.patch [bz#1157798]
  - kvm-rename-parse_enum_option-to-qapi_enum_parse-and-make.patch [bz#1087724]
  - kvm-qapi-introduce-PreallocMode-and-new-PreallocModes-fu.patch [bz#1087724]
  - kvm-raw-posix-Add-falloc-and-full-preallocation-option.patch [bz#1087724]
  - kvm-qcow2-Add-falloc-and-full-preallocation-option.patch [bz#1087724]
  - kvm-vga-fix-invalid-read-after-free.patch [bz#1161890]
  - kvm-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch [bz#1140618]
  - kvm-vnc-sanitize-bits_per_pixel-from-the-client.patch [bz#1157645]
  - kvm-spice-call-qemu_spice_set_passwd-during-init.patch [bz#1138639]
  - kvm-block-raw-posix-Try-both-FIEMAP-and-SEEK_HOLE.patch [bz#1160237]
  - kvm-block-raw-posix-Fix-disk-corruption-in-try_fiemap.patch [bz#1160237]
  - kvm-block-raw-posix-use-seek_hole-ahead-of-fiemap.patch [bz#1160237]
  - kvm-raw-posix-Fix-raw_co_get_block_status-after-EOF.patch [bz#1160237]
  - kvm-raw-posix-raw_co_get_block_status-return-value.patch [bz#1160237]
  - kvm-raw-posix-SEEK_HOLE-suffices-get-rid-of-FIEMAP.patch [bz#1160237]
  - kvm-raw-posix-The-SEEK_HOLE-code-is-flawed-rewrite-it.patch [bz#1160237]
  - Resolves: bz#1087724
    ([Fujitsu 7.1 FEAT]: qemu-img should use fallocate() system call for "preallocation=full" option)
  - Resolves: bz#1138639
    (fail to login spice session with password + expire time)
  - Resolves: bz#1140618
    (Should replace "qemu-system-i386" by "/usr/libexec/qemu-kvm" in manpage of qemu-kvm for our official qemu-kvm build)
  - Resolves: bz#1157645
    (CVE-2014-7815 qemu-kvm: qemu: vnc: insufficient bits_per_pixel from the client sanitization [rhel-7.1])
  - Resolves: bz#1157798
    ([FEAT RHEL7.1]: qemu: Support compression for dump-guest-memory command)
  - Resolves: bz#1160237
    (qemu-img convert intermittently corrupts output images)
  - Resolves: bz#1161563
    (invalid QEMU NOTEs in vmcore that is dumped for multi-VCPU guests)
  - Resolves: bz#1161890
    ([abrt] qemu-kvm: pixman_image_get_data(): qemu-kvm killed by SIGSEGV)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-81.el7
changelog:
  - kvm-migration-static-variables-will-not-be-reset-at-seco.patch [bz#1071776]
  - kvm-vfio-pci-Add-debug-config-options-to-disable-MSI-X-K.patch [bz#1098976]
  - kvm-vfio-correct-debug-macro-typo.patch [bz#1098976]
  - kvm-vfio-pci-Fix-MSI-X-debug-code.patch [bz#1098976]
  - kvm-vfio-pci-Fix-MSI-X-masking-performance.patch [bz#1098976]
  - kvm-vfio-Fix-MSI-X-vector-expansion.patch [bz#1098976]
  - kvm-vfio-Don-t-cache-MSIMessage.patch [bz#1098976]
  - Resolves: bz#1071776
    (Migration "expected downtime" does not refresh after reset to a new value)
  - Resolves: bz#1098976
    (2x RHEL 5.10 VM running on RHEL 7 KVM have low TCP_STREAM throughput)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-82.el7
changelog:
  - kvm-hw-pci-fixed-error-flow-in-pci_qdev_init.patch [bz#1046007]
  - kvm-hw-pci-fixed-hotplug-crash-when-using-rombar-0-with-.patch [bz#1046007]
  - Resolves: bz#1046007
    (qemu-kvm aborted when hot plug PCI device to guest with romfile and rombar=0)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-83.el7
changelog:
  - kvm-xhci-add-sanity-checks-to-xhci_lookup_uport.patch [bz#1074219]
  - kvm-Revert-Build-ceph-rbd-only-for-rhev.patch [bz#1140742]
  - kvm-Revert-rbd-Only-look-for-qemu-specific-copy-of-librb.patch [bz#1140742]
  - kvm-Revert-rbd-link-and-load-librbd-dynamically.patch [bz#1140742]
  - kvm-spec-Enable-rbd-driver-add-dependency.patch [bz#1140742]
  - Resolves: bz#1074219
    (qemu core dump when install a RHEL.7 guest(xhci) with migration)
  - Resolves: bz#1140742
    (Enable native support for Ceph)


author: Jeff E. Nelson <jen@redhat.com> - 1.5.3-84.el7
changelog:
  - kvm-qemu-iotests-Test-case-for-backing-file-deletion.patch [bz#1002493]
  - kvm-qemu-iotests-Add-sample-image-and-test-for-VMDK-vers.patch [bz#1134237]
  - kvm-vmdk-Check-VMFS-extent-line-field-number.patch [bz#1134237]
  - kvm-qemu-iotests-Introduce-_unsupported_imgopts.patch [bz#1002493]
  - kvm-qemu-iotests-Add-_unsupported_imgopts-for-vmdk-subfo.patch [bz#1002493]
  - kvm-vmdk-Fix-big-flat-extent-IO.patch [bz#1134241]
  - kvm-vmdk-Check-for-overhead-when-opening.patch [bz#1134251]
  - kvm-block-vmdk-add-basic-.bdrv_check-support.patch [bz#1134251]
  - kvm-qemu-iotest-Make-077-raw-only.patch [bz#1134237]
  - kvm-qemu-iotests-Don-t-run-005-on-vmdk-split-formats.patch [bz#1002493]
  - kvm-vmdk-extract-vmdk_read_desc.patch [bz#1134251]
  - kvm-vmdk-push-vmdk_read_desc-up-to-caller.patch [bz#1134251]
  - kvm-vmdk-do-not-try-opening-a-file-as-both-image-and-des.patch [bz#1134251]
  - kvm-vmdk-correctly-propagate-errors.patch [bz#1134251]
  - kvm-block-vmdk-do-not-report-file-offset-for-compressed-.patch [bz#1134251]
  - kvm-vmdk-Fix-d-and-lld-to-PRI-in-format-strings.patch [bz#1134251]
  - kvm-vmdk-Fix-x-to-PRIx32-in-format-strings-for-cid.patch [bz#1134251]
  - kvm-qemu-img-Convert-by-cluster-size-if-target-is-compre.patch [bz#1134283]
  - kvm-vmdk-Implement-.bdrv_write_compressed.patch [bz#1134283]
  - kvm-vmdk-Implement-.bdrv_get_info.patch [bz#1134283]
  - kvm-qemu-iotests-Test-converting-to-streamOptimized-from.patch [bz#1134283]
  - kvm-vmdk-Fix-local_err-in-vmdk_create.patch [bz#1134283]
  - kvm-fpu-softfloat-drop-INLINE-macro.patch [bz#1002493]
  - kvm-block-New-bdrv_nb_sectors.patch [bz#1002493]
  - kvm-vmdk-Optimize-cluster-allocation.patch [bz#1002493]
  - kvm-vmdk-Handle-failure-for-potentially-large-allocation.patch [bz#1002493]
  - kvm-vmdk-Use-bdrv_nb_sectors-where-sectors-not-bytes-are.patch [bz#1002493]
  - kvm-vmdk-fix-vmdk_parse_extents-extent_file-leaks.patch [bz#1002493]
  - kvm-vmdk-fix-buf-leak-in-vmdk_parse_extents.patch [bz#1002493]
  - kvm-vmdk-Fix-integer-overflow-in-offset-calculation.patch [bz#1002493]
  - kvm-migration-fix-parameter-validation-on-ram-load-CVE-2.patch [bz#1163078]
  - Resolves: bz#1002493
    (qemu-img convert rate about 100k/second from qcow2/raw to vmdk format on nfs system file)
  - Resolves: bz#1134237
    (Opening malformed VMDK description file should fail)
  - Resolves: bz#1134241
    (QEMU fails to correctly read/write on VMDK with big flat extent)
  - Resolves: bz#1134251
    (Opening an obviously truncated VMDK image should fail)
  - Resolves: bz#1134283
    (qemu-img convert from ISO to streamOptimized fails)
  - Resolves: bz#1163078
    (CVE-2014-7840 qemu-kvm: qemu: insufficient parameter validation during ram load [rhel-7.1])


author: Jeff E. Nelson <jen@redhat.com> - 1.5.3-85.el7
changelog:
  - kvm-block-delete-cow-block-driver.patch [bz#1175325]
  - Resolves: bz#1175325
    (Delete cow block driver)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-86.el7
changelog:
  - kvm-vfio-pci-Fix-interrupt-disabling.patch [bz#1180942]
  - kvm-cirrus-fix-blit-region-check.patch [bz#1169456]
  - kvm-cirrus-don-t-overflow-CirrusVGAState-cirrus_bltbuf.patch [bz#1169456]
  - Resolves: bz#1169456
    (CVE-2014-8106 qemu-kvm: qemu: cirrus: insufficient blit region checks [rhel-7.1])
  - Resolves: bz#1180942
    (qemu core dumped when unhotplug gpu card assigned to guest)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-86.el7_1.1
changelog:
  - kvm-pc-add-rhel6.6.0-machine-type.patch [bz#1198958]
  - Resolves: bz#1198958
    (Add rhel-6.6.0 machine type to RHEL 7.1.z to support RHEL 6.6 to RHEL 7.1 live migration)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-87.el7
changelog:
  - kvm-trace-add-qemu_system_powerdown_request-and-qemu_sys.patch [bz#1155671]
  - kvm-virtio-net-drop-assert-on-vm-stop.patch [bz#1139562]
  - kvm-socket-shutdown.patch [bz#1086168]
  - kvm-Handle-bi-directional-communication-for-fd-migration.patch [bz#1086168]
  - kvm-migration_cancel-shutdown-migration-socket.patch [bz#1086168]
  - kvm-iscsi-Refuse-to-open-as-writable-if-the-LUN-is-write.patch [bz#1032412]
  - kvm-main-set-current_machine-before-calling-machine-init.patch [bz#1176283]
  - kvm-pc_sysfw-prevent-pflash-and-or-mis-sized-firmware-fo.patch [bz#1176283]
  - kvm-Restore-atapi_dma-flag-across-migration.patch [bz#892258]
  - kvm-atapi-migration-Throw-recoverable-error-to-avoid-rec.patch [bz#892258]
  - kvm-build-reenable-local-builds-to-pass-enable-debug-RHE.patch []
  - kvm-raw-posix-Fail-gracefully-if-no-working-alignment-is.patch [bz#1184363]
  - kvm-block-Add-Error-argument-to-bdrv_refresh_limits.patch [bz#1184363]
  - kvm-Python-lang-gdb-script-to-extract-x86_64-guest-vmcor.patch [bz#828493]
  - kvm-RPM-spec-install-dump-guest-memory.py-RHEL-only.patch [bz#828493]
  - kvm-spec-Enable-build-of-qemu-img-and-libcacard-for-ppc6.patch [bz#1190086]
  - Resolves: bz#1032412
    (opening read-only iscsi lun as read-write should fail)
  - Resolves: bz#1086168
    (qemu-kvm can not cancel migration in src host when network of dst host failed)
  - Resolves: bz#1139562
    (qemu-kvm with vhost=off and sndbuf=100 crashed when stop it during pktgen test from guest to host)
  - Resolves: bz#1155671
    ([Fujitsu 7.2 FEAT]: QEMU: Add tracepoints in system shutdown)
  - Resolves: bz#1176283
    ([migration]migration failed when configure guest with OVMF bios + machine type=rhel6.5.0)
  - Resolves: bz#1184363
    (Qemu process fails to start with a multipath device with all paths failed)
  - Resolves: bz#1190086
    (build qemu-img/libcacard on ppc64le for 7.2)
  - Resolves: bz#828493
    ([Hitachi 7.2 FEAT] Extract guest memory dump from qemu-kvm core)
  - Resolves: bz#892258
    (ide CDROM io/data errors after migration)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-88.el7
changelog:
  - kvm-vfio-warn-if-host-device-rom-can-t-be-read.patch [bz#1210503]
  - kvm-vfio-Do-not-reattempt-a-failed-rom-read.patch [bz#1210503]
  - kvm-vfio-Correction-in-vfio_rom_read-when-attempting-rom.patch [bz#1210503]
  - kvm-vfio-Fix-overrun-after-readlink-fills-buffer-complet.patch [bz#1210504]
  - kvm-vfio-use-correct-runstate.patch [bz#1210505]
  - kvm-vfio-pci-Fix-BAR-size-overflow.patch [bz#1181267]
  - kvm-vfio-Use-vfio-type1-v2-IOMMU-interface.patch [bz#1210508]
  - kvm-vfio-pci-Enable-device-request-notification-support.patch [bz#1210509]
  - kvm-vfio-pci-Further-fix-BAR-size-overflow.patch [bz#1181267]
  - kvm-vfio-pci-Fix-error-path-sign.patch [bz#1210504]
  - kvm-x86-Use-common-variable-range-MTRR-counts.patch [bz#1210510]
  - kvm-x86-kvm-Add-MTRR-support-for-kvm_get-put_msrs.patch [bz#1210510]
  - kvm-x86-Clear-MTRRs-on-vCPU-reset.patch [bz#1210510]
  - kvm-spec-Exclude-aarch64.patch [bz#1217850]
  - Resolves: bz#1181267
    (vfio-pci: Fix BAR size overflow)
  - Resolves: bz#1210503
    (vfio improve PCI ROM loading error handling)
  - Resolves: bz#1210504
    (vfio: Fix overrun after readlink() fills buffer completely)
  - Resolves: bz#1210505
    (vfio: use correct runstate)
  - Resolves: bz#1210508
    (vfio: Use vfio type1 v2 IOMMU interface)
  - Resolves: bz#1210509
    (vfio-pci: Enable device request notification support)
  - Resolves: bz#1210510
    (Sync MTRRs with KVM and disable on reset)
  - Resolves: bz#1217850
    (qemu-kvm: ExcludeArch: aarch64)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-89.el7
changelog:
  - kvm-CVE-2015-1779-incrementally-decode-websocket-frames.patch [bz#1206497]
  - kvm-CVE-2015-1779-limit-size-of-HTTP-headers-from-websoc.patch [bz#1206497]
  - kvm-qemu-iotests-Test-unaligned-4k-zero-write.patch [bz#1200295]
  - kvm-block-Fix-NULL-deference-for-unaligned-write-if-qiov.patch [bz#1200295]
  - kvm-qemu-iotests-Test-unaligned-sub-block-zero-write.patch [bz#1200295]
  - kvm-fdc-force-the-fifo-access-to-be-in-bounds-of-the-all.patch [bz#1219270]
  - Resolves: bz#1200295
    (QEMU segfault when doing unaligned zero write to non-512 disk)
  - Resolves: bz#1206497
    (CVE-2015-1779 qemu-kvm: qemu: vnc: insufficient resource limiting in VNC websockets decoder [rhel-7.2])
  - Resolves: bz#1219270
    (CVE-2015-3456 qemu-kvm: qemu: floppy disk controller flaw [rhel-7.2])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-90.el7
changelog:
  - kvm-qcow2-Pass-discard-type-to-qcow2_discard_clusters.patch [bz#1208808]
  - kvm-qcow2-Discard-VM-state-in-active-L1-after-creating-s.patch [bz#1208808]
  - kvm-configure-Require-libfdt-for-arm-ppc-microblaze-soft.patch [bz#1217850]
  - kvm-configure-Add-handling-code-for-AArch64-targets.patch [bz#1217850]
  - kvm-configure-permit-compilation-on-arm-aarch64.patch [bz#1217850]
  - kvm-spec-Allow-build-on-aarch64.patch [bz#1217850]
  - kvm-Remove-redhat-extensions-from-qmp-events.txt.patch [bz#1222833]
  - kvm-spec-Add-misssing-QMP-documentation-files.patch [bz#1222833]
  - Resolves: bz#1208808
    (creating second and further snapshot takes ages)
  - Resolves: bz#1217850
    (qemu-kvm: Enable build on aarch64)
  - Resolves: bz#1222833
    (We ship incomplete QMP documentation)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-91.el7
changelog:
  - kvm-vmdk-Fix-overflow-if-l1_size-is-0x20000000.patch [bz#1217351]
  - kvm-block-ssh-Drop-superfluous-libssh2_session_last_errn.patch [bz#1226683]
  - kvm-block-ssh-Propagate-errors-through-check_host_key.patch [bz#1226683]
  - kvm-block-ssh-Propagate-errors-through-authenticate.patch [bz#1226683]
  - kvm-block-ssh-Propagate-errors-through-connect_to_ssh.patch [bz#1226683]
  - kvm-block-ssh-Propagate-errors-to-open-and-create-method.patch [bz#1226683]
  - kvm-ssh-Don-t-crash-if-either-host-or-path-is-not-specif.patch [bz#1226683]
  - kvm-curl-Replaced-old-error-handling-with-error-reportin.patch [bz#1226684]
  - kvm-curl-Fix-long-line.patch [bz#1226684]
  - kvm-curl-Remove-unnecessary-use-of-goto.patch [bz#1226684]
  - kvm-curl-Fix-return-from-curl_read_cb-with-invalid-state.patch [bz#1226684]
  - kvm-curl-Remove-erroneous-sleep-waiting-for-curl-complet.patch [bz#1226684]
  - kvm-curl-Whitespace-only-changes.patch [bz#1226684]
  - kvm-block-curl-Implement-the-libcurl-timer-callback-inte.patch [bz#1226684]
  - kvm-curl-Remove-unnecessary-explicit-calls-to-internal-e.patch [bz#1226684]
  - kvm-curl-Eliminate-unnecessary-use-of-curl_multi_socket_.patch [bz#1226684]
  - kvm-curl-Ensure-all-informationals-are-checked-for-compl.patch [bz#1226684]
  - kvm-curl-Fix-hang-reading-from-slow-connections.patch [bz#1226684]
  - kvm-curl-Fix-build-when-curl_multi_socket_action-isn-t-a.patch [bz#1226684]
  - kvm-curl-Remove-broken-parsing-of-options-from-url.patch [bz#1226684]
  - kvm-curl-refuse-to-open-URL-from-HTTP-server-without-ran.patch [bz#1226684]
  - kvm-curl-Add-sslverify-option.patch [bz#1226684]
  - kvm-block-Drop-superfluous-conditionals-around-g_free.patch [bz#1226684]
  - kvm-curl-Handle-failure-for-potentially-large-allocation.patch [bz#1226684]
  - kvm-block.curl-adding-timeout-option.patch [bz#1226684]
  - kvm-curl-Allow-a-cookie-or-cookies-to-be-sent-with-http-.patch [bz#1226684]
  - kvm-curl-The-macro-that-you-have-to-uncomment-to-get-deb.patch [bz#1226684]
  - kvm-block-curl-Improve-type-safety-of-s-timeout.patch [bz#1226684]
  - kvm-Enable-ssh-driver-read-only.patch [bz#1226683]
  - kvm-Enable-curl-driver-read-only.patch [bz#1226684]
  - Resolves: bz#1217351
    (Overflow in malloc size calculation in VMDK driver)
  - Resolves: bz#1226683
    ([virt-v2v] Backport upstream ssh driver to qemu-kvm)
  - Resolves: bz#1226684
    ([virt-v2v] Enable curl driver + upstream features + fixes in qemu-kvm and enable https)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-92.el7
changelog:
  - kvm-seccomp-add-timerfd_create-and-timerfd_settime-to-th.patch [bz#1185737]
  - kvm-qdict-Add-qdict_join.patch [bz#1226697]
  - kvm-block-Allow-JSON-filenames.patch [bz#1226697]
  - kvm-spice-display-fix-segfault-in-qemu_spice_create_upda.patch [bz#1230808]
  - Resolves: bz#1185737
    (qemu-kvm hang when boot with usb-host and sandbox was enabled)
  - Resolves: bz#1226697
    ([virt-v2v] Allow json: filenames in qemu-img)
  - Resolves: bz#1230808
    ([abrt] qemu-system-x86: __memcmp_sse4_1(): qemu-system-x86_64 killed by SIGSEGV)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-93.el7
changelog:
  - kvm-atomics-add-explicit-compiler-fence-in-__atomic-memo.patch [bz#1142857 bz#1142857 (aka bz#8*bz#10^bz#6/bz#7)]
  - Resolves: bz#1142857
    ([abrt] qemu-kvm: bdrv_error_action(): qemu-kvm killed by SIGABRT)
  - Resolves: bz#8*10^6/7)
    (XFree86 apparently sets xhost to ill inital values)
  - Resolves: bz#(aka
    ()


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-94.el7
changelog:
  - kvm-qcow2-Put-cache-reference-in-error-case.patch [bz#1129893]
  - kvm-qcow2-Catch-bdrv_getlength-error.patch [bz#1129893]
  - kvm-block-Introduce-qemu_try_blockalign.patch [bz#1129893]
  - kvm-qcow2-Catch-host_offset-for-data-allocation.patch [bz#1129893]
  - kvm-iotests-Add-test-for-image-header-overlap.patch [bz#1129893]
  - kvm-block-Catch-bs-drv-in-bdrv_check.patch [bz#1129893]
  - kvm-qapi-block-Add-fatal-to-BLOCK_IMAGE_CORRUPTED.patch [bz#1129893]
  - kvm-qcow2-Add-qcow2_signal_corruption.patch [bz#1129893]
  - kvm-qcow2-Use-qcow2_signal_corruption-for-overlaps.patch [bz#1129893]
  - kvm-qcow2-Check-L1-L2-reftable-entries-for-alignment.patch [bz#1129893]
  - kvm-iotests-Add-more-tests-for-qcow2-corruption.patch [bz#1129893]
  - kvm-qcow2-fix-leak-of-Qcow2DiscardRegion-in-update_refco.patch [bz#1129893]
  - kvm-qcow2-Do-not-overflow-when-writing-an-L1-sector.patch [bz#1129893]
  - kvm-iotests-Add-test-for-qcow2-L1-table-update.patch [bz#1129893]
  - kvm-block-Add-qemu_-try_-blockalign0.patch [bz#1129893]
  - kvm-qcow2-Calculate-refcount-block-entry-count.patch [bz#1129893]
  - kvm-qcow2-Fix-leaks-in-dirty-images.patch [bz#1129893]
  - kvm-qcow2-Split-qcow2_check_refcounts.patch [bz#1129893]
  - kvm-qcow2-Use-sizeof-refcount_table.patch [bz#1129893]
  - kvm-qcow2-Pull-check_refblocks-up.patch [bz#1129893]
  - kvm-qcow2-Use-int64_t-for-in-memory-reftable-size.patch [bz#1129893]
  - kvm-qcow2-Split-fail-code-in-L1-and-L2-checks.patch [bz#1129893]
  - kvm-qcow2-Let-inc_refcounts-return-errno.patch [bz#1129893]
  - kvm-qcow2-Let-inc_refcounts-resize-the-reftable.patch [bz#1129893]
  - kvm-qcow2-Reuse-refcount-table-in-calculate_refcounts.patch [bz#1129893]
  - kvm-qcow2-Fix-refcount-blocks-beyond-image-end.patch [bz#1129893]
  - kvm-qcow2-Do-not-perform-potentially-damaging-repairs.patch [bz#1129893]
  - kvm-qcow2-Rebuild-refcount-structure-during-check.patch [bz#1129893]
  - kvm-qcow2-Clean-up-after-refcount-rebuild.patch [bz#1129893]
  - kvm-iotests-Fix-test-outputs.patch [bz#1129893]
  - kvm-iotests-Add-test-for-potentially-damaging-repairs.patch [bz#1129893]
  - kvm-qcow2-Drop-REFCOUNT_SHIFT.patch [bz#1129893]
  - kvm-block-Respect-underlying-file-s-EOF.patch [bz#1129893]
  - kvm-qcow2-Fix-header-extension-size-check.patch [bz#1129893]
  - kvm-qcow2.py-Add-required-padding-for-header-extensions.patch [bz#1129893]
  - kvm-block-Don-t-probe-for-unknown-backing-file-format.patch [bz#1129893]
  - kvm-qcow2-Add-two-more-unalignment-checks.patch [bz#1129893]
  - kvm-iotests-Add-tests-for-more-corruption-cases.patch [bz#1129893]
  - kvm-qcow2-Respect-new_block-in-alloc_refcount_block.patch [bz#1129893]
  - kvm-iotests-Add-tests-for-refcount-table-growth.patch [bz#1129893]
  - kvm-qcow2-Fix-header-update-with-overridden-backing-file.patch [bz#1129893]
  - kvm-qcow2-Flush-pending-discards-before-allocating-clust.patch [bz#1129893]
  - Resolves: bz#1129893
    (Backport additional qcow2 corruption prevention and image repair patches)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-95.el7
changelog:
  - kvm-i8254-fix-out-of-bounds-memory-access-in-pit_ioport_.patch [bz#1229646]
  - kvm-target-i386-fix-cpuid-leaf-0x0d.patch [bz#1233350]
  - kvm-target-i386-Intel-MPX.patch [bz#1233350]
  - kvm-always-update-the-MPX-model-specific-register.patch [bz#1233350]
  - kvm-target-i386-bugfix-of-Intel-MPX.patch [bz#1233350]
  - kvm-target-i386-fix-set-of-registers-zeroed-on-reset.patch [bz#1233350]
  - kvm-target-i386-Add-mpx-CPU-feature-name.patch [bz#1233350]
  - kvm-target-i386-Avoid-shifting-left-into-sign-bit.patch [bz#1233350]
  - kvm-target-i386-add-Intel-AVX-512-support.patch [bz#1233350]
  - kvm-configure-Add-support-for-tcmalloc.patch [bz#1213881]
  - Resolves: bz#1213881
    (enable using tcmalloc for memory allocation in qemu-kvm)
  - Resolves: bz#1229646
    (CVE-2015-3214 qemu-kvm: qemu: i8254: out-of-bounds memory access in pit_ioport_read function [rhel-7.2])
  - Resolves: bz#1233350
    ([Intel 7.2 FEAT] Expose MPX feature to guest - qemu-kvm)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-96.el7
changelog:
  - kvm-ahci.c-mask-unused-flags-when-reading-size-PRDT-DBC.patch [bz#1205100]
  - kvm-ide-Correct-handling-of-malformed-short-PRDTs.patch [bz#1205100]
  - Resolves: bz#1205100
    (qemu-kvm: Qemu: PRDT overflow from guest to host [rhel-7.2])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-97.el7
changelog:
  - kvm-ide-Check-array-bounds-before-writing-to-io_buffer-C.patch [bz#1243690]
  - kvm-ide-atapi-Fix-START-STOP-UNIT-command-completion.patch [bz#1243690]
  - kvm-ide-Clear-DRQ-after-handling-all-expected-accesses.patch [bz#1243690]
  - Resolves: bz#1243690
    (EMBARGOED CVE-2015-5154 qemu-kvm: qemu: ide: atapi: heap overflow during I/O buffer memory access [rhel-7.2])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-98.el7
changelog:
  - kvm-block-curl-Don-t-lose-original-error-when-a-connecti.patch [bz#1235812]
  - kvm-vfio-pci-Add-pba_offset-PCI-quirk-for-Chelsio-T5-dev.patch [bz#1244347]
  - kvm-block-Print-its-file-name-if-backing-file-opening-fa.patch [bz#1238639]
  - kvm-block-Propagate-error-in-bdrv_img_create.patch [bz#1238639]
  - kvm-iotests-Add-test-for-non-existing-backing-file.patch [bz#1238639]
  - Resolves: bz#1235812
    (block/curl: Fix generic "Input/output error" on failure)
  - Resolves: bz#1238639
    (qemu-img shows error message for backing file twice)
  - Resolves: bz#1244347
    (Quirk for Chelsio T5 MSI-X PBA)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-99.el7
changelog:
  - kvm-usb-ccid-add-missing-wakeup-calls.patch [bz#1243731]
  - kvm-vpc-Handle-failure-for-potentially-large-allocations.patch [bz#1217349]
  - kvm-block-vpc-prevent-overflow-if-max_table_entries-0x40.patch [bz#1217349]
  - kvm-block-qemu-iotests-add-check-for-multiplication-over.patch [bz#1217349]
  - kvm-virtio-scsi-use-virtqueue_map_sg-when-loading-reques.patch [bz#1249718]
  - kvm-scsi-disk-fix-cmd.mode-field-typo.patch [bz#1249718]
  - kvm-rtl8139-avoid-nested-ifs-in-IP-header-parsing-CVE-20.patch [bz#1248766]
  - kvm-rtl8139-drop-tautologous-if-ip-.-statement-CVE-2015-.patch [bz#1248766]
  - kvm-rtl8139-skip-offload-on-short-Ethernet-IP-header-CVE.patch [bz#1248766]
  - kvm-rtl8139-check-IP-Header-Length-field-CVE-2015-5165.patch [bz#1248766]
  - kvm-rtl8139-check-IP-Total-Length-field-CVE-2015-5165.patch [bz#1248766]
  - kvm-rtl8139-skip-offload-on-short-TCP-header-CVE-2015-51.patch [bz#1248766]
  - kvm-rtl8139-check-TCP-Data-Offset-field-CVE-2015-5165.patch [bz#1248766]
  - Resolves: bz#1217349
    (qemu-img vpc driver segfault)
  - Resolves: bz#1243731
    (smart card emulation doesn't work with USB3 (nec-xhci) controller)
  - Resolves: bz#1248766
    (CVE-2015-5165 qemu-kvm: Qemu: rtl8139 uninitialized heap memory information leakage to guest [rhel-7.2])
  - Resolves: bz#1249718
    (Segfault occurred at Dst VM while completed migration upon ENOSPC)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-100.el7
changelog:
  - kvm-block-update-test-070-for-vhdx.patch [bz#1171576]
  - kvm-block-coverity-fix-check-return-value-for-fcntl-in-g.patch [bz#1219217]
  - Resolves: bz#1171576
    (test case 064 and 070 of qemu-iotests fail for vhdx with qemu-kvm-1.5.3-83.el7)
  - Resolves: bz#1219217
    (Coverity-detected defect: call to fcntl without checking return value)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-101.el7
changelog:
  - kvm-serial-reset-state-at-startup.patch [bz#922014]
  - kvm-ide-Check-validity-of-logical-block-size.patch [bz#1134670]
  - Resolves: bz#1134670
    (fail to specify the physical_block_size/logical_block_size value not 512 for IDE disk)
  - Resolves: bz#922014
    (RFE: support hotplugging chardev & serial ports (Windows guests))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-102.el7
changelog:
  - kvm-mc146818rtc-add-rtc-reset-reinjection-QMP-command.patch [bz#1191226]
  - Resolves: bz#1191226
    (libvirt requires rtc-reset-reinjection command, backport it to RHEL7.1)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-103.el7
changelog:
  - kvm-Drop-superfluous-conditionals-around-g_strdup.patch [bz#1218919]
  - kvm-util-Drop-superfluous-conditionals-around-g_free.patch [bz#1218919]
  - kvm-util-Fuse-g_malloc-memset-into-g_new0.patch [bz#1218919]
  - kvm-util-uri-uri_new-can-t-fail-drop-dead-error-handling.patch [bz#1218919]
  - kvm-util-uri-realloc2n-can-t-fail-drop-dead-error-handli.patch [bz#1218919]
  - kvm-util-uri-URI-member-path-can-be-null-compare-more-ca.patch [bz#1218919]
  - kvm-util-uri-Add-overflow-check-to-rfc3986_parse_port.patch [bz#1218919]
  - Resolves: bz#1218919
    (Coverity-detected defect: buffer overrun at uri.c:2035)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-104.el7
changelog:
  - kvm-qemu-iotests-Filter-qemu-io-output-in-025.patch [bz#1170974]
  - Resolves: bz#1170974
    (test case 025 of qemu-iotests fail for raw with qemu-kvm-1.5.3-83.el7.x86_64)


author: Jeff E. Nelson <jen@redhat.com> - 1.5.3-105.el7
changelog:
  - kvm-qtest-ide-test-disable-flush-test.patch [bz#1270341]
  - Resolves: bz#1270341
    (qemu-kvm build failure race condition in tests/ide-test)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.1
changelog:
  - kvm-rbd-make-qemu-s-cache-setting-override-any-ceph-sett.patch [bz#1279389]
  - kvm-rbd-fix-ceph-settings-precedence.patch [bz#1279389]
  - Resolves: bz#1279389
    (ceph.conf properties override qemu's command-line properties)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.2
changelog:
  - kvm-raw-posix-Fix-.bdrv_co_get_block_status-for-unaligne.patch [bz#1298828]
  - Resolves: bz#1298828
    ([abrt] qemu-img: get_block_status(): qemu-img killed by SIGABRT)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.3
changelog:
  - kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE.patch [bz#1298047]
  - Resolves: bz#1298047
    (CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations [rhel-7.2.z])


author: Simo Sorce <ssorce@redhat.com> - 0.3.0-2
changelog:
  - Try to fix build adding automake as an explicit BuildRequire
  - Add also a couple of last minute patches from upstream


author: Jakub Hrozek <jhrozek@redhat.com> - 0.3.2-1
changelog:
  - bugfix release 0.3.2
  - includes previous release patches
  - change permissions of the /etc/sssd/sssd.conf to 0600


author: Simo Sorce <ssorce@redhat.com> - 0.4.1-1
changelog:
  - add missing configure check that broke stopping the daemon
  - also fix default config to add a missing required option


author: Jakub Hrozek <jhrozek@redhat.com> - 0.4.1-4
changelog:
  - Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
    without a password. (Patch by Stephen Gallagher)


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.0-1
changelog:
  - Ensure that the configuration upgrade script always writes the config
    file with 0600 permissions
  - Eliminate an infinite loop in group enumerations


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.1-1
changelog:
  - Add SSSDConfig API
  - Update polish translation for 0.6.0
  - Fix long timeout on ldap operation
  - Make dp requests more robust


author: Stephen Gallagher <sgallagh@redhat.com> - 0.7.1-1
changelog:
  - Fix segfault in sssd_pam when cache_credentials was enabled
  - Update the sample configuration
  - Fix upgrade issues caused by data provider service removal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.2-1
changelog:
  - Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
  - Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
  - Several segfault bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.3-1
changelog:
  - Fixes link error on platforms that do not do implicit linking
  - Fixes double-free segfault in PAM
  - Fixes double-free error in async resolver
  - Fixes support for TCP-based DNS lookups in async resolver
  - Fixes memory alignment issues on ARM processors
  - Manpage fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-1.pre20100317git0ea7f19
changelog:
  - Release candidate for SSSD 1.1
  - Add simple access provider
  - Create subpackages for libcollection, libini_config, libdhash and librefarray
  - Support IPv6
  - Support LDAP referrals
  - Fix cache issues
  - Better feedback from PAM when offline


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-2
changelog:
  - Release SSSD 1.1.0 final
  - Fix two potential segfaults
  - Fix memory leak in monitor
  - Better error message for unusable confdb


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.1-1
changelog:
  - New upstream release 1.1.1
  - Fixed the IPA provider (which was segfaulting at start)
  - Fixed a bug in the SSSDConfig API causing some options to revert to
  - their defaults
  - This impacted the Authconfig UI
  - Ensure that SASL binds to LDAP auto-retry when interrupted by a signal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.91-10
changelog:
  - Release new upstream version 1.1.91
  - Enhancements when using SSSD with FreeIPA v2
  - Support for deferred kinit
  - Support for DNS SRV records for failover


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.92-11
changelog:
  - New LDAP access provider allows for filtering user access by LDAP attribute
  - Reduced default timeout for detecting offline status with LDAP
  - GSSAPI ticket lifetime made configurable
  - Better offline->online transition support in Kerberos


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-12
changelog:
  - New stable upstream version 1.2.0
  - Support ServiceGroups for FreeIPA v2 HBAC rules
  - Fix long-standing issue with auth_provider = proxy
  - Better logging for TLS issues in LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-15
changelog:
  - New stable upstream version 1.2.1
  - Resolves: rhbz#595529 - spec file should eschew %define in favor of
  -                         %global
  - Resolves: rhbz#593644 - Empty list of simple_allow_users causes sssd service
  -                         to fail while restart.
  - Resolves: rhbz#599026 - Makefile typo causes SSSD not to use the kernel
  -                         keyring
  - Resolves: rhbz#599724 - sssd is broken on Rawhide


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.91-20
changelog:
  - New upstream version 1.2.91 (1.3.0rc1)
  - Improved LDAP failover
  - Synchronous sysdb API (provides performance enhancements)
  - Better online reconnection detection


author: Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-30
changelog:
  - Resolves: CVE-2010-2940 - sssd allows null password entry to authenticate
  -                           against LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-32
changelog:
  - Resolves: rhbz#637955 - libini_config-devel needs libcollection-devel but
  -                         doesn't require it


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.0-1
changelog:
  - New upstream release 1.4.0
  - Added support for netgroups to the LDAP provider
  - Performance improvements made to group processing of RFC2307 LDAP servers
  - Fixed nested group issues with RFC2307bis LDAP servers without a memberOf plugin
  - Build-system improvements to support Gentoo
  - Split out several libraries into the ding-libs tarball
  - Manpage reviewed and updated


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-1
changelog:
  - New upstream release 1.4.1
  - Add support for netgroups to the proxy provider
  - Fixes a minor bug with UIDs/GIDs >= 2^31
  - Fixes a segfault in the kerberos provider
  - Fixes a segfault in the NSS responder if a data provider crashes
  - Correctly use sdap_netgroup_search_base


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-3
changelog:
  - Solve a shutdown race-condition that sometimes left processes running
  - Resolves: rhbz#606887 - SSSD stops on upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.0-1
changelog:
  - New upstream release 1.5.0
  - Fixed issues with LDAP search filters that needed to be escaped
  - Add Kerberos FAST support on platforms that support it
  - Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
  - Added a Kerberos access provider to honor .k5login
  - Addressed several thread-safety issues in the sss_client code
  - Improved support for delayed online Kerberos auth
  - Significantly reduced time between connecting to the network/VPN and
  - acquiring a TGT
  - Added feature for automatic Kerberos ticket renewal
  - Provides the kerberos ticket for long-lived processes or cron jobs
  - even when the user logs out
  - Added several new features to the LDAP access provider
  - Support for 'shadow' access control
  - Support for authorizedService access control
  - Ability to mix-and-match LDAP access control features
  - Added an option for a separate password-change LDAP server for those
  - platforms where LDAP referrals are not supported
  - Added support for manpage translations


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-1
changelog:
  - New upstream release 1.5.1
  - Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
  - Vast performance improvements when enumerate = true
  - All PAM actions will now perform a forced initgroups lookup instead of just
  - a user information lookup
  -   This guarantees that all group information is available to other
  -   providers, such as the simple provider.
  - For backwards-compatibility, DNS lookups will also fall back to trying the
  - SSSD domain name as a DNS discovery domain.
  - Support for more password expiration policies in LDAP
  -    389 Directory Server
  -    FreeIPA
  -    ActiveDirectory
  - Support for ldap_tls_{cert,key,cipher_suite} config options
  -Assorted bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-3
changelog:
  - Fix nested group member filter sanitization for RFC2307bis
  - Put translated tool manpages into the sssd-tools subpackage


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-8
changelog:
  - Resolves: rhbz#677768 - name service caches names, so id command shows
  -                         recently deleted users


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.2-1
changelog:
  - New upstream release 1.5.2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.2
  - Fixes for support of FreeIPA v2
  - Fixes for failover if DNS entries change
  - Improved sss_obfuscate tool with better interactive mode
  - Fix several crash bugs
  - Don't attempt to use START_TLS over SSL. Some LDAP servers can't handle this
  - Delete users from the local cache if initgroups calls return 'no such user'
  - (previously only worked for getpwnam/getpwuid)
  - Use new Transifex.net translations
  - Better support for automatic TGT renewal (now survives restart)
  - Netgroup fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.4-1
changelog:
  - New upstream release 1.5.4
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.4
  - Fixes for Active Directory when not all users and groups have POSIX attributes
  - Fixes for handling users and groups that have name aliases (aliases are ignored)
  - Fix group memberships after initgroups in the IPA provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-1
changelog:
  - New upstream release 1.5.5
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.5
  - Fixes for several crash bugs
  - LDAP group lookups will no longer abort if there is a zero-length member
  - attribute
  - Add automatic fallback to 'cn' if the 'gecos' attribute does not exist


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-3
changelog:
  - Fix systemd conversion. Upgrades from SysV to systemd weren't properly
  - enabling the systemd service.
  - Fix a serious memory leak in the memberOf plugin
  - Fix an issue where the user's full name would sometimes be removed
  - from the cache


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-5
changelog:
  - Resolves: rhbz#697057 - kpasswd fails when using sssd and
  -                         kadmin server != kdc server
  - Upgrades from SysV should now maintain enabled/disabled status


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.6-1
changelog:
  - New upstream release 1.5.6
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.6
  - Fixed a serious memory leak in the memberOf plugin
  - Fixed a regression with the negative cache that caused it to be essentially
  - nonfunctional
  - Fixed an issue where the user's full name would sometimes be removed from
  - the cache
  - Fixed an issue with password changes in the kerberos provider not working
  - with kpasswd


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-1
changelog:
  - Resolves: rhbz#700891 - CVE-2011-1758 sssd: automatic TGT renewal overwrites
  -                         cached password with predicatable filename


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-3
changelog:
  - Resolves: rhbz#706740 - Orphaned links on rc0.d-rc6.d
  - Make sure to properly convert to systemd if upgrading from newer
  - updates for Fedora 14


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.8-1
changelog:
  - New upstream release 1.5.8
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.8
  - Support for the LDAP paging control
  - Support for multiple DNS servers for name resolution
  - Fixes for several group membership bugs
  - Fixes for rare crash bugs


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.9-1
changelog:
  - New upstream release 1.5.9
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.9
  - Support for overriding home directory, shell and primary GID locally
  - Properly honor TTL values from SRV record lookups
  - Support non-POSIX groups in nested group chains (for RFC2307bis LDAP
  - servers)
  - Properly escape IPv6 addresses in the failover code
  - Do not crash if inotify fails (e.g. resource exhaustion)
  - Don't add multiple TGT renewal callbacks (too many log messages)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.10-1
changelog:
  - New upstream release 1.5.10
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.10
  - Fixed a regression introduced in 1.5.9 that could result in blocking calls
  - to LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.11-2
changelog:
  - New upstream release 1.5.11
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.11
  - Fix a serious regression that prevented SSSD from working with ldaps:// URIs
  - IPA Provider: Fix a bug with dynamic DNS that resulted in the wrong IPv6
  - address being saved to the AAAA record


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.0-1
changelog:
  - New upstream release 1.6.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.0
  - Add host access control support for LDAP (similar to pam_host_attr)
  - Finer-grained control on principals used with Kerberos (such as for FAST or
  - validation)
  - Added a new tool sss_cache to allow selective expiring of cached entries
  - Added support for LDAP DEREF and ASQ controls
  - Added access control features for Novell Directory Server
  - FreeIPA dynamic DNS update now checks first to see if an update is needed
  - Complete rewrite of the HBAC library
  - New libraries: libipa_hbac and libipa_hbac-python


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.1-1
changelog:
  - New upstream release 1.6.1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.1
  - Fixes a serious issue with LDAP connections when the communication is
    dropped (e.g. VPN disconnection, waking from sleep)
  - SSSD is now less strict when dealing with users/groups with multiple names
    when a definitive primary name cannot be determined
  - The LDAP provider will no longer attempt to canonicalize by default when
    using SASL. An option to re-enable this has been provided.
  - Fixes for non-standard LDAP attribute names (e.g. those used by Active
    Directory)
  - Three HBAC regressions have been fixed.
  - Fix for an infinite loop in the deref code


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.2-1
changelog:
  - Improved handling of users and groups with multi-valued name attributes
    (aliases)
  - Performance enhancements
      Initgroups on RFC2307bis/FreeIPA
      HBAC rule processing
  - Improved process-hang detection and restarting
  - Enabled the midpoint cache refresh by default (fewer cache misses on
    commonly-used entries)
  - Cleaned up the example configuration
  - New tool to change debug level on the fly


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.2-4
changelog:
  - Change selinux policy requirement to Conflicts: with the old version,
    rather than Requires: the supported version.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.3-1
changelog:
  - New upstream release 1.6.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.3
  - Fixes a major cache performance issue introduced in 1.6.2
  - Fixes a potential infinite-loop with certain LDAP layouts


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.3-4
changelog:
  - Resolves: rhbz#753639 - sssd_nss crashes when passed invalid UTF-8 for the
                            username in getpwnam()
  - Resolves: rhbz#758425 - LDAP failover not working if server refuses
                            connections


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.4-1
changelog:
  - New upstream release 1.6.4
  - Rolls up previous patches applied to the 1.6.3 tarball
  - Fixes a rare issue causing crashes in the failover logic
  - Fixes an issue where SSSD would return the wrong PAM error code for users
    that it does not recognize.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-1
changelog:
  - New upstream release 1.7.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.7.0
  - Support for case-insensitive domains
  - Support for multiple search bases in the LDAP provider
  - Support for the native FreeIPA netgroup implementation
  - Reliability improvements to the process monitor
  - New DEBUG facility with more consistent log levels
  - New tool to change debug log levels without restarting SSSD
  - SSSD will now disconnect from LDAP server when idle
  - FreeIPA HBAC rules can choose to ignore srchost options for significant
    performance gains
  - Assorted performance improvements in the LDAP provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-3
changelog:
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-5
changelog:
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features - fix netgroups and sudo as well


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-1.beta1
changelog:
  - New upstream release
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta1
  - Support for the service map in NSS
  - Support for setting default SELinux user context from FreeIPA
  - Support for retrieving SSH user and host keys from LDAP (Experimental)
  - Support for caching autofs LDAP requests (Experimental)
  - Support for caching SUDO rules (Experimental)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-1.beta2
changelog:
  - New upstream release
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta2
  - Fix two minor manpage bugs
  - Include the IPA AutoFS provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-4.beta3
changelog:
  - New upstream release 1.8.0 beta 3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta3
  - Fixed a regression in group enumeration since 1.7.0
  - Fixed several memory-corruption bugs
  - Finalized the ABI for the autofs support
  - Fixed a regression in the proxy provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-6
changelog:
  - New upstream release 1.8.0
  - Support for the service map in NSS
  - Support for setting default SELinux user context from FreeIPA
  - Support for retrieving SSH user and host keys from LDAP (Experimental)
  - Support for caching autofs LDAP requests (Experimental)
  - Support for caching SUDO rules (Experimental)
  - Include the IPA AutoFS provider
  - Fixed several memory-corruption bugs
  - Fixed a regression in group enumeration since 1.7.0
  - Fixed a regression in the proxy provider
  - Resolves: rhbz#741981 - Separate Cache Timeouts for SSSD
  - Resolves: rhbz#797968 - sssd_be: The requested tar get is not configured is
                            logged at each login
  - Resolves: rhbz#754114 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process
                            /usr/sbin/sssd was killed by signal 11 (SIGSEGV)
  - Resolves: rhbz#743133 - Performance regression with Kerberos authentication
                            against AD
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features
  - Resolves: rhbz#786957 - sssd and kerberos should change the default location for create the Credential Cashes to /run/usr/USERNAME/krb5cc


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-7
changelog:
  - New upstream release 1.8.1
  - Resolve issue where we could enter an infinite loop trying to connect to an
    auth server
  - Fix serious issue with complex (3+ levels) nested groups
  - Fix netgroup support for case-insensitivity and aliases
  - Fix serious issue with lookup bundling resulting in requests never
    completing
  - IPA provider will now check the value of nsAccountLock during pam_acct_mgmt
    in addition to pam_authenticate
  - Fix several regressions in the proxy provider
  - Resolves: rhbz#743133 - Performance regression with Kerberos authentication
                            against AD
  - Resolves: rhbz#799031 - --debug option for sss_debuglevel doesn't work


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-8
changelog:
  - Fix uninitialized value bug causing crashes throughout the code
  - Resolves: rhbz#804783 - [abrt] Segfault during LDAP 'services' lookup


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-9
changelog:
  - Don't duplicate libsss_autofs.so in two packages
  - Set explicit package contents instead of globbing


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.2-10
changelog:
  - New upstream release 1.8.2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.2
  - Several fixes to case-insensitive domain functions
  - Fix for GSSAPI binds when the keytab contains unrelated principals
  - Fixed several segfaults
  - Workarounds added for LDAP servers with unreadable RootDSE
  - SSH knownhostproxy will no longer enter an infinite loop preventing login
  - The provided SYSV init script now starts SSSD earlier at startup and stops
    it later during shutdown
  - Assorted minor fixes for issues discovered by static analysis tools


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.3-11
changelog:
  - New upstream release 1.8.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.3
  - Numerous manpage and translation updates
  - LDAP: Handle situations where the RootDSE isn't available anonymously
  - LDAP: Fix regression for users using non-standard LDAP attributes for user
    information


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-1.beta1
changelog:
  - New upstream release 1.9.0 beta 1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta1
  - Add native support for autofs to the IPA provider
  - Support for ID-mapping when connecting to Active Directory
  - Support for handling very large (> 1500 users) groups in Active Directory
  - Support for sub-domains (will be used for dealing with trust relationships)
  - Add a new fast in-memory cache to speed up lookups of cached data on
    repeated requests


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-2.beta1
changelog:
  - Fix several regressions since 1.5.x
  - Ensure that the RPM creates the /var/lib/sss/mc directory
  - Add support for Netscape password warning expiration control
  - Rebuild against libldb 1.1.6


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-5.beta2
changelog:
  - New upstream release 1.9.0 beta 2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta2
  - Add support for the Kerberos DIR cache for storing multiple TGTs
    automatically
  - Major performance enhancement when storing large groups in the cache
  - Major performance enhancement when performing initgroups() against Active
    Directory
  - SSSDConfig data file default locations can now be set during configure for
    easier packaging


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-7.beta2
changelog:
  - Switch unicode library from libunistring to Glib
  - Drop unnecessary explicit Requires on keyutils
  - Guarantee that versioned Requires include the correct architecture


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-8.beta3
changelog:
  - New upstream release 1.9.0 beta 3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta3
  - Add a new PAC responder for dealing with cross-realm Kerberos trusts
  - Terminate idle connections to the NSS and PAM responders


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-9.beta4
changelog:
  - New upstream release 1.9.0 beta 4
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta4
  - Add a new AD provider to improve integration with Active Directory 2008 R2
    or later servers
  - SUDO integration was completely rewritten. The new implementation works
    with multiple domains and uses an improved refresh mechanism to download
    only the necessary rules
  - The IPA authentication provider now supports subdomains
  - Fixed regression for setups that were setting default_tkt_enctypes
    manually by reverting a previous workaround.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-12.beta5
changelog:
  - New upstream release 1.9.0 beta 5
  - Obsoletes the patch for missing DP_OPTION_TERMINATOR in AD provider options
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta5
  - Many fixes for the support for setting default SELinux user context from
    FreeIPA, most notably fixed the specificity evaluation
  - Fixed an incorrect default in the krb5_canonicalize option of the AD
    provider which was preventing password change operation
  - The shadowLastChange attribute value is now correctly updated with the
    number of days since the Epoch, not seconds


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-13.beta6
changelog:
  - New upstream release 1.9.0 beta 6
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta6
  - A new option, override_shell was added. If this option is set, all users
    managed by SSSD will have their shell set to its value.
  - Fixes for the support for setting default SELinux user context from FreeIPA.
  - Fixed a regression introduced in beta 5 that broke LDAP SASL binds
  - The SSSD supports the concept of a Primary Server and a Back Up Server in
    failover
  - A new command-line tool sss_seed is available to help prime the cache with
    a user record when deploying a new machine
  - SSSD is now able to discover and save the domain-realm mappings
    between an IPA server and a trusted Active Directory server.
  - Packaging changes to fix ldconfig usage in subpackages (#843995)
  - Rebuild against libldb 1.1.9


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-14.beta6
changelog:
  - Don't discard HBAC rule processing result if SELinux is on
    Resolves: rhbz#846792 (CVE-2012-3462)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-18.beta6
changelog:
  - Change the default ccache location to DIR:/run/user/${UID}/krb5cc
    and patch man page accordingly
  - Resolves: rhbz#851304


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.4-3
changelog:
  - Recreate Kerberos ccache directory if it's missing
  - Resolves: rhbz#853558 - [sssd[krb5_child[PID]]]: Credential cache
                            directory /run/user/UID/ccdir does not exist


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-4.beta1
changelog:
  - Explicitly Require libini_config >= 1.0.0.1 to work around a SONAME bug
    in ding-libs
  - Fix SSH integration with fully-qualified domains
  - Add the ability to dynamically discover the NetBIOS name


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-5.beta1
changelog:
  - Resolves: rhbz#961357 - Missing dyndns_update entry in sssd.conf during
                            realm join
  - Resolves: rhbz#961278 - Login failure: Enterprise Principal enabled by
                            default for AD Provider
  - Resolves: rhbz#961251 - sssd does not create user's krb5 ccache dir/file
                            parent directory when logging in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-6.beta1
changelog:
  - Apply a couple of patches from upstream git that resolve crashes when
    ID mapping object was not initialized properly but needed later


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-8.beta2
changelog:
  - New upstream release 1.10 beta2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta2
  - BuildRequire libcmocka-devel in order to run all upstream tests during build
  - BuildRequire libnl3 instead of libnl1
  - No longer BuildRequire initscripts, we no longer use /sbin/service
  - Remove explicit krb5-libs >= 1.10 requires; this platform doensn't carry any
    older krb5-libs version


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-9.beta2
changelog:
  - Fix typo in Requires that prevented an upgrade (#973916)
  - Use a hardcoded version in Conflicts, not less-than-current


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-11.beta2
changelog:
  - Apply a number of patches from upstream to fix issues found post-beta,
    in particular:
    -- segfault with a high DEBUG level
    -- Fix IPA password migration (upstream #1873)
    -- Fix fail over when retrying SRV resolution (upstream #1886)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.10.0-14
changelog:
  - Fix Obsoletes: to account for dist tag
  - Convert post and pre scripts to run on the sssd-common subpackage
  - Remove old conversion from SYSV


author: Stephen Gallagher <sgallagh@redhat.com> - 1.10.0-16
changelog:
  - Move sssd_pac to the sssd-ipa and sssd-ad subpackages
  - Trim out RHEL5-specific macros since we don't build on RHEL 5
  - Trim out macros for Fedora older than F18
  - Update libldb requirement to 1.1.16
  - Trim RPM changelog down to the last year


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-2
changelog:
  - Apply several important fixes from upstream 1.10 branch
  - Related: #966757 - SSSD failover doesn't work if the first DNS server
                       in resolv.conf is unavailable


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-3
changelog:
  - Resolves: #983580 - Netgroups should ignore the 'use_fully_qualified_names'
                        setting


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-4
changelog:
  - Resolves: #983587 - sss_debuglevel did not increase verbosity in
                        sssd_pac.log


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-5
changelog:
  - Resolves: #906427 - Do not use lib in specfile for the nss and
                        pam libraries


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0.1beta2
changelog:
  - New upstream release 1.11 beta 2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.0beta2
  - Related: rhbz#991065


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-1
changelog:
  - New upstream release 1.11.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.0
  - Resolves: rhbz#991065


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.1-1
changelog:
  - New upstream release 1.11.1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.1
  - Resolves: rhbz#991065 - Rebase SSSD to 1.11.0


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.1-2
changelog:
  - Resolves: rhbz#1019882 - RHEL7 ipa ad trusted user lookups failed with
                             sssd_be crash
  - Resolves: rhbz#1002597 - ad: unable to resolve membership when user is
                             from different domain than group


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-1
changelog:
  - New upstream release 1.11.2
  - Remove upstreamed patches
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.2
  - Resolves: rhbz#991065


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-2
changelog:
  - Skip netgroups that don't provide well-formed triplets
  - Related: rhbz#991549 -  sssd fails to retrieve netgroups with multiple
                            CN attributes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-3
changelog:
  - Resolves: rhbz#991549 - sssd fails to retrieve netgroups with multiple
                            CN attributes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-4
changelog:
  - Resolves: rhbz#1031562 - Incorrect mention of access_filter in sssd-ad
                             manpage


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-5
changelog:
  - Resolves: rhbz#1033084 - sssd_be segfaults if empty grop is resolved
                             using ad_matching_rule


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-6
changelog:
  - Resolves: rhbz#1028057 - Improve detection of the right domain when
                             processing group with members from several domains


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-7
changelog:
  - Resolves: rhbz#1036157 - sssd can't retrieve auto.master when using the
                             "default_domain_suffix" option in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-9
changelog:
  - Resolves: rhbz#1036758 - SSSD: Allow for custom attributes in RDN when
                             using id_provider = proxy


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-10
changelog:
  - Resolves: rhbz#1029631 - sssd_be crashes on manually adding a cleartext
                             password to ldap_default_authtok


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-11
changelog:
  - Resolves: rhbz#1038637 - If SSSD starts offline, subdomains list is
                             never read


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-13
changelog:
  - Resolves: rhbz#1023409 - Valgrind sssd "Syscall param
                             socketcall.sendto(msg) points to uninitialised
                             byte(s)"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-14
changelog:
  - Resolves: rhbz#1040969 - sssd_nss grows memory footprint when netgroups
                             are requested


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-15
changelog:
  - Resolves: rhbz#1033096 - tokenGroups do not work reliable with Global
                             Catalog
  - Resolves: rhbz#1030483 - Individual group search returned multiple
                             results in GC lookups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-16
changelog:
  - The AD provider is able to resolve group memberships for groups with
    Global and Universal scope
  - Related: rhbz#1033096 - tokenGroups do not work reliable with Global
                            Catalog


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-17
changelog:
  - Re-initialize subdomains after provider startup
  - Related: rhbz#1038637 - If SSSD starts offline, subdomains list is
                            never read


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-21
changelog:
  - Resolves: rhbz#1048184 - Group lookup does not return member with multiple
                             names after user lookup


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-22
changelog:
  - Resolves: rhbz#1032983 - sssd_be crashes when ad_access_filter uses
                             FOREST keyword.
  - Fix two memory leaks in the PAC responder (Related: rhbz#991065)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-23
changelog:
  - Resolves: rhbz#1033133 - "System Error" when invalid ad_access_filter
                              is used


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-25
changelog:
  - Resolves: rhbz#1053106 - sssd ad trusted sub domain do not inherit
                             fallbacks and overrides settings


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-26
changelog:
  - Resolves: rhbz#1048102 - Access denied for users from gc domain when
                             using format DOMAIN\user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-28
changelog:
  - Resolves: rhbz#1054639 - sssd_be aborts a request if it doesn't match
                             any configured idmap domain
  - Fix return value when searching for AD domain flat names
  - Resolves: rhbz#1048102 - Access denied for users from gc domain when
                             using format DOMAIN\user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-29
changelog:
  - Resolves: rhbz#1051360 - [FJ7.0 Bug]: [REG] sssd_be crashes when
                             ldap_search_base cannot be parsed.
  - Fix a typo in the man page
  - Related: rhbz#1034920 - RHEL7 sssd not setting IPA AD trusted user homedir


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-30
changelog:
  - Resolves: rhbz#1037653 - Enabling ldap_id_mapping doesn't exclude
                             uidNumber in filter


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-31
changelog:
  - Resolves: rhbz#1054899 - explicitly suggest krb5_auth_timeout in a loud
                             DEBUG message in case Kerberos authentication
                             times out


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-32
changelog:
  - Resolves: rhbz#1054639 - sssd_be aborts a request if it doesn't match
                             any configured idmap domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-34
changelog:
  - Resolves: rhbz#877438 - sudoNotBefore/sudoNotAfter not supported by sssd
                            sudoers plugin


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-35
changelog:
  - Resolves: rhbz#1028039 - AD Enumeration reads data from LDAP while
                             regular lookups connect to GC


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-36
changelog:
  - Resolves: rhbz#1059253 - Man page states default_shell option supersedes
                             other shell options but in fact override_shell does.
  - Use the right domain for AD site resolution
  - Related: rhbz#743503 -  [RFE] sssd should support DNS sites


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-38
changelog:
  - Resolves: rhbz#1059753 - Warn with a user-friendly error message when
                             permissions on sssd.conf are incorrect


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-39
changelog:
  - Resolves: rhbz#872177 - [RFE] subdomain homedir template should be
                            configurable/use flatname by default


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-40
changelog:
  - Resolves: rhbz#1033081 - Implement heuristics to detect if POSIX attributes
                             have been replicated to the Global Catalog or not


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-41
changelog:
  - Resolves: rhbz#1064582 - sss_cache does not reset the SYSDB_INITGR_EXPIRE
                             attribute when expiring users


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-43
changelog:
  - Resolves: rhbz#1068640 - 'IPA: Don't call tevent_req_post outside _send'
                             should be added to RHEL7


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-44
changelog:
  - Resolves: rhbz#1033069 - Configuring two different provider types might
                             start two parallel enumeration tasks


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-45
changelog:
  - Resolves: rhbz#1067476 - SSSD pam module accepts usernames with leading
                             spaces


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-48
changelog:
  - Resolves: rhbz#1064908 - MAN: Remove misleading memberof example from
                             ldap_access_filter example


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-49
changelog:
  - Resolves: rhbz#1060389 - Document that `sssd` cache needs to be cleared
                             manually, if ID mapping configuration changes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-50
changelog:
  - Pull some follow up man page fixes from upstream
  - Related: rhbz#1060389 - Document that `sssd` cache needs to be cleared
                            manually, if ID mapping configuration changes
  - Related: rhbz#1064908 - MAN: Remove misleading memberof example from
                            ldap_access_filter example


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-51
changelog:
  - Fix idmap documentation
  - Bump idmap version info
  - Related: rhbz#1067361 - Check IPA idranges before saving them to the cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-52
changelog:
  - Resolves: rhbz#1068725 - Evaluate usage of sudo LDAP provider together
                             with the AD provider


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-53
changelog:
  - Resolves: rhbz#1071903 - ipa-server-mode: Use lower-case user name
                             component in home dir path


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-54
changelog:
  - Resolves: rhbz#1072067 - SSSD Does not cache SELinux map from FreeIPA
                             correctly


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-55
changelog:
  - Resolves: rhbz#1073631 - sssd fails to handle expired passwords
                             when OTP is used


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-56
changelog:
  - Related: rhbz#1072995 -  AD group inconsistency when using AD provider
                             in sssd-1.11-40


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-57
changelog:
  - Related: rhbz#1066096 - not retrieving homedirs of AD users with
                            posix attributes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-58
changelog:
  - Related: rhbz#1073635 - IPA SELinux code looks for the host in the wrong
                            sysdb subdir when a trusted user logs in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-59
changelog:
  - Related: rhbz#1075621 - Add another Kerberos error code to trigger IPA
                            password migration


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-60
changelog:
  - Resolves: rhbz#1075663 - SSSD should create the SELinux mapping file
                             with format expected by pam_selinux


author: Sumit Bose <sbose@redhat.com> - 1.11.2-63
changelog:
  - Resolves: rhbz#1078877 - Valgrind: Invalid read of int while processing
                             netgroup


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-64
changelog:
  - Resolves: rhbz#1077328 - other subdomains are unavailable when joined
                             to a subdomain in the ad forest


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-65
changelog:
  - Resolves: rhbz#1082191 - RHEL7 IPA selinuxusermap hbac rule not always
                             matching


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-66
changelog:
  - Resolves: rhbz#1090653 - segfault in sssd_be when second domain tree
                             users are queried while joined to child domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-67
changelog:
  - Fix a DEBUG message, backport two related fixes
  - Related: rhbz#1090653 - segfault in sssd_be when second domain tree
                             users are queried while joined to child domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-68
changelog:
  - Resolves: rhbz#1097286 - Expanding home directory fails when the request
                             comes from the PAC responder


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-69
changelog:
  - Backport a patch to allow krb5-utils-test to run as root
  - Related: rhbz#1097286 - Expanding home directory fails when the request
                            comes from the PAC responder


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-70
changelog:
  - Squash in upstream review comments about the PAC patch
  - Related: rhbz#1097286 - Expanding home directory fails when the request
                            comes from the PAC responder


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-2
changelog:
  - Use libsemanage for SELinux label changes
  - Resolves: rhbz#1113784 - sssd should audit selinux user map changes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-3
changelog:
  - Add the low-level server changes for running as unprivileged user
  - Package the libsss_semange library needed for SELinux label changes
  - Related: rhbz#1113783 - sssd should run under unprivileged user 
  - Resolves: rhbz#1113784 - sssd should audit selinux user map changes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-4
changelog:
  - Fix regressions caused by views patches when SSSD is connected to a
    pre-4.0 IPA server
  - Related: rhbz#1109756 - Rebase SSSD to 1.12


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-5
changelog:
  - Amend the sssd-ldap man page with info about lockout setup
  - Related: rhbz#1109756 - Rebase SSSD to 1.12
  - Resolves: rhbz#1137014 - Shell fallback mechanism in SSSD 
  - Resolves: rhbz#790854 - 4 functions with reference leaks within sssd (src/python/pyhbac.c)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-6
changelog:
  - Include the responder and packaging patches for rootless sssd
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-7
changelog:
  - Resolves: rhbz#1153518 - service lookups returned in lowercase with
                             case_sensitive=preserving
  - Resolves: rhbz#1158809 - Enumeration shows only a single group multiple
                             times


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-8
changelog:
  - Support overriding SSH public keys with views
  - Support extended attributes via the extop plugin
  - Related: rhbz#1109756 - Rebase SSSD to 1.12
  - Resolves: rhbz#1137010 - disable midpoint refresh for netgroups if ptask
                             refresh is enabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-9
changelog:
  - Include the ldap_child and selinux_child patches for rootless sssd
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-10
changelog:
  - Fix two regressions in the new selinux_child process
  - Related: rhbz#1113783 - sssd should run under unprivileged user
  - Resolves: rhbz#1132365 - Remove password from the PAM stack if OTP is used


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-12
changelog:
  - Move adding the user from pretrans to pre, copy adding the user to
    sssd-krb5-common and sssd-ipa as well in order to work around yum
    ordering issue
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-15
changelog:
  - Resolves: rhbz#1153603 - Proxy Provider: Fails to lookup case sensitive
                             users and groups with case_sensitive=preserving


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-16
changelog:
  - Use upstreamed patches for the rootless sssd
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-17
changelog:
  - Update man page to clarify TGs should be disabled with a custom search base
  - Related: rhbz#1161741 - TokenGroups for LDAP provider breaks in corner cases


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-18
changelog:
  - Support views for IPA users
  - Related: rhbz#891984 - [RFE] ID Views: Support migration from the sync
                           solution to the trust solution


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-19
changelog:
  - Resolves: rhbz#1153593 - Manpage description of case_sensitive=preserving
                            is incomplete


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-20
changelog:
  - Resolves: rhbz#1163742 - "debug_timestamps = false" and "debug_microseconds
                             = true" do not work after enabling journald
                             with sssd.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-22
changelog:
  - Handle IPA group names returned from the extop plugin
  - Related: rhbz#891984 - [RFE] ID Views: Support migration from the sync
                           solution to the trust solution


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-23
changelog:
  - Add an option that describes where to put generated krb5 files to
  - Related: rhbz#1135043 - [RFE] Implement localauth plugin for MIT krb5 1.12


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-24
changelog:
  - Resolves: rhbz#1165794 - sssd does not work with custom value of option
                             re_expression


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-25
changelog:
  - Use alternatives for libwbclient
  - Related: rhbz#1109331 - [RFE] Allow SSSD to be used with smbd shares


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-26
changelog:
  - Handle migrating clients between views
  - Related: rhbz#891984 - [RFE] ID Views: Support migration from the sync
                           solution to the trust solution


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-27
changelog:
  - Resolves: rhbz#1166727 - pam_sss domains option: Untrusted users from
                             the same domain are allowed to auth.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-28
changelog:
  - Fix typo in libwbclient-devel alternatives invocation
  - Related: rhbz#1109331 - [RFE] Allow SSSD to be used with smbd shares


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-30
changelog:
  - krb5_child and ldap_child do not call Kerberos calls as root
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-31
changelog:
  - Resolves: rhbz#1169739 - selinuxusermap rule does not apply to trusted
                             AD users
  - Enable running unit tests without cmocka
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-32
changelog:
  - Resolves: rhbz#1124320 - [FJ7.0 Bug]: getgrent returns error because sss
                             is written in nsswitch.conf as default.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-34
changelog:
  - Resolves: rhbz#1173482 - MAN: Document that only user names are checked
                             for pam_trusted_users
  - Resolves: rhbz#1167324 - pam_sss domains option: User auth should fail
                             when domains=<emtpy value>


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-35
changelog:
  - Remove Coverity warnings in krb5_child code
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-35
changelog:
  - Rebuild to add several forgotten Patch entries
  - Resolves: rhbz#1173482 - MAN: Document that only user names are checked
                             for pam_trusted_users
  - Resolves: rhbz#1167324 - pam_sss domains option: User auth should fail
                             when domains=<emtpy value>


author: Sumit Bose <sbose@redhat.com> - 1.12.2-37
changelog:
  - Resolves: rhbz#1169459 - sssd-ad: The man page description to enable GPO HBAC
                             Policies are unclear
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Sumit Bose <sbose@redhat.com> - 1.12.2-38
changelog:
  - Resolves: rhbz#1171215 - Crash in function get_object_from_cache
  - Resolves: rhbz#1171383 - getent fails for posix group with AD users after
                             login
  - Resolves: rhbz#1171382 - getent of AD universal group fails after group users
                             login
  - Resolves: rhbz#1170300 - Access is not rejected for disabled domain
  - Resolves: rhbz#1162486 - Error processing external groups with
                             getgrnam/getgrgid in the server mode
  - Resolves: rhbz#1168904 - gid is overridden by uid in default trust view


author: Sumit Bose <sbose@redhat.com> - 1.12.2-39
changelog:
  - Resolves: rhbz#1175408 - SSSD should not fail authentication when only allow
                             rules are used
  - Resolves: rhbz#1175705 - sssd-libwbclient conflicts with Samba's and causes
                             crash in wbinfo
                             - in addition to the patch libwbclient.so is
                               filtered out of the Provides list of the package


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-40
changelog:
  - Resolves: rhbz#1177140 - gpo_child fails if "log level" is enabled in smb.conf
  - Related: rhbz#1168904 - gid is overridden by uid in default trust view


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-43
changelog:
  - Resolves: rhbz#1182183 - pam_sss(sshd:auth): authentication failure with
                             user from AD


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-44
changelog:
  - Resolves: rhbz#1184140 - Users saved throug extop don't have the
                             originalMemberOf attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-45
changelog:
  - Open socket to the PAC responder in krb5_child before dropping root
  - Related: rhbz#1184140 - Users saved throug extop don't have the
                            originalMemberOf attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-46
changelog:
  - Handle GID override in MPG domains
  - Handle views with mixed-case domains
  - Related: rhbz#1168904 - gid is overridden by uid in default trust view


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-48
changelog:
  - Related: rhbz#1184140 - Users saved throug extop don't have the
                            originalMemberOf attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-49
changelog:
  - Process ghost members only once
  - Fix processing of universal groups with members from different domains
  - Related: rhbz#1168904 - gid is overridden by uid in default trust view


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-50
changelog:
  - Add a patch dependency
  - Related: rhbz#1184140 - Users saved throug extop don't have the
                            originalMemberOf attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-51
changelog:
  - Bump the release number
  - Related: rhbz#1184140 - Users saved throug extop don't have the
                            originalMemberOf attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-53
changelog:
  - Resolves: rhbz#1187192 - IPA initgroups don't work correctly in
                             non-default view


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-55
changelog:
  - Fix endianess bug in fill_id()
  - Related: rhbz#1109331 - [RFE] Allow SSSD to be used with smbd shares


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-57
changelog:
  - Run the restart in sssd-common posttrans
  - Explicitly require libwbclient
  - Resolves: rhbz#1187113 - sssd deamon was not running after RHEL 7.1 upgrade


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-58.2
changelog:
  - Resolves: rhbz#1199143 - With empty ipaselinuxusermapdefault security
                             context on client is staff_u


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-58.3
changelog:
  - Set a pointer in ldap_child to NULL to avoid warnings
  - Related: rhbz#1198759 - ccname_file_dummy is not unlinked on error


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-58.4
changelog:
  - Handle case where there is no default and no rules
  - Resolves: rhbz#1192314 - With empty ipaselinuxusermapdefault security
                             context on client is staff_u


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-58.5
changelog:
  - Resolves: rhbz#1202170 - sssd_be segfault on IPA(when auth with AD
                             trusted domain) client at
                             src/providers/ipa/ipa_s2n_exop.c:1605


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-58.6
changelog:
  - Initialize variable in the views code in one success and one failure path
  - Resolves: rhbz#1202170 - sssd_be segfault on IPA(when auth with AD
                             trusted domain) client at
                             src/providers/ipa/ipa_s2n_exop.c:1605


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-59
changelog:
  - Resolves: rhbz#1201840 - SSSD downloads too much information when fetching
                             information about groups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-60
changelog:
  - Filter out domain-local groups during AD initgroups operation
  - Related: rhbz#1201840 - SSSD downloads too much information when fetching
                            information about groups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0.1alpha
changelog:
  - Resolves: rhbz#1205554 - Rebase SSSD to 1.13.x
  - Relax the libldb requirement
  - Resolves: rhbz#1221992 - sssd_be segfault at 0 ip sp error 6 in
                             libtevent.so.0.9.21
  - Resolves: rhbz#1221839 - SSSD group enumeration inconsistent due to
                             binary SIDs
  - Resolves: rhbz#1219285 - Unable to resolve group memberships for AD
                             users when using sssd-1.12.2-58.el7_1.6.x86_64
                             client in combination with
                             ipa-server-3.0.0-42.el6.x86_64 with AD Trust
  - Resolves: rhbz#1217559 - [RFE] Support GPOs from different domain controllers
  - Resolves: rhbz#1217350 - ignore_group_members doesn't work for subdomains
  - Resolves: rhbz#1217127 - Override for IPA users with login does not list
                             user all groups
  - Resolves: rhbz#1216285 - autofs provider fails when default_domain_suffix
                             and use_fully_qualified_names set
  - Resolves: rhbz#1214719 - Group resolution is inconsistent with group
                             overrides
  - Resolves: rhbz#1214718 - Overridde with --login fails trusted adusers
                             group membership resolution
  - Resolves: rhbz#1214716 - idoverridegroup for ipa group with --group-name
                             does not work
  - Resolves: rhbz#1214337 - Overrides with --login work in second attempt
  - Resolves: rhbz#1212489 - Disable the cleanup task by default
  - Resolves: rhbz#1211830 - external users do not resolve with
                             "default_domain_suffix" set in IPA server sssd.conf
  - Resolves: rhbz#1210854 - Only set the selinux context if the context
                             differs from the local one
  - Resolves: rhbz#1209483 - When using id_provider=proxy with
                             auth_provider=ldap, it does not work as expected
  - Resolves: rhbz#1209374 - Man sssd-ad(5) lists Group Policy Management
                             Editor naming for some policies but not for all
  - Resolves: rhbz#1208507 - sysdb sudo search doesn't escape special characters
  - Resolves: rhbz#1206571 - [RFE] Expose D-BUS interface
  - Resolves: rhbz#1206566 - SSSD does not update Dynamic DNS records if
                             the IPA domain differs from machine hostname's
                             domain
  - Resolves: rhbz#1206189 - [bug] sssd always appends default_domain_suffix
                             when checking for host keys
  - Resolves: rhbz#1204203 - sssd crashes intermittently
  - Resolves: rhbz#1203945 - [FJ7.0 Bug]: getgrent returns error because
                             sss is written in nsswitch.conf as default
  - Resolves: rhbz#1203642 - GPO access control looks for computer object
                             in user's domain only
  - Resolves: rhbz#1202245 - SSSD's HBAC processing is not permissive enough
                             with broken replication entries
  - Resolves: rhbz#1201271 - sssd_nss segfaults if initgroups request is by
                             UPN and doesn't find anything
  - Resolves: rhbz#1200873 - [RFE] Allow smart multi step prompting when
                             user logs in with password and token code from IPA
  - Resolves: rhbz#1199541 - Read and use the TTL value when resolving a
                             SRV query
  - Resolves: rhbz#1199533 - [RFE] Implement background refresh for users,
                             groups or other cache objects
  - Resolves: rhbz#1199445 - Does sssd-ad use the most suitable attribute
                             for group name?
  - Resolves: rhbz#1198477 - ccname_file_dummy is not unlinked on error
  - Resolves: rhbz#1187103 - [RFE] User's home directories are not taken
                             from AD when there is an IPA trust with AD
  - Resolves: rhbz#1185536 - In ipa-ad trust, with 'default_domain_suffix' set
                             to AD domain, IPA user are not able to log unless
                             use_fully_qualified_names is set
  - Resolves: rhbz#1175760 - [RFE] Have OpenLDAP lock out ssh keys when
                             account naturally expires
  - Resolves: rhbz#1163806 - [RFE]ad provider dns_discovery_domain option:
                             kerberos discovery is not using this option
  - Resolves: rhbz#1205160 - Complain loudly if backend doesn't start due
                             to missing or invalid keytab


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-1
changelog:
  - Rebase to 1.13.0 upstream
  - Related: rhbz#1205554 - Rebase SSSD to 1.13.x
  - Resolves: rhbz#910187 - [RFE] authenticate against cache in SSSD
  - Resolves: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-3
changelog:
  - Add support for InfoPipe wildcard requests
  - Resolves: rhbz#1206571 - [RFE] Expose D-BUS interface


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-6
changelog:
  - Resolves: rhbz#1206565 - [RFE] Add dualstack and multihomed support
  - Resolves: rhbz#1187146 - If v4 address exists, will not create nonexistant
                             v6 in ipa domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-8
changelog:
  - Remove OTP from PAM stack correctly
  - Related: rhbz#1200873 - [RFE] Allow smart multi step prompting when
                            user logs in with password and token code from IPA
  - Handle sssd-owned keytabs when sssd runs as root
  - Related: rhbz#1205144 - RFE: Support one-way trusts for IPA


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-9
changelog:
  - Fix memory cache integration tests
  - Resolves: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups
  - Resolves: rhbz#854396 - [RFE] Support for smart cards


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-10
changelog:
  - Resolves: rhbz#1244949 - getgrgid for user's UID on a trust client
                             prevents getpw*


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-11
changelog:
  - Remove binary blob from SC patches as patch(1) can't handle those
  - Related: rhbz#854396 - [RFE] Support for smart cards


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-12
changelog:
  - More memory cache related fixes
  - Related: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.0-13
changelog:
  - Fix missing dependency of sssd-tools
  - Resolves: rhbz#1246489 - sss_obfuscate fails with "ImportError: No module
                             named pysss"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-14
changelog:
  - Bump release number
  - Related: rhbz#1246489 - sss_obfuscate fails with "ImportError: No module
                            named pysss"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-15
changelog:
  - Resolves: rhbz#1249015 - KDC proxy not working with SSSD krb5_use_kdcinfo
                             enabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-16
changelog:
  - Fix race condition in invalidating the memory cache
  - Related: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-19
changelog:
  - Resolves: rhbz#1202724 - [RFE] Add a way to lookup users based on CAC
                             identity certificates


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-20
changelog:
  - Related: rhbz#1250135 - Detect re-established trusts in the IPA
                            subdomain code


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-22
changelog:
  - Resolves: rhbz#1244950 - Add index for 'objectSIDString' and maybe to
                             other cache attributes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-23
changelog:
  - Support import/export for local overrides
  - Support FQDNs for local overrides
  - Resolves: rhbz#1254184 - sss_override does not work correctly when
                             'use_fully_qualified_names = True'


author: Martin Kosek <mkosek@redhat.com> - 1.13.0-25
changelog:
  - Resolves: rhbz#1254189 - sss_override contains an extra parameter --debug
                             but is not listed in the man page or in
                             the arguments help


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-26
changelog:
  - Resolves: rhbz#1256398 - sssd cannot resolve user names containing
                             backslash with ldap provider


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-29
changelog:
  - Resolves: rhbz#1263587 - sss_override --name doesn't work with RFC2307
                             and ghost users


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-30
changelog:
  - Patches required for better handling of failover with one-way trusts
  - Related: rhbz#1250135 - Detect re-established trusts in the IPA subdomain
                            code


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-31
changelog:
  - Remove -d from sss_override manpage
  - Related: rhbz#1259512 - sss_override : The local override user is not found


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-33
changelog:
  - Resolves: rhbz#1261155 - nsupdate exits on first GSSAPI error instead
                             of processing other commands


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-34
changelog:
  - Fix a Coverity warning in dyndns code
  - Resolves: rhbz#1261155 - nsupdate exits on first GSSAPI error instead
                             of processing other commands


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-35
changelog:
  - Resolves: rhbz#1250135 - Detect re-established trusts in the IPA
                             subdomain code


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-36
changelog:
  - Resolves: rhbz#1266107 - AD: Conditional jump or move depends on
                             uninitialised value


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-40
changelog:
  - Resolves: rhbz#1270827 - local overrides: don't contact server with
                             overridden name/id


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-41
changelog:
  - Resolves: rhbz#1284814  - sssd: [sysdb_add_user] (0x0400): Error: 17
                             (File exists)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-5
changelog:
  - Resolves: #906427 - Do not use lib64 in specfile for the nss and
                        pam libraries


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - we are Serial: 1 now because we are reverting the 1.0.2 version from 5.2
    beta to this prior one
  - install man pages; set defattr defaults


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Work around a problem causing konqueror to segfault in image preview
    mode (Bug #20018)
  - Copy SuSE 7.0's patch to handle bad chunks


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Remove the workaround for Bug #20018 (from Oct 30).
    Qt 2.2.2 fixes the problem the workaround addressed.


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - s/Copyright/License/
  - fix weird versioning system (epoch was set to "2" in the main
    package, serial to "1" in the devel package. Huh?)


author: Matthias Clasen <mclasen@redhat.com> - 2:1.2.5-3
changelog:
  - Reinstate and improve the transfix patch which got lost sometime ago, 
    but is still needed for CAN-2002-1363 (#125934)


author: Matthias Clasen <mclasen@redhat.com> 2:1.2.5-7
changelog:
  - Replace the patches for individual security problems with the
    cumulative patch issued by the png developers. 
  - Build for FC1


author: Tom Lane <tgl@redhat.com> 2:1.2.16-1
changelog:
  - Update to libpng 1.2.16
  Resolves: #211705, #216706, #227334
  - Separate libpng.a into a -static subpackage
  - Other minor packaging fixes per Fedora merge review
  Resolves: #226038


author: Tom Lane <tgl@redhat.com> 2:1.2.46-1
changelog:
  - Update to libpng 1.2.46, includes fixes for CVE-2011-2501, CVE-2011-2690,
    CVE-2011-2691, CVE-2011-2692
  Resolves: #717509
  Resolves: #721307


author: Tom Lane <tgl@redhat.com> 2:1.5.6-1
changelog:
  - Update to new major release series 1.5.x; includes source-code-incompatible
    API changes and a soname version bump
  - Temporarily package 1.2.46 shared library (only) in libpng-compat subpackage
    so that dependent packages won't be broken while rebuilding proceeds


author: Tom Lane <tgl@redhat.com> 2:1.5.6-2
changelog:
  - Don't include libpng12.pc in the compat subpackage; instead just offer a
    phony Provides: for it in the devel subpackage


author: Tom Lane <tgl@redhat.com> 2:1.5.10-3
changelog:
  - Remove compat subpackage (it's now a separate package "libpng12")
  - Minor specfile cleanup per suggestions from Tom Callaway
  Related: #845110


author: Tom Lane <tgl@redhat.com> 2:1.5.12-1
changelog:
  - Update to libpng 1.5.12 for minor bug fixes
  - Activate chunk size limits by default, with a very generous default limit


author: Petr Hracek <phracek@redhat.com> - 2:1.5.13-7
changelog:
  - Security fix for CVE-2015-8126
  - Changing png_ptr to info_ptf based on upstream
  - Related: #1283576


author: Angus Salkeld <asalkeld@redhat.com> - 0.4.0-2
changelog:
  - remove "." from Summary
  - Add "check-devel to BuildRequires
  - Add "make check" to check section
  - Changed a buildroot to RPM_BUILD_ROOT
  - Document alphatag, numcomm and dirty variables.


author: Angus Salkeld <asalkeld@redhat.com> - 0.4.1-1
changelog:
  - SPEC: add procps to BuildRequire
  - SPEC: remove automake and autoconf from BuildRequire
  - SPEC: remove call to ./autogen.sh
  - SPEC: update to new upstream version 0.4.1
  - LOOP: check read() return value
  - DOCS: add missing @param on new timeout argument
  - BUILD: only set -g and -O options if explicitly requested.
  - BUILD: Remove unneccessary check for library "dl"
  - BUILD: improve the release build system


author: Angus Salkeld <asalkeld@redhat.com> - 0.5.1-1
changelog:
  - Rebased to 0.5.1 which includes:
  - LOOP: make the return more consistent in qb_loop_timer_expire_time_get()
  - LOG: add string.h to qblog.h
  - Add a qb_strerror_r wrapper.
  - don't let an invalid time stamp provoke a NULL dereference
  - LOG: move priority check up to prevent unnecessary format.
  - rename README to README.markdown


author: Angus Salkeld <asalkeld@redhat.com> - 0.6.0-1
changelog:
  - Rebased to 0.6.0 which includes (#734457):
  - Add a stop watch
  - LOG: serialize the va_list, don't snprintf
  - LOG: change active list into array access
  - atomic: fix qb_atomic_pointer macros
  - LOG: allow the thread priority to be set.
  - Fix splint warning on ubuntu 11.04


author: Angus Salkeld <asalkeld@redhat.com> - 0.10.0-1
changelog:
  - LOOP: handle errors from the poll function
  - LOOP: make the item type applicable to jobs too.
  - LOOP: fix the todo calculations.
  - TEST: check for a single job causing a cpu spin
  - LOOP: prevent jobs from consuming too much cpu.
  - Get coverity to ignore this warning.
  - Change example code to use fgets instead of gets
  - LOG: pass the result of qb_log_thread_start() back to the user
  - Fix some issues found by clang
  - Add clang-analyzer check
  - Add a split timer to the stopwatch.
  - IPC: merge common code into new function
  - IPC: better handle a disconnect been called from within connection_created()
  - IPC: fix scary typo
  - IPC: fix server error handling


author: Angus Salkeld <asalkeld@redhat.com> - 0.10.1-1
changelog:
  - Fix "make distcheck" add include path to AM_CPPFLAGS
  - Bump the version to 0.10.1
  - clang: Remove unused code
  - TEST: make the ipc failure test closer to corosync's case.
  - RB: add a debug message if trying to read a message of the wrong size
  - IPC: split up the recv into chuncks of 2 seconds. (#788742)
  - Be more consistent with the internal logs.
  - LOOP: make it possible to pass in NULL as the default loop instance
  - RB: use the proper struct not the typedef in the implementation.
  - RB: Fix potential mem leak
  - Don't mix enums (QB_TRUE/TRUE)
  - use random() not rand()
  - Remove dead code
  - set umask before calling mkstemp()
  - Use safer versions of string functions (strcpy -> strlcpy)
  - Increase the coverity aggressiveness
  - TEST: make the loop ratelimit test more forgiving.


author: Angus Salkeld <asalkeld@redhat.com> - 0.11.1-1
changelog:
  - configue libqb to not use epoll as it seems broken (#800865)
  - LOOP: remove some old timerfd code.
  - TEST: add a test to check the order of the jobs
  - LOOP: when new jobs are added they are added to the head instead of the tail.
  - LOG: Now the array is self locking we can make the lookup array dynamic
  - Add locking to the array when growing.
  - IPC: make the _request_q_len_get() function more obvious.
  - IPC: fix multiple receives from qb_ipc_us_recv()
  - IPC: make sure that the wrong union member is not written to.
  - TIMER: check for null timer handle

  Wed Mar 7 2012  Angus Salkeld <asalkeld@redhat.com> - 0.11.0-1
  - ARRAY: cleanup the pointer sizeof()
  - LOG: turn off __attribute__(section) for powerpc (not working)
  - TESTS: move the util tests into "slow-tests" (i.e. optional)
  - TEST: make the test_priority the same type as in the callsite
  - LOG: make the log arrays manually grow-able since we need to lock the calls.
  - RB: fix test failure on ppc
  - RB: change the name of the size to word_size to be more clear
  - TEST: add some more signal tests.
  - LOOP: fix deletion of signal handlers when they are pending
  - LOOP: signal handlers were always added as high priority.
  - TEST: deal with mac's limited sed
  - check: add debugging to the configure options and remove unused options
  - TEST: properly clear the filters
  - LOG: expose the mechanism to get a dynamic callsite.
  - Revert part of my COARSE grained timer commit
  - Remove timerfd usage and go back to timelist.
  - UTIL: if possible use COARSE resolution clocks - they are much faster.
  - ARRAY: save memory (in the bins array) and allow holes in the array
  - LOOP: add qb_loop_timer_is_running()
  - LOOP: allow stop() and run() to be called with NULL loop instance.
  - LOOP: fix doxygen parameter comment
  - LOG: add stdout target
  - LOOP: add a function to delete jobs
  - LOG: remove debug printf's
  - LOG: remove an old/incorrect doxygen comment.
  - LOG: add a hostname %H format specifier.
  - LOG: Add qb_log_filter_fn_set()


author: Angus Salkeld <asalkeld@redhat.com> - 0.13.0-1
changelog:
  - Remove unneccessary __attribute__ ((aligned(8))) from internal headers
  - IPC: add a new function to get (and alloc) the extended stats.
  - Revert "Add the event queue length to the connection stats."
  - IPC: cleanup better on a failed client connect.
  - IPC(soc): be more consistent with control struct size
  - IPC: kill a compiler warning
  - IPC(soc): pass in the correct size into munmap()
  - TEST: Use /bin/sh not /bin/bash
  - TEST: check for lost shared mem on bsd too
  - rb: cleanup the semaphores
  - Fix some small issues in ./check
  - Cleanup the .gitignore files
  - configure.ac tweaks
  - Remove HZ and use sysconf instead.
  - SUN_LEN() macro is present if __EXTENSIONS__ is defined on Illumos
  - PF_UNIX is a POSIX standard name
  - Test for log facility names
  - IPC: drop log message to debug.
  - IPC: fix retrying of partial recv's and sends.
  - IPC: initialize enough shared mem for all 3 one way connections.
  - IPC: keep retrying to recv the socket message if partially recv'ed (part 2)
  - IPC: keep retrying to recv the socket message if partially recv'ed
  - IPC: handle the server shutdown better
  - IPC: handle a connection disconnect from the server better
  - IPC: make it possible to send events in the connected callback.
  - Add the event queue length to the connection stats.
  - IPC: add a is_connected client side function.
  - Fix typo in ./check
  - docs: clarify the need to use request/response headers
  - Remove unused local variable
  - IPC: change the socket recv function to read the response header.
  - Add some special commands into the ipc example
  - TEST: improve the tracing in the ipc tests.
  - Make "make (s)rpm" work more reliably
  - TEST: add a test to confirm we get the events we send.
  - TEST: reuse send_and_check for events.
  - IPC: make it possible for a root client to talk to a non-root server.
  - Run ./Lindent in the examples directory
  - Add some debug code to the ipcclient example
  - IPC: make sure ipc (socket) clients can connect to a server running as root.
  - IPC: allow qb to bump the max_message_size
  - IPC: check for a sane minimum max_message_size
  - add rpl_sem.h loop_poll_int.h to noinst_headers
  - Handle errors more consistently
  - call recv_ready on socket types
  - Handle a recv of size 0
  - make bsd shm path better by default.
  - Fix kqueue on freebsd.
  - Get the example socket includes right.
  - Fix kqueue compiling.
  - POLL: seperate out the poll/epoll and add kqueue
  - Test existence of getpeer* functions
  - Add inet header to tcpclient example
  - Don't link with setpshared if unavailable
  - NetBSD doesn't have semun defined
  - Use MADV_NOSYNC only on systems where available
  - Use SCHED_BATCH only on platforms where available
  - Fix a bug introduced by the bsd patch.
  - Cleanup the selection of semaphores to use
  - Fix some leaks in the logging.
  - Try and improve the portability on bsd variants.


author: Angus Salkeld <asalkeld@redhat.com> - 0.14.0-1
changelog:
  LOG: fix threaded logging.
  Add user control of the permissions that are set on the shared mem files
  LOG: Restrict string trucation during serialization to when a precision is specified
  LOG: Gracefully fail when the caller exceeds QB_LOG_MAX_LEN
  LOG: Observe field widths when serializing string arguments
  RB: use the same mechanism in reclaim as read/peek to detect end-of-ring
  Add needs_response_ack option to ./check
  RB: fix wrong sem_flg IPC_NOWAIT option
  TESTS: fix warning about unused functions
  Remove D_FORTIFY_SOURCE from check.
  Open shared mem file in /dev/shm only for linux
  Don't use msg_flags on solaris (recvmsg).
  Turn off attribute_section on solaris
  ipc example: add -e (events) option
  IPC: if the server returns EAGAIN or ETIMEOUT the check the connection
  LOG: make it possible to fsync() on each file log.
  IPC: make sure that the created callback happens before dispatches
  LOG: fix the printing of %p in the blackbox
  IPC: On bsd's use the notifier for responses
  IPC: interpret ECONNRESET and EPIPE as ENOTCONN
  cleanup some warnings
  config: use newer AC_COMPILE_IFELSE()
  blackbox: fix %p formatting
  LOG: put all fields in the blackbox (added priority and tags)
  example: make the priority uint8_t
  Remove strerror out of check_funcs
  RB: fix compiler warning.
  Add replacement function stpcpy
  Add missing AC_TYPE_UINT16_T to configure.ac
  Use AC_FUNC_STRERROR_R and STRERROR_R_CHAR_P
  Add stpcpy strcasecmp to the check_funcs
  Move some conditional defines into code (from the configure script)
  Remove some unused configure checks
  Remove message queues
  Check for union semun properly
  Blackbox: provide more space for log messages when reading from the blackbox.
  Add the blackbox reader manpage to the spec file
  Enable error logging for the blackbox reader
  RB: Read the file size into an initialized variable of the correct size
  Add a tool to dump the blackbox.
  RB: to be safer save the read and write pointers at the top of the blackbox
  avoid unwarranted use of strncpy: use memcpy instead
  blackbox: fix the print_from_file()
  RB: add an option to not use any semaphores
  LOG: tweak the blackbox format string
  LOG: accept NULL strings into the blackbox
  LOG: protect close and reload from calling log
  Add benchmark option (-b) to examples/ipcclient
  TEST: make rbreader/writer more like the other benchmarking apps
  IPC: log the connection description in all logs
  TEST: re-organise the ipc test suites
  IPC: only modify the dispatch if we get EAGAIN
  Correctly display timestamp in blackbox


author: Angus Salkeld <asalkeld@redhat.com> - 0.14.1-1
changelog:
  RB: set the new read pointer after clearing the header (#839605).
  RB: improve the debug print outs
  RB: be more explicit about the word alignment
  RB: cleanup the macros for wrapping the index
  RB: use sem_getvalue as a tie breaker when read_pt == write_pt
  RB: if read or peek don't get the message then re-post to the semaphore
  RB: convert the rb_peek() status into a recv like status.
  RB: use internal reclaim function
  IPC: use calloc instead of malloc to fix valgrind warnings
  Upgrade the doxygen config.
  Fix a valgrind error.


author: Angus Salkeld <asalkeld@redhat.com> - 0.14.2-1
changelog:
  Get libqb building on cygwin.
  ipc_us: slightly more robust cmsg handling
  ipc_us: on Linux, set SO_PASSCRED on the sending socket too
  ipc_us: clear request unused fields
  TEST: Include writing and reading the blackbox in the log_long_msg test
  LOG: fix qb_vsnprintf_deserialize()
  blackbox: fix 64-bit big-endian issues
  Remove IPC_NEEDS_RESPONSE_ACK and turn off shm ipc on solaris
  Define unix path max for openbsd
  Only turn on ipc_needs_response_ack=yes for solaris
  Some improvements to kqueue usage.
  kqueue: drop log message to trace.
  Fix splint warning
  openbsd requires netinet/in.h before arpa/inet.h
  Avoid strcpy() use strlcpy() instead.
  Fix kqueue complile warnings
  openbsd doesn't have EBADMSG
  openbsd has a different UNIX_PATH_MAX
  LOG: change qb_vsprintf_serialize() into qb_vsnprintf_serialize()
  TEST: increase timeout to 6 secs as the recv timeout is 5 secs
  TEST: get the logic right - grrr.
  Turn off attribute_section on netbsd
  Some missing pshared semaphore checks
  Cleanup the checks for pshared semaphores
  Add a config check for pthread_mutexattr_setpshared
  Remove uses of timersub and use qb_util_stopwatch
  RB: change the #error to ENOTSUP if no usable shared process sem
  LOOP-KQUEUE: fix reference before assignment.
  build: fix libqb.pc creation and make maintainer-clean
  LOG: Make sure the semaphores are initialized.
  build: remove bashism in cc support check
  Catch disconnected sockets on Solaris
  Don't free rb->shared_hdr in qb_rb_create_from_file()
  Check error return of qb_ipcs_uc_recv_and_auth()
  Fix removal of automatically installed doc files when building rpms
  Add the mailing list to the travis email notifications.
  Work around debian not setting the arch path in splint.
  Remove color-tests and parallel-tests automake options.
  Add travis continuous integration config
  LOG: Invoke custom log filter function if tag changes
  tests/rbwriter: don't ignore write failure
  ipcs: avoid use-after-free for size-0 || disconnect-request


author: Angus Salkeld <asalkeld@redhat.com> - 0.14.3-1
changelog:
  IPC: Pass the timeout to poll() if the recv function returns EAGAIN
  LOG: make the format comparison safe and sane
  LOG: don't break on empty callsites, just ignore them
  LOG: use the array callback to register new callsites
  array: add a mechanism to get a callback when a bin is allocated
  Solaris based operating systems don't define MSG_NOSIGNAL and SO_NOSIGPIPE.
  Make sure atomic's are initialized (for non-gcc atomic).


author: Angus Salkeld <asalkeld@redhat.com> - 0.14.4-1
changelog:
  LOG: prevent the last char of the blackbox message from getting lost.
  Example: make the blackbox example more practical.
  Add the processing which remove notifier at skiplist_destroy function
  Add the processing which remove hash node and notifier at hashtable_destroy function
  Unify to QB_TRUE/QB_FALSE a boolean value
  Document the default prefix in INSTALL
  Unify the list processing with qb_list function
  Add travis link to the readme.
  Fix return code which is an error occurred at pthread function
  TEST: add a progam to compare the speed of vsnprintf and qb_vsnprintf_serialize
  LOG: add a test for a padded hex int.
  Fedora's splint has a strange syntax error, don't fail on it.
  LOG: fix truncation in some messages that get padded.
  Fix the blackbox formatter when specifing the string len/precision
  Fix strlcpy and strlcat functions
  IPC: don't over log on disconnect
  Make sure we don't use the format string whilst it is getting changed.
  ptrie: deref the current node in trie_iter_free()
  LOG: fix the format comparison to avoid generating multiple entries.
  LOG: set the return code when calloc fails
  IPC: call poll if we are mid message and get EAGAIN
  Remove extra ";"
  IPC: set the error more correctly when qb_sys_mmap_file_open() fails.
  Make sure that mmap'ed files smaller than a page size are written to.
  example/test: check for error in qb_ipc_run()
  example: check for error in qb_ipc_run()
  TEST: fix typo s/,/; in check_ipc.c


author: David Vossel <dvossel@redhat.com> - 0.16.0-4
changelog:
  - Require log filtering to match function and file exactly.
    No substring matching.

  - Fixes complile time issue with 'make check' unit tests.

    Resolves: rhbz#1018091


author: David Vossel <dvossel@redhat.com> - 0.17.1-1
changelog:
  Fix: ipcs: Correctly allocate receive buffer size
    Fix: ipc_socket: Signalhandler must be resetted to Default, use only cleanup_sigpipe to return from qb_ipc_dgram_sock_setup.
    Fix: trie: allow modifying the trie map during the notify callback
    Fix: fix invalid option when run 'ipcclient -h'
    Fix: epoll: don't miss poll events under high load
    Fix: ipc_shm: fix error handling in qb_ipcs_shm_connect()
    Fix: ringbuffer: fix size in qb_rb_create_from_file()
    Fix: ringbuffer: fix qb_rb_open_2() debug format string
    Fix: trie: fixes regression caused by ref count refactoring
    Fix: ipcc: Properly timeout during recv when timeout value is provided

    Resolves: rhbz#1110043
    Resolves: rhbz#975903


author: David Vossel <dvossel@redhat.com> - 0.17.1-1.1
changelog:
  Fix bug that prevents ipc server from working in pid with realtime priority.

    Resolves: rhbz#1198718


author: Christine Caulfield <ccaulfie@redhat.com> - 0.17.1-2.1
changelog:
  Increase size of the buffer where we make the socket name to allow for 
    longer PIDs
    Resolves: rhbz#1277538


author: Paul Wouters <pwouters@redhat.com> - 3.5-1
changelog:
  - Initial package for RHEL7
  - Added interop patch for (some?) Cisco VPN clients sending 16 zero
    bytes of extraneous IKE data
  - Removed fipscheck_version


author: Paul Wouters <pwouters@redhat.com> - 3.6-1
changelog:
  - Updated to version 3.6 (IKEv2, MODECFG, Cisco interop fixes)
  - Generate empty NSS db if none exists
  - FIPS update using /etc/system-fips
  - Provide: openswan-doc


author: Paul Wouters <pwouters@redhat.com> - 3.8-1
changelog:
  - Resolves: rhbz#CVE-2013-6467 
  - Resolves: rhbz#1043642 rebase to version 3.8
  - Resolves: rhbz#1029912 ipsec force-reload doesn't work
  - Resolves: rhbz#826261 Implement SHA384/512 support for Openswan
  - Resolves: rhbz#1039655 ipsec newhostkey generates false configuration


author: Paul Wouters <pwouters@redhat.com> - 3.8-3
changelog:
  - Resolves: rhbz#1069024  erroneous debug line with mixture [...]
  - Resolves: rhbz#1030939 update nss/x509 documents, don't load acerts
  - Resolves: rhbz#1058813 newhostkey returns zero value when it fails


author: Paul Wouters <pwouters@redhat.com> - 3.11-1
changelog:
  - Resolves: rhbz#1136124 rebase to libreswan 3.11
  - Resolves: rhbz#1099905 ikev2 delete payloads are not delivered to peer
  - Resolves: rhbz#1147693 NetworkManger-libreswan can not connect to Red Hat IPSec Xauth VPN
  - Resolves: rhbz#1055865 [TAHI][IKEv2] libreswan do not ignore the content of version bit
  - Resolves: rhbz#1146106 Pluto crashes after start when some ah algorithms are used
  - Resolves: rhbz#1108256 addconn compatibility with openswan
  - Resolves: rhbz#1152625 [TAHI][IKEv2] IKEv2.EN.I.1.1.6.2 Part D: Integrity Algorithm AUTH_AES_XCBC_96 fail
  - Resolves: rhbz#1119704 [TAHI][IKEv2]IKEv2Interop.1.13a test fail
  - Resolves: rhbz#1100261 libreswan does not send response when when it receives Delete Payload for a CHILD_SA
  - Resolves: rhbz#1100239 ikev2 IKE SA responder does not send delete request to IKE SA initiator
  - Resolves: rhbz#1052811 [TAHI][IKEv2]IKEv2.EN.I.1.1.11.1: Non zero RESERVED fields in IKE_SA_INIT response
  - Resolves: rhbz#1126868 ikev2 sequence numbers are implemented incorrectly
  - Resolves: rhbz#1145245 Libreswan appears to start with systemd before all the NICs are up and running.
  - Resolves: rhbz#1145231 libreswan 3.10 upgrade breaks old ipsec.secrets configs
  - Resolves: rhbz#1144123 Add ESP support for AES_XCBC hash for USGv6 and IPsec-v3 compliance
  - Resolves: rhbz#1144120 Add ESP support for CAMELLIA for USGv6 and IPsec-v3 compliance
  - Resolves: rhbz#1099877 Missing man-pages ipsec_whack, ipsec_manual
  - Resolves: rhbz#1100255 libreswan Ikev2 implementation does not send an INFORMATIONAL response when it receives an INFORMATIONAL request with a Delete Payload for an IKE_SA


author: Paul Wouters <pwouters@redhat.com> - 3.12-1
changelog:
  - Resolves: rhbz#1136124 rebase to libreswan 3.12
  - Resolves: rhbz#1052811 [TAHI] (also clear reserved flags for isakmp_sa header)
  - Resolves: rhbz#1157379 [TAHI][IKEv2] IKEv2.EN.R.1.3.3.1: Non RESERVED fields in INFORMATIONAL request


author: Paul Wouters <pwouters@redhat.com> - 3.12-2
changelog:
  - Resolves: rhbz#1105171 (Update man page entry)
  - Resolves: rhbz#1144120 (Update for ESP CAMELLIA with IKEv2)
  - Resolves: rhbz#1074018 Audit key agreement


author: Paul Wouters <pwouters@redhat.com> - 3.12-4
changelog:
  - Resolves: rhbz#1134297 aes-ctr cipher is not supported
  - Resolves: rhbz#1131503 non-zero rSPI on INVALID_KE (and proper INVALID_KE handling)


author: Paul Wouters <pwouters@redhat.com> - 3.12-5
changelog:
  - Resolves: rhbz#826264 aes-gcm implementation support (for IKEv2)
  - Resolves: rhbz#1074018 Audit key agreement (integ gcm fixup)


author: Paul Wouters <pwouters@redhat.com> - 3.12-6
changelog:
  - Resolves: rhbz#1198650 SELinux context string size limit
  - Resolves: rhbz#1198649 Add new option for BSI random requirement


author: Paul Wouters <pwouters@redhat.com> - 3.12-7
changelog:
  - Resolves: rhbz#1208022 libreswan ignores module blacklist rules
  - Resolves: rhbz#1208023 Libreswan with IPv6 in RHEL7 fails after reboot
  - Resolves: rhbz#1211146 pluto crashes in fips mode


author: Paul Wouters <pwouters@redhat.com> - 3.12-9
changelog:
  - Resolves: rhbz#1213652 Support CAVS [updated to kill another copy of prf()]
  - Resolves: rhbz#1208023 Libreswan with IPv6 [updated patch by Jaroslav Aster]
  - Resolves: rhbz#1208022 libreswan ignores module blacklist [updated modprobe handling]


author: Paul Wouters <pwouters@redhat.com> - 3.15-2
changelog:
  - Resolves: rhbz#1259208 CVE-2015-3240
  - Merge rhel6 and rhel7 spec into one
  - Be lenient for racoon padding behaviour
  - Fix seedev option to /dev/random
  - Some IKEv1 PAM methods always gave 'Permission denied'
  - Parser workarounds for differences in gcc/flex/bison on rhel6/rhel7
  - Parser fix to allow specifying time without unit (openswan compat)
  - Fix Labeled IPsec on rekeyed IPsec SA's
  - Workaround for wrong padding by racoon2
  - Disable NSS HW GCM to workaround rhel6 xen builers bug


author: Paul Wouters <pwouters@redhat.com> - 3.15-4
changelog:
  - Resolves: rhbz#1268775 libreswan should support strictcrlpolicy alias
  - Resolves: rhbz#1268776 Pluto crashes after stop when I use floating ip address
  - Resolves: rhbz#1268773 Pluto crashes on INITIATOR site during 'service ipsec stop'
  - Resolves: rhbz#1208022 libreswan ignores module blacklist rules
  - Resolves: rhbz#1270673 ipsec does not work properly on loopback


author: Daniel Veillard <veillard@redhat.com> 0.0.6-1
changelog:
  - added error handling APIs
  - small bug fixes
  - improve python bindings
  - augment documentation and regression tests


author: Daniel Veillard <veillard@redhat.com> 0.1.0-1
changelog:
  - various fixes
  - new APIs: for Node information and Reboot
  - virsh improvements and extensions
  - documentation updates and man page
  - enhancement and fixes of the XML description format


author: Daniel Veillard <veillard@redhat.com> 0.1.1-1
changelog:
  - extend and cleanup the driver infrastructure and code
  - python examples
  - extend uuid support
  - bug fixes, buffer handling cleanups
  - support for new Xen hypervisor API
  - test driver for unit testing
  - virsh --conect argument


author: Daniel Veillard <veillard@redhat.com> 0.1.4-1
changelog:
  - vCPUs and affinity support
  - more complete XML, console and boot options
  - specific features support
  - enforced read-only connections
  - various improvements, bug fixes


author: Daniel Veillard <veillard@redhat.com> 0.1.5-1
changelog:
  - new release
  - bug fixes
  - support for new hypervisor calls
  - early code for config files and defined domains


author: Daniel Veillard <veillard@redhat.com> 0.1.6-1
changelog:
  - Support for localization
  - Support for new Xen-3.0.3 cdrom and disk configuration
  - Support for setting VNC port
  - Fix bug when running against xen-3.0.2 hypercalls
  - Fix reconnection problem when talking directly to http xend


author: Daniel Veillard <veillard@redhat.com> 0.1.7-1
changelog:
  - Fix bug when running against xen-3.0.3 hypercalls
  - Fix memory bug when getting vcpus info from xend


author: Daniel Veillard <veillard@redhat.com> 0.1.8-1
changelog:
  - fix missing page size detection code for ia64
  - fix mlock size when getting domain info list from hypervisor
  - vcpu number initialization
  - don't label crashed domains as shut off
  - fix virsh man page
  - blktapdd support for alternate drivers like blktap
  - memory leak fixes (xend interface and XML parsing)
  - compile fix
  - mlock/munlock size fixes


author: Daniel Veillard <veillard@redhat.com> 0.1.9-1
changelog:
  - better error reporting
  - python bindings fixes and extensions
  - add support for shareable drives
  - add support for non-bridge style networking
  - hot plug device support
  - added support for inactive domains
  - API to dump core of domains
  - various bug fixes, cleanups and improvements
  - updated the localization


author: Daniel Veillard <veillard@redhat.com> 0.1.10-1.fc7
changelog:
  - support for inactive Xen domains
  - improved support for Xen display and vnc
  - a few bug fixes
  - localization updates


author: Daniel P. Berrange <berrange@redhat.com> - 0.2.0-2.fc7
changelog:
  - Fixed path to qemu daemon for autostart
  - Fixed generation of <features> block in XML
  - Pre-create config directory at startup


author: Daniel P. Berrange <berrange@redhat.com> - 0.2.0-3.fc7
changelog:
  - Disable kqemu support since its not in Fedora qemu binary
  - Fix for -vnc arg syntax change in 0.9.0  QEMU


author: Daniel Veillard <veillard@redhat.com> - 0.2.1-1
changelog:
  - Release of 0.2.1
  - lot of bug and portability fixes
  - Add support for network autostart and init scripts
  - New API to detect the virtualization capabilities of a host
  - Documentation updates


author: Jeremy Katz <katzj@redhat.com> - 0.2.1-2.fc7
changelog:
  - don't require xen; we don't need the daemon and can control non-xen now
  - fix scriptlet error (need to own more directories)
  - update description text


author: Daniel Veillard <veillard@redhat.com> - 0.2.3-1
changelog:
  - Release of 0.2.3
  - lot of assorted bugfixes and cleanups
  - support for Xen-3.1
  - new scheduler API


author: Daniel Veillard <veillard@redhat.com> - 0.3.0-1
changelog:
  - Release of 0.3.0
  - Secure remote access support
  - unification of daemons
  - lots of assorted bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.3.1-1
changelog:
  - Release of 0.3.1
  - localtime clock support
  - PS/2 and USB input devices
  - lots of assorted bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.3.2-1
changelog:
  - Release of 0.3.2
  - API for domains migration
  - APIs for collecting statistics on disks and interfaces
  - lots of assorted bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.3.3-1
changelog:
  - Release of 0.3.3
  - Avahi support
  - NUMA support
  - lots of assorted improvements, bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.4.0-1
changelog:
  - Release of 0.4.0
  - SASL based authentication
  - PolicyKit authentication
  - improved NUMA and statistics support
  - lots of assorted improvements, bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.4.1-1
changelog:
  - Release of 0.4.1
  - Storage APIs
  - xenner support
  - lots of assorted improvements, bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.7.0-1
changelog:
  - ESX, VBox3, Power Hypervisor drivers
  - new net filesystem glusterfs
  - Storage cloning for LVM and Disk backends
  - interface implementation based on netcf
  - Support cgroups in QEMU driver
  - QEmu hotplug NIC support
  - a lot of fixes


author: Mark McLoughlin <markmc@redhat.com> - 0.7.0-2
changelog:
  - Make sure qemu can access kernel/initrd (bug #516034)
  - Set perms on /var/lib/libvirt/boot to 0711 (bug #516034)


author: Mark McLoughlin <markmc@redhat.com> - 0.7.0-5
changelog:
  - Add PCI host device hotplug support
  - Allow PCI bus reset to reset other devices (#499678)
  - Fix stupid PCI reset error message (bug #499678)
  - Allow PM reset on multi-function PCI devices (bug #515689)
  - Re-attach PCI host devices after guest shuts down (bug #499561)
  - Fix list corruption after disk hot-unplug
  - Fix minor 'virsh nodedev-list --tree' annoyance


author: Mark McLoughlin <markmc@redhat.com> - 0.7.1-0.2.gitfac3f4c
changelog:
  - Update to newer snapshot of 0.7.1
  - Stop libvirt using untrusted 'info vcpus' PID data (#520864)
  - Support relabelling of USB and PCI devices
  - Enable multipath storage support
  - Restart libvirtd upon RPM upgrade


author: Daniel Veillard <veillard@redhat.com> - 0.7.1-1
changelog:
  - Upstream release of 0.7.1
  - ESX, VBox driver updates
  - mutipath support
  - support for encrypted (qcow) volume
  - compressed save image format for Qemu/KVM
  - QEmu host PCI device hotplug support
  - configuration of huge pages in guests
  - a lot of fixes


author: Mark McLoughlin <markmc@redhat.com> - 0.7.1-8
changelog:
  - Disable sound backend, even when selinux is disabled (#524499)
  - Re-label qcow2 backing files (#497131)


author: Mark McLoughlin <markmc@redhat.com> - 0.7.1-10
changelog:
  - Create /var/log/libvirt/{lxc,uml} dirs for logrotate
  - Make libvirt-python dependon on libvirt-client
  - Sync misc minor changes from upstream spec


author: Mark McLoughlin <markmc@redhat.com> - 0.7.1-11
changelog:
  - Fix libvirtd memory leak during error reply sending (#528162)
  - Add several PCI hot-unplug typo fixes from upstream


author: Daniel Veillard <veillard@redhat.com> - 0.7.2-1
changelog:
  - Upstream release of 0.7.2
  - Allow to define ESX domains
  - Allows suspend and resulme of LXC domains
  - API for data streams
  - many bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.7.4-1
changelog:
  - upstream release of 0.7.4
  - udev node device backend
  - API to check object properties
  - better QEmu monitor processing
  - MAC address based port filtering for qemu
  - support IPv6 and multiple addresses per interfaces
  - a lot of fixes


author: Daniel Veillard <veillard@redhat.com> - 0.7.5-1
changelog:
  - Add new API virDomainMemoryStats
  - Public API and domain extension for CPU flags
  - vbox: Add support for version 3.1
  - Support QEMU's virtual FAT block device driver
  - a lot of fixes


author: Daniel Veillard <veillard@redhat.com> - 0.7.6-1
changelog:
  - upstream release of 0.7.6
  - Use QEmu new device adressing when possible
  - Implement CPU topology support for QEMU driver
  - Implement SCSI controller hotplug/unplug for QEMU
  - Implement support for multi IQN
  - a lot of fixes and improvements


author: Adam Jackson <ajax@redhat.com> 0.7.6-2
changelog:
  - libvirt-0.7.6-add-needed.patch: Fix FTBFS from --no-add-needed
  - Add BuildRequires: xmlrpc-c-client for libxmlrpc_client.so


author: Daniel Veillard <veillard@redhat.com> - 0.7.7-1
changelog:
  - macvtap support
  - async job handling
  - virtio channel
  - computing baseline CPU
  - virDomain{Attach,Detach}DeviceFlags
  - assorted bug fixes and lots of cleanups


author: Cole Robinson <crobinso@redhat.com> - 0.7.7-2.fc14
changelog:
  - Fix USB devices by product with security enabled (bz 574136)
  - Set kernel/initrd in security driver, fixes some URL installs (bz 566425)


author: Daniel Veillard <veillard@redhat.com> - 0.8.0-1
changelog:
  - Upstream release 0.8.0
  - Snapshotting support (QEmu/VBox/ESX)
  - Network filtering API
  - XenAPI driver
  - new APIs for domain events
  - Libvirt managed save API
  - timer subselection for domain clock
  - synchronous hooks
  - API to update guest CPU to host CPU
  - virDomainUpdateDeviceFlags new API
  - migrate max downtime API
  - volume wiping API
  - and many bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.8.1-1
changelog:
  - Upstream release 0.8.1
  - Starts dnsmasq from libvirtd with --dhcp-hostsfile
  - Add virDomainGetBlockInfo API to query disk sizing
  - a lot of bug fixes and cleanups


author: Daniel Veillard <veillard@redhat.com> - 0.8.2-1
changelog:
  - Upstream release 0.8.2
  - phyp: adding support for IVM
  - libvirt: introduce domainCreateWithFlags API
  - add 802.1Qbh and 802.1Qbg switches handling
  - Support for VirtualBox version 3.2
  - Init script for handling guests on shutdown/boot
  - qemu: live migration with non-shared storage for kvm


author: Daniel P. Berrange <berrange@redhat.com> - 0.8.2-2
changelog:
  - CVE-2010-2237 ignoring defined main disk format when looking up disk backing stores
  - CVE-2010-2238 ignoring defined disk backing store format when recursing into disk
    image backing stores
  - CVE-2010-2239 not setting user defined backing store format when creating new image
  - CVE-2010-2242 libvirt: improperly mapped source privileged ports may allow for
    obtaining privileged resources on the host


author: Daniel Veillard <veillard@redhat.com> - 0.8.5-1
changelog:
  - Enable JSON and netdev features in QEMU >= 0.13
  - framework for auditing integration
  - framework DTrace/SystemTap integration
  - Setting the number of vcpu at boot
  - Enable support for nested SVM
  - Virtio plan9fs filesystem QEMU
  - Memory parameter controls
  - various improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.8.7-1
changelog:
  - Preliminary support for VirtualBox 4.0
  - IPv6 support
  - Add VMware Workstation and Player driver driver
  - Add network disk support
  - Various improvements and bug fixes
  - from 0.8.6:
  - Add support for iSCSI target auto-discovery
  - QED: Basic support for QED images
  - remote console support
  - support for SPICE graphics
  - sysinfo and VMBIOS support
  - virsh qemu-monitor-command
  - various improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.8.8-1
changelog:
  - expose new API for sysinfo extraction
  - cgroup blkio weight support
  - smartcard device support
  - qemu: Support per-device boot ordering
  - Various improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.9.0-1
changelog:
  - Support cputune cpu usage tuning
  - Add public APIs for storage volume upload/download
  - Add public API for setting migration speed on the fly
  - Add libxenlight driver
  - qemu: support migration to fd
  - libvirt: add virDomain{Get,Set}BlkioParameters
  - setmem: introduce a new libvirt API (virDomainSetMemoryFlags)
  - Expose event loop implementation as a public API
  - Dump the debug buffer to libvirtd.log on fatal signal
  - Audit support
  - Various improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.9.1-1
changelog:
  - support various persistent domain updates
  - improvements on memory APIs
  - Add virDomainEventRebootNew
  - various improvements to libxl driver
  - Spice: support audio, images and stream compression
  - Various improvements and bug fixes


author: Richard W.M. Jones <rjones@redhat.com> - 0.9.1-3
changelog:
  - Add upstream patches:
      0001-json-Avoid-passing-large-positive-64-bit-integers-to.patch
      0001-qemudDomainMemoryPeek-change-ownership-selinux-label.patch
      0002-remote-remove-bogus-virDomainFree.patch
    so that users can try out virt-dmesg.
  - Change /var/cache mode to 0711.


author: Daniel Veillard <veillard@redhat.com> - 0.9.2-1
changelog:
  - Framework for lock manager plugins
  - API for network config change transactions
  - flags for setting memory parameters
  - virDomainGetState public API
  - qemu: allow blkstat/blkinfo calls during migration
  - Introduce migration v3 API
  - Defining the Screenshot public API
  - public API for NMI injection
  - Various improvements and bug fixes


author: Laine Stump <laine@redhat.com> - 0.9.2-2
changelog:
  - add rule to require netcf-0.1.8 during build so that new transactional
    network change APIs are included.
  - document that CVE-2011-2178 has been fixed (by virtue of rebase
    to 0.9.2 - see https://bugzilla.redhat.com/show_bug.cgi?id=709777)


author: Daniel Veillard <veillard@redhat.com> - 0.9.3-1
changelog:
  - new API virDomainGetVcpupinInfo
  - Add TXT record support for virtual DNS service
  - Support reboots with the QEMU driver
  - New API virDomainGetControlInfo API
  - New API virNodeGetMemoryStats
  - New API virNodeGetCPUTime
  - New API for send-key
  - New API virDomainPinVcpuFlags
  - support multifunction PCI device
  - lxc: various improvements
  - many improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.9.4-1
changelog:
  - network bandwidth QoS control
  - Add new API virDomainBlockPull*
  - save: new API to manipulate save file images
  - CPU bandwidth limits support
  - allow to send NMI and key event to guests
  - new API virDomainUndefineFlags
  - Implement code to attach to external QEMU instances
  - bios: Add support for SGA
  - various missing python binding
  - many improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.9.5-1
changelog:
  - many snapshot improvements (Eric Blake)
  - latency: Define new public API and structure (Osier Yang)
  - USB2 and various USB improvements (Marc-André Lureau)
  - storage: Add fs pool formatting (Osier Yang)
  - Add public API for getting migration speed (Jim Fehlig)
  - Add basic driver for Microsoft Hyper-V (Matthias Bolte)
  - many improvements and bug fixes


author: Laine Stump <laine@redhat.com> - 0.9.6-2
changelog:
  - Make PCI multifunction support more manual - Bug 742836
  - F15 build still uses cgconfig - Bug 738725


author: Daniel Veillard <veillard@redhat.com> - 0.9.8-1
changelog:
  - Add support for QEMU 1.0
  - Add preliminary PPC cpu driver
  - Add new API virDomain{Set, Get}BlockIoTune
  - block_resize: Define the new API
  - Add a public API to invoke suspend/resume on the host
  - various improvements for LXC containers
  - Define keepalive protocol and add virConnectIsAlive API
  - Add support for STP and VLAN filtering
  - many improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.9.9-1
changelog:
  - Add API virDomain{S,G}etInterfaceParameters
  - Add API virDomain{G, S}etNumaParameters
  - Add support for ppc64 qemu
  - Support Xen domctl v8
  - many improvements and bug fixes


author: Cole Robinson <crobinso@redhat.com> - 0.9.11.3-1
changelog:
  - Rebased to version 0.9.11.3
  - Abide URI username when connecting to hypervisor (bz 811397)
  - Fix managed USB mode (bz 814866)
  - Fix crash connecting to ESX host (bz 811891)


author: Daniel Veillard <veillard@redhat.com> - 0.9.12-1
changelog:
  - qemu: allow snapshotting of sheepdog and rbd disks
  - blockjob: add new APIs
  - a lot of bug fixes, improvements and portability work


author: Daniel Veillard <veillard@redhat.com> - 0.9.13-1
changelog:
  - S390: support for s390(x)
  - snapshot: implement new APIs for esx and vbox
  - snapshot: new query APIs and many improvements
  - virsh: Allow users to reedit rejected XML
  - nwfilter: add DHCP snooping
  - Enable driver modules in libvirt RPM
  - Default to enable driver modules for libvirtd
  - storage backend: Add RBD (RADOS Block Device) support
  - sVirt support for LXC domains inprovement
  - a lot of bug fixes, improvements and portability work


author: Daniel Veillard <veillard@redhat.com> - 0.10.0-1
changelog:
  - upstream release of 0.10.0
  - agent: add qemuAgentArbitraryCommand() for general qemu agent command
  - Introduce virDomainPinEmulator and virDomainGetEmulatorPinInfo functions
  - network: use firewalld instead of iptables, when available
  - network: make network driver vlan-aware
  - esx: Implement network driver
  - driver for parallels hypervisor
  - Various LXC improvements
  - Add virDomainGetHostname
  - a lot of bug fixes, improvements and portability work


author: Cole Robinson <crobinso@redhat.com> - 0.10.1-3
changelog:
  - Fix libvirtd segfault with old netcf-libs (bz 853381)
  - Drop unneeded dnsmasq --filterwin2k
  - Fix unwanted connection closing, needed for boxes


author: Daniel Veillard <veillard@redhat.com> - 0.10.2-1
changelog:
  - Upstream release 0.10.2
  - network: define new API virNetworkUpdate
  - add support for QEmu sandbox support
  - blockjob: add virDomainBlockCommit
  - New APIs to get/set Node memory parameters
  - new API virConnectListAllSecrets
  - new API virConnectListAllNWFilters
  - new API virConnectListAllNodeDevices
  - parallels: add support of containers to the driver
  - new API virConnectListAllInterfaces
  - new API virConnectListAllNetworks
  - new API virStoragePoolListAllVolumes
  - Add PMSUSPENDED life cycle event
  - new API virStorageListAllStoragePools
  - Add per-guest S3/S4 state configuration
  - qemu: Support for Block Device IO Limits
  - a lot of bug fixes, improvements and portability work


author: Richard W.M. Jones <rjones@redhat.com> - 0.10.2-3
changelog:
  - Re-add Use-qemu-system-i386-as-binary-instead-of-qemu.patch
    NB: This patch is Fedora-specific and not upstream.
  - Add upstream patches: don't duplicate environment variables (RHBZ#859596).


author: Cole Robinson <crobinso@redhat.com> - 0.10.2.1-1
changelog:
  - Rebased to version 0.10.2.1
  - Fix lvm volume creation when alloc=0 (bz #866481)
  - Clarify virsh send-keys man page example (bz #860004)
  - Fix occasional deadlock via virDomainDestroy (bz #859009)
  - Fix LXC deadlock from ctrl-c (bz #848119)
  - Fix occasional selinux denials with macvtap (bz #798605)
  - Fix multilib conflict with systemtap files (bz #831425)
  - Don't trigger keytab warning in system logs (bz #745203)
  - Fix qemu domxml-2-native NIC model out (bz #636832)
  - Fix error message if not enough space for lvm vol (bz #609104)


author: Jiri Denemark <jdenemar@redhat.com> - 1.0.5-2
changelog:
  - virInitctlRequest: Don't hardcode 384 bytes size
  - network: Fix network driver startup for qemu:///session
  - virInitctlRequest: Unbreak make syntax check
  - virInitctlRequest: Unbreak make syntax check
  - build: Always include sanitytest in tarball
  - qemu: Fix stupid typos in VFIO cgroup setup/teardown
  - build: Always include libvirt_lxc.syms in tarball
  - build: Clean up stray files found by 'make distcheck'
  - spec: Proper soft static allocation of qemu uid
  - Fix F_DUPFD_CLOEXEC operation args
  - build: Fix mingw build of virprocess.c
  - Fix potential use of undefined variable in remote dispatch code
  - build: Avoid non-portable cast of pthread_t
  - Fix release of resources with lockd plugin
  - Fixup rpcgen code on kFreeBSD too
  - Make detect_scsi_host_caps a function on all architectures
  - qemu: Allocate network connections sooner during domain startup
  - tests: Files named '.*-invalid.xml' should fail validation
  - conf: Don't crash on a tpm device with no backends
  - Don't mention disk controllers in generic controller errors
  - iscsi: Don't leak portal string when starting a pool
  - util: Fix virFileOpenAs return value and resulting error logs


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.0-2
changelog:
  - qemu: Fix double free in qemuMigrationPrepareDirect (rhbz#977961)
  - Fix crash when multiple event callbacks were registered (CVE-2013-2230)
  - Paused domain should remain paused after migration (rhbz#981139)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-2
changelog:
  - spec: Change --enable-werror handling to match upstream
  - Delete obsolete / unused python test files (rhbz#884103)
  - Remove reference to python/tests from RPM %doc (rhbz#884103)
  - spec: Explicitly claim ownership of channel subdir (rhbz#884103)
  - Add APIs for formatting systemd slice/scope names (rhbz#980929)
  - Add support for systemd cgroup mount (rhbz#980929)
  - Cope with races while killing processes (rhbz#980929)
  - Enable support for systemd-machined in cgroups creation (rhbz#980929)
  - Ensure LXC/QEMU APIs set the filename for errors (rhbz#991348)
  - Avoid crash if NULL is passed for filename/funcname in logging (rhbz#991348)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-3
changelog:
  - RPC: Don't accept client if it would overcommit max_clients (rhbz#981729)
  - Introduce max_queued_clients (rhbz#981729)
  - conf: Add default USB controller in qemu post-parse callback (rhbz#819968)
  - qemu: Rename some functions in qemu_command.c (rhbz#819968)
  - qemu: Eliminate almost-duplicate code in qemu_command.c (rhbz#819968)
  - qemu: Enable auto-allocate of all PCI addresses (rhbz#819968)
  - qemu: Add pcie-root controller (rhbz#819968)
  - qemu: Add dmi-to-pci-bridge controller (rhbz#819968)
  - qemu: Fix handling of default/implicit devices for q35 (rhbz#819968)
  - qemu: Properly set/use device alias for pci controllers (rhbz#819968)
  - qemu: Enable using implicit sata controller in q35 machines (rhbz#819968)
  - qemu: Improve error reporting during PCI address validation (rhbz#819968)
  - qemu: Refactor qemuDomainCheckDiskPresence for only disk presence check (rhbz#910171)
  - qemu: Add helper functions for diskchain checking (rhbz#910171)
  - qemu: Check presence of each disk and its backing file as well (rhbz#910171)
  - conf: Add startupPolicy attribute for harddisk (rhbz#910171)
  - qemu: Support to drop disk with 'optional' startupPolicy (rhbz#910171)
  - Split TLS test into two separate tests (rhbz#994158)
  - Avoid re-generating certs every time (rhbz#994158)
  - Change data passed into TLS test cases (rhbz#994158)
  - Fix validation of CA certificate chains (rhbz#994158)
  - Fix parallel runs of TLS test suites (rhbz#994158)
  - tests: Fix parallel runs of TLS test suites (rhbz#994158)
  - Add a man page for virtlockd daemon (rhbz#991494)
  - Add an example config file for virtlockd (rhbz#991494)
  - Properly handle -h / -V for --help/--version aliases in virtlockd/libvirtd (rhbz#991494)
  - Make check for /dev/loop device names stricter to avoid /dev/loop-control (rhbz#924815)
  - Ensure securityfs is mounted readonly in container (rhbz#872642)
  - Add info about access control checks into API reference (rhbz#700443)
  - Record the where the auto-generated data comes from (rhbz#700443)
  - Add documentation for access control system (rhbz#700443)
  - virsh-domain: Flip logic in cmdSetvcpus (rhbz#996552)
  - Honour root prefix in lxcContainerMountFSBlockAuto (rhbz#924815)
  - util: Add virGetUserDirectoryByUID (rhbz#988491)
  - Introduce a virt-login-shell binary (rhbz#988491)
  - build: Fix compilation of virt-login-shell.c (rhbz#988491)
  - Fix double-free and broken logic in virt-login-shell (rhbz#988491)
  - Address missed feedback from review of virt-login-shell (rhbz#988491)
  - Ensure that /dev exists in the container root filesystem (rhbz#924815)
  - remote: Fix a segfault in remoteDomainCreateWithFlags (rhbz#994855)
  - build: Avoid -lgcrypt with newer gnutls (rhbz#951637)
  - virnettlscontext: Resolve Coverity warnings (UNINIT) (rhbz#994158)
  - build: Fix missing max_queued_clients in augeas test file for libvirtd.conf (rhbz#981729)
  - virsh-domain: Fix memleak in cmdCPUBaseline (rhbz#997798)
  - Fix typo in domain name in polkit acl example (rhbz#700443)
  - Update polkit examples to use 'lookup' method (rhbz#700443)
  - Add bounds checking on virDomainMigrate*Params RPC calls (CVE-2013-4292) (rhbz#1002667)
  - Add bounds checking on virDomainGetJobStats RPC call (rhbz#1002667)
  - Add bounds checking on virDomain{SnapshotListAllChildren, ListAllSnapshots} RPC calls (rhbz#1002667)
  - Add bounds checking on virConnectListAllDomains RPC call (rhbz#1002667)
  - Add bounds checking on virConnectListAllStoragePools RPC call (rhbz#1002667)
  - Add bounds checking on virStoragePoolListAllVolumes RPC call (rhbz#1002667)
  - Add bounds checking on virConnectListAllNetworks RPC call (rhbz#1002667)
  - Add bounds checking on virConnectListAllInterfaces RPC call (rhbz#1002667)
  - Add bounds checking on virConnectListAllNodeDevices RPC call (rhbz#1002667)
  - Add bounds checking on virConnectListAllNWFilters RPC call (rhbz#1002667)
  - Add bounds checking on virConnectListAllSecrets RPC call (rhbz#1002667)
  - Prohibit unbounded arrays in XDR protocols (rhbz#1002667)
  - virbitmap: Refactor virBitmapParse to avoid access beyond bounds of array (rhbz#997906)
  - virbitmaptest: Fix function header formatting (rhbz#997906)
  - virbitmaptest: Add test for out of bounds condition (rhbz#997906)
  - virsh-domain: Fix memleak in cmdUndefine with storage (rhbz#999057)
  - virsh: Modify vshStringToArray to duplicate the elements too (rhbz#999057)
  - virsh: Don't leak list of volumes when undefining domain with storage (rhbz#999057)
  - Fix URI connect precedence (rhbz#999323)
  - tests: Add URI precedence checking (rhbz#999323)
  - Don't free NULL network in cmdNetworkUpdate (rhbz#1001094)
  - virsh: Fix debugging (rhbz#1001628)
  - qemu: Remove hostdev entry when freeing the depending network entry (rhbz#1002669)
  - Set security label on FD for virDomainOpenGraphics (rhbz#999925)
  - virsh: Free the caps list properly if one of them is invalid (rhbz#1001957)
  - virsh: Free the formatting string when listing pool details (rhbz#1001957)
  - virsh-pool.c: Don't jump over variable declaration (rhbz#1001957)
  - virsh: Free the list from ListAll APIs even for 0 items (rhbz#1001957)
  - virsh: Free messages after logging them to a file (rhbz#1001957)
  - Reverse logic allowing partial DHCP host XML (rhbz#1001078)
  - virsh: Print cephx and iscsi usage (rhbz#1000155)
  - qemu_conf: Fix broken logic for adding passthrough iscsi lun (rhbz#1000159)
  - Report secret usage error message similarly (rhbz#1000168)
  - docs: Update the formatdomain disk examples (rhbz#1000169)
  - docs: Update formatsecrets to include more examples of each type (rhbz#1000169)
  - docs: Update iSCSI storage pool example (rhbz#1000169)
  - docs: Reformat <disk> attribute description in formatdomain (rhbz#1000169)
  - qemuBuildNicDevStr: Add mq=on for multiqueue networking (rhbz#651941)
  - migration: Do not restore labels on failed migration (rhbz#822052)
  - qemu: Drop qemuDomainMemoryLimit (rhbz#1001143)
  - docs: Discourage users to set hard_limit (rhbz#1001143)
  - docs: Clean 09adfdc62de2b up (rhbz#1001143)
  - qemuSetupMemoryCgroup: Handle hard_limit properly (rhbz#1001143)
  - qemuBuildCommandLine: Fall back to mem balloon if there's no hard_limit (rhbz#1001143)
  - qemuDomainAttachHostPciDevice: Fall back to mem balloon if there's no hard_limit (rhbz#1001143)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-4
changelog:
  - Don't crash in qemuBuildDeviceAddressStr (rhbz#1003526)
  - Fix leaks in python bindings (rhbz#1003828)
  - Process virtlockd.conf instead of libvirtd.conf (rhbz#1003685)
  - test_virtlockd.aug.in: Use the correct file (rhbz#1003685)
  - qemu: Make domain renaming work during migration (rhbz#999352)
  - qemu: Handle huge number of queues correctly (rhbz#651941)
  - conf: Remove the actual hostdev when removing a network (rhbz#1003537)
  - conf: Don't deref NULL actual network in virDomainNetGetActualHostdev() (rhbz#1003537)
  - python: Fix a PyList usage mistake (rhbz#1002558)
  - Add '<nat>' element to '<forward>' network schemas (rhbz#1004364)
  - Always specify qcow2 compat level on qemu-img command line (rhbz#997977)
  - selinux: Distinguish failure to label from request to avoid label (rhbz#924153)
  - selinux: Enhance test to cover nfs label failure (rhbz#924153)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-5
changelog:
  - Pass AM_LDFLAGS to driver modules too (rhbz#1006299)
  - virsh domjobinfo: Do not return 1 if job is NONE (rhbz#1006864)
  - Fix polkit permission names for storage pools, vols & node devices (rhbz#700443)
  - Fix naming of permission for detecting storage pools (rhbz#700443)
  - security: Provide supplemental groups even when parsing label (CVE-2013-4291) (rhbz#1006513)
  - virFileNBDDeviceAssociate: Avoid use of uninitialized variable (CVE-2013-4297)
  - Rename "struct interface_driver" to virNetcfDriverState (rhbz#983026)
  - netcf driver: Use a single netcf handle for all connections (rhbz#983026)
  - virDomainDefParseXML: Set the argument of virBitmapFree to NULL after calling virBitmapFree (rhbz#1006722)
  - Add test for the nodemask double free crash (rhbz#1006722)
  - qemu: Fix checking of guest ABI compatibility when reverting snapshots (rhbz#1006886)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-6
changelog:
  - Also store user & group ID values in virIdentity (rhbz#1006272)
  - Ensure system identity includes process start time (rhbz#1006272)
  - Add support for using 3-arg pkcheck syntax for process (CVE-2013-4311)
  - Free slicename in virSystemdCreateMachine (rhbz#1008619)
  - qemu: Fix checking of ABI stability when restoring external checkpoints (rhbz#1008340)
  - qemu: Use "migratable" XML definition when doing external checkpoints (rhbz#1008340)
  - qemu: Fix memleak after commit 59898a88ce8431bd3ea249b8789edc2ef9985827 (rhbz#1008340)
  - qemu: Avoid dangling job in qemuDomainSetBlockIoTune (rhbz#700443)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-7
changelog:
  - Fix crash in remoteDispatchDomainMemoryStats (CVE-2013-4296)
  - LXC: Don't mount securityfs when user namespace enabled (rhbz#872648)
  - Move array of mounts out of lxcContainerMountBasicFS (rhbz#872648)
  - Ensure root filesystem is recursively mounted readonly (rhbz#872648)
  - qemu: Fix seamless SPICE migration (rhbz#1010861)
  - qemu: Use "ide" as device name for implicit SATA controller on Q35 (rhbz#1008903)
  - qemu: Only parse basename when determining emulator properties (rhbz#1010617)
  - qemu: Recognize -machine accel=kvm when parsing native (rhbz#1010617)
  - qemu: Don't leave shutdown inhibited on attach failure (rhbz#1010617)
  - qemu: Don't leak vm on failure (rhbz#1010617)
  - Fix typo in identity code which is pre-requisite for CVE-2013-4311 (rhbz#1006272)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-8
changelog:
  - conf: Don't crash on invalid chardev source definition of RNGs and other (rhbz#1012196)
  - rpc: Increase bound limit for virDomainGetJobStats (rhbz#1012818)
  - qemu: Free all driver data in qemuStateCleanup (rhbz#1011330)
  - qemu: Don't leak reference to virQEMUDriverConfigPtr (rhbz#1011330)
  - qemu: Eliminate redundant if clauses in qemuCollectPCIAddress (rhbz#1003983)
  - qemu: Allow some PCI devices to be attached to PCIe slots (rhbz#1003983)
  - qemu: Replace multiple strcmps with a switch on an enum (rhbz#1003983)
  - qemu: Support ich9-intel-hda audio device (rhbz#1003983)
  - qemu: Turn if into switch in qemuDomainValidateDevicePCISlotsQ35 (rhbz#1003983)
  - qemu: Prefer to put a Q35 machine's dmi-to-pci-bridge at 00:1E.0 (rhbz#1003983)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-9
changelog:
  - virNetDevBandwidthEqual: Make it more robust (rhbz#1014503)
  - qemu_hotplug: Allow QoS update in qemuDomainChangeNet (rhbz#1014503)
  - qemu: Check actual netdev type rather than config netdev type during init (rhbz#1012824)
  - Fix crash in libvirtd when events are registered & ACLs active (CVE-2013-4399) (rhbz#1011429)
  - Remove virConnectPtr arg from virNWFilterDefParse* (rhbz#1015108)
  - Don't pass virConnectPtr in nwfilter 'struct domUpdateCBStruct' (rhbz#1015108)
  - Remove use of virConnectPtr from all remaining nwfilter code (rhbz#1015108)
  - Don't set netdev offline in container cleanup (rhbz#1014604)
  - Avoid reporting an error if veth device is already deleted (rhbz#1014604)
  - Avoid deleting NULL veth device name (rhbz#1014604)
  - Retry veth device creation on failure (rhbz#1014604)
  - Use 'vnet' as prefix for veth devices (rhbz#1014604)
  - Free cmd in virNetDevVethDelete (rhbz#1014604)
  - Free cmd in virNetDevVethCreate (rhbz#1014604)
  - LXC: Fix handling of RAM filesystem size units (rhbz#1015689)
  - build: Add lxc testcase to dist list (rhbz#1015689)
  - tests: Work with older dbus (rhbz#1018730)
  - virdbus: Add virDBusHasSystemBus() (rhbz#1018730)
  - virsystemd: Don't fail to start VM if DBus isn't available or compiled in (rhbz#1018730)
  - DBus: Introduce virDBusIsServiceEnabled (rhbz#1018730)
  - Change way we fake dbus method calls (rhbz#1018730)
  - Fix virsystemdtest for previous commit (rhbz#1018730)
  - LXC: Workaround machined uncleaned data with containers running systemd. (rhbz#1018730)
  - Allow use of a private dbus bus connection (rhbz#998365)
  - Add a method for closing the dbus system bus connection (rhbz#998365)
  - Make LXC controller use a private dbus connection & close it (rhbz#998365)
  - Fix flaw in detecting log format (rhbz#927072)
  - Fix exit status of lxc controller (rhbz#927072)
  - Improve error reporting with LXC controller (rhbz#927072)
  - nwfilter: Don't fail to start if DBus isn't available (rhbz#927072)
  - Don't ignore all dbus connection errors (rhbz#927072)
  - LXC: Check the existence of dir before resolving symlinks (rhbz#927072)
  - Ensure lxcContainerMain reports errors on stderr (rhbz#927072)
  - Ensure lxcContainerResolveSymlinks reports errors (rhbz#927072)
  - Improve log filtering in virLXCProcessReadLogOutputData (rhbz#927072)
  - Initialize threading & error layer in LXC controller (rhbz#1018725)
  - qemu_migration: Avoid crashing if domain dies too quickly (rhbz#1018267)
  - Convert uuid to a string before printing it (rhbz#1019023)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-10
changelog:
  - qemu_process: Make qemuProcessReadLog() more versatile and reusable (rhbz#1001738)
  - qemu: monitor: Add infrastructure to access VM logs for better err msgs (rhbz#1001738)
  - qemu: monitor: Produce better errors on monitor hangup (rhbz#1001738)
  - qemu: Wire up better early error reporting (rhbz#1001738)
  - qemu: process: Silence coverity warning when rewinding log file (rhbz#1001738)
  - qemu: hostdev: Refactor PCI passhrough handling (rhbz#1001738)
  - qemu: hostdev: Fix function spacing and header formatting (rhbz#1001738)
  - qemu: hostdev: Add checks if PCI passthrough is available in the host (rhbz#1001738)
  - qemu: Prefer VFIO for PCI device passthrough (rhbz#1001738)
  - qemu: Init @pcidevs in qemuPrepareHostdevPCIDevices (rhbz#1001738)
  - Fix max stream packet size for old clients (rhbz#950416)
  - Adjust legacy max payload size to account for header information (rhbz#950416)
  - rpc: Correct the wrong payload size checking (rhbz#950416)
  - qemu: Simplify calling qemuDomainHostdevNetConfigRestore (rhbz#1005682)
  - qemu: Move qemuDomainRemoveNetDevice to avoid forward reference (rhbz#1005682)
  - qemu: Fix removal of <interface type='hostdev'> (rhbz#1005682)
  - remote: Fix regression in event deregistration (rhbz#1020376)
  - qemu: managedsave: Add support for compressing managed save images (rhbz#1017227)
  - qemu: snapshot: Add support for compressing external snapshot memory (rhbz#1017227)
  - Migration: Introduce VIR_MIGRATE_PARAM_LISTEN_ADDRESS (rhbz#1015215)
  - virsocket: Introduce virSocketAddrIsWildcard (rhbz#1015215)
  - qemu: Implement support for VIR_MIGRATE_PARAM_LISTEN_ADDRESS (rhbz#1015215)
  - qemu_conf: Introduce "migration_address" (rhbz#1015215)
  - qemu: Include listenAddress in debug prints (rhbz#1015215)
  - docs: Expand description of host-model CPU mode (rhbz#1014682)
  - qemu: Avoid assigning unavailable migration ports (rhbz#1019237)
  - qemu: Make migration port range configurable (rhbz#1019237)
  - qemu: Fix augeas support for migration ports (rhbz#1019237)
  - Fix perms for virConnectDomainXML{To, From}Native (CVE-2013-4401)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-11
changelog:
  - Add helpers for getting env vars in a setuid environment (rhbz#1015247)
  - Only allow 'stderr' log output when running setuid (CVE-2013-4400)
  - Close all non-stdio FDs in virt-login-shell (CVE-2013-4400)
  - Don't link virt-login-shell against libvirt.so (CVE-2013-4400)
  - build: Fix linking virt-login-shell (rhbz#1015247)
  - build: Fix build of virt-login-shell on systems with older gnutls (rhbz#1015247)
  - Set a sane $PATH for virt-login-shell (rhbz#1015247)
  - spec: Fix rpm build when lxc disabled (rhbz#1015247)
  - Move virt-login-shell into libvirt-login-shell sub-RPM (rhbz#1015247)
  - Make virCommand env handling robust in setuid env (rhbz#1015247)
  - Remove all direct use of getenv (rhbz#1015247)
  - Block all use of getenv with syntax-check (rhbz#1015247)
  - Only allow the UNIX transport in remote driver when setuid (rhbz#1015247)
  - Don't allow remote driver daemon autostart when running setuid (rhbz#1015247)
  - Add stub getegid impl for platforms lacking it (rhbz#1015247)
  - Remove (nearly) all use of getuid()/getgid() (rhbz#1015247)
  - Block all use of libvirt.so in setuid programs (rhbz#1015247)
  - spec: Clean up distribution of ChangeLog (and others) (rhbz#1024393)
  - Push RPM deps down into libvirt-daemon-driver-XXXX sub-RPMs (rhbz#1024393)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-12
changelog:
  - virpci: Don't error on unbinded devices (rhbz#1019387)
  - network: Fix connections count in case of allocate failure (rhbz#1020135)
  - qemu: Clean up migration ports when migration cancelled (rhbz#1019237)
  - qemuMigrationBeginPhase: Check for 'drive-mirror' for NBD (rhbz#1022393)
  - Allow root directory in filesystem source dir schema (rhbz#1028107)
  - Use a port from the migration range for NBD as well (rhbz#1025699)
  - qemu: Avoid double free of VM (rhbz#1018267)
  - util: Use size_t instead of unsigned int for num_virtual_functions (rhbz#1025397)
  - pci: Properly handle out-of-order SRIOV virtual functions (rhbz#1025397)
  - conf: Do better job when comparing features ABI compatibility (rhbz#1008989)
  - schema: Rename option 'hypervtristate' to 'featurestate' (rhbz#1008989)
  - conf: Mark user provided strings in error messages when parsing XML (rhbz#1008989)
  - cpu: Add support for loading and storing CPU data (rhbz#1008989)
  - cpu: x86: Rename struct cpuX86cpuid as virCPUx86CPUID (rhbz#1008989)
  - cpu: x86: Rename struct cpuX86Data as virCPUx86Data (rhbz#1008989)
  - cpu: x86: Rename x86DataFree() as virCPUx86DataFree() (rhbz#1008989)
  - Ensure 'arch' is always set in cpuArchNodeData (rhbz#1008989)
  - cpu: x86: Rename x86MakeCPUData as virCPUx86MakeData (rhbz#1008989)
  - cpu: x86: Rename x86DataAddCpuid as virCPUx86DataAddCPUID (rhbz#1008989)
  - cpu: x86: Rename data_iterator and DATA_ITERATOR_INIT (rhbz#1008989)
  - cpu: x86: Fix return types of x86cpuidMatch and x86cpuidMatchMasked (rhbz#1008989)
  - cpu: x86: Use whitespace to clarify context and use consistent labels (rhbz#1008989)
  - cpu: x86: Clean up error messages in x86VendorLoad() (rhbz#1008989)
  - cpu: Export few x86-specific APIs (rhbz#1008989)
  - cpu: x86: Parse the CPU feature map only once (rhbz#1008989)
  - cpu_x86: Refactor storage of CPUID data to add support for KVM features (rhbz#1008989)
  - qemu: Add monitor APIs to fetch CPUID data from QEMU (rhbz#1008989)
  - cpu: x86: Add internal CPUID features support and KVM feature bits (rhbz#1008989)
  - conf: Refactor storing and usage of feature flags (rhbz#1008989)
  - qemu: Add support for paravirtual spinlocks in the guest (rhbz#1008989)
  - qemu: process: Validate specific CPUID flags of a guest (rhbz#1008989)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-13
changelog:
  - virsh-domain: Mark --live and --config mutually exclusive in vcpucount (rhbz#1024245)
  - virSecurityLabelDefParseXML: Don't parse label on model='none' (rhbz#1028962)
  - qemuMonitorIO: Don't use @mon after it's unrefed (rhbz#1018267)
  - qemu: Allow hotplug of multiple SCSI devices (rhbz#1031062)
  - qemu: Call qemuSetupHostdevCGroup later during hotplug (rhbz#1025108)
  - virscsi: Hostdev SCSI AdapterId retrieval fix (rhbz#1031079)
  - storage: Returns earlier if source adapter of the scsi pool is a HBA (rhbz#1027680)
  - spec: Restrict virt-login-shell usage (rhbz#1033614)
  - spec: Don't save/restore running VMs on libvirt-client update (rhbz#1033626)
  - Don't start a nested job in qemuMigrationPrepareAny (rhbz#1018267)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-14
changelog:
  - nodedev: Resolve Relax-NG validity error (rhbz#1035792)
  - test-lib: Make case skipping possible (rhbz#1034380)
  - tests: Don't test user config file if ran as root (rhbz#1034380)
  - Improve cgroups docs to cover systemd integration (rhbz#1004340)
  - Fix busy wait loop in LXC container I/O handling (rhbz#1032705)
  - tests: Guarantee abs_srcdir in all C tests (rhbz#1035403)
  - Introduce standard methods for sorting strings with qsort (rhbz#1035403)
  - Add virFileIsMountPoint function (rhbz#1035403)
  - Pull lxcContainerGetSubtree out into shared virfile module (rhbz#1035403)
  - Fix bug in identifying sub-mounts (rhbz#1035403)
  - LXC: Ensure security context is set when mounting images (rhbz#923903)
  - Ensure to zero out the virDomainBlockJobInfo arg (rhbz#1028846)
  - qemu: Default to vfio for nodedev-detach (rhbz#1035188)
  - daemon: Run virStateCleanup conditionally (rhbz#1033061)
  - qemu: Add "-boot strict" to commandline whenever possible (rhbz#1037593)
  - tests: Add forgotten boot-strict test files (rhbz#1037593)
  - conf: Fix XML formatting of RNG device info (rhbz#1035118)
  - qemu: Improve error when setting invalid count of vcpus via agent (rhbz#1035108)
  - Add qxl ram size to ABI stability check (rhbz#1035123)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-15
changelog:
  - spec: Don't save/restore running VMs on libvirt-client update (rhbz#1033626)
  - qemu: hotplug: Only label hostdev after checking device conflicts (rhbz#1025108)
  - qemu: hotplug: Fix double free on USB collision (rhbz#1025108)
  - qemu: hotplug: Fix adding USB devices to the driver list (rhbz#1025108)
  - docs: Enhance memoryBacking/locked documentation (rhbz#1035954)
  - util: Fix two virCompareLimitUlong bugs (rhbz#1024272)
  - cgroups: Redefine what "unlimited" means wrt memory limits (rhbz#1024272)
  - qemu: Report VIR_DOMAIN_MEMORY_PARAM_UNLIMITED properly (rhbz#1024272)
  - qemu: Fix minor inconsistency in error message (rhbz#1024272)
  - conf: Don't format memtune with unlimited values (rhbz#1024272)
  - qemu_process: Read errors from child (rhbz#1035955)
  - network: Properly update iptables rules during net-update (rhbz#1035336)
  - Tie SASL callbacks lifecycle to virNetSessionSASLContext (rhbz#1039991)
  - screenshot: Implement multiple screen support (rhbz#1026966)
  - Switch to private redhat namespace for QMP I/O error reason (rhbz#1026966)
  - Support virtio disk hotplug in JSON mode (rhbz#1026966)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-16
changelog:
  - qemu: Check for reboot-timeout on monitor (rhbz#1042690)
  - virsh: Fix return value error of cpu-stats (rhbz#1043388)
  - tools: Fix virsh connect man page (rhbz#1043260)
  - conf: Introduce generic ISA address (rhbz#996520)
  - conf: Add support for panic device (rhbz#996520)
  - qemu: Add support for -device pvpanic (rhbz#996520)
  - Fix invalid read in virNetSASLSessionClientStep debug log (rhbz#1043864)
  - virsh: man: Mention that volumes need to be in storage pool for undefine (rhbz#1044445)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-18
changelog:
  - qemu: Ask for -enable-fips when FIPS is required (rhbz#1035474)
  - qemu: Properly set MaxMemLock when hotplugging with VFIO (rhbz#1035490)
  - qemu: Avoid duplicate security label restore on hostdev attach failure (rhbz#1035490)
  - qemu: Re-add hostdev interfaces to hostdev array on libvirtd restart (rhbz#1045002)
  - domain: Don't try to interpret <driver> as virtio config for hostdev interfaces (rhbz#1046337)
  - virBitmapParse: Fix behavior in case of error and fix up callers (rhbz#1047234)
  - qemu: Fix live pinning to memory node on NUMA system (rhbz#1047234)
  - qemu: Clean up qemuDomainSetNumaParameters (rhbz#1047234)
  - qemu: Range check numa memory placement mode (rhbz#1047234)
  - virkeycode: Allow ANSI_A (rhbz#1044806)
  - Fix argument order of qemuMigrationPerformJob(). (rhbz#1049338)
  - qemu: Do not access stale data in virDomainBlockStats (CVE-2013-6458)
  - qemu: Avoid using stale data in virDomainGetBlockInfo (CVE-2013-6458)
  - qemu: Fix job usage in qemuDomainBlockJobImpl (CVE-2013-6458)
  - qemu: Fix job usage in qemuDomainBlockCopy (rhbz#1048643)
  - qemu: Fix job usage in virDomainGetBlockIoTune (CVE-2013-6458)
  - PanicCheckABIStability: Need to check for existence (rhbz#996520)
  - virsh: Improve usability of '--print-xml' flag for attach-disk command (rhbz#1049529)
  - virsh: Don't use legacy API if --current is used on device hot(un)plug (rhbz#1049529)
  - virsh: Use inactive definition when removing disk from config (rhbz#1049529)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-19
changelog:
  - CVE-2013-6436: Fix crash in lxcDomainGetMemoryParameters (rhbz#1049137)
  - Fix crash in lxcDomainSetMemoryParameters (rhbz#1052062)
  - Don't crash if a connection closes early (CVE-2014-1447)
  - Really don't crash if a connection closes early (CVE-2014-1447)
  - qemu: Change the default unix monitor timeout (rhbz#892273)
  - virSecuritySELinuxSetFileconHelper: Don't fail on read-only NFS (rhbz#996543)
  - qemu: Avoid operations on NULL monitor if VM fails early (rhbz#1054785)
  - virt-login-shell: Fix regressions in behavior (rhbz#1015247)
  - pci: Make reattach work for unbound devices (rhbz#1046919)
  - pci: Fix failure paths in detach (rhbz#1046919)
  - qemu: Don't detach devices if passthrough doesn't work (rhbz#1046919)
  - Fix migration with QEMU 1.6 (rhbz#1053405)
  - build: More workarounds for if_bridge.h (rhbz#1042937)
  - build: Fix build with latest rawhide kernel headers (rhbz#1042937)
  - aarch64: Disable -fstack-protector. (rhbz#1042937)
  - AArch64: Parse cputopology from /proc/cpuinfo. (rhbz#1042937)
  - virDomainEventCallbackListFree: Don't leak @list->callbacks (rhbz#1047964)
  - Fix memory leak in virObjectEventCallbackListRemoveID() (rhbz#1047964)
  - event: Filter global events by domain:getattr ACL (CVE-2014-0028)
  - Doc: Improve the document for nodesuspend (rhbz#1045089)
  - Doc: Add "note" for node-memory-tune (rhbz#1045089)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-21
changelog:
  - util: Correct the NUMA node range checking (rhbz#1045958)
  - storage: Add document for possible problem on volume detection (rhbz#726797)
  - storage: Fix autostart of pool with "fc_host" type adapter (rhbz#726797)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-22
changelog:
  - Add a read/write lock implementation (rhbz#1034807)
  - Push nwfilter update locking up to top level (rhbz#1034807)
  - utils: Introduce functions for kernel module manipulation (rhbz#1045124)
  - virCommand: Introduce virCommandSetDryRun (rhbz#1045124)
  - tests: Add test for new virkmod functions (rhbz#1045124)
  - Honor blacklist for modprobe command (rhbz#1045124)
  - qemu: Be sure we're using the updated value of backend during hotplug (rhbz#1056360)
  - network: Permit upstream forwarding of unqualified DNS names (rhbz#1061099)
  - network: Only prevent forwarding of DNS requests for unqualified names (rhbz#1061099)
  - network: Change default of forwardPlainNames to 'yes' (rhbz#1061099)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-23
changelog:
  - Generate a valid imagelabel even for type 'none' (rhbz#1061657)
  - qemu: keep pre-migration domain state after failed migration (rhbz#1057407)
  - schema: Fix guest timer specification schema according to the docs (rhbz#1056205)
  - conf: Enforce supported options for certain timers (rhbz#1056205)
  - qemu: hyperv: Add support for timer enlightenments (rhbz#1056205)
  - build: correctly check for SOICGIFVLAN GET_VLAN_VID_CMD command (rhbz#1062665)
  - util: Add "shareable" field for virSCSIDevice struct (rhbz#957292)
  - util: Fix the indention (rhbz#957292)
  - qemu: Don't fail if the SCSI host device is shareable between domains (rhbz#957292)
  - util: Add one argument for several scsi utils (rhbz#957292)
  - tests: Add tests for scsi utils (rhbz#957292)
  - qemu: Fix the error message for scsi host device's shareable checking (rhbz#957292)
  - util: Accept test data path for scsi device's sg_path (rhbz#957292)
  - tests: Modify the scsi util tests (rhbz#957292)
  - event: move event filtering to daemon (regression fix) (rhbz#1047964)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-24
changelog:
  - Block info query: Add check for transient domain (rhbz#1065531)
  - Fix minor typos in messages and docs (rhbz#1045643)
  - LXC: Free variable vroot in lxcDomainDetachDeviceHostdevUSBLive() (rhbz#1045643)
  - LXC: free dst before lxcDomainAttachDeviceDiskLive returns (rhbz#1045643)
  - maint: fix comment typos (rhbz#1045643)
  - storage: avoid short reads while chasing backing chain (rhbz#1045643)
  - Don't block use of USB with containers (rhbz#1045643)
  - Fix path used for USB device attach with LXC (rhbz#1045643)
  - Record hotplugged USB device in LXC live guest config (rhbz#1045643)
  - Fix reset of cgroup when detaching USB device from LXC guests (rhbz#1045643)
  - Disks are always block devices, never character devices (rhbz#1045643)
  - Move check for cgroup devices ACL upfront in LXC hotplug (rhbz#1045643)
  - Add virFileMakeParentPath helper function (rhbz#1045643)
  - Add helper for running code in separate namespaces (rhbz#1045643)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC shutdown/reboot code (CVE-2013-6456)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC disk hotplug (CVE-2013-6456)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC USB hotplug (CVE-2013-6456)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC block hostdev hotplug (CVE-2013-6456)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC chardev hostdev hotplug (CVE-2013-6456)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC hotunplug code (CVE-2013-6456)
  - Ignore additional fields in iscsiadm output (rhbz#1067173)
  - qemuBuildNicDevStr: Set vectors= on Multiqueue (rhbz#1066209)
  - Don't depend on syslog.service (rhbz#1032695)
  - libvirt-guests: Run only after libvirtd (rhbz#1032695)
  - virSystemdCreateMachine: Set dependencies for slices (rhbz#1032695)
  - libvirt-guests: Wait for libvirtd to initialize (rhbz#1032695)
  - virNetServerRun: Notify systemd that we're accepting clients (rhbz#1032695)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-25
changelog:
  - maint: fix comma style issues: conf (rhbz#1032370)
  - Allow <source> for type=block to have no dev (rhbz#1032370)
  - Allow LUN type disks to have no source (rhbz#1032370)
  - virsh-volume: Unify strigification of volume type (rhbz#1032370)
  - conf: Refactor virDomainDiskSourcePoolDefParse (rhbz#1032370)
  - conf: Split out code to parse the source of a disk definition (rhbz#1032370)
  - conf: Rename virDomainDiskHostDefFree to virDomainDiskHostDefClear (rhbz#1032370)
  - conf: Refactor virDomainDiskSourceDefParse (rhbz#1032370)
  - storage: fix RNG validation of gluster via netfs (rhbz#1032370)
  - maint: fix comment typos. (rhbz#1032370)
  - storage: use valid XML for awkward volume names (rhbz#1032370)
  - build: Don't fail on '&lt; ' or '&gt; ' with old xmllint (rhbz#1032370)
  - storage: allow interleave in volume XML (rhbz#1032370)
  - storage: expose volume meta-type in XML (rhbz#1032370)
  - storage: initial support for linking with libgfapi (rhbz#1032370)
  - storage: document existing pools (rhbz#1032370)
  - storage: document gluster pool (rhbz#1032370)
  - storage: implement rudimentary glusterfs pool refresh (rhbz#1032370)
  - storage: add network-dir as new storage volume type (rhbz#1032370)
  - storage: improve directory support in gluster pool (rhbz#1032370)
  - storage: improve allocation stats reported on gluster files (rhbz#1032370)
  - storage: improve handling of symlinks in gluster (rhbz#1032370)
  - storage: probe qcow2 volumes in gluster pool (rhbz#1032370)
  - storage: fix typo in previous patch (rhbz#1032370)
  - conf: Export virStorageVolType enum helper functions (rhbz#1032370)
  - test: Implement fake storage pool driver in qemuxml2argv test (rhbz#1032370)
  - storage: reduce number of stat calls (rhbz#1032370)
  - storage: use simpler 'char *' (rhbz#1032370)
  - storage: refactor backing chain division of labor (rhbz#1032370)
  - storage: always probe type with buffer (rhbz#1032370)
  - storage: don't read storage volumes in nonblock mode (rhbz#1032370)
  - storage: skip selinux cleanup when fd not available (rhbz#1032370)
  - storage: use correct type for array count (rhbz#1032370)
  - storage: allow interleave in pool XML (rhbz#1032370)
  - qemuxml2argv: Add test to verify correct usage of disk type="volume" (rhbz#1032370)
  - qemuxml2argv: Add test for disk type='volume' with iSCSI pools (rhbz#1032370)
  - tests: Fix comment for fake storage pool driver (rhbz#1032370)
  - conf: Support disk source formatting without needing a virDomainDiskDefPtr (rhbz#1032370)
  - conf: Clean up virDomainDiskSourceDefFormatInternal (rhbz#1032370)
  - conf: Split out seclabel formating code for disk source (rhbz#1032370)
  - conf: Export disk source formatter and parser (rhbz#1032370)
  - snapshot: conf: Use common parsing and formatting functions for source (rhbz#1032370)
  - snapshot: conf: Fix NULL dereference when <driver> element is empty (rhbz#1032370)
  - conf: Add functions to copy and free network disk source definitions (rhbz#1032370)
  - qemu: snapshot: Detect internal snapshots also for sheepdog and RBD (rhbz#1032370)
  - conf: Add helper do clear disk source authentication struct (rhbz#1032370)
  - qemu: snapshot: Touch up error message (rhbz#1032370)
  - qemu: snapshot: Add functions similar to disk source pool translation (rhbz#1032370)
  - qemu: Refactor qemuTranslateDiskSourcePool (rhbz#1032370)
  - qemu: Split out formatting of network disk source URI (rhbz#1032370)
  - qemu: Simplify call pattern of qemuBuildDriveURIString (rhbz#1032370)
  - qemu: Use qemuBuildNetworkDriveURI to handle http/ftp and friends (rhbz#1032370)
  - qemu: Migrate sheepdog source generation into common function (rhbz#1032370)
  - qemu: Split out NBD command generation (rhbz#1032370)
  - qemu: Unify formatting of RBD sources (rhbz#1032370)
  - qemu: Refactor disk source string formatting (rhbz#1032370)
  - qemu: Clear old translated pool source (rhbz#1032370)
  - qemu: snapshots: Declare supported and unsupported snapshot configs (rhbz#1032370)
  - domainsnapshotxml2xmltest: Clean up labels and use bool instead of int (rhbz#1032370)
  - domainsnapshotxml2xmltest: Allow for better testing of snapshots (rhbz#1032370)
  - domainsnapshotxml2xml: Move files with conflicting names (rhbz#1032370)
  - domainsnapshotxml2xmltest: Add existing files as new tests (rhbz#1032370)
  - domainsnapshotxml2xmltest: Add test case for empty driver element (rhbz#1032370)
  - qemu: Fix indentation in qemuTranslateDiskSourcePool (rhbz#1032370)
  - qemu: snapshot: Fix incorrect disk type for auto-generated disks (rhbz#1032370)
  - storage: fix omitted slash in gluster volume URI (rhbz#1032370)
  - virsh: domain: Fix undefine with storage of 'volume' disks (rhbz#1032370)
  - snapshot: schema: Split out snapshot disk driver definition (rhbz#1032370)
  - storage: Add gluster pool filter and fix virsh pool listing (rhbz#1032370)
  - storage: fix bogus target in gluster volume xml (rhbz#1032370)
  - storage: Improve error message when a storage backend is missing (rhbz#1032370)
  - storage: Break long lines and clean up spaces in storage backend header (rhbz#1032370)
  - storage: Support deletion of volumes on gluster pools (rhbz#1032370)
  - qemu: snapshot: Avoid libvirtd crash when qemu crashes while snapshotting (rhbz#1032370)
  - qemu: snapshot: Forbid snapshots when backing is a scsi passthrough disk (rhbz#1034993)
  - qemu: Avoid crash in qemuDiskGetActualType (rhbz#1032370)
  - snapshot: Add support for specifying snapshot disk backing type (rhbz#1032370)
  - conf: Move qemuDiskGetActualType to virDomainDiskGetActualType (rhbz#1032370)
  - conf: Move qemuSnapshotDiskGetActualType to virDomainSnapshotDiskGetActualType (rhbz#1032370)
  - storage: Add file storage APIs in the default storage driver (rhbz#1032370)
  - storage: add file functions for local and block files (rhbz#1032370)
  - storage: Add storage file backends for gluster (rhbz#1032370)
  - qemu: Switch snapshot deletion to the new API functions (rhbz#1032370)
  - qemu: snapshot: Use new APIs to detect presence of existing storage files (rhbz#1032370)
  - qemu: snapshot: Add support for external active snapshots on gluster (rhbz#1032370)
  - storage: Fix build with older compilers afeter gluster snapshot series (rhbz#1032370)
  - storage: gluster: Don't leak private data when storage file init fails (rhbz#1032370)
  - spec: Use correct versions of libgfapi in RHEL builds (rhbz#1032370)
  - spec: Fix braces around macros (rhbz#1032370)
  - build: use --with-systemd-daemon as configure option (rhbz#1032695)
  - spec: require device-mapper-devel for storage-disk (rhbz#1032695)
  - spec: make systemd_daemon usage configurable (rhbz#1032695)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-26
changelog:
  - virNetDevVethCreate: Serialize callers (rhbz#1014604)
  - qemuBuildNicDevStr: Adapt to new advisory on multiqueue (rhbz#1071888)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-27
changelog:
  - spec: Let translations be properly updated (rhbz#1030368)
  - Update translation to supported languages (rhbz#1030368)
  - Add a mutex to serialize updates to firewall (rhbz#1074003)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-28
changelog:
  - qemu: Forbid "sgio" support for SCSI generic host device (rhbz#957292)
  - qemu: monitor: Fix invalid parentheses (rhbz#1075973)
  - qemu: Introduce qemuDomainDefCheckABIStability (rhbz#1076503)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-29
changelog:
  - nwfilter: Increase buffer size for libpcap (rhbz#1078347)
  - nwfilter: Display pcap's error message when pcap setup fails (rhbz#1078347)
  - nwfilter: Fix double free of pointer (rhbz#1071181)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.7-1
changelog:
  - Rebased to libvirt-1.2.7 (rhbz#1035158)
  - The rebase also fixes the following bugs:
      rhbz#823535, rhbz#872628, rhbz#874418, rhbz#878394, rhbz#880483
      rhbz#921094, rhbz#963817, rhbz#964177, rhbz#967493, rhbz#967494
      rhbz#972964, rhbz#983350, rhbz#985782, rhbz#985980, rhbz#990319
      rhbz#990418, rhbz#991290, rhbz#992980, rhbz#994731, rhbz#995377
      rhbz#997627, rhbz#997802, rhbz#1006700, rhbz#1007698, rhbz#1007759
      rhbz#1010885, rhbz#1022874, rhbz#1023366, rhbz#1025407, rhbz#1027076
      rhbz#1029266, rhbz#1029732, rhbz#1032363, rhbz#1033020, rhbz#1033398
      rhbz#1033704, rhbz#1035128, rhbz#1046192, rhbz#1049038, rhbz#1052114
      rhbz#1056902, rhbz#1062142, rhbz#1063837, rhbz#1066280, rhbz#1066894
      rhbz#1067338, rhbz#1069552, rhbz#1069784, rhbz#1070680, rhbz#1072141
      rhbz#1072677, rhbz#1073368, rhbz#1073506, rhbz#1074086, rhbz#1075290
      rhbz#1075299, rhbz#1076957, rhbz#1076959, rhbz#1076960, rhbz#1076962
      rhbz#1077009, rhbz#1077572, rhbz#1078590, rhbz#1079162, rhbz#1079173
      rhbz#1080859, rhbz#1081881, rhbz#1081932, rhbz#1082124, rhbz#1083345
      rhbz#1084360, rhbz#1085706, rhbz#1085769, rhbz#1086121, rhbz#1086331
      rhbz#1086704, rhbz#1087104, rhbz#1087671, rhbz#1088293, rhbz#1088667
      rhbz#1088787, rhbz#1088864, rhbz#1089179, rhbz#1089378, rhbz#1091132
      rhbz#1091866, rhbz#1092038, rhbz#1092253, rhbz#1093127, rhbz#1095035
      rhbz#1097028, rhbz#1097503, rhbz#1097677, rhbz#1097968, rhbz#1098659
      rhbz#1099978, rhbz#1100086, rhbz#1100769, rhbz#1101059, rhbz#1101510
      rhbz#1101987, rhbz#1101999, rhbz#1102426, rhbz#1102457, rhbz#1102611
      rhbz#1104992, rhbz#1104993, rhbz#1105939, rhbz#1108593, rhbz#1110198
      rhbz#1110212, rhbz#1110673, rhbz#1111044, rhbz#1112939, rhbz#1113332
      rhbz#1113668, rhbz#1113751, rhbz#1113868, rhbz#1118710, rhbz#1119206
      rhbz#1119387, rhbz#1119592, rhbz#1120474, rhbz#1122255, rhbz#1122973
  - spec: Enable qemu driver for RHEL-7 on ppc64 (rhbz#1120474)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-1
changelog:
  - Rebased to libvirt-1.2.8 (rhbz#1035158)
  - The rebase also fixes the following bugs:
      rhbz#927369, rhbz#957293, rhbz#999926, rhbz#1021703, rhbz#1043735
      rhbz#1047818, rhbz#1062142, rhbz#1064770, rhbz#1072653, rhbz#1078126
      rhbz#1095636, rhbz#1103245, rhbz#1119215, rhbz#1121837, rhbz#1121955
      rhbz#1122455, rhbz#1126329, rhbz#1126721, rhbz#1126909, rhbz#1128097
      rhbz#1128751, rhbz#1129207, rhbz#1129372, rhbz#1129998, rhbz#1130089
      rhbz#1130379, rhbz#1131306, rhbz#1131445, rhbz#1131788, rhbz#1131811
      rhbz#1131819, rhbz#1131876, rhbz#1132301, rhbz#1132305, rhbz#1132347


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-2
changelog:
  - remote: Fix memory leak on error path when deserializing bulk stats (rhbz#1136350)
  - spec: Fix preun script for daemon (rhbz#1136736)
  - security: fix DH key generation when FIPS mode is on (rhbz#1128497)
  - tests: force FIPS testing mode with new enough GNU TLS versions (rhbz#1128497)
  - Don't include non-migratable features in host-model (rhbz#1138221)
  - qemu: Rename DEFAULT_JOB_MASK to QEMU_DEFAULT_JOB_MASK (rhbz#1134154)
  - qemu: snapshot: Fix job handling when creating snapshots (rhbz#1134154)
  - qemu: snapshot: Acquire job earlier on snapshot revert/delete (rhbz#1134154)
  - qemu: snapshot: Fix snapshot function header formatting and spacing (rhbz#1134154)
  - qemu: snapshot: Simplify error paths (rhbz#1134154)
  - qemu: Propagate QEMU errors during incoming migrations (rhbz#1090093)
  - Refactor job statistics (rhbz#1063724)
  - qemu: Avoid incrementing jobs_queued if virTimeMillisNow fails (rhbz#1063724)
  - Add support for fetching statistics of completed jobs (rhbz#1063724)
  - qemu: Silence coverity on optional migration stats (rhbz#1063724)
  - virsh: Add support for completed job stats (rhbz#1063724)
  - qemu: Transfer migration statistics to destination (rhbz#1063724)
  - qemu: Recompute downtime and total time when migration completes (rhbz#1063724)
  - qemu: Transfer recomputed stats back to source (rhbz#1063724)
  - conf: Extend <loader/> and introduce <nvram/> (rhbz#1112257)
  - qemu: Implement extended loader and nvram (rhbz#1112257)
  - qemu: Automatically create NVRAM store (rhbz#1112257)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-3
changelog:
  - virsh: Move --completed from resume to domjobinfo (rhbz#1063724)
  - qemu_driver: Resolve Coverity COPY_PASTE_ERROR (rhbz#1141209)
  - virfile: Resolve Coverity DEADCODE (rhbz#1141209)
  - lxc: Resolve Coverity FORWARD_NULL (rhbz#1141209)
  - qemu: Resolve Coverity FORWARD_NULL (rhbz#1141209)
  - qemu: Resolve Coverity FORWARD_NULL (rhbz#1141209)
  - xen: Resolve Coverity NEGATIVE_RETURNS (rhbz#1141209)
  - qemu: Resolve Coverity NEGATIVE_RETURNS (rhbz#1141209)
  - qemu: Resolve Coverity NEGATIVE_RETURNS (rhbz#1141209)
  - virsh: Resolve Coverity NEGATIVE_RETURNS (rhbz#1141209)
  - daemon: Resolve Coverity RESOURCE_LEAK (rhbz#1141209)
  - domain_conf: Resolve Coverity COPY_PASTE_ERROR (rhbz#1141209)
  - storage_conf: Fix libvirtd crash when defining scsi storage pool (rhbz#1141943)
  - qemu: time: Report errors if agent command fails (rhbz#1142294)
  - util: storage: Copy driver type when initializing chain element (rhbz#1140984)
  - docs, conf, schema: add support for shared memory mapping (rhbz#1133144)
  - qemu: add support for shared memory mapping (rhbz#1133144)
  - rpc: reformat the flow to make a bit more sense (rhbz#927369)
  - remove redundant pidfile path constructions (rhbz#927369)
  - util: fix potential leak in error codepath (rhbz#927369)
  - util: get rid of unnecessary umask() call (rhbz#927369)
  - rpc: make daemon spawning a bit more intelligent (rhbz#927369)
  - conf: add backend element to interfaces (rhbz#1139362)
  - Wire up the interface backend options (rhbz#1139362)
  - CVE-2014-3633: qemu: blkiotune: Use correct definition when looking up disk (CVE-2014-3633)
  - qemu: fix crash with shared disks (rhbz#1142722)
  - nvram: Fix permissions (rhbz#1026772)
  - libvirt.spec: Fix permission even for libvirt-driver-qemu (rhbz#1026772)
  - virDomainUndefineFlags: Allow NVRAM unlinking (rhbz#1026772)
  - formatdomain: Update <loader/> example to match the rest (rhbz#1026772)
  - domaincaps: Expose UEFI capability (rhbz#1026772)
  - qemu_capabilities: Change virQEMUCapsFillDomainCaps signature (rhbz#1026772)
  - domaincaps: Expose UEFI binary path, if it exists (rhbz#1026772)
  - domaincapstest: Run cleanly on systems missing OVMF firmware (rhbz#1026772)
  - conf: Disallow nonexistent NUMA nodes for hugepages (rhbz#1135396)
  - qemu: Honor hugepages for UMA domains (rhbz#1135396)
  - RHEL: Fix maxvcpus output (rhbz#1092363)
  - virsh: Add iothread to 'attach-disk' (rhbz#1101574)
  - qemu: Issue query-iothreads and to get list of active IOThreads (rhbz#1101574)
  - vircgroup: Introduce virCgroupNewIOThread (rhbz#1101574)
  - qemu_domain: Add niothreadpids and iothreadpids (rhbz#1101574)
  - qemu_cgroup: Introduce cgroup functions for IOThreads (rhbz#1101574)
  - qemu: Allow pinning specific IOThreads to a CPU (rhbz#1101574)
  - domain_conf: Add iothreadpin to cputune (rhbz#1101574)
  - vircgroup: Fix broken builds without cgroups (rhbz#1101574)
  - cputune: allow interleaved xml (rhbz#1101574)
  - qemu: Fix iothreads issue (rhbz#1101574)
  - qemu_cgroup: Adjust spacing around incrementor (rhbz#1101574)
  - qemu: Fix call in qemuDomainSetNumaParamsLive for virCgroupNewIOThread (rhbz#1101574)
  - qemu: Need to check for capability before query (rhbz#1101574)
  - qemu: Don't fail startup/attach for IOThreads if no JSON (rhbz#1101574)
  - Fixes for domains with no iothreads (rhbz#1101574)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-4
changelog:
  - Fix libvirtd crash when removing metadata (rhbz#1143955)
  - Fix leak in x86UpdateHostModel (rhbz#1144303)
  - Move the FIPS detection from capabilities (rhbz#1135431)
  - qemu: raise an error when trying to use readonly sata disks (rhbz#1112939)
  - virsh-host: fix pagesize unit of freepages (rhbz#1145048)
  - nodeinfo: report error when given node is out of range (rhbz#1145050)
  - Fix typo of virNodeGetFreePages comment (rhbz#1145050)
  - nodeinfo: Prefer MIN in nodeGetFreePages (rhbz#1145050)
  - Fix bug with loading bridge name for active domain during libvirtd start (rhbz#1140085)
  - qemu: save image: Split out user provided XML checker (rhbz#1142693)
  - qemu: save image: Add possibility to return XML stored in the image (rhbz#1142693)
  - qemu: save image: Split out new definition check/update (rhbz#1142693)
  - qemu: save image: Split out checks done only when editing the save img (rhbz#1142693)
  - qemu: hook: Provide hook when restoring a domain save image (rhbz#1142693)
  - qemu: Expose additional migration statistics (rhbz#1013055)
  - qemu: Fix old tcp:host URIs more cleanly (rhbz#1013055)
  - qemu: Prepare support for arbitrary migration protocol (rhbz#1013055)
  - qemu: Add RDMA migration capabilities (rhbz#1013055)
  - qemu: RDMA migration support (rhbz#1013055)
  - qemu: Memory pre-pinning support for RDMA migration (rhbz#1013055)
  - qemu: Fix memory leak in RDMA migration code (rhbz#1013055)
  - schemas: finish virTristate{Bool, Switch} transition (rhbz#1139364)
  - conf: split out virtio net driver formatting (rhbz#1139364)
  - conf: remove redundant local variable (rhbz#1139364)
  - conf: add options for disabling segment offloading (rhbz#1139364)
  - qemu: wire up virtio-net segment offloading options (rhbz#1139364)
  - spec: Enable qemu driver for RHEL-7 on aarch64 (rhbz#1142448)
  - blkdeviotune: fix bug with saving values into live XML (rhbz#1146511)
  - security: Fix labelling host devices (rhbz#1146550)
  - qemu: Add missing goto on rawio (rhbz#1103739)
  - hostdev: Add "rawio" attribute to _virDomainHostdevSubsysSCSI (rhbz#1103739)
  - qemu: Process the hostdev "rawio" setting (rhbz#1103739)
  - util: Add function to check if a virStorageSource is "empty" (rhbz#1138231)
  - util: storage: Allow metadata crawler to report useful errors (rhbz#1138231)
  - qemu: Sanitize argument names and empty disk check in qemuDomainDetermineDiskChain (rhbz#1138231)
  - qemu: Report better errors from broken backing chains (rhbz#1138231)
  - storage: Improve error message when traversing backing chains (rhbz#1138231)
  - qemu: Always re-detect backing chain (rhbz#1144922)
  - event: introduce new event for tunable values (rhbz#1115898)
  - tunable_event: extend debug message and tweak limit for remote message (rhbz#1115898)
  - add an example how to use tunable event (rhbz#1115898)
  - Fix MinGW build (rhbz#1115898)
  - event_example: cleanup example code for tunable event (rhbz#1115898)
  - cputune_event: queue the event for cputune updates (rhbz#1115898)
  - blkdeviotune: trigger tunable event for blkdeviotune updates (rhbz#1115898)
  - Rename tunable event constants (rhbz#1115898)
  - Fix typo s/EMULATORIN/EMULATORPIN/ (rhbz#1115898)
  - Check for NULL in qemu monitor event filter (rhbz#1144920)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-5
changelog:
  - qemuPrepareNVRAM: Save domain after NVRAM path generation (rhbz#1026772)
  - Fix crash cpu_shares change event crash on domain startup (rhbz#1147494)
  - Don't verify CPU features with host-passthrough (rhbz#1147584)
  - Also filter out non-migratable features out of host-passthrough (rhbz#1147584)
  - selinux: Avoid label reservations for type = none (rhbz#1138487)
  - qemu: bulk stats: extend internal collection API (rhbz#1113116)
  - qemu: bulk stats: implement CPU stats group (rhbz#1113116)
  - qemu: bulk stats: implement balloon group (rhbz#1113116)
  - qemu: bulk stats: implement VCPU group (rhbz#1113116)
  - qemu: bulk stats: implement interface group (rhbz#1113116)
  - qemu: bulk stats: implement block group (rhbz#1113116)
  - virsh: add options to query bulk stats group (rhbz#1113116)
  - lib: De-duplicate stats group documentation for all stats functions (rhbz#1113116)
  - lib: Document that virConnectGetAllDomainStats may omit some stats fields (rhbz#1113116)
  - man: virsh: Add docs for supported stats groups (rhbz#1113116)
  - qemu: monitor: return block stats data as a hash to avoid disk mixup (rhbz#1113116)
  - qemu: monitor: Avoid shadowing variable "devname" on FreeBSD (rhbz#1113116)
  - qemu: monitor: Add helper function to fill physical/virtual image size (rhbz#1113116)
  - qemu: bulk stats: add block allocation information (rhbz#1113116)
  - qemu: json: Fix missing break in error reporting function (rhbz#1113116)
  - qemu: monitor: Avoid shadowing variable "devname" on FreeBSD. Again. (rhbz#1113116)
  - docs, conf, schema: add support for shmem device (rhbz#1126991)
  - qemu: add capability probing for ivshmem device (rhbz#1126991)
  - qemu: Build command line for ivshmem device (rhbz#1126991)
  - minor shmem clean-ups (rhbz#1126991)
  - virSecuritySELinuxSetTapFDLabel: Temporarily revert to old behavior (rhbz#1095636)
  - domain_conf: fix domain deadlock (CVE-2014-3657)
  - qemu: support relative backing for RHEL 7.0.z qemu (rhbz#1150322)
  - qemu: Fix hot unplug of SCSI_HOST device (rhbz#1141732)
  - qemu: Remove need for virConnectPtr in hotunplug detach host, net (rhbz#1141732)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-6
changelog:
  - qemu: support nospace reason in io error event (rhbz#1119784)
  - RHEL: Add support for QMP I/O error reason (rhbz#1119784)
  - nodeinfo: fix nodeGetFreePages when max node is zero (rhbz#1145048)
  - nodeGetFreePages: Push forgotten change (rhbz#1145048)
  - conf: tests: fix virDomainNetDefFormat for vhost-user in client mode (rhbz#1155458)
  - util: string: Add helper to check whether string is empty (rhbz#1142693)
  - qemu: restore: Fix restoring of VM when the restore hook returns empty XML (rhbz#1142693)
  - security_selinux: Don't relabel /dev/net/tun (rhbz#1095636)
  - qemu: Fix updating bandwidth limits in live XML (rhbz#1146511)
  - qemu: save domain status after set the blkio parameters (rhbz#1146511)
  - qemu: call qemuDomainObjBeginJob/qemuDomainObjEndJob in qemuDomainSetInterfaceParameters (rhbz#1146511)
  - qemu: save domain status after set domain's numa parameters (rhbz#1146511)
  - qemu: forbid snapshot-delete --children-only on external snapshot (rhbz#956506)
  - qemu: better error message when block job can't succeed (rhbz#1140981)
  - Reject live update of offloading options (rhbz#1155441)
  - virutil: Introduce virGetSCSIHostNumber (rhbz#1146837)
  - virutil: Introduce virGetSCSIHostNameByParentaddr (rhbz#1146837)
  - storage_conf: Resolve libvirtd crash matching scsi_host (rhbz#1146837)
  - Match scsi_host pools by parent address first (rhbz#1146837)
  - Relax duplicate SCSI host pool checking (rhbz#1146837)
  - qemu: Remove possible NULL deref in debug output (rhbz#1141621)
  - virsh: Adjust the text in man page regarding qemu-attach (rhbz#1141621)
  - hotplug: Check for alias in controller detach (rhbz#1141621)
  - hotplug: Check for alias in disk detach (rhbz#1141621)
  - hotplug: Check for alias in hostdev detach (rhbz#1141621)
  - hotplug: Check for alias in chrdev detach (rhbz#1141621)
  - hotplug: Check for alias in net detach (rhbz#1141621)
  - qemu-attach: Assign device aliases (rhbz#1141621)
  - hotplug: fix char device detach (rhbz#1141621)
  - storage: Fix crash when parsing backing store URI with schema (rhbz#1156288)
  - remote: fix jump depends on uninitialised value (rhbz#1158715)
  - qemu: Release nbd port from migrationPorts instead of remotePorts (rhbz#1159245)
  - conf: add trustGuestRxFilters attribute to network and domain interface (rhbz#848199)
  - network: set interface actual trustGuestRxFilters from network/portgroup (rhbz#848199)
  - util: define virNetDevRxFilter and basic utility functions (rhbz#848199)
  - qemu: qemuMonitorQueryRxFilter - retrieve guest netdev rx-filter (rhbz#848199)
  - qemu: add short document on qemu event handlers (rhbz#848199)
  - qemu: setup infrastructure to handle NIC_RX_FILTER_CHANGED event (rhbz#848199)
  - qemu: change macvtap device MAC address in response to NIC_RX_FILTER_CHANGED (rhbz#848199)
  - util: Functions to update host network device's multicast filter (rhbz#848199)
  - qemu: change macvtap multicast list in response to NIC_RX_FILTER_CHANGED (rhbz#848199)
  - virnetdev: Resolve Coverity DEADCODE (rhbz#848199)
  - virnetdev: Resolve Coverity FORWARD_NULL (rhbz#848199)
  - virnetdev: Resolve Coverity RESOURCE_LEAK (rhbz#848199)
  - lxc: improve error message for invalid blkiotune settings (rhbz#1131306)
  - qemu: improve error message for invalid blkiotune settings (rhbz#1131306)
  - Do not probe for power mgmt capabilities in lxc emulator (rhbz#1159227)
  - qemu: make advice from numad available when building commandline (rhbz#1138545)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-7
changelog:
  - qemu: avoid rare race when undefining domain (rhbz#1150505)
  - qemu: stop NBD server after successful migration (rhbz#1160212)
  - Require at least one console for LXC domain (rhbz#1155410)
  - remote: Fix memory leak in remoteConnectGetAllDomainStats (rhbz#1158715)
  - CVE-2014-7823: dumpxml: security hole with migratable flag (CVE-2014-7823)
  - Free job statistics from the migration cookie (rhbz#1161124)
  - Fix virDomainChrEquals for spicevmc (rhbz#1162097)
  - network: fix call virNetworkEventLifecycleNew when networkStartNetwork fail (rhbz#1162915)
  - Do not crash on gluster snapshots with no host name (rhbz#1162974)
  - nwfilter: fix deadlock caused updating network device and nwfilter (rhbz#1143780)
  - util: eliminate "use after free" in callers of virNetDevLinkDump (rhbz#1163463)
  - storage: Check for valid fc_host parent at startup (rhbz#1160565)
  - storage: Ensure fc_host parent matches wwnn/wwpn (rhbz#1160565)
  - storage: Don't use a stack copy of the adapter (rhbz#1160926)
  - storage: Introduce virStoragePoolSaveConfig (rhbz#1160926)
  - storage: Introduce 'managed' for the fchost parent (rhbz#1160926)
  - qemu: Always set migration capabilities (rhbz#1163953)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-8
changelog:
  - qemu: Fix crash in tunnelled migration (rhbz#1147331)
  - qemu: Really fix crash in tunnelled migration (rhbz#1147331)
  - qemu: Update fsfreeze status on domain state transitions (rhbz#1160084)
  - qemuPrepareNVRAM: Save domain conf only if domain's persistent (rhbz#1026772)
  - docs: Document NVRAM behavior on transient domains (rhbz#1026772)
  - Fix build in qemu_capabilities (rhbz#1165782)
  - qemu: Support OVMF on armv7l aarch64 guests (rhbz#1165782)
  - qemu: Drop OVMF whitelist (rhbz#1165782)
  - storage: Fix issue finding LU's when block doesn't exist (rhbz#1152382)
  - storage: Add thread to refresh for createVport (rhbz#1152382)
  - storage: qemu: Fix security labelling of new image chain elements (rhbz#1151718)
  - virsh: sync domdisplay help and manual (rhbz#997802)
  - docs: domain: Move docs for storage hosts under the <source> element (rhbz#1164528)
  - test: virstoragetest: Add testing of network disk details (rhbz#1164528)
  - util: storage: Copy hosts of a storage file only if they exist (rhbz#1164528)
  - qemu: Refactor qemuBuildNetworkDriveURI to take a virStorageSourcePtr (rhbz#1164528)
  - tests: Reflow the expected output from RBD disk test (rhbz#1164528)
  - util: split out qemuParseRBDString into a common helper (rhbz#1164528)
  - util: storagefile: Split out parsing of NBD string into a separate func (rhbz#1164528)
  - storage: Allow parsing of RBD backing strings when building backing chain (rhbz#1164528)
  - storage: rbd: qemu: Add support for specifying internal RBD snapshots (rhbz#1164528)
  - storage: rbd: Implement support for passing config file option (rhbz#1164528)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-9
changelog:
  - doc: fix mismatched ACL attribute name (rhbz#1161358)
  - qemu: monitor: Rename and improve qemuMonitorGetPtyPaths (rhbz#1146944)
  - conf: Add channel state for virtio channels to the XML (rhbz#1146944)
  - qemu: Add handling for VSERPORT_CHANGE event (rhbz#1146944)
  - qemu: chardev: Extract more information about character devices (rhbz#1146944)
  - qemu: process: Refresh virtio channel guest state when connecting to mon (rhbz#1146944)
  - event: Add guest agent lifecycle event (rhbz#1146944)
  - examples: Add support for the guest agent lifecycle event (rhbz#1146944)
  - qemu: Emit the guest agent lifecycle event (rhbz#1146944)
  - internal: add macro to round value to the next closest power of 2 (rhbz#1076098)
  - video: cleanup usage of vram attribute and update documentation (rhbz#1076098)
  - QXL: fix setting ram and vram values for QEMU QXL device (rhbz#1076098)
  - caps: introduce new QEMU capability for vgamem_mb device property (rhbz#1076098)
  - qemu-command: use vram attribute for all video devices (rhbz#1076098)
  - qemu-command: introduce new vgamem attribute for QXL video device (rhbz#1076098)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-10
changelog:
  - qemu: add the missing jobinfo type in qemuDomainGetJobInfo (rhbz#1167883)
  - network: Fix upgrade from libvirt older than 1.2.4 (rhbz#1167145)
  - qemu: fix domain startup failing with 'strict' mode in numatune (rhbz#1168866)
  - qemu: Don't track quiesced state of FSs (rhbz#1160084)
  - qemu: fix block{commit,copy} abort handling (rhbz#1135169)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-11
changelog:
  - virsh: vol-upload disallow negative offset (rhbz#1087104)
  - storage: fix crash caused by no check return before set close (rhbz#1087104)
  - qemu: Fix virsh freeze when blockcopy storage file is removed (rhbz#1139567)
  - security: Manage SELinux labels on shared/readonly hostdev's (rhbz#1082521)
  - nwfilter: fix crash when adding non-existing nwfilter (rhbz#1169409)
  - conf: Fix libvirtd crash matching hostdev XML (rhbz#1174053)
  - qemu: Resolve Coverity REVERSE_INULL (rhbz#1172570)
  - CVE-2014-8131: Fix possible deadlock and segfault in qemuConnectGetAllDomainStats() (CVE-2014-8131)
  - qemu: bulk stats: Fix logic in monitor handling (rhbz#1172570)
  - qemu: avoid rare race when undefining domain (rhbz#1150505)
  - Do not format CPU features without a model (rhbz#1151885)
  - Ignore CPU features without a model for host-passthrough (rhbz#1151885)
  - Silently ignore MAC in NetworkLoadConfig (rhbz#1156367)
  - Generate a MAC when loading a config instead of package update (rhbz#1156367)
  - qemu: move setting emulatorpin ahead of monitor showing up (rhbz#1170484)
  - util: Introduce flags field for macvtap creation (rhbz#1081461)
  - network: Bring netdevs online later (rhbz#1081461)
  - qemu: always call qemuInterfaceStartDevices() when starting CPUs (rhbz#1081461)
  - qemu: add a qemuInterfaceStopDevices(), called when guest CPUs stop (rhbz#1081461)
  - conf: replace call to virNetworkFree() with virObjectUnref() (rhbz#1099210)
  - util: new functions for setting bridge and bridge port attributes (rhbz#1099210)
  - util: functions to manage bridge fdb (forwarding database) (rhbz#1099210)
  - conf: new network bridge device attribute macTableManager (rhbz#1099210)
  - network: save bridge name in ActualNetDef when actualType==network too (rhbz#1099210)
  - network: store network macTableManager setting in NetDef actual object (rhbz#1099210)
  - network: setup bridge devices for macTableManager='libvirt' (rhbz#1099210)
  - qemu: setup tap devices for macTableManager='libvirt' (rhbz#1099210)
  - qemu: add/remove bridge fdb entries as guest CPUs are started/stopped (rhbz#1099210)
  - virsh: document block.n.allocation stat (rhbz#1041569)
  - getstats: avoid memory leak on OOM (rhbz#1041569)
  - getstats: improve documentation (rhbz#1041569)
  - getstats: start giving offline block stats (rhbz#1041569)
  - getstats: add block.n.path stat (rhbz#1041569)
  - qemuMonitorJSONBlockStatsUpdateCapacity: Don't skip disks (rhbz#1041569)
  - getstats: prepare monitor collection for recursion (rhbz#1041569)
  - getstats: perform recursion in monitor collection (rhbz#1041569)
  - getstats: prepare for dynamic block.count stat (rhbz#1041569)
  - getstats: add new flag for block backing chain (rhbz#1041569)
  - getstats: split block stats reporting for easier recursion (rhbz#1041569)
  - getstats: crawl backing chain for qemu (rhbz#1041569)
  - logical: Add "--type snapshot" to lvcreate command (rhbz#1166592)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-12
changelog:
  - Fix hotplugging of block device-backed usb disks (rhbz#1175668)
  - qemu: Create memory-backend-{ram, file} iff needed (rhbz#1175397)
  - conf: Don't format actual network definition in migratable XML (rhbz#1177194)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-13
changelog:
  - conf: Fix memory leak when parsing invalid network XML (rhbz#1180136)
  - qxl: change the default value for vgamem_mb to 16 MiB (rhbz#1181052)
  - qemuxml2argvtest: Fix test after change of qxl vgamem_mb default (rhbz#1181052)
  - conf: fix crash when hotplug a channel chr device with no target (rhbz#1181408)
  - qemu: forbid second blockcommit during active commit (rhbz#1135339)
  - qemu_monitor: introduce new function to get QOM path (rhbz#1180574)
  - qemu_process: detect updated video ram size values from QEMU (rhbz#1180574)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-14
changelog:
  - virNetworkDefUpdateIPDHCPHost: Don't crash when updating network (rhbz#1182486)
  - Format CPU features even for host-model (rhbz#1182448)
  - util: Add function virCgroupHasEmptyTasks (rhbz#1161540)
  - util: Add virNumaGetHostNodeset (rhbz#1161540)
  - qemu: Remove unnecessary qemuSetupCgroupPostInit function (rhbz#1161540)
  - qemu: Save numad advice into qemuDomainObjPrivate (rhbz#1161540)
  - qemu: Leave cpuset.mems in parent cgroup alone (rhbz#1161540)
  - qemu: Fix hotplugging cpus with strict memory pinning (rhbz#1161540)
  - util: Fix possible NULL dereference (rhbz#1161540)
  - qemu_driver: fix setting vcpus for offline domain (rhbz#1161540)
  - qemu: migration: Unlock vm on failed ACL check in protocol v2 APIs (CVE-2014-8136)
  - CVE-2015-0236: qemu: Check ACLs when dumping security info from save image (CVE-2015-0236)
  - CVE-2015-0236: qemu: Check ACLs when dumping security info from snapshots (CVE-2015-0236)
  - Check for domain liveness in qemuDomainObjExitMonitor (rhbz#1161024)
  - Mark the domain as active in qemuhotplugtest (rhbz#1161024)
  - Fix vmdef usage while in monitor in qemuDomainHotplugVcpus (rhbz#1161024)
  - Fix vmdef usage while in monitor in BlockStat* APIs (rhbz#1161024)
  - Fix vmdef usage while in monitor in qemu process (rhbz#1161024)
  - Fix vmdef usage after domain crash in monitor on device detach (rhbz#1161024)
  - Fix vmdef usage after domain crash in monitor on device attach (rhbz#1161024)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.8-16
changelog:
  - qemu: don't setup cpuset.mems if memory mode in numatune is not 'strict' (rhbz#1186094)
  - lxc: don't setup cpuset.mems if memory mode in numatune is not 'strict' (rhbz#1186094)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.13-1
changelog:
  - Rebased to libvirt-1.2.13 (rhbz#1194593)
  - The rebase also fixes the following bugs:
      rhbz#872028, rhbz#907779, rhbz#927252, rhbz#956891, rhbz#1073506
      rhbz#1079917, rhbz#1095637, rhbz#1123767, rhbz#1125764, rhbz#1126762
      rhbz#1130390, rhbz#1131919, rhbz#1132900, rhbz#1135442, rhbz#1138125
      rhbz#1138516, rhbz#1138539, rhbz#1140034, rhbz#1140960, rhbz#1141159
      rhbz#1143921, rhbz#1146334, rhbz#1147195, rhbz#1151942, rhbz#1152404
      rhbz#1152473, rhbz#1153891, rhbz#1155843, rhbz#1158034, rhbz#1158722
      rhbz#1159180, rhbz#1160559, rhbz#1160995, rhbz#1161831, rhbz#1164627
      rhbz#1165485, rhbz#1165993, rhbz#1168849, rhbz#1169183, rhbz#1170092
      rhbz#1170140, rhbz#1170492, rhbz#1171533, rhbz#1171582, rhbz#1172015
      rhbz#1172468, rhbz#1172526, rhbz#1173420, rhbz#1174096, rhbz#1174154
      rhbz#1174569, rhbz#1175123, rhbz#1175449, rhbz#1176503, rhbz#1176510
      rhbz#1177723, rhbz#1178652, rhbz#1178850, rhbz#1178853, rhbz#1178986
      rhbz#1179678, rhbz#1179684, rhbz#1179981, rhbz#1181182, rhbz#1182467
      rhbz#1183869, rhbz#1183890, rhbz#1185165, rhbz#1186175, rhbz#1186199
      rhbz#1186765, rhbz#1186886, rhbz#1188914, rhbz#1189007, rhbz#1190956
      rhbz#1191016, rhbz#1191227, rhbz#1191355, rhbz#1191567, rhbz#1195461
      rhbz#1196503, rhbz#1196528, rhbz#1204017


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.14-1
changelog:
  - Rebased to libvirt-1.2.14 (rhbz#1194593)
  - The rebase also fixes the following bugs:
      rhbz#790583, rhbz#853839, rhbz#872424, rhbz#921426, rhbz#952499
      rhbz#958510, rhbz#1070695, rhbz#1125755, rhbz#1127045, rhbz#1129198
      rhbz#1135491, rhbz#1140958, rhbz#1141119, rhbz#1142631, rhbz#1142636
      rhbz#1143832, rhbz#1155887, rhbz#1161461, rhbz#1163553, rhbz#1164053
      rhbz#1166024, rhbz#1171484, rhbz#1173468, rhbz#1174147, rhbz#1176050
      rhbz#1177219, rhbz#1177237, rhbz#1179533, rhbz#1181062, rhbz#1187012
      rhbz#1187533, rhbz#1190590, rhbz#1196185, rhbz#1196644, rhbz#1196934
      rhbz#1197600, rhbz#1199036, rhbz#1199182, rhbz#1206365, rhbz#1206406
      rhbz#1206987, rhbz#1207122, rhbz#1207937
  - RHEL: Hack around changed Broadwell/Haswell CPUs (rhbz#1199446)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.15-1
changelog:
  - Rebased to libvirt-1.2.15 (rhbz#1194593)
  - The rebase also fixes the following bugs:
      rhbz#858147, rhbz#890606, rhbz#1043436, rhbz#1073305, rhbz#1076708
      rhbz#1084876, rhbz#1147847, rhbz#1161617, rhbz#1165119, rhbz#1168530
      rhbz#1171933, rhbz#1177062, rhbz#1177733, rhbz#1181465, rhbz#1192318
      rhbz#1200634, rhbz#1202606, rhbz#1202704, rhbz#1203628, rhbz#1203931
      rhbz#1206114, rhbz#1206479, rhbz#1206521, rhbz#1206625, rhbz#1207257
      rhbz#1208009, rhbz#1208176, rhbz#1208434, rhbz#1208763, rhbz#1209312
      rhbz#1209394, rhbz#1209813, rhbz#1210159, rhbz#1210545, rhbz#1210650
      rhbz#1210669, rhbz#1211436, rhbz#1211548, rhbz#1211550, rhbz#1213434
      rhbz#1213698, rhbz#1215569, rhbz#1216046


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.15-2
changelog:
  - RHEL: Relax qemu-kvm dependency from libvirt-daemon-kvm (rhbz#1212642)
  - caps: Fix regression defaulting to host arch (rhbz#1219191)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.16-1
changelog:
  - Rebased to libvirt-1.2.16 (rhbz#1194593)
  - The rebase also fixes the following bugs:
      rhbz#847198, rhbz#890648, rhbz#893738, rhbz#976387, rhbz#981546
      rhbz#998813, rhbz#1066375, rhbz#1073233, rhbz#1073305, rhbz#1076354
      rhbz#1131486, rhbz#1143837, rhbz#1146539, rhbz#1159171, rhbz#1159219
      rhbz#1161541, rhbz#1164966, rhbz#1171984, rhbz#1174177, rhbz#1174226
      rhbz#1176020, rhbz#1176739, rhbz#1177599, rhbz#1181074, rhbz#1183893
      rhbz#1191227, rhbz#1194593, rhbz#1195882, rhbz#1197580, rhbz#1204006
      rhbz#1204033, rhbz#1206521, rhbz#1207043, rhbz#1211938, rhbz#1213345
      rhbz#1218145, rhbz#1218577, rhbz#1220195, rhbz#1220265, rhbz#1220474
      rhbz#1220702, rhbz#1220809, rhbz#1221047, rhbz#1221504, rhbz#1223631
      rhbz#1223688, rhbz#1224018, rhbz#1226849


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-1
changelog:
  - Rebased to libvirt-1.2.17 (rhbz#1194593)
  - The rebase also fixes the following bugs:
      rhbz#890648, rhbz#985653, rhbz#1021480, rhbz#1089914, rhbz#1131755
      rhbz#1171933, rhbz#1179680, rhbz#1181087, rhbz#1182388, rhbz#1186797
      rhbz#1186969, rhbz#1194593, rhbz#1196644, rhbz#1200206, rhbz#1201143
      rhbz#1201760, rhbz#1202208, rhbz#1207692, rhbz#1210352, rhbz#1220213
      rhbz#1223177, rhbz#1224053, rhbz#1224088, rhbz#1224233, rhbz#1224587
      rhbz#1225694, rhbz#1226234, rhbz#1226854, rhbz#1227180, rhbz#1227551
      rhbz#1227555, rhbz#1227558, rhbz#1227664, rhbz#1228007, rhbz#1229199
      rhbz#1229592, rhbz#1229666, rhbz#1230039, rhbz#1230137, rhbz#1230664
      rhbz#1232606, rhbz#1232880, rhbz#1234686, rhbz#1234729, rhbz#1235116
      rhbz#1236438, rhbz#1236496, rhbz#1236507, rhbz#1236585, rhbz#1236924
      rhbz#1238153, rhbz#1238338


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-2
changelog:
  - util: bitmap: Don't alloc overly large binary bitmaps (rhbz#1238589)
  - storage: Fix regression in storagePoolUpdateAllState (rhbz#1238610)
  - Separate isa-fdc options generation (rhbz#1227880)
  - Explicitly format the isa-fdc controller for newer q35 machines (rhbz#1227880)
  - Add rhel machine types to qemuDomainMachineNeedsFDC (rhbz#1227880)
  - conf: Don't allow duplicated target names regardless of bus (rhbz#1142631)
  - storage: Revert volume obj list updating after volume creation (4749d82a) (rhbz#1241454)
  - qemu_monitor: Wire up MIGRATION event (rhbz#1212077)
  - qemu: Enable migration events on QMP monitor (rhbz#1212077)
  - qemuDomainGetJobStatsInternal: Support migration events (rhbz#1212077)
  - qemu: Update migration state according to MIGRATION event (rhbz#1212077)
  - qemu: Wait for migration events on domain condition (rhbz#1212077)
  - qemu: Check duplicate WWNs also for hotplugged disks (rhbz#1208009)
  - qemu: move the guest status check before agent config and status check (rhbz#1240979)
  - qemu: report error for non-existing disk in blockjobinfo (rhbz#1241355)
  - virCondWaitUntil: add another return value (rhbz#1147471)
  - virDomainObjSignal: drop this function (rhbz#1147471)
  - monitor: detect that eject fails because the tray is locked (rhbz#1147471)
  - qemu_hotplug: try harder to eject media (rhbz#1147471)
  - qemu: Drop LFs at the end of error from QEMU log (rhbz#1090093)
  - Introduce virHashAtomic (rhbz#1090093)
  - Introduce virErrorCopyNew (rhbz#1090093)
  - RHEL: spec: Require perl-XML-XPath (rhbz#1090093)
  - qemu: Remember incoming migration errors (rhbz#1090093)
  - qemu: Don't report false error from MigrateFinish (rhbz#1090093)
  - qemu: Use error from Finish instead of "unexpectedly failed" (rhbz#1090093)
  - cpu: Add support for MPX and AVX512 Intel features (rhbz#1076170)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-3
changelog:
  - qemuProcessHandleMigrationStatus: Update migration status more frequently (rhbz#1212077)
  - qemuDomainSetNumaParamsLive: Check for NUMA mode more wisely (rhbz#1232663)
  - qemu: process: Improve update of maximum balloon state at startup (rhbz#1242940)
  - storage: Fix pool building when directory already exists (rhbz#1244080)
  - virsh: report error if vcpu number exceed the guest maxvcpu number (rhbz#1160559)
  - cmdVcpuPin: Remove dead code (rhbz#1160559)
  - rpc: Add virNetDaemonHasClients (rhbz#1240283)
  - rpc: Rework timerActive logic in daemon (rhbz#1240283)
  - cgroup: Drop resource partition from virSystemdMakeScopeName (rhbz#1238570)
  - virsh: blockjob: Extract block job info code into a separate function (rhbz#1227551)
  - virsh: cmdBlockJob: Switch to declarative flag interlocking (rhbz#1227551)
  - virsh: blockjob: Split out vshBlockJobSetSpeed from blockJobImpl (rhbz#1227551)
  - virsh: block job: separate abort from blockJobImpl (rhbz#1227551)
  - virsh: Split out block pull implementation from blockJobImpl (rhbz#1227551)
  - virsh: Kill blockJobImpl by moving the final impl into cmdBlockCommit (rhbz#1227551)
  - virsh: Refactor argument checking in cmdBlockCommit (rhbz#1227551)
  - virsh: Refactor argument handling in cmdBlockCopy (rhbz#1227551)
  - virsh: Refactor argument handling in cmdBlockPull (rhbz#1227551)
  - qemu: Update state of block job to READY only if it actually is ready (rhbz#1227551)
  - virsh: Refactor block job waiting in cmdBlockPull (rhbz#1227551)
  - virsh: Refactor block job waiting in cmdBlockCommit (rhbz#1227551)
  - virsh: Refactor block job waiting in cmdBlockCopy (rhbz#1197592)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-4
changelog:
  - qemu: Reject migration with memory-hotplug if destination doesn't support it (rhbz#1248350)
  - qemu: Properly check for incoming migration job (rhbz#1242904)
  - qemu: Do not reset labels when migration fails (rhbz#1242904)
  - qemu: Check for iotune_max support properly (rhbz#1224053)
  - docs: Add Fibre Channel NPIV supported option for volume lun config (rhbz#1238545)
  - conf: Allow error reporting in virDomainDiskSourceIsBlockType (rhbz#1238545)
  - qemu: Forbid image pre-creation for non-shared storage migration (rhbz#1249587)
  - qemu: remove deadcode in qemuDomain{HelperGetVcpus|GetIOThreadsLive} (rhbz#1213713)
  - nodeinfo: Introduce local linuxGetCPUPresentPath (rhbz#1213713)
  - nodeinfo: Add sysfs_prefix to nodeGetCPUCount (rhbz#1213713)
  - nodeinfo: Add sysfs_prefix to nodeGetPresentCPUBitmap (rhbz#1213713)
  - nodeinfo: Add sysfs_prefix to nodeGetCPUBitmap (rhbz#1213713)
  - nodeinfo: Add sysfs_prefix to nodeGetCPUMap (rhbz#1213713)
  - nodeinfo: Add sysfs_prefix to nodeGetInfo (rhbz#1213713)
  - nodeinfo: Add sysfs_prefix to nodeCapsInitNUMA (rhbz#1213713)
  - nodeinfo: Add sysfs_prefix to nodeGetMemoryStats (rhbz#1213713)
  - nodeinfo: fix to parse present cpus rather than possible cpus (rhbz#1213713)
  - tests: Add nodeinfo test for non-present CPUs (rhbz#1213713)
  - nodeinfo: Make sysfs_prefix usage more consistent (rhbz#1213713)
  - nodeinfo: Formatting changes (rhbz#1213713)
  - tests: Restore links in deconfigured-cpus nodeinfo test (rhbz#1213713)
  - nodeinfo: Add nodeGetPresentCPUBitmap() to libvirt_private.syms (rhbz#1213713)
  - nodeinfo: Fix nodeGetCPUBitmap()'s fallback code path (rhbz#1213713)
  - nodeinfo: Introduce linuxGetCPUGlobalPath() (rhbz#1213713)
  - nodeinfo: Introduce linuxGetCPUOnlinePath() (rhbz#1213713)
  - nodeinfo: Rename linuxParseCPUmax() to linuxParseCPUCount() (rhbz#1213713)
  - nodeinfo: Add old kernel compatibility to nodeGetPresentCPUBitmap() (rhbz#1213713)
  - nodeinfo: Remove out parameter from nodeGetCPUBitmap() (rhbz#1213713)
  - nodeinfo: Rename nodeGetCPUBitmap() to nodeGetOnlineCPUBitmap() (rhbz#1213713)
  - nodeinfo: Phase out cpu_set_t usage (rhbz#1213713)
  - nodeinfo: Use nodeGetOnlineCPUBitmap() when parsing node (rhbz#1213713)
  - nodeinfo: Use a bitmap to keep track of node CPUs (rhbz#1213713)
  - nodeinfo: Calculate present and online CPUs only once (rhbz#1213713)
  - nodeinfo: Check for errors when reading core_id (rhbz#1213713)
  - Renamed deconfigured-cpus to allow make dist (rhbz#1213713)
  - tests: Finish rename of the long nodeinfo test case (rhbz#1213713)
  - nodeinfo: Fix output on PPC64 KVM hosts (rhbz#1213713)
  - tests: Prepare for subcore tests (rhbz#1213713)
  - tests: Add subcores1 nodeinfo test (rhbz#1213713)
  - tests: Add subcores2 nodeinfo test (rhbz#1213713)
  - tests: Add subcores3 nodeinfo test (rhbz#1213713)
  - nodeinfo: Fix build failure when KVM headers are not available (rhbz#1213713)
  - qemu: fix some api cannot work when disable cpuset in conf (rhbz#1244664)
  - qemu: Auto assign pci addresses for shared memory devices (rhbz#1165029)
  - conf: Add getter for network routes (rhbz#1094205)
  - network: Add another collision check into networkCheckRouteCollision (rhbz#1094205)
  - docs: Document how libvirt handles companion controllers (rhbz#1069590)
  - qemu: Reject updating unsupported disk information (rhbz#1007228)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-5
changelog:
  - numa_conf: Introduce virDomainNumaGetMaxCPUID (rhbz#1176020)
  - virDomainDefParseXML: Check for malicious cpu ids in <numa/> (rhbz#1176020)
  - conf: more useful error message when pci function is out of range (rhbz#1004596)
  - qemu: Fix reporting of physical capacity for block devices (rhbz#1250982)
  - network: verify proper address family in updates to <host> and <range> (rhbz#1184736)
  - rpc: Remove keepalive_required option (rhbz#1247087)
  - virNetDevBandwidthParseRate: Reject negative values (rhbz#1022292)
  - domain: Fix crash if trying to live update disk <serial> (rhbz#1007228)
  - qemu: fail on attempts to use <filterref> for non-tap network connections (rhbz#1180011)
  - network: validate network NAT range (rhbz#985653)
  - conf: Don't try formating non-existing addresses (rhbz#985653)
  - cpu: Rename {powerpc, ppc} => ppc64 (filesystem) (rhbz#1250977)
  - cpu: Rename {powerpc, ppc} => ppc64 (exported symbols) (rhbz#1250977)
  - cpu: Rename {powerpc, ppc} => ppc64 (internal symbols) (rhbz#1250977)
  - cpu: Indentation changes in the ppc64 driver (rhbz#1250977)
  - cpu: Mark driver functions in ppc64 driver (rhbz#1250977)
  - cpu: Simplify NULL handling in ppc64 driver (rhbz#1250977)
  - cpu: Simplify ppc64ModelFromCPU() (rhbz#1250977)
  - cpu: Reorder functions in the ppc64 driver (rhbz#1250977)
  - cpu: Remove ISA information from CPU map XML (rhbz#1250977)
  - tests: Remove unused file (rhbz#1250977)
  - tests: Improve result handling in cpuTestGuestData() (rhbz#1250977)
  - cpu: Never skip CPU model name check in ppc64 driver (rhbz#1250977)
  - cpu: CPU model names have to match on ppc64 (rhbz#1250977)
  - cpu: Use ppc64Compute() to implement ppc64DriverCompare() (rhbz#1250977)
  - tests: Temporarily disable ppc64 cpu tests (rhbz#1250977)
  - cpu: Align ppc64 CPU data with x86 (rhbz#1250977)
  - cpu: Support multiple PVRs in the ppc64 driver (rhbz#1250977)
  - cpu: Simplify ppc64 part of CPU map XML (rhbz#1250977)
  - cpu: Parse and use PVR masks in the ppc64 driver (rhbz#1250977)
  - cpu: Add POWER8NVL information to CPU map XML (rhbz#1250977)
  - cpu: Implement backwards compatibility in the ppc64 driver (rhbz#1250977)
  - cpu: Forbid model fallback in the ppc64 driver (rhbz#1250977)
  - tests: Re-enable ppc64 cpu tests (rhbz#1250977)
  - tests: Add a bunch of cpu test case for ppc64 (rhbz#1250977)
  - cpu: Fix segfault in the ppc64 driver (rhbz#1250977)
  - qemu: Fix segfault when parsing private domain data (rhbz#1162947)
  - conf: Pass private data to Parse function of XML options (rhbz#1162947)
  - qemu: Keep numad hint after daemon restart (rhbz#1162947)
  - qemu: Use numad information when getting pin information (rhbz#1162947)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-6
changelog:
  - api: Remove check on iothread_id arg in virDomainPinIOThread (rhbz#1251886)
  - api: Adjust comment for virDomainAddIOThread (rhbz#1251886)
  - qemu: Add check for invalid iothread_id in qemuDomainChgIOThread (rhbz#1251886)
  - conf: Check for attach disk usage of iothread=0 (rhbz#1253108)
  - virNetDevBandwidthUpdateRate: turn class_id into integer (rhbz#1252473)
  - bridge_driver: Introduce networkBandwidthChangeAllowed (rhbz#1252473)
  - bridge_driver: Introduce networkBandwidthUpdate (rhbz#1252473)
  - qemuDomainSetInterfaceParameters: Use new functions to update bandwidth (rhbz#1252473)
  - cpu: Don't update host-model guest CPUs on ppc64 (rhbz#1251927)
  - cpu: Better support for ppc64 compatibility modes (rhbz#1251927)
  - cpu: Move check for NULL CPU model inside the driver (rhbz#1251927)
  - tests: Add some compatibility-related cases to the CPU tests (rhbz#1251927)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-7
changelog:
  - Start daemon only after filesystems are mounted (rhbz#1255228)
  - virfile: Add error for root squash change mode failure (rhbz#1253609)
  - virfile: Introduce virFileUnlink (rhbz#1253609)
  - storage: Correct the 'mode' check (rhbz#1253609)
  - storage: Handle failure from refreshVol (rhbz#1253609)
  - util: Add virStringGetFirstWithPrefix (rhbz#1165580)
  - util: Add virCgroupGetBlockDevString (rhbz#1165580)
  - util: Add getters for cgroup block device I/O throttling (rhbz#1165580)
  - lxc: Sync BlkioDevice values when setting them in cgroups (rhbz#1165580)
  - qemu: Sync BlkioDevice values when setting them in cgroups (rhbz#1165580)
  - Allow vfio hotplug of a device to the domain which owns the iommu (rhbz#1256486)
  - hostdev: skip ACS check when using VFIO for device assignment (rhbz#1256486)
  - docs: Clarify unprivileged sgio feature (rhbz#1072736)
  - qemu: Introduce qemuIsSharedHostdev (rhbz#1072736)
  - qemu: Introduce qemuGetHostdevPath (rhbz#1072736)
  - qemu: Refactor qemuCheckSharedDisk to create qemuCheckUnprivSGIO (rhbz#1072736)
  - qemu: Inline qemuGetHostdevPath (rhbz#1072736)
  - qemu: Refactor qemuSetUnprivSGIO return values (rhbz#1072736)
  - qemu: Fix integer/boolean logic in qemuSetUnprivSGIO (rhbz#1072736)
  - RHEL: qemu: Add ability to set sgio values for hostdev (rhbz#1072736)
  - RHEL: qemu: Add check for unpriv sgio for SCSI generic host device (rhbz#1072736)
  - security_selinux: Use proper structure to access socket data (rhbz#1146886)
  - security_dac: Label non-listening sockets (rhbz#1146886)
  - security: Add virSecurityDomainSetDirLabel (rhbz#1146886)
  - security_stack: Add SetDirLabel support (rhbz#1146886)
  - security_selinux: Add SetDirLabel support (rhbz#1146886)
  - security_dac: Add SetDirLabel support (rhbz#1146886)
  - qemu: Fix access to auto-generated socket paths (rhbz#1146886)
  - tests: Use qemuProcessPrepareMonitorChr in qemuxmlnstest (rhbz#1146886)
  - qemu: Label correct per-VM path when starting (rhbz#1146886)
  - selinux: fix compile errors (rhbz#1146886)
  - conf: Add ioeventfd option for controllers (rhbz#1150484)
  - qemu: Enable ioeventfd usage for virtio-scsi controllers (rhbz#1150484)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-8
changelog:
  - util: make virNetDev(Replace|Restore)MacAddress public functions (rhbz#1257004)
  - util: don't use netlink to save/set mac for macvtap+passthrough+802.1Qbh (rhbz#1257004)
  - cpu: Introduce IvyBridge CPU model (rhbz#1254420)
  - examples: Add example polkit ACL rules (rhbz#1115289)
  - qemu: don't use initialized ret in qemuRemoveSharedDevice (rhbz#1072736)
  - qemu: Introduce qemuDomainMachineIsS390CCW (rhbz#1258361)
  - qemu: Need to check for machine.os when using ADDRESS_TYPE_CCW (rhbz#1258361)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-9
changelog:
  - conf: fix crash when parsing a unordered NUMA <cell/> (rhbz#1260846)
  - vmx: Some whitespace cleanup (rhbz#1172544)
  - vmx: The virVMXParseDisk deviceType can be NULL, add some missing checks (rhbz#1172544)
  - vmx: Add handling for CDROM devices with SCSI passthru (rhbz#1172544)
  - qemu: hotplug: Properly clean up drive backend if frontend hotplug fails (rhbz#1262399)
  - qemu: Introduce QEMU_CAPS_DEVICE_RTL8139 (rhbz#1254044)
  - qemu: Introduce QEMU_CAPS_DEVICE_E1000 (rhbz#1254044)
  - qemu: Introduce QEMU_CAPS_DEVICE_VIRTIO_NET (rhbz#1254044)
  - qemu: Try several network devices when looking for a default (rhbz#1254044)
  - qemu: Report error if per-VM directory cannot be created (rhbz#1146886)
  - qemu: Do not allow others into per-VM subdirectories (rhbz#1146886)
  - qemu: Allow others to browse /var/lib/libvirt/qemu (rhbz#1146886)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-10
changelog:
  - virSecuritySELinuxSetSecurityAllLabel: drop useless virFileIsSharedFSType (rhbz#1124841)
  - security_selinux: Replace SELinuxSCSICallbackData with proper struct (rhbz#1124841)
  - virSecurityManager: Track if running as privileged (rhbz#1124841)
  - security_selinux: Take @privileged into account (rhbz#1124841)
  - qemu: Fix using guest architecture as lookup key (rhbz#1260753)
  - virfile: Check for existence of dir in virFileDeleteTree (rhbz#1146886)
  - Revert "qemu: Fix integer/boolean logic in qemuSetUnprivSGIO" (rhbz#1072736)
  - qemu: migration: Relax enforcement of memory hotplug support (rhbz#1252685)
  - conf: Add helper to determine whether memory hotplug is enabled for a vm (rhbz#1252685)
  - qemu: Make memory alignment helper more universal (rhbz#1252685)
  - conf: Drop VIR_DOMAIN_DEF_PARSE_CLOCK_ADJUST flag (rhbz#1252685)
  - conf: Document all VIR_DOMAIN_DEF_PARSE_* flags (rhbz#1252685)
  - conf: Add XML parser flag that will allow us to do incompatible updates (rhbz#1252685)
  - conf: Split memory related post parse stuff into separate function (rhbz#1252685)
  - conf: Rename max_balloon to total_memory (rhbz#1252685)
  - conf: Pre-calculate initial memory size instead of always calculating it (rhbz#1252685)
  - conf: Don't always recalculate initial memory size from NUMA size totals (rhbz#1252685)
  - qemu: command: Align memory sizes only on fresh starts (rhbz#1252685)
  - qemu: ppc64: Align memory sizes to 256MiB blocks (rhbz#1249006)
  - test: Add test to validate that memory sizes don't get updated on migration (rhbz#1252685)
  - qemu: Align memory module sizes to 2MiB (rhbz#1252685)
  - qemu: Refresh memory size only on fresh starts (rhbz#1242940)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-13
changelog:
  - qemu: Add conditions for qemu-kvm use on ppc64 (rhbz#1267882)
  - qemu: Move simplification variable to begining of the function (rhbz#1266856)
  - qemu: Extract -mem-path building into its own function (rhbz#1266856)
  - qemu: Add -mem-path even with numa (rhbz#1266856)
  - qemu: Use memory-backing-file only when needed (rhbz#1266856)
  - qemu: Always update migration times on destination (rhbz#1265902)
  - qemu: Copy completed migration stats only on success (rhbz#1265902)
  - qemu: Introduce flags in qemuMigrationCompleted (rhbz#1265902)
  - qemu: Make updating stats in qemuMigrationCheckJobStatus optional (rhbz#1265902)
  - qemu: Wait until destination QEMU consumes all migration data (rhbz#1265902)


author: Jiri Denemark <jdenemar@redhat.com> - 1.2.17-13.el7_2.1
changelog:
  - qemu: migration: Properly parse memory hotplug migration flag (rhbz#1280419)
  - qemu: Emit correct audit message for memory hot unplug (rhbz#1280420)
  - qemu: Emit correct audit message for memory hot plug (rhbz#1280420)
  - qemu: Extract logic to determine the mlock limit size for VFIO (rhbz#1280420)
  - qemu: hotplug: Fix mlock limit handling on memory hotplug (rhbz#1280420)
  - qemu: domain: Restructurate control flow in qemuDomainGetMlockLimitBytes (rhbz#1280420)
  - qemu: Explain mlock limit size more in detail (rhbz#1280420)
  - qemu: hotplug: Reject VFIO hotplug if setting RLIMIT_MEMLOCK fails (rhbz#1283924)
  - process: Log when limiting the amount of locked memory (rhbz#1283924)
  - qemu: Use qemuDomainRequiresMlock() in qemuBuildCommandLine() (rhbz#1283924)
  - qemu: Use qemuDomainRequiresMlock() when attaching PCI hostdev (rhbz#1283924)
  - qemu: Add ppc64-specific math to qemuDomainGetMlockLimitBytes() (rhbz#1283924)
  - qemu: Always set locked memory limit for ppc64 domains (rhbz#1283924)


author: Daniel Veillard <veillard@redhat.com> 2.6.27-1
changelog:
  - upstream release 2.6.27 see http://xmlsoft.org/news.html
  - very large amount of bug fixes reported upstream


author: Daniel Veillard <veillard@redhat.com> 2.7.0-1.fc10
changelog:
  - upstream release of 2.7.0
  - switch to XML 1.0 5th edition
  - switch to RFC 3986 for URI parsing
  - better entity handling
  - option to remove hardcoded limitations in the parser
  - more testing
  - a new API to allocate entity nodes
  - and lot of fixes and clanups


author: Daniel Veillard <veillard@redhat.com> 2.7.2-1.fc10
changelog:
  - new release 2.7.2
  - Fixes the known problems in 2.7.1
  - increase the set of options when saving documents


author: Daniel Veillard <veillard@redhat.com> - 2.7.3-1
changelog:
  - new release 2.7.3
  - limit default max size of text nodes
  - special parser mode for PHP
  - bug fixes and more compiler checks


author: Daniel Veillard <veillard@redhat.com> - 2.7.4-1
changelog:
  - upstream release 2.7.4
  - symbol versioning of libxml2 shared libs
  - very large number of bug fixes


author: Daniel Veillard <veillard@redhat.com> - 2.7.7-1
changelog:
  - Upstream release of 2.7.7
  - fix serious trouble with zlib >= 1.2.4
  - xmllint new option --xpath
  - various HTML parser improvements
  - includes a number of nug fixes


author: Daniel Veillard <veillard@redhat.com> - 2.7.8-1
changelog:
  - Upstream release of 2.7.8
  - various bug fixes, including potential crashes
  - new non-destructive formatting option
  - date parsing updated to RFC 5646


author: Daniel Veillard <veillard@redhat.com> - 2.9.0-0rc1
changelog:
  - upstream release candidate 1 of 2.9.0
  - introduce a small API change, but ABI compatible, see
    https://mail.gnome.org/archives/xml/2012-August/msg00005.html
    patches for php, gcc/libjava and evolution-data-connector are upstream
    Grab me in cases of problems veillard@redhat.com
  - many bug fixes including security aspects and small improvements


author: Daniel Veillard <veillard@redhat.com> - 2.9.0-1
changelog:
  - upstream release of 2.9.0
  - A few new API entry points
  - More resilient push parser mode
  - A lot of portability improvement
  - Faster XPath evaluation
  - a lot of bug fixes and smaller improvement


author: Daniel Veillard <veillard@redhat.com> - 2.9.0-2
changelog:
  - remaining cleanups from merge bug rhbz#226079
  - do not put the docs in the main package, only in -devel rhbz#864731


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-1
changelog:
  - upstream release of 2.9.1
  - a couple more API entry point
  - compatibility with python3
  - a lot of bug fixes


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-6
changelog:
  - Fix missing entities after CVE-2014-3660 fix
  - CVE-2014-0191 Do not fetch external parameter entities (rhbz#1195650)
  - Fix regressions introduced by CVE-2014-0191 patch


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-6.2
changelog:
  - Fix a series of CVEs (rhbz#1286496)
  - CVE-2015-7941 Stop parsing on entities boundaries errors
  - CVE-2015-7941 Cleanup conditional section error handling
  - CVE-2015-8317 Fail parsing early on if encoding conversion failed
  - CVE-2015-7942 Another variation of overflow in Conditional sections
  - CVE-2015-7942 Fix an error in previous Conditional section patch
  - Fix parsing short unclosed comment uninitialized access
  - CVE-2015-7498 Avoid processing entities after encoding conversion failures
  - CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey
  - CVE-2015-5312 Another entity expansion issue
  - CVE-2015-7499 Add xmlHaltParser() to stop the parser
  - CVE-2015-7499 Detect incoherency on GROW
  - CVE-2015-7500 Fix memory access error due to incorrect entities boundaries
  - CVE-2015-8242 Buffer overead with HTML parser in push mode
  - CVE-2015-1819 Enforce the reader to run in constant memory


author: Preston Brown <pbrown@redhat.com> 3.5.6-1
changelog:
  - enable LFS support (debian bug #100810)
  - quote filenames for running compress commands or pre/postrotate cmds (#21348)
  - deprecate "errors" directive (see bug #16544 for explanation)
  - update man page
  - configurable compression command by Colm Buckley <colm@tuatha.org>


author: Preston Brown <pbrown@redhat.com> 3.6-1
changelog:
  - patch from Alexander Kourakos <awk@awks.org> to stop the shared
    postrotate/prerotate scripts from running if none of the log(s) need
    rotating.  All log files are now checked for rotation in one batch,
    rather than sequentially.
  - more fixes from Paul Martin <pm@debian.org>


author: Elliot Lee <sopwith@redhat.com> 3.6.2-1
changelog:
  - Fix bug #55809 (include logrotate.status in "files")
  - Fix bug #58328 (incorrect error detection when reading state file)
  - Allow 'G' size specifier from bug #57242


author: Erik Troan <ewt@redhat.com>
changelog:
  - always use compressext for the extension for compressed
    files; before compresscmd and compressext had to agree
  - moved all compression to one code block
  - compression, scripts don't use system() anymore
  - compress and maillast didn't work together properly
  - delaycompress and mailfirst didn't work properly
  - don't use system() for mailing (or uncompressing) logs anymore
  - use "-s" for speciying the subjected of mailed logs


author: Miloslav Trmac <mitr@redhat.com> - 3.7.1-2
changelog:
  - Fix sending mails (#131583)
  - Preserve file attributes when compressing files (#121523, original patch by
    Daniel Himler)


author: Peter Vrabec <pvrabec@redhat.com> 3.7.4-11
changelog:
  - logrotate won't stop if there are some errors in configuration
    or glob failures (#166510, #182062)


author: Peter Vrabec <pvrabec@redhat.com> 3.7.4-12
changelog:
  - fix problem with compress_options_list (#227706)
  - fix spec file to meet Fedora standards (#226104)


author: Peter Vrabec <pvrabec@redhat.com> 3.7.5-2
changelog:
  - fix error hadnling after prerotate, postrotate, firstaction 
    script failure. (http://qa.mandriva.com/show_bug.cgi?id=29979)


author: Tomas Smetana <tsmetana@redhat.com> 3.7.5-4
changelog:
  - use dateext in the default config file (#240292)
  - add options to use shred for deleting files -- adapt patch sent by
    Peter Eckersley <pde@eff.org> (#239934)
  - ignore .cfsaved files by default (#223476)


author: Tomas Smetana <tsmetana@redhat.com> 3.7.6-1
changelog:
  - new upstream version
  - fix #248565 logrotate never rotates /var/log/btmp
  - fix compile warnings
  - tabooext accepts wildcards (related #247816)
  - fix minor errors and update man page (related #250059)
  - fix handling of size directive (related #247410)


author: Tomas Smetana <tsmetana@redhat.com> 3.7.6-2
changelog:
  - fix #427274 - logrotate fails to preserve SELinux file contexts
  - fix #427661 - SELinux stops vsftpd from working correctly


author: Jan Kaluza <jkaluza@redhat.com> 3.7.8-12
changelog:
  - fix #602643 - update manpage to reflect scripts changes
  - fix #606675 - pass currently rotated file as argument to
    postrotate/prerotate script in nosharedscripts mode


author: Jan Kaluza <jkaluza@redhat.com> 3.7.9-5
changelog:
  - fix #661181 - fixed SIGBUS when config file is empty or 4096 bytes
  - fix #666677 - preserve ACLs when rotating files


author: Jan Kaluza <jkaluza@redhat.com> - 3.8.6-5
changelog:
  - mention copy/copytruncate/renamecopy influence to olddir option (#1175292)
  - delete last log when dateformat cannot be sorted alphabetically (#1174208)
  - mark cron.daily/logrotate as config file (#1174207)
  - create olddir diectory if it does not exist (#1187161)


author: Jan Pazdziora <jpazdziora@redhat.com> - 0.6-1
changelog:
  - Make pam_authenticate_with_login_password available for other modules.
  - Reformat documentation to make the Basic Auth usage less prominent.


author: Christopher Aillon <caillon@redhat.com> 3.11-0.cvs
changelog:
  - Initial import into Fedora Core, based on a CVS snapshot of
    the NSS_3_11_RTM tag
  - Fix up the pkcs11-devel subpackage to contain the proper headers
  - Build with RPM_OPT_FLAGS
  - No need to have rpath of /usr/lib in the pc file


author: Kai Engert <kengert@redhat.com> - 3.11.3-2
changelog:
  - Revert the attempt to require latest NSPR, as it is not yet available
    in the build infrastructure.


author: Kai Engert <kengert@redhat.com> - 3.11.5-1
changelog:
  - Update to 3.11.5
  - This update fixes two security vulnerabilities with SSL 2
  - Do not use -rpath link option
  - Added several unsupported tools to tools package


author: Kai Engert <kengert@redhat.com> - 3.11.5-2
changelog:
  - Fix rhbz#230545, failure to enable FIPS mode
  - Fix rhbz#220542, make NSS more tolerant of resets when in the 
    middle of prompting for a user password.


author: Kai Engert <kengert@redhat.com> - 3.11.7-2
changelog:
  - Update to 3.11.7, but freebl/softokn remain at 3.11.5.
  - Use a workaround to avoid mozilla bug 51429.


author: Kai Engert <kengert@redhat.com> - 3.11.7-10
changelog:
  - Add /etc/prelink.conf.d/nss-prelink.conf in order to blacklist
    our signed libraries and protect them from modification.


author: Kai Engert <kengert@redhat.com> - 3.11.99.3-2
changelog:
  - Build against gcc 4.3.0, use workaround for bug 432146
  - Run the test suite after the build and abort on failures.


author: Kai Engert <kengert@redhat.com> - 3.12.0.3-3
changelog:
  - nss package should own /etc/prelink.conf.d folder, rhbz#452062
  - use upstream patch to fix test suite abort


author: Kai Engert <kaie@redhat.com> - 3.12.3-3
changelog:
  - ship .chk files instead of running shlibsign at install time
  - include .chk file in softokn-freebl subpackage
  - add patch for upstream nss bug 488350


author: Kai Engert <kaie@redhat.com> - 3.12.3-7
changelog:
  - re-enable test suite
  - add patch for upstream bug 488646 and add newer paypal
    certs in order to make the test suite pass


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-5
changelog:
  - updated pem module incorporates various patches
  - fix off-by-one error when computing size to reduce memory leak. (483855)
  - fix data type to work on x86_64 systems. (429175)
  - fix various memory leaks and free internal objects on module unload. (501080)
  - fix to not clone internal objects in collect_objects().  (501118)
  - fix to not bypass initialization if module arguments are omitted. (501058)
  - fix numerous gcc warnings. (500815)
  - fix to support arbitrarily long password while loading a private key. (500180) 
  - fix memory leak in make_key and memory leaks and return values in pem_mdSession_Login (501191)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-10
changelog:
  - must install libnssutil3.since nss-util is untagged at the moment
  - preserve time stamps when installing various files


author: Elio Maldonado+emaldona@redhat.com - 3.12.3.99.3-11
changelog:
  - split off nss-softokn and nss-util as subpackages with their own rpms
  - first phase of splitting nss-softokn and nss-util as their own packages


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-19
changelog:
  - remove patches that are now in nss-softokn and
  - remove spurious exec-permissions for nss.pc per rpmlint
  - single requires line in nss.pc.in


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-22
changelog:
  - Fix nss-config not to include nssutil
  - Add BuildRequires on nss-softokn and nss-util since build also runs the test suite


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-25
changelog:
  - Remove nss-prelink.conf as signed all shared libraries moved to nss-softokn
  - Add a temprary hack to nss.pc.in to unblock builds


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-29
changelog:
  - Restoring patches 2 and 7 as we still compile all sources
  - Applying the nss-nolocalsql.patch solves nss-tools sqlite dependency problems


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-30
changelog:
  - Fix FORTIFY_SOURCE buffer overflows in test suite on ppc and ppc64 - bug 519766
  - Fixed requires and buildrequires as per recommendations in spec file review


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-2
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - No rpath-link in nss-softokn-config


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - PEM module implements memory management for internal objects - 509705
  - PEM module doesn't crash when processing malformed key files - 512019


author: Elio Maldonado<emaldona@redhat.com - 3.12.4-9
changelog:
  - Install blank databases and configuration file for system shared database
  - nsssysinit queries system for fips mode before relying on environment variable


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-13
changelog:
  - User no longer prompted for a password when listing keys an empty system db (#527048)
  - Fix setup-nsssysinit to handle more general formats (#527051)


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-13.1
changelog:
  - Require nss-softoken of same architecture as nss (#527867)
  - Merge setup-nsssysinit.sh improvements from F-12 (#527051)


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1
changelog:
  - Update to 3.12.5
  - Patch to allow ssl/tls clients to interoperate with servers that require renogiation


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1.5
changelog:
  - Fix nsssysinit to set the default flags on the crypto module (#545779)
  - Remove redundant header from the pem module


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1.6
changelog:
  - Fix nsssysinit to enable apps to use system cert store, patch contributed by David Woodhouse (#546221)
  - Fix spec so sysinit requires coreutils for post install scriplet (#547067)
  - Fix segmentation fault when listing keys or certs in the database, patch contributed by Kamil Dudka (#540387)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-1.1
changelog:
  - Using SSL_RENEGOTIATE_TRANSITIONAL as default while on transition period
  - Disabling ssl tests suites until bug 539183 is resolved


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-3
changelog:
  - Add sed to sysinit requires as setup-nsssysinit.sh requires it (#576071)
  - Update PayPalEE test cert with unexpired one (#580207)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-5
changelog:
  - Update pem source tar to pick up the following bug fixes:
  - PEM - Allow collect objects to search through all objects
  - PEM - Make CopyObject return a new shallow copy
  - PEM - Fix memory leak in pem_mdCryptoOperationRSAPriv


author: Elio Maldonado <emaldona@redhat.com> - 3.12.7-2
changelog:
  - Define NSS_USE_SYSTEM_SQLITE and remove unneeded patch
  - Add comments regarding an unversioned provides which triggers rpmlint warning
  - Build requires nss-softokn-devel >= 3.12.7


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-1
changelog:
  - Update to 3.12.8
  - Prevent disabling of nss-sysinit on package upgrade (#636787)
  - Create pkcs11.txt with correct permissions regardless of umask (#636792) 
  - Setup-nsssysinit.sh reports whether nss-sysinit is turned on or off (#636801)
  - Added provides pkcs11-devel-static to comply with packaging guidelines (#609612)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-3
changelog:
  - Replace posttrans sysinit scriptlet with a triggerpostun one (#636787)
  - Fix and cleanup the setup-nsssysinit.sh script (#636792, #636801)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8.99.2-1
changelog:
  - Update to NSS_3_12_9_BETA2
  - Fix libpnsspem crash when cacert dir contains other directories (#642433)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-5
changelog:
  - Fix the earlier infinite recursion patch (#499444)
  - Remove a header that now nss-softokn-freebl-devel ships


author: Christopher Aillon <caillon@redhat.com> - 3.12.9-6
changelog:
  - Revert patches for 499444 as they use a C++ reserved word and
    cause compilation of Firefox to fail


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-10
changelog:
  - Fix cms headers to not use c++ reserved words (#676036)
  - Reenabling Bug 499444 patches
  - Fix to swap internal key slot on fips mode switches


author: Elio Maldonado <emaldona@redhat.com> - 3.12.10-4
changelog:
  - Enable pluggable ecc support (#712556)
  - Disable the nssdb write-access-on-read-only-dir tests when user is root (#646045)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.11-3
changelog:
  - Fix attempt to free initilized pointer (#717338)
  - Fix leak on pem_CreateObject when given non-existing file name (#734760)
  - Fix pem_Initialize to return CKR_CANT_LOCK on multi-treaded calls (#736410)


author: Elio Maldonado Batiz <emaldona@redhat.com> - 3.13.1-4
changelog:
  - Rebuild with nss-softokn from 3.12 in the buildroot
  - Allows the pem module to statically link against 3.12.x freebl
  - Required for using nss-3.13.x with nss-softokn-3.12.y for a merge inrto rhel git repo
  - Build will be temprarily placed on buildroot override but not pushed in bodhi


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-5
changelog:
  - Statically link the pem module against system freebl found in buildroot
  - Disabling sha224-related powerup selftest until we update softokn
  - Disable sha224 and pss tests which nss-softokn 3.12.x doesn't support


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-6
changelog:
  - Removed unwanted /usr/include/nss3 in front of the normal cflags include path
  - Removed unnecessary patch dealing with CERTDB_TERMINAL_RECORD, it's visible


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-7
changelog:
  - Resolves: Bug 750376 - nss 3.13 breaks sssd TLS
  - Fix how pem is built so that nss-3.13.x works with nss-softokn-3.12.y
  - Only patch blapitest for the lack of sha224 on system freebl
  - Completed the patch to make pem link against system freebl


author: elio maldonado <emaldona@redhat.com> - 3.13.1-9
changelog:
  - Revert to using current nss_softokn_version
  - Patch to deal with lack of sha224 is no longer needed


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-10
changelog:
  - Resolves: Bug 770682 - nss update breaks pidgin-sipe connectivity
  - NSS_SSL_CBC_RANDOM_IV set to 0 by default and changed to 1 on user request


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Pick up fixes from RHEL
  - Resolves: rhbz#800674 - Unable to contact LDAP Server during winsync
  - Resolves: rhbz#800682 - Qpid AMQP daemon fails to load after nss update
  - Resolves: rhbz#800676 - NSS workaround for freebl bug that causes openswan to drop connections


author: Elio Maldonado <emaldona@redhat.com> - 3.13.4-1
changelog:
  - Update to NSS_3_13_4_RTM
  - Update the nss-pem source archive to the latest version
  - Remove no longer needed patches
  - Resolves: Bug 806043 - use pem files interchangeably in a single process
  - Resolves: Bug 806051 - PEM various flaws detected by Coverity
  - Resolves: Bug 806058 - PEM pem_CreateObject leaks memory given a non-existing file name


author: Elio Maldonado <emaldona@redhat.com> - 3.13.4-2
changelog:
  - Resolves: Bug 805723 - Library needs partial RELRO support added
  - Patch coreconf/Linux.mk as done on RHEL 6.2


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-4
changelog:
  - Resolves: Bug 830410 - Missing Requires %{?_isa}
  - Use Requires: %{name}%{?_isa} = %{version}-%{release} on tools
  - Drop zlib requires which rpmlint reports as error E: explicit-lib-dependency zlib
  - Enable sha224 portion of powerup selftest when running test suites
  - Require nspr 4.9.1


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-8
changelog:
  - Rebase pem sources to fedora-hosted upstream to pick up two fixes from rhel-6.3
  - Resolves: rhbz#847460 - Fix invalid read and free on invalid cert load
  - Resolves: rhbz#847462 - PEM module may attempt to free uninitialized pointer 
  - Remove unneeded fix gcc 4.7 c++ issue in secmodt.h that actually undoes the upstream fix


author: Elio Maldonado <emaldona@redhat.com> - 3.14-0.1.rc.1
changelog:
  - Update to NSS_3_14_RC1
  - update nss-589636.patch to apply to httpdserv
  - turn off ocsp tests for now
  - remove no longer needed patches
  - remove headers shipped by nss-util


author: Elio Maldonado <emaldona@redhat.com> - 3.14-2
changelog:
  - Add secmodt.h to the headers installed by nss-devel
  - nss-devel must install secmodt.h which moved from softoken to pk11wrap with nss-3.14


author: Elio Maldonado <emaldona@redhat.com> - 3.14-5
changelog:
  - Fix the spec file so sechash.h gets installed
  - Resolves: rhbz#871882 - missing header: sechash.h in nss 3.14


author: Elio Maldonado <emaldona@redhat.com> - 3.14-6
changelog:
  - Fix a previous unwanted merge from f18
  - Update the SS_SSL_CBC_RANDOM_IV patch to match new sources while
  - Keeping the patch disabled while we are still in rawhide and
  - State in comment that patch is needed for both stable and beta branches
  - Update .gitignore to download only the new sources


author: Elio Maldonado <emaldona@redhat.com> - 3.14-7
changelog:
  - Add a dummy source file for testing /preventing fedpkg breakage
  - Helps test the fedpkg new-sources and upload commands for breakage by nss updates
  - Related to Bug 872124 - nss 3.14 breaks fedpkg new-sources


author: Elio Maldonado <emaldona@redhat.com> - 3.14-8
changelog:
  - Fix pk11wrap locking which fixes 'fedpkg new-sources' and 'fedpkg update' hangs
  - Bug 872124 - nss-3.14 breaks fedpkg new-sources
  - Fix should be considered preliminary since the patch may change upon upstream approval


author: Elio Maldonado <emaldona@redhat.com> - 3.14-9
changelog:
  - Disable bypass code at build time and return failure on attempts to enable at runtime
  - Bug 806588 - Disable SSL PKCS #11 bypass at build time


author: Elio Maldonado <emaldona@redhat.com> - 3.14-11
changelog:
  - Bug 879978 - Install the nssck.api header template in a place where mod_revocator can access it
  - Install nssck.api in /usr/includes/nss3


author: Elio Maldonado <emaldona@redhat.com> - 3.14-12
changelog:
  - Bug 879978 - Install the nssck.api header template where mod_revocator can access it
  - Install nssck.api in /usr/includes/nss3/templates


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3_14_3_RTM
  - sync up pem rsawrapr.c with softoken upstream changes for nss-3.14.3
  - Resolves: rhbz#908257 - CVE-2013-1620 nss: TLS CBC padding timing attack
  - Resolves: rhbz#896651 - PEM module trashes private keys if login fails
  - Resolves: rhbz#909775 - specfile support for AArch64
  - Resolves: rhbz#910584 - certutil -a does not produce ASCII output


author: Kai Engert <kaie@redhat.com> - 3.14.3-9
changelog:
  - Configure libnssckbi.so to use the alternatives system
    in order to prepare for a drop in replacement.


author: Elio Maldonado <emaldona@redhat.com> - 3.15-5
changelog:
  - Install man pages for nss-tools and the nss-config and setup-nsssysinit scripts
  - Resolves: rhbz#606020 - nss security tools lack man pages


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-2
changelog:
  - Update to NSS_3_15_1_RTM
  - Apply various fixes to the man pages and add new ones
  - Enable the iquote.patch to access newly introduced types
  - Add man page for pkcs11.txt configuration file and cert and key databases
  - Add missing option descriptions for {cert|cms|crl}util
  - Resolves: rhbz#948495 - Man page scan results for nss
  - Resolves: rhbz#982723 - Fix path to script in man page for nss-sysinit


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-4
changelog:
  - Install symlink to nss-sysinit.sh without the .sh suffix
  - Resolves: rhbz#982723 - nss-sysinit man page has wrong path for the script


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-1
changelog:
  - Rebase to nss-3.15.2
  - Resolves: rhbz#1012656 - pick up NSS 3.15.2 to fix CVE-2013-1739 and disable MD5 in OCSP/CRL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-2
changelog:
  - Add description of the certutil's --email option to it's manpage
  - Resolves: rhbz#Bug 948495 - Man page scan results for nss


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-4
changelog:
  - Enable fips when system is in fips mode
  - Resolves: rhbz#852023 - FIPS mode detection does not work


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-6
changelog:
  - Fix errors in ssl disabling patches for both library and tests
  - Add s390x to the multilib_arches definition used for alt_ckbi
  - Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-7
changelog:
  - Fix bash syntax error in patch for disabling ssl2 tests
  - Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-8
changelog:
  - Fix patch for disabling ssl2 in ssl to correctly set error code
  - Fix syntax error reported in the build.log even tough it succeeds
  - Add patch top ignore setpolicy result 
  - Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites
  - Resolves: rhbz#1026677 - Attempt to run ipa-client-install fails


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-9
changelog:
  - Fix certutil man page options names to be consistent with help
  - Resolves: rhbz#948495 - man page scan results for nss
  - Remove incorrect count argument in status description in nss-sysinit man page
  - Resolves: rhbz#982723 - man page of nss-sysinit incorrect option descriptions


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-10
changelog:
  - Fix path to script and remove -- from some options in nss-sysinit man page
  - Resolves: rhbz#982723 - man page of nss-sysinit worong path and other flaws


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Revoke trust in one mis-issued anssi certificate
  - Resolves: Bug 1040284 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117) [rhel-7.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Improve pluggable ECC support for ECDSA
  - Resolves: Bug 752980 - [7.0 FEAT] Support ECDSA algorithm in the nss package


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-6
changelog:
  - Fix a coverity scan compile time warning for the pem module
  - Resolves: Bug 1002271 - NSS pem module should not require unique base file names


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-7
changelog:
  - Move several nss-sysinit manpages tar archives to the %files
  - Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-8
changelog:
  - Fix the spec file to apply the nss ecc list patch for bug 752980
  - Resolves: Bug 752980 - Support ECDSA algorithm in the nss package via puggable ecc


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-9
changelog:
  - Rebase to nss-3.15.4
  - Resolves: Bug 1054457 - CVE-2013-1740 nss: false start PR_Recv information disclosure security issue
  - Remove no longer needed patches for manpages that were applied upstream
  - Remove no longer needed patch to disable ocsp stapling tests
  - Update iquote.patch on account of upstream changes
  - Update and rename patch to pem/rsawrapr.c on account of upstream changes
  - Use the pristine upstream sources for nss without repackaging
  - Avoid unneeded manual step which may introduce errors


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-3
changelog:
  - Remove spurious man5 wildcard entry as all manpages are listed by name
  - Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-4
changelog:
  - Update pem sources to latest from nss-pem upstream
  - Pick up pem module fixes verified on RHEL and applied upstream
  - Remove no loger needed pem patches on acccount on this update
  - Add comments documenting the iquote.patch 
  - Resolves: Bug 1054457 - CVE-2013-1740


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-5
changelog:
  - Pick up a fix from rhel-6 and fix an rpm conflict
  - Don't hold issuer cert handles in crl cache
  - Resolves: Bug 1034409 - deadlock in trust domain and object lock
  - Move nss shared db files to the main package
  - Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-6
changelog:
  - Disallow disabling the internal module
  - Resolves: Bug 1056036 - nss segfaults with opencryptoki module


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-1
changelog:
  - Rebase to nss-3.16.2
  - Resolves: Bug 1103252 - Rebase RHEL 7.1 to at least NSS 3.16.1 (FF 31)
  - Fix test failure detection in the %check section
  - Move removal of unwanted source directories to the end of the %prep section
  - Update various patches on account of the rebase
  - Remove unused patches rendered obsolete by the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-2
changelog:
  - Fix libssl and test patches that disable ssl2 support
  - Resolves: Bug 1123435
  - Replace expired PayPal test certificate with current one


author: Elio Maldonado <pbrobinson@redhat.com> 3.16.2-3
changelog:
  - Generic 32/64 bit platform detection (fix ppc64le build)
  - Resolves: Bug 1125619 - nss fails to build on arch: ppc64le (missing dependencies)
  - Fix contributed by Peter Robinson <pbrobinson@redhat.com>


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-10
changelog:
  - Resolves: Bug 1158161 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Support TLS_FALLBACK_SCSV in tstclnt and ssltap


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Restore patch for certutil man page
  - supply missing options descriptions
  - Resolves: Bug 1158161 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-4
changelog:
  - Fix race condition
  - Resolves: Bug 1094468 - 389-ds-base server reported crash in stan_GetCERTCertificate
  - under the replication replay failure condition


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-5
changelog:
  - Reverse the sense of a test in patch to fix pk12util segfault
  - Resolves: Bug 1174527 - Segfault in pk12util when using -l option with certain .p12 files


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-2
changelog:
  - Replace expired PayPal test certificate that breaks the build
  - Resolves: Bug 1200898 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-3
changelog:
  - Fix shell syntax error on nss/tests/all.sh
  - Resolves: Bug 1200898 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
  - Update and reeneable nss-646045.patch on account of the rebase
  - Resolves: Bug 1200898 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-4
changelog:
  - Add support for sha384 tls cipher suites
  - Add support for server-side hde key exchange
  - Add support for DSS+SHA256 ciphersuites


author: Kai Engert <kaie@redhat.com> - 3.19.1-5
changelog:
  - Incremental patches to fix SSL/TLS test suite execution,
    fix the earlier SHA384 patch, and inform clients to use SHA384 with
    certificate_verify if required by NSS.


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-9
changelog:
  - Fix checks to skip ssl2/export cipher suites tests to not skip needed tests
  - Fix libssl ssl2/export disabling patch to handle NULL cipher cases
  - Enable additional cipher suites by default


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-12
changelog:
  - Support TLS > 1.0 by support while still allowing to connect to SSL3 only servers
  - Enable ECDSA cipher suites by default, a subset of the ones requested


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-13
changelog:
  - Reorder the cipher suites and enable two more by default
  - Fix some of the ssauth sni and ocsp stapling tests


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-14
changelog:
  - Update the required_softokn_build_version to -14
  - Add references to bugs filed upstream for new patches
  - Merge ocsp stapling and sslauth sni tests patches into one


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-16
changelog:
  - Fix check for public key size of DSA certificates
  - Use size of prime P not the size of dsa.publicValue


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-17
changelog:
  - Change the required_softokn_build_version back to -13
  - Ensure we use nss-softokn-3.16.2.3-13.el7_1


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-19
changelog:
  - Prevent TLS 1.2 Transcript Collision attacks against MD5 in key exchange protocol
  - Resolves: Bug 1289883


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - comment out default values for keys, warn about starting with -A (#19316).
  - take out -A from ntpd startup as well.
  - update to 4.0.99k.


author: Preston Brown <pbrown@redhat.com>
changelog:
  - allow comments in %{_sysconfdir}/ntp/step-tickers file (#28786).
  - need patch0 (glibc patch) on ia64 too


author: Pekka Savola <pekkas@netcore.fi>
changelog:
  - require/buildprereq libcap/libcap-devel
  - use 'ntp' user, tune the pre/post scripts, %files
  - add $OPTIONS to the init script


author: Pekka Savola <pekkas@netcore.fi>
changelog:
  - Add the remote root exploit patch (based on ntp-hackers).
  - Enhance droproot patch (more documentation, etc.) <Jarno.Huuskonen@uku.fi>
  - Tweak the droproot patch to include sys/prctl.h, not linux/prctl.h
  (implicit declarations)
  - Remote groupdel commands, shouldn't be needed.
  - Removed -Wcast-qual and -Wconversion due to excessive warnings (hackish).
  - Make ntp compilable with both glibc 2.1 and 2.2.x (very dirty hack)
  - Add %{_sysconfdir}/sysconfig/ntpd which drops root privs by default


author: Harald Hoyer <harald@redhat.de>
changelog:
  - new snapshot
  - removed typos and security patch (already there)
  - commented multicastclient in config file


author: Harald Hoyer <harald@redhat.de> 4.1.0-1
changelog:
  - wow, how stupid can a man be ;).. fixed #50698 
  - updated to 4.1.0 (changes are small and in non-critical regions)


author: Harald Hoyer <harald@redhat.de> 4.1.0b-4
changelog:
  - created drift with dummy value #58294
  - grep for timeservers in ntp.conf also for ntpdate #57837
  - check return value of ntpdate #58836


author: Harald Hoyer <harald@redhat.de> 4.1.1b-1
changelog:
  - updated to version 4.1.1b
  - improved initscript - use ntpdate on -x
  - improved initscript - open firewall only for timeservers
  - ntp-4.1.1a-adjtime.patch removed (already in source)
  - ntp-4.1.1a-mfp.patch removed (already in source)
  - ntp-4.0.99j-vsnprintf.patch removed (already in source)


author: Harald Hoyer <harald@redhat.com> - 4.2.0.a.20040617-4
changelog:
  - removed firewall hole punching from the initscript; rely on iptables
    ESTABLISHED,RELATED or manual firewall configuration


author: Jindrich Novy <jnovy@redhat.com> 4.2.0.a.20050816-1
changelog:
  - update to the latest stable 4.2.0.a.20050816
  - drop upstreamed .gcc4, .vsnprintf patches
  - remove obsolete .autofoo patch
  - make patch numbering less chaotic
  - don't package backup for .droproot patch


author: Petr Raszyk <praszyk@redhat.com> 4.2.0.a.20050816-2
changelog:
  - Fix fails on upgrade, if ntpd is disabled (#166773)
  - A cosmetic patch. There are some comments and braces '{' '}' added.
  - One unprintable character was converted to octal-form .
  - It can be removed anytime (conversion of the cvs-projets for C-Frame 121,
  - (auto-debug, auto-trace for cfr-printnet server).


author: Petr Raszyk <praszyk@redhat.com> 4.2.0.a.20050816-3
changelog:
  - A similar patch as ntp-4.0.99j-vsnprintf.patch in FEDORA CORE 4
  - (current patch is ntp-stable-4.2.0a-20050816-vsnprintf.patch)


author: Petr Raszyk <praszyk@redhat.com> 4.2.0.a.20050816-10
changelog:
  - ntpd does not submit his local clock (if there is no peer).
    ntpdate->ntpd #163862 , Patch13: ntp-stable-4.2.0a-20050816-loconly.patch


author: Miroslav Lichvar <mlichvar@redhat.com> - 4.2.0.a.20050816-11
changelog:
  - update man pages (#153195, #162856)
  - drop C-Frame-121, vsnprintf, minusTi and loconly patch
  - prevent segfault when loopback interface is not configured (#159056)
  - spec cleanup


author: Miroslav Lichvar <mlichvar@redhat.com> - 4.2.0.a.20050816-12
changelog:
  - fix initscript:
    - replace -U with -u in getopts (#187003)
    - don't pass group to ntpdate -U argument and ignore -i in options (#142926)
    - set ntpconf for -c
    - remove -p 8 from ntpdate arguments
    - don't call ntpdate when step-tickers doesn't contain anything useful
      and -x isn't in options
  - fix default keyfile for ntpdate (#183196)


author: Miroslav Lichvar <mlichvar@redhat.com> - 4.2.0.a.20050816-14
changelog:
  - modify ntp.conf, change default restrict, remove broadcastdelay,
    use fedora.pool.ntp.org (#189667)
  - don't install drift file
  - remove unsupported options from ntptrace manpage (#137717)
  - fix default paths in manpages for ntp-keygen and ntpdate


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2-3
changelog:
  - fix manycast support in ntpdate (#194329)
  - reply to manycast requests with null refid
  - enable mlockall (#195617)
  - correct threshold value in ntpdate manpage


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2p4-1
changelog:
  - update to 4.2.2p4
  - fix buffer overflow in WWV Audio driver (#216309)
  - don't mark init script as config


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4-1
changelog:
  - update to 4.2.4 (#146884)
  - don't use local clock in default config
  - autogenerate man pages from HTML
  - clean up spec a bit


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4-3
changelog:
  - disable autoopts option preset mechanisms for ntpd
  - document -I option of ntpd
  - generate makewhatis friendly man pages


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4-4
changelog:
  - don't wake up every second (#204748)
  - add option to enable memory locking (#195617)
  - fix broadcast client
  - use option values in ntp-keygen
  - improve man pages


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p0-1
changelog:
  - update to 4.2.4p0
  - fix init script
    - don't add second -g to ntpd options (#228424)
    - update getopts
    - skip all refclocks when parsing ntp.conf
  - spec cleanup


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p0-3
changelog:
  - fix interface updates with -I or -L option (#240254)
  - accept multiple -I options
  - fix broadcast client/server to accept/allow sending
    broadcasts on 255.255.255.255 (#226958)
  - fix return codes in init script (#240120)
  - exit with nonzero code if ntpd -q did not set clock (#240134)
  - drop revert452 patch, fixed in kernel 2.6.19
  - make with _smp_mflags


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p2-2
changelog:
  - ignore tentative addresses (#246297)
  - improve init script (#247003)
  - fix sleep patch
  - ease Autokey setup (#139673)
    - change default keysdir to /etc/ntp/crypto
    - set crypto password in /etc/ntp/crypto/pw
    - don't use randfile if /dev/urandom is used by OpenSSL
  - change default statsdir to /var/log/ntpstats/, use statistics type
    as default filename
  - package more doc files


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p2-5
changelog:
  - avoid use of uninitialized floating-point values in clock_select
  - update license tag (Tom "spot" Callaway)
  - drop sntp, MSNTP license is non-free


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p4-1
changelog:
  - update to 4.2.4p4
  - fix default NTP version for outgoing packets in ntpdate man page
    (#245408)
  - replace BSD with advertising code in ntpdc and ntpq


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p4-4
changelog:
  - reset kernel frequency when -x option is used
  - create separate init script for ntpdate
  - add note about paths and exit codes to ntpd man page


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p4-5
changelog:
  - fix building IPv6 support with new glibc-headers (#436713)
  - avoid unaligned memory access (#435301)
  - fix receiving broadcasts on 255.255.255.255


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p4-7
changelog:
  - reload resolv.conf after temporary failure in name resolution (#456743)
  - use clock_gettime
  - make subpackages for perl scripts and ntpdate (#452097, #456116)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p5-2
changelog:
  - retry failed name resolution few times before giving up (#460561)
  - don't write drift file upon exit
  - run ntpq with full path in ntp-wait script


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p6-1
changelog:
  - update to 4.2.4p6 (CVE-2009-0021)
  - include dhclient script (David Cantrell)
  - convert COPYRIGHT to UTF-8


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p6-4
changelog:
  - don't restart ntpd in dhclient script with every renewal
  - fix buffer overflow in ntpq (#490617)
  - check status in condrestart (#481261)
  - don't crash when compiled with HAVE_TIMER_CREATE (#486217)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p7-1
changelog:
  - update to 4.2.4p7 (CVE-2009-1252)
  - improve PLL response when kernel discipline is disabled
  - don't log STA_MODE changes
  - enable nanokernel support
  - allow minpoll 3
  - increase memlock limit
  - move html documentation to -doc subpackage (#492444)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p7-2
changelog:
  - fix frequency calculation when starting with no drift file
  - reduce phase adjustments beyond Allan intercept in daemon PLL


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p7-3
changelog:
  - handle system time jumps better
  - don't wake up every second for refclocks without timer
  - don't crash in ntpstat when unknown clock type is received (#505564)
  - make ntpstat process first packet in multipacket response
  - switch to editline
  - set pool.ntp.org vendor zone in spec (#512711)
  - compile with -fno-strict-aliasing


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p1-0.1.rc5
changelog:
  - update to 4.2.6p1-RC5
  - support NTPSERVERARGS variable in dhclient script (#558110)
  - don't use deprecated egrep (#548182)
  - don't verify ntp.conf (#481151)
  - compile with PPS API support
  - include new sntp


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p1-2
changelog:
  - update ntpstat to use current system variable names (#588067)
  - print synchronization distance instead of dispersion in ntpstat
  - clarify ntpd -q description


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p2-2
changelog:
  - add support for systemd (#617328)
  - retry few times in ntpdate init script before giving up (#445229)
  - add fourth pool server to default ntp.conf and use iburst


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p2-5
changelog:
  - remove systemctl dependency for now
  - suppress chkconfig output in %post (#629285)
  - generate ntp_decode(5) man page (#632300)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p3-0.1.rc10
changelog:
  - update to 4.2.6p3-RC10
  - fix system peer unmarking when unreachable
  - fix broadcastdelay option
  - fix automatic broadcast delay calibration
  - fix ntp-keygen -V crash
  - avoid unnecessary timeout in ntpdate
  - drop nano patch
  - convert ChangeLog to UTF-8


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p3-3
changelog:
  - pull in time-sync.target from ntpdate.service (Lennart Poettering)
  - link with -Wl,-z,relro,-z,now options
  - fix typo in ntpq man page (#664525)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-2
changelog:
  - update service file for systemd-timedated-ntp target (#816495)
  - allow service to set realtime scheduler (#810801)
  - drop comment enabling local driver in default config


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-4
changelog:
  - start ntpdate service after nss-lookup.target (#837486)
  - update systemd-timedated integration (#846077)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-5
changelog:
  - fix crash in FIPS mode (#839280)
  - use systemd macros if available (#850235)
  - remove obsolete macros


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-6
changelog:
  - bind broadcast client to new interfaces (#722690)
  - decode hex encoded passwords in ntpq/ntpdc
  - remove sample MD5 keys from default keys config


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-7
changelog:
  - allow selection of cipher for private key files
  - set identity modulus size in ntp-keygen
  - create sntp subpackage
  - add sntp service
  - use system libopts
  - add Wants=ntp-wait.service to ntpd service
  - don't fail when /etc/sysconfig/ntpd is missing
  - modify mlock and multiopts patches to use autogen
  - make perl subpackage noarch


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-11
changelog:
  - avoid rereading /etc/services (#768804)
  - remove ntp-wait dependency from ntpd service (#906753)
  - add missing and remove unrecognized options in documentation
  - update comments in some config files


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-12
changelog:
  - workaround failing autogen
  - move files from /lib
  - don't own ntp-units.d directory
  - drop old systemd scriptlets
  - fix dates in changelog


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-13
changelog:
  - ignore duplicate servers from dhclient
  - don't use -Wstrict-overflow with -fno-strict-overflow
  - buildrequire systemd-units
  - remove pie test


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-16
changelog:
  - refresh peers on routing updates (#1048132)
  - fix calculation of root dispersion (#1045377)
  - remove unnecessary IPv6 restrict line from default ntp.conf (#1048255)
  - remove kod from default restrict in ntp.conf (#1048255)
  - update logconfig documentation for patched default (#1048252)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-19
changelog:
  - don't generate weak control key for resolver (CVE-2014-9293)
  - don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294)
  - fix buffer overflows via specially-crafted packets (CVE-2014-9295)
  - don't mobilize passive association when authentication fails (CVE-2014-9296)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-20
changelog:
  - validate lengths of values in extension fields (CVE-2014-9297)
  - drop packets with spoofed source address ::1 (CVE-2014-9298)
  - reject packets without MAC when authentication is enabled (CVE-2015-1798)
  - protect symmetric associations with symmetric key against DoS attack (CVE-2015-1799)
  - fix generation of MD5 keys with ntp-keygen on big-endian systems (CVE-2015-3405)
  - add option to set Differentiated Services Code Point (DSCP) (#1202828)
  - add nanosecond support to SHM refclock (#1117702)
  - allow creating all SHM segments with owner-only access (#1122012)
  - allow different thresholds for forward and backward step (#1193154)
  - allow symmetric keys up to 32 bytes again (#1191111)
  - don't step clock for leap second with -x option (#1191122)
  - don't drop packets with source port below 123 (#1171640)
  - retry joining multicast groups (#1207014)
  - increase memlock limit again (#1053569)
  - warn when monitor can't be disabled due to limited restrict (#1191108)
  - use larger RSA exponent in ntp-keygen (#1191116)
  - fix crash in ntpq mreadvar command (#1180721)
  - move sntp kod database to allow SELinux labeling (#1082934)
  - fix typos in ntpd man page (#1195211)
  - improve documentation of restrict command (#1213953)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-22
changelog:
  - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
  - allow only one step larger than panic threshold with -g (CVE-2015-5300)


author: Ade Lee <alee@redhat.com> 1.0.0-14
changelog:
  - Resolves: #643546 - [RFE] Add nuxwdog to RHEL.
  - Remove old encryption scheme
  - Store passwords in kernel keyring


author: Ade Lee <alee@redhat.com> - 1.0.1-10
changelog:
  - Resolves: rhbz#1117072 -  ppc64le is missing from ExcludeArch
  - reverted the previous change.  ppc64le now removed from ExcludeArch


author: Ade Lee <alee@redhat.com> 1.0.2-1
changelog:
  - Allow passwords to be retrieved post-init phase
  - Fix null termination issue on returned stored passwords


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Patch to build with neither RSA nor RSAref.
  - Miscellaneous FHS-compliance tweaks.
  - Fix for possibly-compressed man pages.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Move condrestart to server postun.
  - Move key generation to init script.
  - Actually use the right patch for moving the key generation to the init script.
  - Clean up the init script a bit.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 2.1.1p4, which includes fixes for config file parsing problems.
  - Move the init script back.
  - Add Damien's quick fix for wackiness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 20000823 snapshot.
  - Change subpackage requirements from %{version} to %{version}-%{release}
  - Back out the pipe patch.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update x11-askpass to 1.0.2. (#17835)
  - Add BuildPreReqs for /bin/login and /usr/bin/rsh so that configure will
    always find them in the right place. (#17909)
  - Set the default path to be the same as the one supplied by /bin/login, but
    add /usr/X11R6/bin. (#17909)
  - Try to handle obsoletion of ssh-server more cleanly.  Package names
    are different, but init script name isn't. (#17865)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add BuildPreReq on /usr/include/security/pam_appl.h to be sure we always
    build PAM authentication in.
  - Try setting SSH_ASKPASS if gnome-ssh-askpass is installed.
  - Clean out no-longer-used patches.
  - Patch ssh-add to try to add both identity and id_dsa, and to error only
    when neither exists.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to OpenSSH 2.3.0p1.
  - Update to x11-askpass 1.1.0.
  - Enable keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Resync with conditional options in Damien Miller's .spec file for an errata.
  - Change libexecdir from %{_libexecdir}/ssh to %{_libexecdir}/openssh.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add the primes file from the latest snapshot to the main package (#20884).
  - Add the dev package to the prereq list (#19984).
  - Remove the default path and mimic login's behavior in the server itself.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Disable the built-in MD5 password support.  We're using PAM.
  - Take a crack at doing keyboard-interactive authentication with PAM, and
    enable use of it in the default client configuration so that the client
    will try it when the server disallows password authentication.
  - Build with debugging flags.  Build root policies strip all binaries anyway.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Merge multiple PAM text messages into subsequent prompts when possible when
    doing keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to x11-askpass 1.1.1. (#21301)
  - Don't second-guess fixpaths, which causes paths to get fixed twice. (#21290)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't treat pam_setcred() failure as fatal unless pam_authenticate() has
    succeeded, to allow public-key authentication after a failure with "none"
    authentication.  (#21268)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - More gettextizing.
  - Close all files after going into daemon mode (needs more testing).
  - Extract patch from CVS to handle auth banners (in the client).
  - Extract patch from CVS to handle compat weirdness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't open a PAM session until we've forked and become the user (#25690).
  - Apply Andrew Bartlett's patch for letting pam_authenticate() know which
    host the user is attempting a login from.
  - Resync with parts of Damien Miller's openssh.spec from CVS.
  - Don't expose KbdInt responses in debug messages (from CVS).
  - Detect and handle errors in rsa_{public,private}_decrypt (from CVS).


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.0p1.
  - Use $RPM_OPT_FLAGS instead of -O when building gnome-ssh-askpass
  - Resync with parts of Damien Miller's openssh.spec from CVS, including
    update of x11 askpass to 1.2.0.
  - Only require openssl (don't prereq) because we generate keys in the init
    script now.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.1p1.
  - Add init script mods from Pekka Savola.
  - Tweak the init script to match the CVS contrib script more closely.
  - Redo patch to ssh-add to try to adding both identity and id_dsa to also try
    adding id_rsa.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Redo patch to move pam_open_session after the server setuid()s to the user.
  - Rework the nopam patch to use be picked up by autoconf.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Chuck the closing patch.
  - Add a trigger to add host keys for protocol 2 to the config file, now that
    configuration file syntax requires us to specify it with HostKey if we
    specify any other HostKey values, which we do.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Revert the patch to move pam_open_session.
  - Init script and spec file changes from Pekka Savola. (#28750)
  - Patch sftp to recognize '-o protocol' arguments. (#29540)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p1 (includes endianness fixes in the rijndael implementation)
  - don't enable challenge-response by default until we find a way to not
    have too many userauth requests (we may make up to six pubkey and up to
    three password attempts as it is)
  - remove build dependency on rsh to match openssh.com's packages more closely


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p2
  - call setcred() again after initgroups, because the "creds" could actually
    be group memberships


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make do_pam_setcred() smart enough to know when to establish creds and
    when to reinitialize them
  - add in a couple of other fixes from Damien for inclusion in the errata


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - mention that challengereponse supports PAM, so disabling password doesn't
    limit users to pubkey and rsa auth (#34378)
  - bypass the daemon() function in the init script and call initlog directly,
    because daemon() won't start a daemon it detects is already running (like
    open connections)
  - require the version of openssl we had when we were built


author: Preston Brown <pbrown@redhat.com>
changelog:
  - remove explicit openssl requirement, fixes builddistro issue
  - make initscript stop() function wait until sshd really dead to avoid 
    races in condrestart


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - finish marking strings in the init script for translation
  - modify init script to source /etc/sysconfig/sshd and pass $OPTIONS to sshd
    at startup (change merged from openssh.com init script, originally by
    Pekka Savola)
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add in Simon Wilkinson's GSSAPI patch to give it some testing in-house,
    to be removed before the next beta cycle because it's a big departure
    from the upstream version


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix an error parsing the new default sshd_config
  - add a fix from Markus Friedl (via openssh-unix-dev) for ssh-keygen not
    dealing with comments right


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change Copyright: BSD to License: BSD
  - add Markus Friedl's unverified patch for the cookie file deletion problem
    so that we can verify it
  - drop patch to check if xauth is present (was folded into cookie patch)
  - don't apply gssapi patches for the errata candidate
  - clear supplemental groups list at startup


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pull cvs patch to add session initialization to no-pty sessions
  - pull cvs patch to not cut off challengeresponse auth needlessly
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed (#49263)


author: Nalin Dahyabhai <nalin@redhat.com> 2.9p2-7
changelog:
  - fix scp's server's reporting of file sizes, and build with the proper
    preprocessor define to get large-file capable open(), stat(), etc.
    (sftp has been doing this correctly all along) (#51827)
  - configure without --with-ipv4-default on RHL 7.x and newer (#45987,#52247)
  - pull cvs patch to fix support for /etc/nologin for non-PAM logins (#47298)
  - mark profile.d scriptlets as config files (#42337)
  - refer to Jason Stone's mail for zsh workaround for exit-hanging quasi-bug
  - change a couple of log() statements to debug() statements (#50751)
  - pull cvs patch to add -t flag to sshd (#28611)
  - clear fd_sets correctly (one bit per FD, not one byte per FD) (#43221)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 3.0p1
  - update to x11-ssh-askpass 1.2.4.1
  - change build dependency on a file from pam-devel to the pam-devel package
  - replace primes with moduli


author: Nalin Dahyabhai <nalin@redhat.com> 3.0p1-1
changelog:
  - merge some of Damien Miller <djm@mindrot.org> changes from the upstream
    3.0p1 spec file and init script


author: Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-3
changelog:
  - add patches from Simon Wilkinson and Nicolas Williams for GSSAPI key
    exchange, authentication, and named key support


author: Nalin Dahyabhai <nalin@redhat.com> SNAP-20020220
changelog:
  - update to SNAP-20020220 for testing purposes (you've been warned, if there's
    anything to be warned about, gss patches won't apply, I don't mind)


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-1
changelog:
  - require sharutils for building (mindrot #137)
  - require db1-devel only when building for 6.x (#55105), which probably won't
    work anyway (3.1 requires OpenSSL 0.9.6 to build), but what the heck
  - require pam-devel by file (not by package name) again
  - add Markus's patch to compile with OpenSSL 0.9.5a (from
    http://bugzilla.mindrot.org/show_bug.cgi?id=141) and apply it if we're
    building for 6.x


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2gss
changelog:
  - reintroduce Simon's gssapi patches
  - add buildprereq for autoconf253, which is needed to regenerate configure
    after applying the gssapi patches
  - refresh to the latest version of Markus's patch to build properly with
    older versions of OpenSSL


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-3
changelog:
  - pull patch from CVS to avoid printing error messages when some of the
    default keys aren't available when running ssh-add
  - refresh to current revisions of Simon's patches


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-4
changelog:
  - drop buildreq on db1-devel
  - require pam-devel by package name
  - require autoconf instead of autoconf253 again


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-1
changelog:
  - update to 3.3p1
  - merge in spec file changes from upstream (remove setuid from ssh, ssh-keysign)
  - disable gtk2 askpass
  - require pam-devel by filename rather than by package for erratum
  - include patch from Solar Designer to work around anonymous mmap failures


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-2
changelog:
  - rework the close-on-exit docs
  - include configuration file man pages
  - make use of nologin as the privsep shell optional


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-2
changelog:
  - patch PAM configuration to use relative path names for the modules, allowing
    us to not worry about which arch the modules are built for on multilib systems


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-6
changelog:
  - move scp to the -clients subpackage, because it directly depends on ssh
    which is also in -clients (#84329)


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-6
changelog:
  - modify patch which clears the supplemental group list at startup to only
    complain if setgroups() fails if sshd has euid == 0
  - handle krb5 installed in %{_prefix} or elsewhere by using krb5-config


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-11
changelog:
  - apply patch to store the correct buffer size in allocated buffers
    (CAN-2003-0693)
  - skip the initial PAM authentication attempt with an empty password if
    empty passwords are not permitted in our configuration (#103998)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - additional fix for apparently-never-happens double-free in buffer_free()
  - extend fix for #103998 to cover SSH1


author: Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-34
changelog:
  * Wed Mar 03 2004 Phil Knirsch <pknirsch@redhat.com> 3.6.1p2-33.30.1
  - Built RHLE3 U2 update package.


author: Nalin Dahyabhai <nalin@redhat.com> 3.8.1p1-1
changelog:
  - request gssapi-with-mic by default but not delegation (flag day for anyone
    who used previous gssapi patches)
  - no longer request x11 forwarding by default


author: Nalin Dahyabhai <nalin@redhat.com> 3.9p1-8
changelog:
  - add a --enable-vendor-patchlevel option which allows a ShowPatchLevel option
    to enable display of a vendor patch level during version exchange (#120285)
  - configure with --disable-strip to build useful debuginfo subpackages


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - change permissions on pam.d/sshd to 0644 (#64697)
  - patch initscript so it doesn't kill opened sessions if
    the sshd daemon isn't running anymore (#67624)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-10
changelog:
  - enable trusted forwarding by default if X11 forwarding is 
    required by user (#137685 and duplicates)
  - disable protocol 1 support by default in sshd server config (#88329)
  - keep the gnome-askpass dialog above others (#69131)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-11
changelog:
  - don't call syslog in signal handler
  - allow password authentication when copying from remote
    to remote machine (#103364)


author: Tomas Mraz <tmraz@redhat.com> 4.0p1-2
changelog:
  - fixed Local/RemoteForward in ssh_config.5 manpage
  - fix fatal when Local/RemoteForward is used and scp run (#153258)
  - don't leak user validity when using krb5 authentication


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-3
changelog:
  - fix small regression caused by the nologin patch (#161956)
  - fix race in getpeername error checking (mindrot #1054)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-4
changelog:
  - don't deadlock on exit with multiple X forwarded channels (#152432)
  - don't use X11 port which can't be bound on all IP families (#163732)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-5
changelog:
  - use x11-ssh-askpass if openssh-askpass-gnome is not installed (#165207)
  - install ssh-copy-id from contrib (#88707)


author: Tomas Mraz <tmraz@redhat.com> 4.2p1-2
changelog:
  - use include instead of pam_stack in pam config
  - use fork+exec instead of system in scp - CVE-2006-0225 (#168167)
  - upstream patch for displaying authentication errors


author: Warren Togami <wtogami@redhat.com> - 4.2p1-7
changelog:
  - xorg-x11-devel -> libXt-devel
  - rebuild for new xauth location so X forwarding works
  - buildreq audit-libs-devel
  - buildreq automake for aclocal
  - buildreq imake for xmkmf
  -  -D_GNU_SOURCE in flags in order to get it to build
     Ugly hack to workaround openssh defining __USE_GNU which is
     not allowed and causes problems according to Ulrich Drepper
     fix this the correct way after FC5test1


author: Nalin Dahyabhai <nalin@redhat.com> - 4.2p1-8
changelog:
  - work around missing gccmakedep by wrapping makedepend in a local script
  - remove now-obsolete build dependency on "xauth"


author: Tomas Mraz <tmraz@redhat.com> - 4.2p1-9
changelog:
  - drop x11-ssh-askpass from the package
  - drop old build_6x ifs from spec file
  - improve gnome-ssh-askpass so it doesn't reveal number of passphrase 
    characters to person looking at the display
  - less hackish fix for the __USE_GNU problem


author: Tomas Mraz <tmraz@redhat.com> - 4.3p1-2
changelog:
  - fixed another place where syslog was called in signal handler
  - pass locale environment variables to server, accept them there (#179851)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-3
changelog:
  - enable the subprocess in chroot to send messages to system log
  - sshd should prevent login if audit call fails


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-6
changelog:
  - improve selinux patch (by Jan Kiszka)
  - upstream patch for buffer append space error (#191940)
  - fixed typo in configure.ac (#198986)
  - added pam_keyinit to pam configuration (#198628)
  - improved error message when askpass dialog cannot grab
    keyboard input (#198332)
  - buildrequires xauth instead of xorg-x11-xauth
  - fixed a few rpmlint warnings


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-7
changelog:
  - dropped old ssh obsoletes
  - call the pam_session_open/close from the monitor when privsep is
    enabled so it is always called as root (patch by Darren Tucker)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-8
changelog:
  - drop the pam-session patch from the previous build (#201341)
  - don't set IPV6_V6ONLY sock opt when listening on wildcard addr (#201594)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-9
changelog:
  - don't report duplicate syslog messages, use correct local time (#189158)
  - don't allow spnego as gssapi mechanism (from upstream)
  - fixed memleaks found by Coverity (from upstream)
  - allow ip options except source routing (#202856) (patch by HP)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-10
changelog:
  - improve gssapi-no-spnego patch (#208102)
  - CVE-2006-4924 - prevent DoS on deattack detector (#207957)
  - CVE-2006-5051 - don't call cleanups from signal handler (#208459)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-11
changelog:
  - merge sshd initscript patches
  - kill all ssh sessions when stop is called in halt or reboot runlevel
  - remove -TERM option from killproc so we don't race on sshd restart


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-13
changelog:
  - improved pam_session patch so it doesn't regress, the patch is necessary
    for the pam_session_close to be called correctly as uid 0


author: Tomas Mraz <tmraz@redhat.com> - 4.5p1-2
changelog:
  - support mls on labeled networks (#220487)
  - support mls level selection on unlabeled networks
  - allow / in usernames in scp (only beginning /, ./, and ../ is special)


author: Tomas Mraz <tmraz@redhat.com> - 4.5p1-8
changelog:
  - fix sftp client problems on write error (#247802)
  - allow disabling autocreation of server keys (#235466)


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-1
changelog:
  - upgrade to latest upstream
  - use libedit in sftp (#203009)
  - fixed audit log injection problem (CVE-2007-3102)


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-4
changelog:
  - do not copy /etc/localtime into the chroot as it is not
    necessary anymore (#193184)
  - call setkeycreatecon when selinux context is established
  - test for NULL privk when freeing key (#391871) - patch by
    Pierre Ossman


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-9
changelog:
  - set FD_CLOEXEC on client socket
  - apply real fix for window size problem (#286181) from upstream
  - apply fix for the spurious failed bind from upstream
  - apply open handle leak in sftp fix from upstream


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-10
changelog:
  - fix race on control master and cleanup stale control socket (#436311)
    patches by David Woodhouse


author: Tomas Mraz <tmraz@redhat.com> - 5.0p1-1
changelog:
  - upgrade to new upstream (#441066)
  - prevent initscript from killing itself on halt with upstart (#438449)
  - initscript status should show that the daemon is running
    only when the main daemon is still alive (#430882)


author: Tomas Mraz <tmraz@redhat.com> - 5.0p1-2
changelog:
  - add LANGUAGE to accepted/sent environment variables (#443231)
  - use pam_selinux to obtain the user context instead of doing it itself
  - unbreak server keep alive settings (patch from upstream)
  - small addition to scp manpage


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-1
changelog:
  - upgrade to new upstream release
  - fixed a problem with public key authentication and explicitely
    specified SELinux role


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-4
changelog:
  - set FD_CLOEXEC on channel sockets (#475866)
  - adjust summary
  - adjust nss-keys patch so it is applicable without selinux patches (#470859)


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-5
changelog:
  - remove obsolete --with-rsh (#478298)
  - add pam_sepermit to allow blocking confined users in permissive mode
    (#471746)
  - move system-auth after pam_selinux in the session stack


author: Jan F. Chadima <jchadima@redhat.com> - 5.2p1-20
changelog:
  - merged xmodifiers to redhat patch
  - merged gssapi-role to selinux patch
  - merged cve-2007_3102 to audit patch
  - sesftp patch only with WITH_SELINUX flag
  - rearange sesftp patch according to upstream request


author: Jan F. Chadima <jchadima@redhat.com> - 5.2p1-28
changelog:
  - Repair initscript to be acord to guidelines (#521860)
  - Add bugzilla# to application of edns and xmodifiers patch


author: Jan F. Chadima <jchadima@redhat.com> - 5.5p1-10 + 0.9.2-26
changelog:
  - Repair the reference in man ssh-ldap-helper(8)
  - Repair the PubkeyAgent section in sshd_config(5)
  - Provide example ldap.conf


author: Jan F. Chadima <jchadima@redhat.com> - 5.6p1-20 + 0.9.2-29
changelog:
  - reapair clientloop crash (#627332)
  - properly restore euid in case connect to the ssh-agent socket fails


author: Jan F. Chadima <jchadima@redhat.com> - 5.8p1-18 + 0.9.2-30
changelog:
  - add periodical reseeding of random generator 
  - change selinux contex for internal sftp in do_usercontext
  - exit(0) after sigterm


author: Jan F. Chadima <jchadima@redhat.com> - 5.8p1-20 + 0.9.2-30
changelog:
  - use /dev/random or /dev/urandom for seeding prng
  - improve periodical reseeding of random generator


author: Jan F. Chadima <jchadima@redhat.com> - 5.8p2-12 + 0.9.2-31
changelog:
  - Systemd compatibility according to Mathieu Bridon <bochecha@fedoraproject.org>
  - Split out the host keygen into their own command, to ease future migration
    to systemd. Compatitbility with the init script was kept.
  - Migrate the package to full native systemd unit files, according to the Fedora
    packaging guidelines.
  - Prepate the unit files for running an ondemand server. (do not add it actually)


author: Tomas Mraz <tmraz@redhat.com> - 5.9p1-11 + 0.9.2-32
changelog:
  - remove unnecessary requires on initscripts
  - set VerifyHostKeyDNS to ask in the default configuration (#739856)


author: Tomas Mraz <tmraz@redhat.com> - 5.9p1-12 + 0.9.2-32
changelog:
  - still support /etc/sysconfig/sshd loading in sshd service (#754732)
  - fix incorrect key permissions generated by sshd-keygen script (#754779)


author: Tomas Mraz <tmraz@redhat.com> - 5.9p1-13 + 0.9.2-32
changelog:
  - add back the restorecon call to ssh-copy-id - it might be needed on older
    distributions (#739989)


author: Petr Lautrbach <plautrba@redhat.com> 5.9p1-18 + 0.9.2-32
changelog:
  - replace TwoFactorAuth with RequiredAuthentications[12]
    https://bugzilla.mindrot.org/show_bug.cgi?id=983


author: Tomas Mraz <tmraz@redhat.com> 5.9p1-23 + 0.9.3-1
changelog:
  - fix segfault in su when pam_ssh_agent_auth is used and the ssh-agent
    is not running, most probably not exploitable
  - update pam_ssh_agent_auth to 0.9.3 upstream version


author: Petr Lautrbach <plautrba@redhat.com> 6.1p1-1 + 0.9.3-3
changelog:
  - new upstream release (#852651)
  - use DIR: kerberos type cache (#848228)
  - don't use chroot_user_t for chrooted users (#830237)
  - replace scriptlets with systemd macros (#850249)
  - don't use /bin and /sbin paths (#856590)


author: Petr Lautrbach <plautrba@redhat.com> 6.1p1-2
changelog:
  - add SELinux comment to /etc/ssh/sshd_config about SELinux command to modify port (#861400)
  - drop required chkconfig (#865498)
  - drop openssh-5.9p1-sftp-chroot.patch (#830237)


author: Petr Lautrbach <plautrba@redhat.com> 6.1p1-3 + 0.9.3-3
changelog:
  - replace RequiredAuthentications2 with AuthenticationMethods based on upstream
  - obsolete RequiredAuthentications[12] options
  - fix openssh-6.1p1-privsep-selinux.patch


author: Petr Lautrbach <plautrba@redhat.com> 6.2p1-2 + 0.9.3-4
changelog:
  - keep track of which IndentityFile options were manually supplied and
    which were default options, and don't warn if the latter are missing.
    (mindrot#2084)


author: Petr Lautrbach <plautrba@redhat.com> 6.2p1-3 + 0.9.3-4
changelog:
  - sshd.service: use KillMode=process (#890376)
  - add latest config.{sub,guess} to support aarch64 (#926284)


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-4 + 0.9.3-5
changelog:
  - don't show Success for EAI_SYSTEM (#985964)
  - make sftp's libedit interface marginally multibyte aware (#841771)


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-7 + 0.9.3-5
changelog:
  - use hmac_suffix for ssh{,d} hmac checksums
  - bump the minimum value of SSH_USE_STRONG_RNG to 14 according to SP800-131A
  - automatically restart sshd.service on-failure after 42s interval


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-8 + 0.9.3-5
changelog:
  - sshd-keygen: generate only RSA keys by default (#1010361)
  - use dist tag in suffixes for hmac checksum files


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-9 + 0.9.3-5
changelog:
  - use dracut-fips package to determine if a FIPS module is installed (#1001566)
  - revert -fips subpackages and hmac files suffixes


author: Petr Lautrbach <plautrba@redhat.com> 6.3p1-2 + 0.9.3-6
changelog:
  - use default_ccache_name from /etc/krb5.conf for a kerberos cache (#991186)
  - increase the size of the Diffie-Hellman groups (#1010607)
  - sshd-keygen to generate ECDSA keys <i.grok@comcast.net> (#1019222)


author: Petr Lautrbach <plautrba@redhat.com> 6.3p1-4 + 0.9.3-7
changelog:
  - adjust gss kex mechanism to the upstream changes (#1024004)
  - don't use xfree in pam_ssh_agent_auth sources <geertj@gmail.com> (#1024965)


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-2 + 0.9.3-1
changelog:
  - fix fatal() cleanup in the audit patch (#1029074)
  - fix parsing logic of ldap.conf file (#1033662)


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-3 + 0.9.3-8
changelog:
  - sshd-keygen - use correct permissions on ecdsa host key (#1023945)
  - use only rsa and ecdsa host keys by default


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-5 + 0.9.3-8
changelog:
  - use tty allocation for a remote scp (#985650)
  - run ssh-copy-id in the legacy mode when SSH_COPY_ID_LEGACY variable is set (#969375)
  - FIPS mode - adjust the key echange DH groups and ssh-keygen according toSP800-131A (#1001748)


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-7 + 0.9.3-8
changelog:
  - log fipscheck verification message into syslog authpriv
  - ssh-keygen - relative-specified certificate expiry time should be relative
    to current time and not the validity start time (#1058234)
  - use the size of security of 3des for DH (#1053107)
  - ssh-copy-id.1 man page fix (#1058792)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-1 + 0.9.3-9
changelog:
  - new upstream release (#1059667)
  - prevent a server from skipping SSHFP lookup - CVE-2014-2653 (#1081338)
  - make /etc/ssh/moduli file public (#1134448)
  - test existence of /etc/ssh/ssh_host_ecdsa_key in sshd-keygen.service
  - don't clean up gssapi credentials by default (#1134447)
  - ssh-agent - try CLOCK_BOOTTIME with fallback (#1134449)
  - disable the curve25519 KEX when speaking to OpenSSH 6.5 or 6.6
  - add support for ED25519 keys to sshd-keygen and sshd.sysconfig
  - standardise on NI_MAXHOST for gethostname() string lengths (#1097665)
  - set a client's address right after a connection is set (mindrot#2257) (#912792)
  - apply RFC3454 stringprep to banners when possible (mindrot#2058) (#1104662)
  - don't consider a partial success as a failure (mindrot#2270) (#1112972)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-2 + 0.9.3-9
changelog:
  - slightly change systemd units logic - use sshd-keygen.service (#1066615)
  - log when a client requests an interactive session and only sftp is allowed (#1130198)
  - sshd-keygen - don't generate DSA and ED25519 host keys in FIPS mode (#1143867)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-4 + 0.9.3-9
changelog:
  - revert the default of KerberosUseKuserok back to yes
  - fix kuserok patch which checked for the existence of .k5login unconditionally
    and hence prevented other mechanisms to be used properly


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-8 + 0.9.3-9
changelog:
  - increase size of AUDIT_LOG_SIZE to 256 (#1171163)
  - record pfs= field in CRYPTO_SESSION audit event (#1171248)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-10 + 0.9.3-9
changelog:
  - add new option GSSAPIEnablek5users and disable using ~/.k5users by default CVE-2014-9278
    (#1169843)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-13 + 0.9.3-9
changelog:
  - Increase limit of files for glob match in sftp (#1160377)
  - Add pam_reauthorize.so to /etc/pam.d/sshd (#1204233)
  - Show all config values in sshd test mode (#1187597)
  - Document required selinux boolean for working ssh-ldap-helper (#1178116)
  - Consistent usage of pam_namespace in sshd (#1125110)
  - Fix auditing when using combination of ForcedCommand and PTY (#1199112)
  - Add sftp option to force mode of created files (#1197989)
  - Ability to specify an arbitrary LDAP filter in ldap.conf for ssh-ldap-helper (#1201753)
  - Provide documentation line for systemd service and socket (#1181591)
  - Provide LDIF version of LPK schema (#1184938)
  - Document TERM environment variable (#1162683)
  - Fix ssh-copy-id on non-sh remote shells (#1201758)
  - Do not read RSA1 hostkeys for HostBased authentication in FIPS (#1197666)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-14 + 0.9.3-9
changelog:
  - Fix ldif schema to have correct spacing on newlines (#1184938)
  - Add missing values for sshd test mode (#1187597)
  - ssh-copy-id: tcsh doesnt work with multiline strings (#1201758)
  - Fix memory problems with newkeys and array transfers (#1223218)
  - Enhance AllowGroups documentation in man page (#1150007)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-15 + 0.9.3-9
changelog:
  - One more typo in manual page documenting TERM variable (#1162683)
  - Fix race condition with auditing messages answers (#1240613)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-17 + 0.9.3-9
changelog:
  - Security fixes released with openssh-6.9 (CVE-2015-5352) (#1247864)
   - XSECURITY restrictions bypass under certain conditions in ssh(1) (#1238231)
   - weakness of agent locking (ssh-add -x) to password guessing (#1238238)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-20 + 0.9.3-9
changelog:
  - Fix vulnerabilities published with openssh-7.0 (#1265807)
   - Privilege separation weakness related to PAM support
   - Use-after-free bug related to PAM support


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-23 + 0.9.3-9
changelog:
  - Disable undocumented feauture Roaming for good (#1298218)
  - prevents CVE-2016-0777 and CVE-2016-0778


author: Bernhard Rosenkrdnzer <bero@redhat.de>
changelog:
  - inital packaging
  - changes from base:
    - Move /usr/local/ssl to /usr/share/ssl for FHS compliance
    - handle RPM_OPT_FLAGS


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.5a, modified for U.S.
  - add perl as a build-time requirement
  - move certificate makefile to another package
  - disable RC5, IDEA, RSA support
  - remove optimizations for now


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - byte-compile python extensions without the build-root
  - adjust the makefile to not remove temporary files (like .key files when
    building .csr files) by marking them as .PRECIOUS


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove -Wa,* and -m* compiler flags from the default Configure file (#20656)
  - add the CA.pl man page to the perl subpackage


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - disable some inline assembly, which on x86 is Pentium-specific
  - re-enable MD2 (see http://www.ietf.org/ietf/IPR/RSA-MD-all)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - re-disable MD2 -- the EVP_MD_CTX structure would grow from 100 to 152
    bytes or so, causing EVP_DigestInit() to zero out stack variables in
    apps built against a version of the library without it


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.6
  - enable MD2
  - use the libcrypto.so and libssl.so targets to build shared libs with
  - bump the soversion to 1 because we're no longer compatible with any of
    the various 0.9.5a packages circulating around, which provide lib*.so.0


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.6a
  - use the build-shared target to build shared libraries
  - bump the soversion to 2 because we're no longer compatible with
    our 0.9.5a packages or our 0.9.6 packages
  - drop the patch for making rsatest a no-op when rsa null support is used
  - put all man pages into <section>ssl instead of <section>
  - break the m2crypto modules into a separate package


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add a script for creating dummy certificates
  - move man pages from %{_mandir}/man?/foo.?ssl to %{_mandir}/man?ssl/foo.?


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-3
changelog:
  - add patches for AEP hardware support
  - add patch to keep trying when we fail to load a cert from a file and
    there are more in the file
  - add missing prototype for ENGINE_ubsec() in engine_int.h


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-4
changelog:
  - move man pages back to %{_mandir}/man?/foo.?ssl from
    %{_mandir}/man?ssl/foo.?
  - add an [ engine ] section to the default configuration file


author: Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-1
changelog:
  - upgrade to 0.9.6c
  - bump BuildArch to i686 and enable assembler on all platforms
  - synchronise with shrimpy and rawhide
  - bump soversion to 3


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-30
changelog:
  - add configuration stanza for x86_64 and use it on x86_64
  - build for linux-ppc on ppc
  - start running the self-tests again


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7-6
changelog:
  - EVP_DecryptInit should call EVP_CipherInit() instead of EVP_CipherInit_ex(),
    to get the right behavior when passed uninitialized context structures
    (#83766)
  - build with -mcpu=ev5 on alpha family (#83828)


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7-8
changelog:
  - add fix to guard against attempts to allocate negative amounts of memory
  - add patch for CAN-2003-0078, fixing a timing attack


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-5
changelog:
  - add patch to harden against Klima-Pokorny-Rosa extension of Bleichenbacher's
    attack (CAN-2003-0131)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - backport fix for engine-used-for-everything from 0.9.7b
  - backport fix for prng not being seeded causing problems, also from 0.9.7b
  - add a check at build-time to ensure that RSA is thread-safe
  - keep perlpath from stomping on the libica configure scripts


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add security fixes for protocol parsing bugs (CAN-2003-0543, CAN-2003-0544)
    and heap corruption (CAN-2003-0545)
  - update RHNS-CA-CERT files
  - ease back on the number of threads used in the threading test


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22
changelog:
  - add -Wa,--noexecstack to RPM_OPT_FLAGS so that assembled modules get tagged
    as not needing executable stacks


author: Phil Knirsch <pknirsch@redhat.com> 0.9.7a-24
changelog:
  - Use /dev/urandom instead of PRNG for libica.
  - Apply libica-1.3.5 fix for /dev/urandom in icalinux.c
  - Use latest ICA engine patch from IBM.


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-25
changelog:
  - add dependency on zlib-devel for the -devel package, which depends on zlib
    symbols because we enable zlib for libssl (#102962)


author: Joe Orton <jorton@redhat.com> 0.9.7a-27
changelog:
  - updated ca-bundle.crt: removed expired GeoTrust roots, added
    freessl.com root, removed trustcenter.de Class 0 root


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-33
changelog:
  - add an intermediate <openssl/opensslconf.h> which points to the right
    arch-specific opensslconf.h on multilib arches


author: Tomas Mraz <tmraz@redhat.com> 0.9.7e-1
changelog:
  - new upstream source, updated patches
  - added patch so we are hopefully ABI compatible with upcoming
    0.9.7f


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-1
changelog:
  - reenable optimizations on ppc64 and assembly code on ia64
  - upgrade to new upstream version (no soname bump needed)
  - disable thread test - it was testing the backport of the
    RSA blinding - no longer needed
  - added support for changing serial number to
    Makefile.certificate (#151188)
  - make ca-bundle.crt a config file (#118903)


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-2
changelog:
  - add back RC4_CHAR on ia64 and x86_64 so the ABI isn't broken
  - disable broken bignum assembly on x86_64


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-3
changelog:
  - uninitialized variable mustn't be used as input in inline
    assembly
  - reenable the x86_64 assembly again


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-4
changelog:
  - move certificates to _sysconfdir/pki/tls (#143392)
  - move CA directories to _sysconfdir/pki/CA
  - patch the CA script and the default config so it points to the
    CA directories


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-6
changelog:
  - use poll instead of select in rand (#128285)
  - fix Makefile.certificate to point to /etc/pki/tls
  - change the default string mask in ASN1 to PrintableString+UTF8String


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-7
changelog:
  - fix CAN-2005-0109 - use constant time/memory access mod_exp
    so bits of private key aren't leaked by cache eviction (#157631)
  - a few more fixes from upstream 0.9.7g


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-9
changelog:
  - add *.so.soversion as symlinks in /lib (#165264)
  - remove unpackaged symlinks (#159595)
  - fixes from upstream (constant time fixes for DSA,
    bn assembler div on ppc arch, initialize memory on realloc)


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-10
changelog:
  - fix CAN-2005-2969 - remove SSL_OP_MSIE_SSLV2_RSA_PADDING which
    disables the countermeasure against man in the middle attack in SSLv2
    (#169863)
  - use sha1 as default for CA and cert requests - CAN-2005-2946 (#169803)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8a-4
changelog:
  - fix build (-lcrypto was erroneusly dropped) of the updated libica
  - updated ICA engine to 1.3.6-rc3


author: Tomas Mraz <tmraz@redhat.com> - 0.9.8a-6
changelog:
  - fix stale open handles in libica (#177155)
  - fix build if 'rand' or 'passwd' in buildroot path (#178782)
  - initialize VIA Padlock engine (#186857)


author: Tomas Mraz <tmraz@redhat.com> - 0.9.8b-1
changelog:
  - upgrade to new version, stays ABI compatible
  - there is no more linux/config.h (it was empty anyway)


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - add ipv6 support to s_client and s_server (by Jan Pazdziora) (#198737)
  - add patches for BN threadsafety, AES cache collision attack hazard fix and
    pkcs7 code memleak fix from upstream CVS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-7
changelog:
  - fix CVE-2006-2937 - mishandled error on ASN.1 parsing (#207276)
  - fix CVE-2006-2940 - parasitic public keys DoS (#207274)
  - fix CVE-2006-3738 - buffer overflow in SSL_get_shared_ciphers (#206940)
  - fix CVE-2006-4343 - sslv2 client DoS (#206940)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-13
changelog:
  - allow building on ARM architectures (#245417)
  - use reference timestamps to prevent multilib conflicts (#218064)
  - -devel package must require pkgconfig (#241031)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-14
changelog:
  - use localhost in testsuite, hopefully fixes slow build in koji
  - CVE-2007-3108 - fix side channel attack on private keys (#250577)
  - make ssl session cache id matching strict (#233599)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-16
changelog:
  - fix CVE-2007-5135 - off-by-one in SSL_get_shared_ciphers (#309801)
  - fix CVE-2007-4995 - out of order DTLS fragments buffer overflow (#321191)
  - add alpha sub-archs (#296031)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-2
changelog:
  - enable some new crypto algorithms and features
  - add some more important bug fixes from openssl CVS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-3
changelog:
  - set default paths when no explicit paths are set (#418771)
  - do not add tls extensions to client hello for SSLv3 (#422081)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-9
changelog:
  - fix CVE-2008-0891 - server name extension crash (#448492)
  - fix CVE-2008-1672 - server key exchange message omit crash (#448495)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-1
changelog:
  - new upstream version with necessary soname bump (#455753)
  - temporarily provide symlink to old soname to make it possible to rebuild
    the dependent packages in rawhide
  - add eap-fast support (#428181)
  - add possibility to disable zlib by setting
  - add fips mode support for testing purposes
  - do not null dereference on some invalid smime files
  - add buildrequires pkgconfig (#479493)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-6
changelog:
  - drop the temporary triggerpostun and symlinking in post
  - fix the pkgconfig files and drop the unnecessary buildrequires
    on pkgconfig as it is a rpmbuild dependency (#481419)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-7
changelog:
  - must also verify checksum of libssl.so in the FIPS mode
  - obtain the seed for FIPS rng directly from the kernel device
  - drop the temporary symlinks


author: Tomas Mraz <tmraz@redhat.com> 0.9.8k-1
changelog:
  - update to new upstream release (minor bug fixes, security
    fixes and machine code optimizations only)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8k-6
changelog:
  - abort if selftests failed and random number generator is polled
  - mention EVP_aes and EVP_sha2xx routines in the manpages
  - add README.FIPS
  - make CA dir absolute path (#445344)
  - change default length for RSA key generation to 2048 (#484101)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.11.beta4
changelog:
  - update to new upstream version, no soname bump needed
  - fix CVE-2009-3555 - note that the fix is bypassed if SSL_OP_ALL is used
    so the compatibility with unfixed clients is not broken. The
    protocol extension is also not final.


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.12.beta4
changelog:
  - keep the beta status in version number at 3 so we do not have to rebuild
    openssh and possibly other dependencies with too strict version check


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.13.beta4
changelog:
  - disable enforcement of the renegotiation extension on the client (#537962)
  - add fixes from the current upstream snapshot


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.17.beta4
changelog:
  - upstream fix compression handling on session resumption
  - various null checks and other small fixes from upstream
  - upstream changes for the renegotiation info according to the latest draft


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.19.beta4
changelog:
  - fix CVE-2009-4355 - leak in applications incorrectly calling
    CRYPTO_free_all_ex_data() before application exit (#546707)
  - upstream fix for future TLS protocol version handling


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.21.beta5
changelog:
  - gracefully handle zero length in assembler implementations of
    OPENSSL_cleanse (#564029)
  - do not fail in s_server if client hostname not resolvable (#561260)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0c-2
changelog:
  - listen on ipv6 wildcard in s_server so we accept connections
    from both ipv4 and ipv6 (#601612)
  - fix openssl speed command so it can be used in the FIPS mode
    with FIPS allowed ciphers


author: Tomas Mraz <tmraz@redhat.com> 1.0.0c-3
changelog:
  - add -x931 parameter to openssl genrsa command to use the ANSI X9.31
    key generation method
  - use FIPS-186-3 method for DSA parameter generation
  - add OPENSSL_FIPS_NON_APPROVED_MD5_ALLOW environment variable
    to allow using MD5 when the system is in the maintenance state
    even if the /proc fips flag is on
  - make openssl pkcs12 command work by default in the FIPS mode


author: Tomas Mraz <tmraz@redhat.com> 1.0.0d-3
changelog:
  - add support for VIA Padlock on 64bit arch from upstream (#617539)
  - do not return bogus values from load_certs (#652286)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0d-6
changelog:
  - add support for newest Intel acceleration improvements backported
    from upstream by Intel in form of a separate engine


author: Tomas Mraz <tmraz@redhat.com> 1.0.0d-7
changelog:
  - correct openssl cms help output (#636266)
  - more tolerant starttls detection in XMPP protocol (#608239)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0d-8
changelog:
  - drop the separate engine for Intel acceleration improvements
    and merge in the AES-NI, SHA1, and RC4 optimizations
  - add support for OPENSSL_DISABLE_AES_NI environment variable
    that disables the AES-NI support


author: Tomas Mraz <tmraz@redhat.com> 1.0.0e-3
changelog:
  - do not use AVX instructions when osxsave bit not set
  - add direct known answer tests for SHA2 algorithms


author: Tomas Mraz <tmraz@redhat.com> 1.0.0g-1
changelog:
  - new upstream release fixing CVE-2012-0050 - DoS regression in
    DTLS support introduced by the previous release (#782795)


author: Tomas Mraz <tmraz@redhat.com> 1.0.1-0.1.beta2
changelog:
  - new upstream release from the 1.0.1 branch, ABI compatible
  - add documentation for the -no_ign_eof option


author: Tomas Mraz <tmraz@redhat.com> 1.0.1-0.2.beta3
changelog:
  - epoch bumped to 1 due to revert to 1.0.0g on Fedora 17
  - new upstream release from the 1.0.1 branch
  - fix s390x build (#798411)
  - versioning for the SSLeay symbol (#794950)
  - add -DPURIFY to build flags (#797323)
  - filter engine provides
  - split the libraries to a separate -libs package
  - add make to requires on the base package (#783446)


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-3
changelog:
  - fix DSA key generation in FIPS mode (#833866)
  - allow duplicate FIPS_mode_set(1)
  - enable build on ppc64 subarch (#834652)


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-4
changelog:
  - do not move libcrypto to /lib
  - do not use environment variables if __libc_enable_secure is on
  - fix strict aliasing problems in modes


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-7
changelog:
  - add missing initialization of str in aes_ccm_init_key (#853963)
  - add important patches from upstream CVS
  - use the secure_getenv() with new glibc


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-8
changelog:
  - use 1024 bit DH parameters in s_server as 512 bit is not allowed
    in FIPS mode and it is quite weak anyway


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-11
changelog:
  - add script for renewal of a self-signed cert by Philip Prindeville (#871566)
  - allow X509_issuer_and_serial_hash() produce correct result in
    the FIPS mode (#881336)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-20
changelog:
  - document the nextprotoneg option in manual pages
    original patch by Hubert Kario
  - try to avoid some races when updating the -fips subpackage


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-21
changelog:
  - make DTLS1 work in FIPS mode
  - avoid RSA and DSA 512 bits and Whirlpool in 'openssl speed' in FIPS mode
  - drop the -fips subpackage, installation of dracut-fips marks that the FIPS
    module is installed
  - avoid dlopening libssl.so from libcrypto
  - fix small memory leak in FIPS aes selftest
  - fix segfault in openssl speed hmac in the FIPS mode


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-24
changelog:
  - additional changes required for FIPS validation
  - disable verification of certificate, CRL, and OCSP signatures
    using MD5 if OPENSSL_ENABLE_MD5_VERIFY environment variable
    is not set


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-26
changelog:
  - fix CVE-2013-6449 - crash when version in SSL structure is incorrect
  - drop weak ciphers from the default TLS ciphersuite list
  - add back some symbols that were dropped with update to 1.0.1 branch
  - more FIPS validation requirement changes


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-28
changelog:
  - fix CVE-2013-4353 - Invalid TLS handshake crash
  - fix CVE-2013-6450 - possible MiTM attack on DTLS1


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-31
changelog:
  - print ephemeral key size negotiated in TLS handshake (#1057715)
  - add DH_compute_key_padded needed for FIPS CAVS testing
  - make expiration and key length changeable by DAYS and KEYLEN
    variables in the certificate Makefile (#1058108)
  - change default hash to sha256 (#1062325)
  - lower the actual 3des strength so it is sorted behind aes128 (#1056616)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-34.3
changelog:
  - fix CVE-2010-5298 - possible use of memory after free
  - fix CVE-2014-0195 - buffer overflow via invalid DTLS fragment
  - fix CVE-2014-0198 - possible NULL pointer dereference
  - fix CVE-2014-0221 - DoS from invalid DTLS handshake packet
  - fix CVE-2014-0224 - SSL/TLS MITM vulnerability
  - fix CVE-2014-3470 - client-side DoS when using anonymous ECDH


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-35
changelog:
  - fix CVE-2014-3505 - doublefree in DTLS packet processing
  - fix CVE-2014-3506 - avoid memory exhaustion in DTLS
  - fix CVE-2014-3507 - avoid memory leak in DTLS
  - fix CVE-2014-3508 - fix OID handling to avoid information leak
  - fix CVE-2014-3509 - fix race condition when parsing server hello
  - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS
  - fix CVE-2014-3511 - disallow protocol downgrade via fragmentation


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-37
changelog:
  - add support for RFC 5649 (#1119738)
  - do not pass the FIPS integrity check if the .hmac files are empty (#1128849)
  - add ECC TLS extensions to DTLS (#1119803)
  - do not send ECC ciphersuites in SSLv2 client hello (#1090955)
  - properly propagate encryption failure in BIO_f_cipher (#1072439)
  - fix CVE-2014-0224 fix that broke EAP-FAST session resumption support
  - improve documentation of ciphersuites - patch by Hubert Kario (#1108026)
  - use case insensitive comparison for servername in s_server (#1081163)
  - add support for automatic ECDH curve selection on server (#1080128)
  - FIPS mode: make the limitations on DSA, DH, and RSA keygen
    length enforced only if OPENSSL_ENFORCE_MODULUS_BITS environment
    variable is set


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-39
changelog:
  - fix CVE-2014-3567 - memory leak when handling session tickets
  - fix CVE-2014-3513 - memory leak in srtp support
  - add support for fallback SCSV to partially mitigate CVE-2014-3566
    (padding attack on SSL3)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-40
changelog:
  - use FIPS approved method for computation of d in RSA
  - copy digest algorithm when handling SNI context switch


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-41
changelog:
  - fix CVE-2014-3570 - incorrect computation in BN_sqr()
  - fix CVE-2014-3571 - possible crash in dtls1_get_record()
  - fix CVE-2014-3572 - possible downgrade of ECDH ciphersuite to non-PFS state
  - fix CVE-2014-8275 - various certificate fingerprint issues
  - fix CVE-2015-0204 - remove support for RSA ephemeral keys for non-export
    ciphersuites and on server
  - fix CVE-2015-0205 - do not allow unauthenticated client DH certificate
  - fix CVE-2015-0206 - possible memory leak when buffering DTLS records


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42
changelog:
  - test in the non-FIPS RSA keygen for minimal distance of p and q
    similarly to the FIPS RSA keygen


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-44
changelog:
  - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()
  - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison
  - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
  - fix CVE-2015-0288 - X509_to_X509_REQ NULL pointer dereference
  - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
  - fix CVE-2015-0292 - integer underflow in base64 decoder
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server


