# changelog

author: Simon Wilkinson <simon@sxw.org.uk> 1.4.5
changelog:
  - Update to match the shipped 1.4.5 RPMS
  - Fix the kvariant stuff to only configure the 'standard' case once
  - Add openafs-kvers.sh back in


author: Simon Wilkinson <simon@sxw.org.uk> 1.4.4-3
changelog:
  - Use distributed files, rather than those in packager's SOURCE directory
  - Remove SuidCells stuff, which was unused


author: Derrick Brashear <shadow@dementia.org> 1.4.2-2
changelog:
  - integrate s390x changes
  - allow for building libafs*.a and not libafs*.so into packages, for platforms
    that won't build the .so files.


author: Derek Atkins <warlord@MIT.EDU> 1.4.2-0.1.rc1
changelog:
  - update to 1.4.2-rc1
  - hand-apply lee damon's changes to support largesmp kernels from RHEL4
    (but only add support for 2.6 kernels.  No need for the 2.4 kernels).
  - don't need the posixlock patch anymore.


author: Derek Atkins <warlord@MIT.EDU>
changelog:
  - change non-target-cpu kernel dep to a file dep
  - make sure we use the proper kernel version for the dependency.


author: Derek Atkins <warlord@MIT.EDU>
changelog:
  - allow users to specify local CellServDB and SuidCells entries
    don't overwrite user's changes.  Provide a .dist an let users
    make entries in a ".local"
  - build the CellServDB and SuidCells at client startup and at
    client install-time
  - add provideskernelarch functionality to openafs-kvers-is.sh
  - use that functionality to Require kernel{,-<type>}-targetcpu
    to get better package safety due to RPM bugs where the kernel
    release isn't used so you can install the kernel module against
    any kernel of the same major version.


author: Derek Atkins <warlord@MIT.EDU>
changelog:
  - update the README in openafs-kernel-source
  - fix openafs-kvers-is.sh from Alexander Bergolth's patch.
  - move kernel module from .../kernel/fs/openafs to .../fs/openafs/


author: Derek Atkins <warlord@MIT.EDU>
changelog:
  - build requires autoconf and automake for krb5support
    and autoconf for standard package
  - dont setup the krb5 migration kit (or patches) if we don't care.
  - require ncurses-devel to build


author: Derek Atkins <warlord@MIT.EDU> 1.4.1-1
changelog:
  - update to 1.4.1 release.
  - distribute asetkey from openafs instead of krb5-migration kit
  - don't need to apply the FC5 patches because they are part of the distro.
  - install asetkey into the "proper" place
  - dont list a manpage twice.
  - package asetkey man page.  delete it when not needed.


author: Derek Atkins <warlord@MIT.EDU> 1.4.1rc10-1
changelog:
  - update to 1.4.1rc10, build on FC5
  - fix the man pages (distribute into various packages)
  - include patches for FC5, RT #29112 and #29122


author: Derek Atkins <warlord@MIT.EDU>
changelog:
  - patch from Mike Polek <mike at pictage.com> to run depmod for
    the target kernel and not the running kernel.


author: Derek Atkins <warlord@MIT.EDU>
changelog:
  - fix openafs-kernel-version.sh so it will build an RPM for the
    currently-running kernel even if it's smp on 2.6.


author: Derek Atkins <warlord@MIT.EDU> 1.4.0rc4-2
changelog:
  - add kmodule26 patch: fix the kernel module name on 2.6 kernels so
    it's called "openafs" and not "libafs".  This fixes the shutdown
    problem.


author: Derek Atkins <warlord@MIT.EDU>
changelog:
  - update kversis script, add 'kvers' operation
  - fix bug that 2.6 smp/hugemem kernels don't provide
    kernel-foo = 2.6.33.3-85.fc13 with 'smp', 'hugemem', etc.
  - add patch to remove res_search from the afs-krb5 configure


author: Derek Atkins <warlord@MIT.EDU> 1.4.0rc4-1
changelog:
  - Update to 1.4.0rc4
  - Update the afs-krb5 krb524 patch so it actually works on
    some older systems like RHEL3 that still need -lkrb524.
  - Update the buildall script so choose better architecture support,
    e.g. don't build i586 on RHEL.
  - Update the rebuild information in the SPEC file.
  - Add support for finding .EL kernels in openafs-kvers-is.sh
  - Add additional error messages when kernel version/type parsing fails.
  - Update the buildall script to use the kernel srcdir directly.


author: Derek Atkins <warlord@MIT.EDU> 1.4.0rc3-2
changelog:
  - Add "hugemem" to 2.4 configs
  - Add checks to support scripts to determine whether to build
    the bigmem and/or hugemem kernels for 2.4.


author: Derek Atkins <warlord@MIT.EDU> 1.4.0rc3-1
changelog:
  - Added some afs-krb5 patches to get the migration kit to build
    on modern AFS and modern Kerberos.
  - Added authlibs and authlibs-devel packages as per UMich changes.


author: Derek Atkins <warlord@MIT.EDU>
changelog:
  - Merged in lots of changes from David Howells and Nalin Dahyabhai
    from Red Hat.   Initial attempt at a release of 1.4.  Still need
    to work in a 2.6 build system.


author: Joe Orton <jorton@redhat.com> - 2.2.14-1
changelog:
  - update to 2.2.14
  - relax permissions on /var/run/httpd (#495780)
  - Requires(pre): httpd in mod_ssl subpackage (#543275)
  - add partial security fix for CVE-2009-3555 (#533125)


author: Joe Orton <jorton@redhat.com> 2.2.11-8
changelog:
  - fix pidfile in httpd.logrotate (thanks to Rainer Traut)
  - don't build mod_mem_cache or mod_file_cache


author: Joe Orton <jorton@redhat.com> 2.2.11-6
changelog:
  - Require: apr-util-ldap (#471898)
  - init script changes: pass pidfile to status(), use status() in
    condrestart (#480602), support try-restart as alias for
    condrestart
  - change /etc/httpd/run symlink to have destination /var/run/httpd,
    and restore "run/httpd.conf" as default PidFile (#478688)


author: Joe Orton <jorton@redhat.com> 2.2.11-3
changelog:
  - update to 2.2.11
  - package new /var/run/httpd directory, and move default pidfile
    location inside there


author: Joe Orton <jorton@redhat.com> 2.2.9-4
changelog:
  - use Charset=UTF-8 in default httpd.conf (#455123)
  - only enable suexec when appropriate (Jim Radford, #453697)


author: Joe Orton <jorton@redhat.com> 2.2.6-3
changelog:
  - add fix for SSL library string regression (PR 43334)
  - use powered-by logo from system-logos (#250676)
  - preserve timestamps for installed config files


author: Joe Orton <jorton@redhat.com> 2.2.4-5
changelog:
  - spec file cleanups: provide httpd-suexec, mod_dav; 
   don't obsolete mod_jk; drop trailing dots from Summaries
  - init script
   * add LSB info header, support force-reload (#246944)
   * update description
   * drop 1.3 config check
   * pass $pidfile to daemon and pidfile everywhere


author: Joe Orton <jorton@redhat.com> 2.2.4-3
changelog:
  - drop old triggers, old Requires, xmlto BR
  - use Requires(...) correctly 
  - use standard BuildRoot 
  - don't mark init script as config file
  - trim CHANGES further


author: Joe Orton <jorton@redhat.com> 2.2.3-5
changelog:
  - updated "powered by Fedora" logo (#205573, Diana Fong)
  - tweak welcome page wording slightly (#205880)


author: Joe Orton <jorton@redhat.com> 2.2.2-5
changelog:
  - require pkgconfig for -devel (#194152)
  - fixes for installed support makefiles (special.mk et al)
  - BR autoconf


author: Joe Orton <jorton@redhat.com> 2.2.0-5.1
changelog:
  - mod_auth_basic/mod_authn_file: if no provider is configured,
    and AuthUserFile is not configured, decline to handle authn
    silently rather than failing noisily.


author: Joe Orton <jorton@redhat.com> 2.2.0-5
changelog:
  - mod_ssl: add security fix for CVE-2005-3357 (#177914)
  - mod_imagemap: add security fix for CVE-2005-3352 (#177913)
  - add fix for AP_INIT_* designated initializers with C++ compilers
  - httpd.conf: enable HTMLTable in default IndexOptions
  - httpd.conf: add more "redirect-carefully" matches for DAV clients


author: Joe Orton <jorton@redhat.com> 2.2.0-2
changelog:
  - don't strip C-L from HEAD responses (Greg Ames, #110552)
  - load mod_proxy_balancer by default
  - add proxy_ajp.conf to load/configure mod_proxy_ajp
  - Obsolete mod_jk
  - update docs URLs in httpd.conf/ssl.conf


author: Joe Orton <jorton@redhat.com> 2.0.54-15
changelog:
  - log notice giving SELinux context at startup if enabled
  - drop SSLv2 and restrict default cipher suite in default
   SSL configuration


author: Joe Orton <jorton@redhat.com> 2.0.54-14
changelog:
  - mod_ssl: add security fix for SSLVerifyClient (CVE-2005-2700)
  - add security fix for byterange filter DoS (CVE-2005-2728)
  - add security fix for C-L vs T-E handling (CVE-2005-2088)
  - mod_ssl: add security fix for CRL overflow (CVE-2005-1268)
  - mod_ldap/mod_auth_ldap: add fixes from 2.0.x branch (upstream #34209 etc)
  - add fix for dummy connection handling (#167425)
  - mod_auth_digest: fix hostinfo comparison in CONNECT requests
  - mod_include: fix variable corruption in nested includes (upstream #12655)
  - mod_ssl: add fix for handling non-blocking reads
  - mod_ssl: fix to enable output buffering (upstream #35279)
  - mod_ssl: buffer request bodies for per-location renegotiation (upstream #12355)


author: Joe Orton <jorton@redhat.com> 2.0.54-11
changelog:
  - mod_dav_fs: fix uninitialized variable (#162144)
  - add epoch to dependencies as appropriate
  - mod_ssl: drop dependencies on dev, make
  - mod_ssl: mark post script dependencies as such


author: Joe Orton <jorton@redhat.com> 2.0.54-7
changelog:
  - mod_userdir: fix memory allocation issue (upstream #34588)
  - mod_ldap: fix memory corruption issue (Brad Nicholes, upstream #34618)


author: Joe Orton <jorton@redhat.com> 2.0.54-5
changelog:
  - create default dummy cert in /etc/pki/tls
  - use a pseudo-random serial number on the dummy cert
  - change default ssl.conf to point at /etc/pki/tls
  - merge back -suexec subpackage; SELinux policy can now be
    used to persistently disable suexec (#155716)
  - drop /etc/httpd/conf/ssl.* directories and Makefiles
  - unconditionally enable PIE support
  - mod_ssl: fix for picking up -shutdown options (upstream #34452)


author: Joe Orton <jorton@redhat.com> 2.0.53-6
changelog:
  - update default httpd.conf:
   * clarify the comments on AddDefaultCharset usage (#135821)
   * remove all the AddCharset default extensions
   * don't load mod_imap by default
   * synch with upstream 2.0.53 httpd-std.conf
  - mod_ssl: set user from SSLUserName in access hook (upstream #31418)
  - htdigest: fix permissions of created files (upstream #33765)
  - remove htsslpass


author: Joe Orton <jorton@redhat.com> 2.0.52-7
changelog:
  - fix cosmetic issues in "service httpd reload"
  - move User/Group higher in httpd.conf (#146793)
  - load mod_logio by default in httpd.conf
  - apachectl: update for correct libselinux tools locations


author: Joe Orton <jorton@redhat.com> 2.0.52-6
changelog:
  - add security fix for CVE CAN-2004-0942 (memory consumption DoS)
  - SELinux: run httpd -t under runcon in configtest (Steven Smalley)
  - fix SSLSessionCache comment for distcache in ssl.conf
  - restart using SIGHUP not SIGUSR1 after logrotate
  - add ap_save_brigade fix (upstream #31247)
  - mod_ssl: fix possible segfault in auth hook (upstream #31848)
  - add htsslpass(1) and configure as default SSLPassPhraseDialog (#128677)
  - apachectl: restore use of $OPTIONS
  - apachectl, httpd.init: refuse to restart if $HTTPD -t fails
  - apachectl: run $HTTPD -t in user SELinux context for configtest
  - update for pcre-5.0 header locations


author: Nalin Dahyabhai <nalin@redhat.com> 1.7.1-10
changelog:
  - add patch to correct GSSAPI library null pointer dereference which could be
    triggered by malformed client requests (CVE-2010-1321, #582466)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - drop patch to suppress key expiration warnings sent from the KDC in
    the last-req field, as the KDC is expected to just be configured to either
    send them or not as a particular key approaches expiration (#556495)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7.1-6
changelog:
  - pull up patch to get the client libraries to correctly perform password
    changes over IPv6 (Sumit Bose, RT#6661)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7.1-5
changelog:
  - fix a null pointer dereference and crash introduced in our PAM patch that
    would happen if ftpd was given the name of a user who wasn't known to the
    local system, limited to being triggerable by gssapi-authenticated clients by
    the default xinetd config (Olivier Fourdan, #569472)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7.1-3
changelog:
  - pull up the change to make kpasswd's behavior better match the docs
    when there's no ccache (#563431)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7.1-1
changelog:
  - update to 1.7.1
    - don't trip AD lockout on wrong password (#542687, #554351)
    - incorporates fixes for CVE-2009-4212 and CVE-2009-3295
    - fixes gss_krb5_copy_ccache() when SPNEGO is used
  - move sim_client/sim_server, gss-client/gss-server, uuclient/uuserver to
    the devel subpackage, better lining up with the expected krb5/krb5-appl
    split in 1.8
  - drop kvno,kadmin,k5srvutil,ktutil from -workstation-servers, as it already
    depends on -workstation which also includes them


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-22
changelog:
  - use portreserve correctly -- portrelease takes the basename of the file
    whose entries should be released, so we need three files, not one


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-21
changelog:
  - suppress warnings of impending password expiration if expiration is more than
    seven days away when the KDC reports it via the last-req field, just as we
    already do when it reports expiration via the key-expiration field (#556495)
  - link with libtinfo rather than libncurses, when we can, in future RHEL


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-20
changelog:
  - krb5_get_init_creds_password: check opte->flags instead of options->flags
    when checking whether or not we get to use the prompter callback (#555875)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-19
changelog:
  - use portreserve to make sure the KDC can always bind to the kerberos-iv
    port, kpropd can always bind to the krb5_prop port, and that kadmind can
    always bind to the kerberos-adm port (#555279)
  - correct inadvertent use of macros in the changelog (rpmlint)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-18
changelog:
  - add upstream patch for integer underflow during AES and RC4 decryption
    (CVE-2009-4212), via Tom Yu (#545015)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-17
changelog:
  - put the conditional back for the -devel subpackage
  - back down to the earlier version of the patch for #551764; the backported
    alternate version was incomplete


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-16
changelog:
  - use %global instead of %define
  - pull up proposed patch for creating previously-not-there lock files for
    kdb databases when 'kdb5_util' is called to 'load' (#551764)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-15
changelog:
  - add upstream patch for KDC crash during referral processing (CVE-2009-3295),
    via Tom Yu (#545002)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move man pages that live in the -libs subpackage into the regular
    %{_mandir} tree where they'll still be found if that package is the
    only one installed (#529319)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-11
changelog:
  - ksu: move account management checks to before we drop privileges, like
    su does (#540769)
  - selinux: set the user part of file creation contexts to match the current
    context instead of what we looked up
  - configure with --enable-dns-for-realm instead of --enable-dns, which isn't
    recognized any more


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-10
changelog:
  - move /etc/pam.d/ksu from krb5-workstation-servers to krb5-workstation,
    where it's actually needed (#538703)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-8
changelog:
  - specify the location of the subsystem lock when using the status() function
    in the kadmind and kpropd init scripts, so that we get the right error when
    we're dead but have a lock file - requires initscripts 8.99 (#521772)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - if the init script fails to start krb5kdc/kadmind/kpropd because it's already
    running (according to status()), return 0 (part of #521772)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - simplify the man pages patch by only preprocessing the files we care about
    and moving shared configure.in logic into a shared function
  - catch the case of ftpd printing file sizes using %i, when they might be
    bigger than an int now


author: Nalin Dahyabhai <nalin@redhat.com> 1.7-4
changelog:
  - try to merge and clean up all the large file support for ftp and rcp
    - ftpd no longer prints a negative length when sending a large file
      from a 32-bit host


author: Nalin Dahyabhai <nalin@redhat.com> 1.7-3
changelog:
  - switch buildrequires: and requires: on e2fsprogs-devel into
    buildrequires: and requires: on libss-devel, libcom_err-devel, per
    sandeen on fedora-devel-list


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix a type mismatch in krb5_copy_error_message()
  - ftp: fix some odd use of strlen()
  - selinux labeling: use selabel_open() family of functions rather than
    matchpathcon(), bail on it if attempting to get the mutex lock fails


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - compile with %{?_smp_mflags} (Steve Grubb)
  - drop the bit where we munge part of the error table header, as it's not
    needed any more


author: Nalin Dahyabhai <nalin@redhat.com> 1.7-1
changelog:
  - update to 1.7
    - no need to work around build issues with ASN1BUF_OMIT_INLINE_FUNCS
    - configure recognizes --enable/--disable-pkinit now
    - configure can take --disable-rpath now
    - no more libdes425, krb524d, krb425.info
    - kadmin/k5srvutil/ktutil are user commands now
    - new kproplog
    - FAST encrypted-challenge plugin is new
  - drop static build logic
  - drop pam_krb5-specific configuration from the default krb5.conf
  - drop only-use-v5 flags being passed to various things started by xinetd
  - put %{krb5prefix}/sbin in everyone's path, too (#504525)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-104
changelog:
  - extend PAM support to ksu: perform account and session management for the
    target user
  - pull up and merge James Leddy's changes to also set PAM_RHOST in PAM-aware
    network-facing services


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-103
changelog:
  - fix a typo in a ksu error message (Marek Mahut)
  - "rev" works the way the test suite expects now, so don't disable tests
    that use it


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-101
changelog:
  - add patches for read overflow and null pointer dereference in the
    implementation of the SPNEGO mechanism (CVE-2009-0844, CVE-2009-0845)
  - add patch for attempt to free uninitialized pointer in libkrb5
    (CVE-2009-0846)
  - add patch to fix length validation bug in libkrb5 (CVE-2009-0847)
  - put the krb5-user .info file into just -workstation and not also
    -workstation-clients


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-100
changelog:
  - turn off krb4 support (it won't be part of the 1.7 release, but do it now)
  - use triggeruns to properly shut down and disable krb524d when -server and
    -workstation-servers gets upgraded, because it's gone now
  - move the libraries to /%{_lib}, but leave --libdir alone so that plugins
    get installed and are searched for in the same locations (#473333)
  - clean up buildprereq/prereqs, explicit mktemp requires, and add the
    ldconfig for the -server-ldap subpackage (part of #225974)
  - escape possible macros in the changelog (part of #225974)
  - fixup summary texts (part of #225974)
  - take the execute bit off of the protocol docs (part of #225974)
  - unflag init scripts as configuration files (part of #225974)
  - make the kpropd init script treat 'reload' as 'restart' (part of #225974)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-19
changelog:
  - libgssapi_krb5: backport fix for some errors which can occur when
    we fail to set up the server half of a context (CVE-2009-0845)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - if we successfully change the user's password during an attempt to get
    initial credentials, but then fail to get initial creds from a non-master
    using the new password, retry against the master (#432334)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - clear fuzz out of patches, dropping a man page patch which is no longer
    necessary
  - quote %{__cc} where needed because it includes whitespace now
  - define ASN1BUF_OMIT_INLINE_FUNCS at compile-time (for now) to keep building


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-15
changelog:
  - build with -fno-strict-aliasing, which is needed because the library
    triggers these warnings
  - don't forget to label principal database lock files
  - fix the labeling patch so that it doesn't break bootstrapping


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-12
changelog:
  - stop exporting kadmin keys to a keytab file when kadmind starts -- the
    daemon's been able to use the database directly for a long long time now
  - belatedly add aes128,aes256 to the default set of supported key types


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-11
changelog:
  - libgssapi_krb5: properly export the acceptor subkey when creating a lucid
    context (Kevin Coffman, via the nfs4 mailing list)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-10
changelog:
  - add fixes from MITKRB5-SA-2008-001 for use of null or dangling pointer
    when v4 compatibility is enabled on the KDC (CVE-2008-0062, CVE-2008-0063,
    - add fixes from MITKRB5-SA-2008-002 for array out-of-bounds accesses when
    high-numbered descriptors are used (CVE-2008-0947, #433596)
  - add backport bug fix for an attempt to free non-heap memory in
    libgssapi_krb5 (CVE-2007-5901, #415321)
  - add backport bug fix for a double-free in out-of-memory situations in
    libgssapi_krb5 (CVE-2007-5971, #415351)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-9
changelog:
  - rework file labeling patch to not depend on fragile preprocessor trickery,
    in another attempt at fixing #428355 and friends


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-8
changelog:
  - ftp: add patch to fix "runique on" case when globbing fixes applied
  - stop adding a redundant but harmless call to initialize the gssapi internals


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add patch to suppress double-processing of /etc/krb5.conf when we build
    with --sysconfdir=/etc, thereby suppressing double-logging (#231147)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove a patch, to fix problems with interfaces which are "up" but which
    have no address assigned, which conflicted with a different fix for the same
    problem in 1.5 (#200979)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - in login, allow PAM to interact with the user when they've been strongly
    authenticated
  - in login, signal PAM when we're changing an expired password that it's an
    expired password, so that when cracklib flags a password as being weak it's
    treated as an error even if we're running as root


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-7
changelog:
  - drop netdb patch
  - kdb_ldap: add patch to treat 'nsAccountLock: true' as an indication that
    the DISALLOW_ALL_TIX flag is set on an entry, for better interop with Fedora,
    Netscape, Red Hat Directory Server (Simo Sorce)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-5
changelog:
  - enable patch for key-expiration reporting
  - enable patch to make kpasswd fall back to TCP if UDP fails (#251206)
  - enable patch to make kpasswd use the right sequence number on retransmit
  - enable patch to allow mech-specific creds delegated under spnego to be found
    when searching for creds


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-4
changelog:
  - some init script cleanups
    - drop unquoted check and silent exit for "$NETWORKING" (#426852, #242502)
    - krb524: don't barf on missing database if it looks like we're using kldap,
      same as for kadmin
    - return non-zero status for missing files which cause startup to
      fail (#242502)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-3
changelog:
  - allocate space for the nul-terminator in the local pathname when looking up
    a file context, and properly free a previous context (Jose Plans, #426085)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-1
changelog:
  - update to 1.6.3, dropping now-integrated patches for CVE-2007-3999
    and CVE-2007-4000 (the new pkinit module is built conditionally and goes
    into the -pkinit-openssl package, at least for now, to make a buildreq
    loop with openssl avoidable)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make krb5.conf %verify(not md5 size mtime) in addition to
    %config(noreplace), like /etc/nsswitch.conf (#329811)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.2-9
changelog:
  - apply the fix for CVE-2007-4000 instead of the experimental patch for
    setting ok-as-delegate flags


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.2-7
changelog:
  - also perform PAM session and credential management when ftpd accepts a
    client using strong authentication, missed earlier
  - also label kadmind log files and files created by the db2 plugin


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.2-6
changelog:
  - incorporate updated fix for CVE-2007-3999 (CVE-2007-4743)
  - fix incorrect call to "test" in the kadmin init script (#252322,#287291)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-8
changelog:
  - incorporate fixes for MITKRB5-SA-2007-004 (CVE-2007-2442,CVE-2007-2443)
    and MITKRB5-SA-2007-005 (CVE-2007-2798)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - perform PAM account / session management in krshd (#182195,#195922)
  - perform PAM authentication and account / session management in ftpd
  - perform PAM authentication, account / session management, and password-
    changing in login.krb5 (#182195,#195922)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - preprocess kerberos.ldif into a format FDS will like better, and include
    that as a doc file as well


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - switch man pages to being generated with the right paths in them
  - drop old, incomplete SELinux patch
  - add patch from Greg Hudson to make srvtab routines report missing-file errors
    at same point that keytab routines do (#241805)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-2
changelog:
  - pull patch from svn to undo unintentional chattiness in ftp
  - pull patch from svn to handle NULL krb5_get_init_creds_opt structures
    better in a couple of places where they're expected


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-1
changelog:
  - update to 1.6.1
    - drop no-longer-needed patches for CVE-2007-0956,CVE-2007-0957,CVE-2007-1216
    - drop patch for sendto bug in 1.6, fixed in 1.6.1


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - kadmind.init: don't fail outright if the default principal database
    isn't there if it looks like we might be using the kldap plugin
  - kadmind.init: attempt to extract the key for the host-specific kadmin
    service when we try to create the keytab


author: Nalin Dahyabhai <nalin@redhat.com> 1.6-6
changelog:
  - omit dependent libraries from the krb5-config --libs output, as using
    shared libraries (no more static libraries) makes them unnecessary and
    they're not part of the libkrb5 interface (patch by Rex Dieter, #240220)
    (strips out libkeyutils, libresolv, libdl)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6-4
changelog:
  - fix an uninitialized length value which could cause a crash when parsing
    key data coming from a directory server
  - correct a typo in the krb5.conf man page ("ldap_server"->"ldap_servers")


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move the default acl_file, dict_file, and admin_keytab settings to
    the part of the default/example kdc.conf where they'll actually have
    an effect (#236417)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6-3
changelog:
  - add patch to correct unauthorized access via krb5-aware telnet
    daemon (#229782, CVE-2007-0956)
  - add patch to fix buffer overflow in krb5kdc and kadmind
    (#231528, CVE-2007-0957)
  - add patch to fix double-free in kadmind (#231537, CVE-2007-1216)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6-2
changelog:
  - add buildrequires: on keyutils-libs-devel to enable use of keyring ccaches,
    dragging keyutils-libs in as a dependency


author: Nalin Dahyabhai <nalin@redhat.com> 1.5-22
changelog:
  * Thu Mar 15 2007 Nalin Dahyabhai <nalin@redhat.com> 1.5-21
  - add preliminary patch to fix buffer overflow in krb5kdc and kadmind
    (#231528, CVE-2007-0957)
  - add preliminary patch to fix double-free in kadmind (#231537, CVE-2007-1216)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.5-20
changelog:
  - temporarily back out %post changes, fix for #143289 for security update
  - add preliminary patch to correct unauthorized access via krb5-aware telnet


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - initial update to 1.6, pre-package-reorg
  - move workstation daemons to a new subpackage (#81836, #216356, #217301), and
    make the new subpackage require xinetd (#211885)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.5-18
changelog:
  - make use of install-info more failsafe (Ville Skyttä, #223704)
  - preserve timestamps on shell scriptlets at %install-time


author: Nalin Dahyabhai <nalin@redhat.com> - 1.5-14
changelog:
  - apply fixes from Tom Yu for MITKRB5-SA-2006-002 (CVE-2006-6143) (#218456)
  - apply fixes from Tom Yu for MITKRB5-SA-2006-003 (CVE-2006-6144) (#218456)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update backport of the preauth module interface
  - add proposed patches 4566, 4567
  - add proposed edata reporting interface for KDC
  - add temporary placeholder for module global context fixes


author: Nalin Dahyabhai <nalin@redhat.com> - 1.5-11
changelog:
  - don't bail from the KDC init script if there's no database, it may be in
    a different location than the default (fenlason)
  - remove the [kdc] section from the default krb5.conf -- doesn't seem to have
    been applicable for a while


author: Nalin Dahyabhai <nalin@redhat.com> - 1.5-10
changelog:
  - rename krb5.sh and krb5.csh so that they don't overlap (#210623)
  - way-late application of added error info in kadmind.init (#65853)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.5-4
changelog:
  - ensure that the gssapi library's been initialized before walking the
    internal mechanism list in gss_release_oid(), needed if called from
    gss_release_name() right after a gss_import_name() (#198092)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.3-7
changelog:
  - further munge krb5-config so that 'libdir=/usr/lib' is given even on 64-bit
    architectures, to avoid multilib conflicts; other changes will conspire to
    strip out the -L flag which uses this, so it should be harmless (#192692)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.3-6
changelog:
  - adjust the patch which removes the use of rpath to also produce a
    krb5-config which is okay in multilib environments (#190118)
  - make the name-of-the-tempfile comment which compile_et adds to error code
    headers always list the same file to avoid conflicts on multilib installations
  - strip SIZEOF_LONG out of krb5.h so that it doesn't conflict on multilib boxes
  - strip GSS_SIZEOF_LONG out of gssapi.h so that it doesn't conflict on mulitlib
    boxes


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.3-4
changelog:
  - give a little bit more information to the user when kinit gets the catch-all
    I/O error (#180175)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.3-3
changelog:
  - rebuild properly when pthread_mutexattr_setrobust_np() is defined but not
    declared, such as with recent glibc when _GNU_SOURCE isn't being used


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - login: don't truncate passwords before passing them into crypt(), in
    case they're significant (#149476)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.2-3
changelog:
  - add an xinetd configuration file for encryption-only telnetd, parallelling
    the kshell/ekshell pair (#167535)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.2-2
changelog:
  - change the default configured encryption type for KDC databases to the
    compiled-in default of des3-hmac-sha1 (#57847)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.1-5
changelog:
  - fix telnet client environment variable disclosure the same way NetKit's
    telnet client did (CAN-2005-0488) (#159305)
  - keep apps which call krb5_principal_compare() or krb5_realm_compare() with
    malformed or NULL principal structures from crashing outright (Thomas Biege)
    (#161475)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - apply fixes from draft of MIT-KRB5-SA-2005-002 (CAN-2005-1174,CAN-2005-1175)
    (#157104)
  - apply fixes from draft of MIT-KRB5-SA-2005-003 (CAN-2005-1689) (#159755)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.1-4
changelog:
  - fix double-close in keytab handling
  - add port of fixes for CAN-2004-0175 to krb5-aware rcp (#151612)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.1-3
changelog:
  - prevent spurious EBADF in krshd when stdin is closed by the client while
    the command is running (#151111)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.1-1
changelog:
  - update to 1.4.1, incorporating fixes for CAN-2005-0468 and CAN-2005-0469
  - when starting the KDC or kadmind, if KRB5REALM is set via the /etc/sysconfig
    file for the service, pass it as an argument for the -r flag


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add draft fix from Tom Yu for slc_add_reply() buffer overflow (CAN-2005-0469)
  - add draft fix from Tom Yu for env_opt_add() buffer overflow (CAN-2005-0468)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4-1
changelog:
  - update to 1.4
    - v1.4 kadmin client requires a v1.4 kadmind on the server, or use the "-O"
      flag to specify that it should communicate with the server using the older
      protocol
    - new libkrb5support library
    - v5passwdd and kadmind4 are gone
    - versioned symbols
  - pick up $KRB5KDC_ARGS from /etc/sysconfig/krb5kdc, if it exists, and pass
    it on to krb5kdc
  - pick up $KADMIND_ARGS from /etc/sysconfig/kadmin, if it exists, and pass
    it on to kadmind
  - pick up $KRB524D_ARGS from /etc/sysconfig/krb524, if it exists, and pass
    it on to krb524d *instead of* "-m"
  - set "forwardable" in [libdefaults] in the default krb5.conf to match the
    default setting which we supply for pam_krb5
  - set a default of 24h for "ticket_lifetime" in [libdefaults], reflecting the
    compiled-in default


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - silence compiler warning in kprop by using an in-memory ccache with a fixed
    name instead of an on-disk ccache with a name generated by tmpnam()


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove rc4-hmac:norealm and rc4-hmac:onlyrealm from the default list of
    supported keytypes in kdc.conf -- they produce exactly the same keys as
    rc4-hmac:normal because rc4 string-to-key ignores salts
  - nuke kdcrotate -- there are better ways to balance the load on KDCs, and
    the SELinux policy for it would have been scary-looking
  - update to 1.3.5, mainly to include MITKRB5SA 2004-002 and 2004-003


author: Nalin Dahyabhai <nalin@redhat.com> 1.3.4-3
changelog:
  - incorporate fixes from Tom Yu for CAN-2004-0642, CAN-2004-0772
    (MITKRB5-SA-2004-002, #130732)
  - incorporate fixes from Tom Yu for CAN-2004-0644 (MITKRB5-SA-2004-003, #130732)


author: Nalin Dahyabhai <nalin@redhat.com> 1.3.3-2
changelog:
  - re-enable large file support, fell out in 1.3-1
  - patch rcp to use long long and %lld format specifiers when reporting file
    sizes on large files


author: Nalin Dahyabhai <nalin@redhat.com> 1.3.1-9
changelog:
  - remove patch to set TERM in klogind which, combined with the upstream fix in
    1.3.1, actually produces the bug now (#114762)


author: Nalin Dahyabhai <nalin@redhat.com> 1.3.1-8
changelog:
  - when iterating over lists of interfaces which are "up" from getifaddrs(),
    skip over those which have no address (#113347)


author: Nalin Dahyabhai <nalin@redhat.com> 1.3.1-6
changelog:
  - fix bug in patch to make rlogind start login with a clean environment a la
    netkit rlogin, spotted and fixed by Scott McClung


author: Nalin Dahyabhai <nalin@redhat.com> 1.3.1-5
changelog:
  - include profile.d scriptlets in krb5-devel so that krb5-config will be in
    the path if krb5-workstation isn't installed, reported by Kir Kolyshkin


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add more etypes (arcfour) to the default enctype list in kdc.conf
  - don't apply previous patch, refused upstream


author: Nalin Dahyabhai <nalin@redhat.com> 1.3-2
changelog:
  - pull fix for non-compliant encoding of salt field in etype-info2 preauth
    data from 1.3.1 beta 1, until 1.3.1 is released.


author: Nalin Dahyabhai <nalin@redhat.com> 1.3-0.beta.4
changelog:
  - test update to 1.3 beta 4
  - ditch statglue build option
  - krb5-devel requires e2fsprogs-devel, which now provides libss and libcom_err


author: Jakub Jelinek <jakub@redhat.com> 1.2.7-2
changelog:
  - always #include <errno.h> to access errno, never do it directly
  - enable LFS on a bunch of other 32-bit arches


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - increase the maximum name length allowed by kuserok() to the higher value
    used in development versions


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - install src/krb524/README as README.krb524 in the -servers package,
    includes information about converting for AFS principals


author: Nalin Dahyabhai <nalin@redhat.com> 1.2.6-2
changelog:
  - remove hashless key types from the default kdc.conf, they're not supposed to
    be there, noted by Sam Hartman on krbdev


author: Nalin Dahyabhai <nalin@redhat.com> 1.2.3-1
changelog:
  - rename the krb5 package back to krb5-libs; the previous rename caused
    something of an uproar
  - update to 1.2.3, which includes the FTP and telnetd fixes
  - configure without --enable-dns-for-kdc --enable-dns-for-realm, which now set
    the default behavior instead of enabling the feature (the feature is enabled
    by --enable-dns, which we still use)
  - reenable optimizations on Alpha
  - support more encryption types in the default kdc.conf (heads-up from post
    to comp.protocols.kerberos by Jason Heiss)


author: Nalin Dahyabhai <nalin@redhat.com> 1.2.2-14
changelog:
  - rename the krb5-libs package to krb5 (naming a subpackage -libs when there
    is no main package is silly)
  - move defaults for PAM to the appdefaults section of krb5.conf -- this is
    the area where the krb5_appdefault_* functions look for settings)
  - disable statglue (warning: breaks binary compatibility with previous
    packages, but has to be broken at some point to work correctly with
    unpatched versions built with newer versions of glibc)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add patch to support "ANY" keytab type (i.e.,
    "default_keytab_name = ANY:FILE:/etc/krb5.keytab,SRVTAB:/etc/srvtab"
    patch from Gerald Britton, #42551)
  - build with -D_FILE_OFFSET_BITS=64 to get large file I/O in ftpd (#30697)
  - patch ftpd to use long long and %lld format specifiers to support the SIZE
    command on large files (also #30697)
  - don't use LOG_AUTH as an option value when calling openlog() in ksu (#45965)
  - implement reload in krb5kdc and kadmind init scripts (#41911)
  - lose the krb5server init script (not using it any more)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 1.2.2, which fixes some bugs relating to empty ETYPE-INFO
  - re-enable optimization on Alpha


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix krb5-send-pr (#18932) and move it from -server to -workstation
  - buildprereq libtermcap-devel
  - temporariliy disable optimization on alphas
  - gettextize init scripts


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make krb5-libs obsolete the old krb5-configs package (#18351)
  - don't quit from the kpropd init script if there's no principal database so
    that you can propagate the first time without running kpropd manually
  - don't complain if /etc/ld.so.conf doesn't exist in the -libs %post


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix credential forwarding problem in klogind (goof in KRB5CCNAME handling)
    (#11588)
  - fix heap corruption bug in FTP client (#14301)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix summaries and descriptions
  - switched the default transfer protocol from PORT to PASV as proposed on
    bugzilla (#16134), and to match the regular ftp package's behavior


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - disable servers by default to keep linuxconf from thinking they need to be
    started when they don't


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move condrestarts to postun
  - make xinetd configs noreplace
  - add descriptions to xinetd configs
  - add /etc/init.d as a prereq for the -server package
  - patch to properly truncate $TERM in krlogind


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 1.2.1
  - back out Tom Yu's patch, which is a big chunk of the 1.2 -> 1.2.1 update
  - start using the official source tarball instead of its contents


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Tom Yu's patch to fix compatibility between 1.2 kadmin and 1.1.1 kadmind
  - pull out 6.2 options in the spec file (sonames changing in 1.2 means it's not
    compatible with other stuff in 6.2, so no need)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to the 1.2 release
  - ditch a lot of our patches which went upstream
  - enable use of DNS to look up things at build-time
  - disable use of DNS to look up things at run-time in default krb5.conf
  - change ownership of the convert-config-files script to root.root
  - compress PS docs
  - fix some typos in the kinit man page
  - run condrestart in server post, and shut down in preun


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - patch mkdir/rmdir problem in ftpcmd.y
  - add condrestart option to init script
  - split the server init script into three pieces and add one for kpropd


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - apply second set of buffer overflow fixes from Tom Yu
  - fix from Dirk Husung for a bug in buffer cleanups in the test suite
  - work around possibly broken rev binary in running test suite
  - move default realm configs from /var/kerberos to %{_var}/kerberos


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - use %{_infodir} to better comply with FHS
  - move .so files to -devel subpackage
  - tweak xinetd config files (bugs #11833, #11835, #11836, #11840)
  - fix package descriptions again


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change a LINE_MAX to 1024, fix from Ken Raeburn
  - add fix for login vulnerability in case anyone rebuilds without krb4 compat
  - add tweaks for byte-swapping macros in krb.h, also from Ken
  - add xinetd config files
  - make rsh and rlogin quieter
  - build with debug to fix credential forwarding
  - add rsh as a build-time req because the configure scripts look for it to
    determine paths


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove setuid bit on v4rcp and ksu in case the checks previously added
    don't close all of the problems in ksu
  - apply patches from Jeffrey Schiller to fix overruns Chris Evans found
  - reintroduce configs subpackage for use in the errata
  - add PreReq: sh-utils


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix double-free in the kdc (patch merged into MIT tree)
  - include convert-config-files script as a documentation file


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - patch ksu man page because the -C option never works
  - add access() checks and disable debug mode in ksu
  - modify default ksu build arguments to specify more directories in CMD_PATH
    and to use getusershell()


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add LDCOMBINE=-lc to configure invocation to use libc versioning (bug #10653)
  - change Requires: for/in subpackages to include %{version}


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Merge krb5-configs back into krb5-libs.  The krb5.conf file is marked as
    a %config file anyway.
  - Make krb5.conf a noreplace config file.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't enable the server by default.
  - Compress info pages.
  - Add defaults for the PAM module to krb5.conf


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Correct copyright: it's exportable now, provided the proper paperwork is
    filed with the government.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - apply Mike Friedman's patch to fix format string problems
  - don't strip off argv[0] when invoking regular rsh/rlogin


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - tweak server init script to automatically extract kadm5 keys if
    /var/kerberos/krb5kdc/kadm5.keytab doesn't exist yet
  - adjust package descriptions


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - patch around TIOCGTLC defined on alpha and remove warnings from libpty.h
  - add installation of info docs
  - remove krb4 compat patch because it doesn't fix workstation-side servers


author: Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
changelog:
  - clean up init script for server, verify that it works [jlkatz]
  - clean up rotation script so that rc likes it better
  - add clean stanza


author: Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
changelog:
  - backed out ncurses and makeshlib patches
  - update for krb5-1.1
  - add KDC rotation to rc.boot, based on ideas from Michael's C version


author: Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
changelog:
  - started changelog (previous package from zedz.net)
  - updated existing 1.0.5 RPM from Eos Linux to krb5 1.0.6
  - added --force to makeinfo commands to skip errors during build


author: Mitchell Berger <mitchb@mit.edu> - 4.0.0-4.1489M.svn20100223
changelog:
  - Update to new original upstream version (svn snapshot)
  - Drop install-headers patch which was incorporated upstream (from Debathena)


author: Mitchell Berger <mitchb@mit.edu> - 4.0.0-3.1405M.svn20100104
changelog:
  - Update to new original upstream version (svn snapshot)
  - Build and install libmrclient as a shared library (from Debathena)


author: Mitchell Berger <mitchb@mit.edu> 1.9-1
changelog:
  - Per Fedora packaging guidelines, don't ever remove groups.
  - Rebuild to ensure that the nss-nonlocal-users group is added, even if it was
    previously rejected by a buggy groupadd with an incorrect name length limit.


author: Jan F. Chadima <jchadima@redhat.com> - 5.2p1-28
changelog:
  - Repair initscript to be acord to guidelines (#521860)
  - Add bugzilla# to application of edns and xmodifiers patch


author: Jan F. Chadima <jchadima@redhat.com> - 5.2p1-20
changelog:
  - merged xmodifiers to redhat patch
  - merged gssapi-role to selinux patch
  - merged cve-2007_3102 to audit patch
  - sesftp patch only with WITH_SELINUX flag
  - rearange sesftp patch according to upstream request


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-5
changelog:
  - remove obsolete --with-rsh (#478298)
  - add pam_sepermit to allow blocking confined users in permissive mode
    (#471746)
  - move system-auth after pam_selinux in the session stack


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-4
changelog:
  - set FD_CLOEXEC on channel sockets (#475866)
  - adjust summary
  - adjust nss-keys patch so it is applicable without selinux patches (#470859)


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-1
changelog:
  - upgrade to new upstream release
  - fixed a problem with public key authentication and explicitely
    specified SELinux role


author: Tomas Mraz <tmraz@redhat.com> - 5.0p1-2
changelog:
  - add LANGUAGE to accepted/sent environment variables (#443231)
  - use pam_selinux to obtain the user context instead of doing it itself
  - unbreak server keep alive settings (patch from upstream)
  - small addition to scp manpage


author: Tomas Mraz <tmraz@redhat.com> - 5.0p1-1
changelog:
  - upgrade to new upstream (#441066)
  - prevent initscript from killing itself on halt with upstart (#438449)
  - initscript status should show that the daemon is running
    only when the main daemon is still alive (#430882)


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-10
changelog:
  - fix race on control master and cleanup stale control socket (#436311)
    patches by David Woodhouse


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-9
changelog:
  - set FD_CLOEXEC on client socket
  - apply real fix for window size problem (#286181) from upstream
  - apply fix for the spurious failed bind from upstream
  - apply open handle leak in sftp fix from upstream


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-4
changelog:
  - do not copy /etc/localtime into the chroot as it is not
    necessary anymore (#193184)
  - call setkeycreatecon when selinux context is established
  - test for NULL privk when freeing key (#391871) - patch by
    Pierre Ossman


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-1
changelog:
  - upgrade to latest upstream
  - use libedit in sftp (#203009)
  - fixed audit log injection problem (CVE-2007-3102)


author: Tomas Mraz <tmraz@redhat.com> - 4.5p1-8
changelog:
  - fix sftp client problems on write error (#247802)
  - allow disabling autocreation of server keys (#235466)


author: Tomas Mraz <tmraz@redhat.com> - 4.5p1-2
changelog:
  - support mls on labeled networks (#220487)
  - support mls level selection on unlabeled networks
  - allow / in usernames in scp (only beginning /, ./, and ../ is special)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-13
changelog:
  - improved pam_session patch so it doesn't regress, the patch is necessary
    for the pam_session_close to be called correctly as uid 0


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-11
changelog:
  - merge sshd initscript patches
  - kill all ssh sessions when stop is called in halt or reboot runlevel
  - remove -TERM option from killproc so we don't race on sshd restart


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-10
changelog:
  - improve gssapi-no-spnego patch (#208102)
  - CVE-2006-4924 - prevent DoS on deattack detector (#207957)
  - CVE-2006-5051 - don't call cleanups from signal handler (#208459)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-9
changelog:
  - don't report duplicate syslog messages, use correct local time (#189158)
  - don't allow spnego as gssapi mechanism (from upstream)
  - fixed memleaks found by Coverity (from upstream)
  - allow ip options except source routing (#202856) (patch by HP)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-8
changelog:
  - drop the pam-session patch from the previous build (#201341)
  - don't set IPV6_V6ONLY sock opt when listening on wildcard addr (#201594)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-7
changelog:
  - dropped old ssh obsoletes
  - call the pam_session_open/close from the monitor when privsep is
    enabled so it is always called as root (patch by Darren Tucker)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-6
changelog:
  - improve selinux patch (by Jan Kiszka)
  - upstream patch for buffer append space error (#191940)
  - fixed typo in configure.ac (#198986)
  - added pam_keyinit to pam configuration (#198628)
  - improved error message when askpass dialog cannot grab
    keyboard input (#198332)
  - buildrequires xauth instead of xorg-x11-xauth
  - fixed a few rpmlint warnings


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-3
changelog:
  - enable the subprocess in chroot to send messages to system log
  - sshd should prevent login if audit call fails


author: Tomas Mraz <tmraz@redhat.com> - 4.3p1-2
changelog:
  - fixed another place where syslog was called in signal handler
  - pass locale environment variables to server, accept them there (#179851)


author: Tomas Mraz <tmraz@redhat.com> - 4.2p1-9
changelog:
  - drop x11-ssh-askpass from the package
  - drop old build_6x ifs from spec file
  - improve gnome-ssh-askpass so it doesn't reveal number of passphrase 
    characters to person looking at the display
  - less hackish fix for the __USE_GNU problem


author: Nalin Dahyabhai <nalin@redhat.com> - 4.2p1-8
changelog:
  - work around missing gccmakedep by wrapping makedepend in a local script
  - remove now-obsolete build dependency on "xauth"


author: Warren Togami <wtogami@redhat.com> - 4.2p1-7
changelog:
  - xorg-x11-devel -> libXt-devel
  - rebuild for new xauth location so X forwarding works
  - buildreq audit-libs-devel
  - buildreq automake for aclocal
  - buildreq imake for xmkmf
  -  -D_GNU_SOURCE in flags in order to get it to build
     Ugly hack to workaround openssh defining __USE_GNU which is
     not allowed and causes problems according to Ulrich Drepper
     fix this the correct way after FC5test1


author: Tomas Mraz <tmraz@redhat.com> 4.2p1-2
changelog:
  - use include instead of pam_stack in pam config
  - use fork+exec instead of system in scp - CVE-2006-0225 (#168167)
  - upstream patch for displaying authentication errors


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-5
changelog:
  - use x11-ssh-askpass if openssh-askpass-gnome is not installed (#165207)
  - install ssh-copy-id from contrib (#88707)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-4
changelog:
  - don't deadlock on exit with multiple X forwarded channels (#152432)
  - don't use X11 port which can't be bound on all IP families (#163732)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-3
changelog:
  - fix small regression caused by the nologin patch (#161956)
  - fix race in getpeername error checking (mindrot #1054)


author: Tomas Mraz <tmraz@redhat.com> 4.0p1-2
changelog:
  - fixed Local/RemoteForward in ssh_config.5 manpage
  - fix fatal when Local/RemoteForward is used and scp run (#153258)
  - don't leak user validity when using krb5 authentication


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-11
changelog:
  - don't call syslog in signal handler
  - allow password authentication when copying from remote
    to remote machine (#103364)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-10
changelog:
  - enable trusted forwarding by default if X11 forwarding is 
    required by user (#137685 and duplicates)
  - disable protocol 1 support by default in sshd server config (#88329)
  - keep the gnome-askpass dialog above others (#69131)


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - change permissions on pam.d/sshd to 0644 (#64697)
  - patch initscript so it doesn't kill opened sessions if
    the sshd daemon isn't running anymore (#67624)


author: Nalin Dahyabhai <nalin@redhat.com> 3.9p1-8
changelog:
  - add a --enable-vendor-patchlevel option which allows a ShowPatchLevel option
    to enable display of a vendor patch level during version exchange (#120285)
  - configure with --disable-strip to build useful debuginfo subpackages


author: Nalin Dahyabhai <nalin@redhat.com> 3.8.1p1-1
changelog:
  - request gssapi-with-mic by default but not delegation (flag day for anyone
    who used previous gssapi patches)
  - no longer request x11 forwarding by default


author: Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-34
changelog:
  * Wed Mar 03 2004 Phil Knirsch <pknirsch@redhat.com> 3.6.1p2-33.30.1
  - Built RHLE3 U2 update package.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - additional fix for apparently-never-happens double-free in buffer_free()
  - extend fix for #103998 to cover SSH1


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-11
changelog:
  - apply patch to store the correct buffer size in allocated buffers
    (CAN-2003-0693)
  - skip the initial PAM authentication attempt with an empty password if
    empty passwords are not permitted in our configuration (#103998)


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-6
changelog:
  - modify patch which clears the supplemental group list at startup to only
    complain if setgroups() fails if sshd has euid == 0
  - handle krb5 installed in %{_prefix} or elsewhere by using krb5-config


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-6
changelog:
  - move scp to the -clients subpackage, because it directly depends on ssh
    which is also in -clients (#84329)


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-2
changelog:
  - patch PAM configuration to use relative path names for the modules, allowing
    us to not worry about which arch the modules are built for on multilib systems


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-2
changelog:
  - rework the close-on-exit docs
  - include configuration file man pages
  - make use of nologin as the privsep shell optional


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-1
changelog:
  - update to 3.3p1
  - merge in spec file changes from upstream (remove setuid from ssh, ssh-keysign)
  - disable gtk2 askpass
  - require pam-devel by filename rather than by package for erratum
  - include patch from Solar Designer to work around anonymous mmap failures


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-4
changelog:
  - drop buildreq on db1-devel
  - require pam-devel by package name
  - require autoconf instead of autoconf253 again


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-3
changelog:
  - pull patch from CVS to avoid printing error messages when some of the
    default keys aren't available when running ssh-add
  - refresh to current revisions of Simon's patches


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2gss
changelog:
  - reintroduce Simon's gssapi patches
  - add buildprereq for autoconf253, which is needed to regenerate configure
    after applying the gssapi patches
  - refresh to the latest version of Markus's patch to build properly with
    older versions of OpenSSL


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-1
changelog:
  - require sharutils for building (mindrot #137)
  - require db1-devel only when building for 6.x (#55105), which probably won't
    work anyway (3.1 requires OpenSSL 0.9.6 to build), but what the heck
  - require pam-devel by file (not by package name) again
  - add Markus's patch to compile with OpenSSL 0.9.5a (from
    http://bugzilla.mindrot.org/show_bug.cgi?id=141) and apply it if we're
    building for 6.x


author: Nalin Dahyabhai <nalin@redhat.com> SNAP-20020220
changelog:
  - update to SNAP-20020220 for testing purposes (you've been warned, if there's
    anything to be warned about, gss patches won't apply, I don't mind)


author: Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-3
changelog:
  - add patches from Simon Wilkinson and Nicolas Williams for GSSAPI key
    exchange, authentication, and named key support


author: Nalin Dahyabhai <nalin@redhat.com> 3.0p1-1
changelog:
  - merge some of Damien Miller <djm@mindrot.org> changes from the upstream
    3.0p1 spec file and init script


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 3.0p1
  - update to x11-ssh-askpass 1.2.4.1
  - change build dependency on a file from pam-devel to the pam-devel package
  - replace primes with moduli


author: Nalin Dahyabhai <nalin@redhat.com> 2.9p2-7
changelog:
  - fix scp's server's reporting of file sizes, and build with the proper
    preprocessor define to get large-file capable open(), stat(), etc.
    (sftp has been doing this correctly all along) (#51827)
  - configure without --with-ipv4-default on RHL 7.x and newer (#45987,#52247)
  - pull cvs patch to fix support for /etc/nologin for non-PAM logins (#47298)
  - mark profile.d scriptlets as config files (#42337)
  - refer to Jason Stone's mail for zsh workaround for exit-hanging quasi-bug
  - change a couple of log() statements to debug() statements (#50751)
  - pull cvs patch to add -t flag to sshd (#28611)
  - clear fd_sets correctly (one bit per FD, not one byte per FD) (#43221)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pull cvs patch to add session initialization to no-pty sessions
  - pull cvs patch to not cut off challengeresponse auth needlessly
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed (#49263)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change Copyright: BSD to License: BSD
  - add Markus Friedl's unverified patch for the cookie file deletion problem
    so that we can verify it
  - drop patch to check if xauth is present (was folded into cookie patch)
  - don't apply gssapi patches for the errata candidate
  - clear supplemental groups list at startup


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix an error parsing the new default sshd_config
  - add a fix from Markus Friedl (via openssh-unix-dev) for ssh-keygen not
    dealing with comments right


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add in Simon Wilkinson's GSSAPI patch to give it some testing in-house,
    to be removed before the next beta cycle because it's a big departure
    from the upstream version


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - finish marking strings in the init script for translation
  - modify init script to source /etc/sysconfig/sshd and pass $OPTIONS to sshd
    at startup (change merged from openssh.com init script, originally by
    Pekka Savola)
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed


author: Preston Brown <pbrown@redhat.com>
changelog:
  - remove explicit openssl requirement, fixes builddistro issue
  - make initscript stop() function wait until sshd really dead to avoid 
    races in condrestart


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - mention that challengereponse supports PAM, so disabling password doesn't
    limit users to pubkey and rsa auth (#34378)
  - bypass the daemon() function in the init script and call initlog directly,
    because daemon() won't start a daemon it detects is already running (like
    open connections)
  - require the version of openssl we had when we were built


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make do_pam_setcred() smart enough to know when to establish creds and
    when to reinitialize them
  - add in a couple of other fixes from Damien for inclusion in the errata


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p2
  - call setcred() again after initgroups, because the "creds" could actually
    be group memberships


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p1 (includes endianness fixes in the rijndael implementation)
  - don't enable challenge-response by default until we find a way to not
    have too many userauth requests (we may make up to six pubkey and up to
    three password attempts as it is)
  - remove build dependency on rsh to match openssh.com's packages more closely


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Revert the patch to move pam_open_session.
  - Init script and spec file changes from Pekka Savola. (#28750)
  - Patch sftp to recognize '-o protocol' arguments. (#29540)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Chuck the closing patch.
  - Add a trigger to add host keys for protocol 2 to the config file, now that
    configuration file syntax requires us to specify it with HostKey if we
    specify any other HostKey values, which we do.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Redo patch to move pam_open_session after the server setuid()s to the user.
  - Rework the nopam patch to use be picked up by autoconf.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.1p1.
  - Add init script mods from Pekka Savola.
  - Tweak the init script to match the CVS contrib script more closely.
  - Redo patch to ssh-add to try to adding both identity and id_dsa to also try
    adding id_rsa.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.0p1.
  - Use $RPM_OPT_FLAGS instead of -O when building gnome-ssh-askpass
  - Resync with parts of Damien Miller's openssh.spec from CVS, including
    update of x11 askpass to 1.2.0.
  - Only require openssl (don't prereq) because we generate keys in the init
    script now.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't open a PAM session until we've forked and become the user (#25690).
  - Apply Andrew Bartlett's patch for letting pam_authenticate() know which
    host the user is attempting a login from.
  - Resync with parts of Damien Miller's openssh.spec from CVS.
  - Don't expose KbdInt responses in debug messages (from CVS).
  - Detect and handle errors in rsa_{public,private}_decrypt (from CVS).


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - More gettextizing.
  - Close all files after going into daemon mode (needs more testing).
  - Extract patch from CVS to handle auth banners (in the client).
  - Extract patch from CVS to handle compat weirdness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't treat pam_setcred() failure as fatal unless pam_authenticate() has
    succeeded, to allow public-key authentication after a failure with "none"
    authentication.  (#21268)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to x11-askpass 1.1.1. (#21301)
  - Don't second-guess fixpaths, which causes paths to get fixed twice. (#21290)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Merge multiple PAM text messages into subsequent prompts when possible when
    doing keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Disable the built-in MD5 password support.  We're using PAM.
  - Take a crack at doing keyboard-interactive authentication with PAM, and
    enable use of it in the default client configuration so that the client
    will try it when the server disallows password authentication.
  - Build with debugging flags.  Build root policies strip all binaries anyway.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add the primes file from the latest snapshot to the main package (#20884).
  - Add the dev package to the prereq list (#19984).
  - Remove the default path and mimic login's behavior in the server itself.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Resync with conditional options in Damien Miller's .spec file for an errata.
  - Change libexecdir from %{_libexecdir}/ssh to %{_libexecdir}/openssh.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to OpenSSH 2.3.0p1.
  - Update to x11-askpass 1.1.0.
  - Enable keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add BuildPreReq on /usr/include/security/pam_appl.h to be sure we always
    build PAM authentication in.
  - Try setting SSH_ASKPASS if gnome-ssh-askpass is installed.
  - Clean out no-longer-used patches.
  - Patch ssh-add to try to add both identity and id_dsa, and to error only
    when neither exists.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update x11-askpass to 1.0.2. (#17835)
  - Add BuildPreReqs for /bin/login and /usr/bin/rsh so that configure will
    always find them in the right place. (#17909)
  - Set the default path to be the same as the one supplied by /bin/login, but
    add /usr/X11R6/bin. (#17909)
  - Try to handle obsoletion of ssh-server more cleanly.  Package names
    are different, but init script name isn't. (#17865)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 20000823 snapshot.
  - Change subpackage requirements from %{version} to %{version}-%{release}
  - Back out the pipe patch.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 2.1.1p4, which includes fixes for config file parsing problems.
  - Move the init script back.
  - Add Damien's quick fix for wackiness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Move condrestart to server postun.
  - Move key generation to init script.
  - Actually use the right patch for moving the key generation to the init script.
  - Clean up the init script a bit.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Patch to build with neither RSA nor RSAref.
  - Miscellaneous FHS-compliance tweaks.
  - Fix for possibly-compressed man pages.


author: Anders Kaseorg <andersk@mit.edu> - 3.0-0
changelog:
  - Decrease version below a hypothetical Fedora package.
  - Split out -server, -libs, and -devel into subpackages.
  - Disable the static library and remove the libtool archive.


author: Derek Atkins <warlord@MIT.EDU>
changelog:
  - update kversis script, add 'kvers' operation
  - fix bug that 2.6 smp/hugemem kernels don't provide
    kernel-foo = 2.6.34.6-54.fc13.x86_64 with 'smp', 'hugemem', etc.
  - add patch to remove res_search from the afs-krb5 configure


author: Derek Atkins <warlord@MIT.EDU>
changelog:
  - update kversis script, add 'kvers' operation
  - fix bug that 2.6 smp/hugemem kernels don't provide
    kernel-foo = 2.6.34.6-54.fc13 with 'smp', 'hugemem', etc.
  - add patch to remove res_search from the afs-krb5 configure


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pull up fix for upstream #6745, in which the gssapi library would add the
    wrong error table but subsequently attempt to unload the right one


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7.1-11
changelog:
  - use the "pathmunge" function to add %{krb5prefix}/bin to $PATH rather
    than doing it the harder way ourselves (part of #544652)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - ksu: move session management calls to before we drop privileges, like
    su does (#596887), and don't skip the PAM account check for root or the
    same user (more of #540769)


author: Derek Atkins <warlord@MIT.EDU>
changelog:
  - update kversis script, add 'kvers' operation
  - fix bug that 2.6 smp/hugemem kernels don't provide
    kernel-foo = 2.6.34.7-56.fc13 with 'smp', 'hugemem', etc.
  - add patch to remove res_search from the afs-krb5 configure


author: Nalin Dahyabhai <nalin@redhat.com> 1.7.1-14
changelog:
  - revert pathmunge-related changes because pathmunge() isn't always there
    if we've upgraded or anything weird's happened (#633212)


author: Derek Atkins <warlord@MIT.EDU>
changelog:
  - update kversis script, add 'kvers' operation
  - fix bug that 2.6 smp/hugemem kernels don't provide
    kernel-foo = 2.6.34.7-61.fc13 with 'smp', 'hugemem', etc.
  - add patch to remove res_search from the afs-krb5 configure


author: Rich Megginson <rmeggins@redhat.com> - 1.2.6.1-1
changelog:
  - This is the 1.2.6.1 release - git tag 389-ds-base-1.2.6.1
  - Bug 634561 - Server crushes when using Windows Sync Agreement
  - Bug 635987 - Incorrect sub scope search result with ACL containing ldap:///self
  - Bug 612264 - ACI issue with (targetattr='userPassword')
  - Bug 606920 - anonymous resource limit- nstimelimit - also applied to "cn=directory manager"
  - Bug 631862 - crash - delete entries not in cache + referint


author: Rich Megginson <rmeggins@redhat.com> - 1.2.6-0.11.rc7
changelog:
  - 1.2.6 release candidate 7
  - git tag 389-ds-base-1.2.6.rc7
  - Bug 621928 - Unable to enable replica (rdn problem?) on 1.2.6 rc6


author: Rich Megginson <rmeggins@redhat.com> - 1.2.6-0.10.rc6
changelog:
  - 1.2.6 release candidate 6
  - git tag 389-ds-base-1.2.6.rc6
  - Bug 617013 - repl-monitor.pl use cpu upto 90%
  - Bug 616618 - 389 v1.2.5 accepts 2 identical entries with different DN formats
  - Bug 547503 - replication broken again, with 389 MMR replication and TCP errors
  - Bug 613833 - Allow dirsrv_t to bind to rpc ports
  - Bug 612242 - membership change on DS does not show on AD
  - Bug 617629 - Missing aliases in new schema files
  - Bug 619595 - Upgrading sub suffix under non-normalized suffix disappears
  - Bug 616608 - SIGBUS in RDN index reads on platforms with strict alignments
  - Bug 617862 - Replication: Unable to delete tombstone errors
  - Bug 594745 - Get rid of dirsrv_lib_t label


author: Rich Megginson <rmeggins@redhat.com> - 1.2.6-0.9.rc3
changelog:
  - make selinux-devel explicit Require the base package in order
  - to comply with Fedora Licensing Guidelines


author: Rich Megginson <rmeggins@redhat.com> - 1.2.6-0.8.rc3
changelog:
  - 1.2.6 release candidate 3
  - git tag 389-ds-base-1.2.6.rc3
  - Bug 603942 - null deref in _ger_parse_control() for subjectdn
  - 609256  - Selinux: pwdhash fails if called via Admin Server CGI
  - 578296  - Attribute type entrydn needs to be added when subtree rename switch is on
  - 605827 - In-place upgrade: upgrade dn format should not run in setup-ds-admin.pl
  - Bug 604453 - SASL Stress and Server crash: Program quits with the assertion failure in PR_Poll
  - Bug 604453 - SASL Stress and Server crash: Program quits with the assertion failure in PR_Poll
  - 606920 - anonymous resource limit - nstimelimit - also applied to "cn=directory manager"


author: Nathan Kinder <nkinder@redhat.com> - 1.2.6-0.4.a3
changelog:
  - 1.2.6.a3 release
  - add managed entries plug-in
  - many bug fixes
  - moved selinux subpackage into base package


author: Rich Megginson <rmeggins@redhat.com> - 1.2.4-1
changelog:
  - 1.2.4 release
  - resolves bug 221905 - added support for Salted MD5 (SMD5) passwords - primarily for migration
  - resolves bug 529258 - Make upgrade remove obsolete schema from 99user.ldif


author: Rich Megginson <rmeggins@redhat.com> - 1.2.3-1
changelog:
  - 1.2.3 release
  - added template-initconfig to %files
  - %posttrans now runs update to update the server instances
  - servers are shutdown, then restarted if running before install
  - scriptlets mostly use lua now to pass data among scriptlet phases


author: Rich Megginson <rmeggins@redhat.com> - 1.2.2-1
changelog:
  - backed out - added template-initconfig to %files - this change is for the next major release
  - bump version to 1.2.2
  - fix reopened 509472 db2index all does not reindex all the db backends correctly
  - fix 518520 -  pre hashed salted passwords do not work
  - see https://bugzilla.redhat.com/show_bug.cgi?id=518519 for the list of
  - bugs fixed in 1.2.2


author: Rich Megginson <rmeggins@redhat.com> - 1.2.1-1
changelog:
  - change name to 389
  - change version to 1.2.1
  - added initial support for numeric string syntax
  - added initial support for syntax validation
  - added initial support for paged results including sorting


author: Rich Megginson <rmeggins@redhat.com> - 1.2.0-4
changelog:
  - final release 1.2.0
  - Resolves: bug 475338 - LOG: the intenal type of maxlogsize, maxdiskspace and minfreespace should be 64-bit integer
  - Resolves: bug 496836 - SNMP ldap-agent on Solaris: Unable to open semaphore for server: 389
  - CVS tag: FedoraDirSvr_1_2_0 FedoraDirSvr_1_2_0_20090428


author: Rich Megginson <rmeggins@redhat.com> - 1.2.0-1
changelog:
  - new release 1.2.0
  - Made devel package depend on mozldap-devel
  - only create run dir if it does not exist
  - CVS tag: FedoraDirSvr_1_2_0_RC1 FedoraDirSvr_1_2_0_RC1_20090330


author: Rich Megginson <rmeggins@redhat.com> - 1.1.2-1
changelog:
  - This is the 1.1.2 release.  The bugs fixed can be found here
  - https://bugzilla.redhat.com/showdependencytree.cgi?id=452721
  - Added winsync-plugin.h to the devel subpackage


author: Tom "spot" Callaway <tcallawa@redhat.com> - 1.1.0.1-3
changelog:
  - add patch to allow server to work with NSS 3.11.99 and later
  - do NSS_Init after fork but before detaching from console


author: Rich Megginson <rmeggins@redhat.com> - 1.1.0.1-1
changelog:
  - Resolves bug 434403 - GCC 4.3 build fails
  - Rolled new source tarball which includes Nathan's fix for the struct ucred
  - NOTE: Change version back to 1.1.1 for next release
  - this release was pulled from CVS tag FedoraDirSvr110_gcc43


author: Rich Megginson <rmeggins@redhat.com> - 1.1.0-4
changelog:
  - This is the GA release of Fedora DS 1.1
  - Removed version numbers for BuildRequires and Requires
  - Added full URL to source tarball


author: Rich Megginson <rmeggins@redhat.com> - 1.1.0-2.0
changelog:
  - This is the beta2 release
  - new file added to package - /etc/sysconfig/dirsrv - for setting
  - daemon environment as is usual in other linux daemons


author: Rich Megginson <rmeggins@redhat.com> - 1.1.0-1.2
changelog:
  - fix build breakage due to open()
  - mock could not find BuildRequires: db4-devel >= 4.2.52
  - mock works if >= version is removed - it correctly finds db4.6


author: Rich Megginson <rmeggins@redhat.com> - 1.1.0-0.3.20070720
changelog:
  - Added Requires for perldap, cyrus sasl plugins
  - Removed template-migrate* files
  - Added perl module directory
  - Removed install.inf - setup-ds.pl can now easily generate one


author: Rich Megginson <rmeggins@redhat.com> - 1.1.0-0.1.20070320
changelog:
  - update to latest sources
  - added migrateTo11 to allow migrating instances from 1.0.x to 1.1
  - ldapi support
  - fixed pam passthru plugin ENTRY method


author: Rich Megginson <rmeggins@redhat.com> - 1.1.0-0.1.20070223
changelog:
  - Renamed package to fedora-ds-base, but keep names of paths/files/services the same
  - use the shortname macro (fedora-ds) for names of paths, files, and services instead
  - of name, so that way we can continue to use e.g. /etc/fedora-ds instead of /etc/fedora-ds-base
  - updated to latest sources


author: Rich Megginson <rmeggins@redhat.com> - 1.1.0-0.1.20070213
changelog:
  - More cleanup suggested by Dennis Gilmore
  - This is the fedora extras candidate based on cvs tag FedoraDirSvr110a1


author: Rich Megginson <rmeggins@redhat.com> - 1.1.0-8.el4.20070125
changelog:
  - added logconv.pl
  - added slapi-plugin.h to devel package
  - added explicit dirs for /var/log/fedora-ds et. al.


author: Rich Megginson <rmeggins@redhat.com> - 1.1.0-6.el4.20070125
changelog:
  - Move the plugin *.so files into the main package instead of the devel
  - package because they are loaded directly by name via dlopen


author: Rich Megginson <rmeggins@redhat.com> - 1.1.0-1.el4.cvs20070119
changelog:
  - Changed version to 1.1.0 and added Release 1.el4.cvs20070119
  - merged in changes from Fedora Extras candidate spec file


author: Dennis Gilmore <dennis@ausil.us> - 1.1-0.1.cvs20070108
changelog:
  - update to a cvs snapshot
  - fedorafy the spec 
  - create -devel subpackage
  - apply a patch to use mozldap not mozldap6
  - apply a patch to allow --prefix to work correctly


author: Rich Megginson <rmeggins@redhat.com> - 1.0.99-16
changelog:
  - Fixed the problem where the server would crash upon shutdown in dblayer
  - due to a race condition among the database housekeeping threads
  - Fix a problem with normalized absolute paths for db directories


author: Rich Megginson <rmeggins@redhat.com> - 1.0.99-15
changelog:
  - Touch all of the ldap/admin/src/scripts/*.in files so that they
  - will be newer than their corresponding script template files, so
  - that make will rebuild them.


author: Rich Megginson <rmeggins@redhat.com> - 1.0.99-9
changelog:
  - The template scripts needed to use @libdir@ instead of hardcoding
  - /usr/lib
  - Use make DESTDIR=$RPM_BUILD_ROOT install instead of % makeinstall
  - do the actual build in a "built" subdirectory, until we remove
  - the old script templates


author: Thomas Spura <tomspur@fedoraproject.org> - 0.10-3
changelog:
  - fix license tag (#603178)
  - add requires on wxpython to gui subpackage (#515570)
  - start unbundling the libraries - more to come (#603937)


author: Thomas Spura <tomspur@fedoraproject.org> - 0.10-2
changelog:
  - move docs into a subpackage
  - subpackage wxPython
  - subpackage tests
  - use proper %{python_site*} definitions
  - make %{files} more explicit
  - add some missing R (fixes #529185, #515570)


author: Derek Atkins <warlord@MIT.EDU>
changelog:
  - update kversis script, add 'kvers' operation
  - fix bug that 2.6 smp/hugemem kernels don't provide
    kernel-foo = '2.6.34.7-63.fc13' with 'smp', 'hugemem', etc.
  - add patch to remove res_search from the afs-krb5 configure


author: Nalin Dahyabhai <nalin@redhat.com> 1.7.1-16
changelog:
  - add upstream patch to fix various issues from MITKRB5-SA-2010-007
    (CVE-2010-1323, #648734, CVE-2010-1324, #648674)


author: Nalin Dahyabhai <nalin@redhat.com> 1.7.1-15
changelog:
  - make -libs actually own /usr/kerberos, because it may be the only reason
    that directory exists, due to owning /usr/kerberos/share (#636746)


author: Rich Megginson <rmeggins@redhat.com> - 1.2.7.1-1
changelog:
  - 1.2.7.1 release - git tag 389-ds-base-1.2.7.1
  - Bug 656515 - Allow Name and Optional UID syntax for grouping attributes
  - Bug 656392 - Remove calls to ber_err_print()
  - Bug 625950 - hash nsslapd-rootpw changes in audit log


author: Rich Megginson <rmeggins@redhat.com> - 1.2.7-0.8.a5
changelog:
  - 1.2.7.a5 release - git tag 389-ds-base-1.2.7.a5
  - Bug 643979 - Strange byte sequence for attribute with no values (nsslapd-ref
  erral)
  - Bug 635009 - Add one-way AD sync capability
  - Bug 572018 - Upgrading from 1.2.5 to 1.2.6.a2 deletes userRoot
  - put replication config entries in separate file
  - Bug 567282 - server can not abandon searchRequest of "simple paged results"
  - Bug 329751 - "nested" filtered roles searches candidates more than needed
  - Bug 521088 - DNA should check ACLs before getting a value from the range


author: Rich Megginson <rmeggins@redhat.com> - 1.2.7-0.7.a4
changelog:
  - 1.2.7.a4 release - git tag 389-ds-base-1.2.7.a4
  - Bug 647932 - multiple memberOf configuration adding memberOf where there is no member
  - Bug 491733 - dbtest crashes
  - Bug 606545 - core schema should include numSubordinates
  - Bug 638773 - permissions too loose on pid and lock files
  - Bug 189985 - Improve attribute uniqueness error message
  - Bug 619623 - attr-unique-plugin ignores requiredObjectClass on modrdn operations
  - Bug 619633 - Make attribute uniqueness obey requiredObjectClass


author: Rich Megginson <rmeggins@redhat.com> - 1.2.7-0.4.a3
changelog:
  - 1.2.7.a3 release - a2 was never released - this is a rebuild to pick up
  - Bug 644608 - RHDS 8.1->8.2 upgrade fails to properly migrate ACIs
  - Adding the ancestorid fix code to ##upgradednformat.pl.


author: Rich Megginson <rmeggins@redhat.com> - 1.2.7-0.3.a3
changelog:
  - 1.2.7.a3 release - a2 was never released
  - Bug 644608 - RHDS 8.1->8.2 upgrade fails to properly migrate ACIs
  - Bug 629681 - Retro Changelog trimming does not behave as expected
  - Bug 645061 - Upgrade: 06inetorgperson.ldif and 05rfc4524.ldif
  -              are not upgraded in the server instance schema dir


author: Rich Megginson <rmeggins@redhat.com> - 1.2.7-0.2.a2
changelog:
  - 1.2.7.a2 release - a1 was the OpenLDAP testday release
  - git tag 389-ds-base-1.2.7.a2
  - added openldap support on platforms that use openldap with moznss
  - for crypto (F-14 and later)
  - many bug fixes
  - Account Policy Plugin (keep track of last login, disable old accounts)


author: Rich Megginson <rmeggins@redhat.com> - 1.2.7.2-1
changelog:
  - 1.2.7.2 release - git tag 389-ds-base-1.2.7.2
  - Bug 659456 - Incorrect usage of ber_printf() in winsync code
  - Bug 658309 - Process escaped characters in managed entry mappings
  - Bug 197886 - Initialize return value for UUID generation code
  - Bug 658312 - Allow mapped attribute types to be quoted
  - Bug 197886 - Avoid overflow of UUID generator


author: Rich Megginson <rmeggins@redhat.com> - 1.2.7.3-1
changelog:
  - 1.2.7.3 release - git tag 389-ds-base-1.2.7.3
  - Bug 658312 - Invalid free in Managed Entry plug-in
  - Bug 641944 - Don't normalize non-DN RDN values


author: Derek Atkins <warlord@MIT.EDU>
changelog:
  - update kversis script, add 'kvers' operation
  - fix bug that 2.6 smp/hugemem kernels don't provide
    kernel-foo = 2.6.34.7-66.fc13.x86_64 with 'smp', 'hugemem', etc.
  - add patch to remove res_search from the afs-krb5 configure


author: Nalin Dahyabhai <nalin@redhat.com> 1.7.1-17
changelog:
  - add upstream patches to fix standalone kpropd exiting if the per-client
    child process exits with an error (MITKRB5-SA-2011-001), and a hang or
    crash in the KDC when using the LDAP kdb backend (MITKRB5-SA-2011-002)
    (CVE-2010-4022, #664009, CVE-2011-0281, #668719, CVE-2011-0282, #668726)


author: Derek Atkins <warlord@MIT.EDU>
changelog:
  - update kversis script, add 'kvers' operation
  - fix bug that 2.6 smp/hugemem kernels don't provide
    kernel-foo = 2.6.34.8-68.fc13 with 'smp', 'hugemem', etc.
  - add patch to remove res_search from the afs-krb5 configure


author: Nalin Dahyabhai <nalin@redhat.com> 1.7.1-18
changelog:
  - add revised upstream patch to fix double-free in KDC while returning
    typed-data with errors (CVE-2011-0284, #674325)


author: Mitchell Berger <mitchb@mit.edu> 2.6.34.8-68.scriptsxenreboot
changelog:
  - linux-2.6-xen-dont-stop-other-cpus-on-reboot.patch: allow
    multi-vcpu paravms to reboot or shutdown cleanly


author: Kyle McMartin <kmcmartin@redhat.com> 2.6.34.8-68
changelog:
  - Backport commits from longterm-2.6.35.y to 'fix' Intel Sandy Bridge
    chipsets. (Requested by Intel folks.)


author: Chuck Ebbert <cebbert@redhat.com>
changelog:
  - Linux 2.6.34.8
  - Drop merged patches:
      01-compat-make-compat_alloc_user_space-incorporate-the-access_ok-check.patch
      02-compat-test-rax-for-the-system-call-number-not-eax.patch
      03-compat-retruncate-rax-after-ia32-syscall-entry-tracing.patch
      aio-check-for-multiplication-overflow-in-do_io_submit.patch
      cifs-fix-dns-resolver.patch
      inotify-fix-inotify-oneshot-support.patch
      inotify-send-IN_UNMOUNT-events.patch
      irda-correctly-clean-up-self-ias_obj-on-irda_bind-failure.patch
      keys-fix-bug-in-keyctl-session-to-parent-if-parent-has-no-session-keyring.patch
      keys-fix-rcu-no-lock-warning-in-keyctl-session-to-parent.patch
      wireless-extensions-fix-kernel-heap-content-leak.patch
      pci-msi-remove-unsafe-and-unnecessary-hardware-access.patch
      pci-msi-restore-read_msi_msg_desc-add-get_cached_msi_msg_desc.patch
      x86-tsc-sched-recompute-cyc2ns_offset-s-during-resume-from-sleep-states.patch
      x86-tsc-fix-a-preemption-leak-in-restore_sched_clock_state.patch
      execve-improve-interactivity-with-large-arguments.patch
      execve-make-responsive-to-sigkill-with-large-arguments.patch
      setup_arg_pages-diagnose-excessive-argument-size.patch
      alsa-seq-oss-fix-double-free-at-error-path-of-snd_seq_oss_open.patch
      tracing-do-not-allow-llseek-to-set_ftrace_filter.patch
      sched-00-fix-user-time-incorrectly-accounted-as-system-time-on-32-bit.patch
      xen-handle-events-as-edge-triggered.patch
      xen-use-percpu-interrupts-for-ipis-and-virqs.patch
      sctp-do-not-reset-the-packet-during-sctp_packet_config.patch
      r8169-fix-dma-allocations.patch
      skge-quirk-to-4gb-dma.patch
      depessimize-rds_copy_page_user.patch
      via-ioctl-prevent-reading-uninit-memory.patch
      v4l1-fix-32-bit-compat-microcode-loading-translation.patch
      kvm-fix-fs-gs-reload-oops-with-invalid-ldt.patch
      alsa-prevent-heap-corruption-in-snd_ctl_new.patch
      gdth-integer-overflow-in-ioctl.patch
  - Drop from drm-next patch:
      d831692 sis-agp: Remove SIS 760, handled by amd64-agp
  - Drop hunk of quiet-prove_RCU-in-cgroups.patch, now upstream.


author: Chuck Ebbert <cebbert@redhat.com>
changelog:
  - TCP networking fixes from 2.6.36.3, including one CVE
    CVE-2010-4165: possible kernel oops from user MSS
  - CVE-2011-0521: av7110 negative array offset


author: Chuck Ebbert <cebbert@redhat.com>
changelog:
  - Security updates
    CVE-2010-4346: install_special_mapping skips security_file_mmap check
    CVE-2010-4649: IB/uverbs: Handle large number of entries in poll CQ
    CVE-2011-0006: ima: fix add LSM rule bug
    CVE-2010-4648: orinoco: fix TKIP countermeasure behaviour
    CVE-2010-4650: fuse: verify ioctl retries


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.7-66
changelog:
  - CVE-2010-4157: gdth: integer overflow in ioc_general()
  - CVE-2010-4158: socket filters infoleak
  - CVE-2010-3874: CAN sockets minor heap overflow


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.7-65
changelog:
  - CVE-2010-4162: bio: integer overflow page count when mapping/copying user data
  - CVE-2010-4249: unix socket local dos


author: Chuck Ebbert <cebbert@redhat.com>
changelog:
  - CVE-2010-2962: arbitrary kernel memory write via i915 GEM ioctl
  - CVE-2010-2963: v4l: VIDIOCSMICROCODE arbitrary write
  - CVE-2010-3698: kvm: invalid selector in fs/gs causes kernel panic
  - CVE-2010-3705: sctp: Fix out-of-bounds reading in sctp_asoc_get_hmac()
  - CVE-2010-3442: ALSA: prevent heap corruption in snd_ctl_new()
  - CVE-2010-4258: failure to revert address limit override in OOPS error path
  - CVE-2010-4169: perf_events: denial-of-service bug


author: Kyle McMartin <kyle@redhat.com>
changelog:
  - ioat2-catch-and-recover-from-broken-vtd-configurations.patch: copy patch
    from 2.6.35.y (#605845) [556ab45f]


author: Kyle McMartin <kyle@redhat.com>
changelog:
  - Backport XFS fixes for the kernel.org xfs boog. [4d4e307a]
    Needed two other backports to simplify life.


author: John W. Linville <linville@redhat.com>
changelog:
  - rtl8180: improve signal reporting for rtl8185 hardware
  - rtl8180: improve signal reporting for actual rtl8180 hardware


author: Kyle McMartin <kyle@redhat.com>
changelog:
  - zero struct memory in ipc compat (CVE-2010-4073) (#648658)
  - zero struct memory in ipc shm (CVE-2010-4072) (#648656)
  - fix logic error in INET_DIAG bytecode auditing (CVE-2010-3880) (#651264)
  - posix-cpu-timers: workaround to suppress the problems with mt exec
    (rhbz#656264)
  - clear memory in viafb ioctl (CVE-2010-4082) (#648671)


author: Kyle McMartin <kyle@redhat.cmo> 2.6.34.7-62
changelog:
  - tpm-autodetect-itpm-devices.patch: Auto-fix TPM issues on various
    laptops which prevented suspend/resume.
  - depessimize-rds_copy_page_user.patch: Fix CVE-2010-3904, local
    privilege escalation via RDS protocol.
  - rt2x00: Backport fixes for #642031 from Stanislaw Gruszka.


author: Ben Skeggs <bskeggs@redhat.com> 2.6.34.7-59
changelog:
  - nouveau: fix theoretical race condition that could be responsible for
    certain random hangs that have been reported.


author: Kyle McMartin <kyle@redhat.com>
changelog:
  - x86_64: plug compat syscalls holes. (CVE-2010-3081, CVE-2010-3301)
    upgrading is highly recommended.
  - aio: check for multiplication overflow in do_io_submit. (CVE-2010-3067)


author: Kyle McMartin <kyle@redhat.com>
changelog:
  - Backport 6f772d7e to hopefully fix #629442,
    (drm/i915: Explosion following OOM in do_execbuffer.)


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.6-53
changelog:
  - Disable asynchronous suspend, a new feature in 2.6.34
  - Fix unsafe access to MSI registers during suspend
    (pci-msi-remove-unsafe-and-unnecessary-hardware-access.patch,
     pci-msi-restore-read_msi_msg_desc-add-get_cached_msi_msg_desc.patch)
  - x86-tsc-sched-recompute-cyc2ns_offset-s-during-resume-from-sleep-states.patch
     Fix load balancing after suspend/resume cycle (taken from 2.6.32 stable queue)


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.6-52
changelog:
  - acpi-ec-pm-fix-race-between-ec-transactions-and-system-suspend.patch:
    another possible fix for suspend/resume problems.
  - From 2.6.35.4: nfs-fix-an-oops-in-the-nfsv4-atomic-open-code.patch
  - Add fix for CVE-2010-2960: keyctl_session_to_parent NULL deref system crash


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.6-50
changelog:
  - Re-enable I2O, but only for 32-bit x86 (#629676)
  - Add support for eject key on Dell laptops (#513530)
  - irda-correctly-clean-up-self-ias_obj-on-irda_bind-failure.patch (CVE-2010-2954)
  - wireless-extensions-fix-kernel-heap-content-leak.patch (CVE-2010-2955)


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.6-48
changelog:
  - Revert commit 6a1a82df91fa0eb1cc76069a9efe5714d087eccd from 2.6.34.1;
    it breaks ftdi_sio (#613597)


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.6-47
changelog:
  - Linux 2.6.34.6
  - drivers-hwmon-coretemp-c-detect-the-thermal-sensors-by-cpuid.patch (#625734)
  - kprobes-x86-fix-kprobes-to-skip-prefixes-correctly.patch (#610941)


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.5-45
changelog:
  - Revert commit 3d61510f4ecacfe47c75c0eb51c0659dfa77fb1b from 2.6.34.2;
    it causes dropped keystrokes (#625758)


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.5-43
changelog:
  - Linux 2.6.34.5
  - Drop merged patches:
     mm-fix-page-table-unmap-for-stack-guard-page-properly.patch
     mm-fix-up-some-user-visible-effects-of-the-stack-guard-page.patch


author: Chuck Ebbert <cebbert@redhat.com>
changelog:
  - Restore linux-2.6-umh-refactor.patch, still needed in 2.6.34 (#625150)
  - Drop coredump-uid-pipe-check.patch, now upstream.


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.4-42
changelog:
  - Revert "ata-piix: Detect spurious IRQs and clear them",
    should be fixed by commit 27943620c upstream.


author: Kyle McMartin <kyle@redhat.com>
changelog:
  - Touch .scmversion in the kernel top level to prevent scripts/setlocalversion
    from recursing into our fedpkg git tree and trying to decide whether the
    kernel git is modified (obviously not, since it's a tarball.) Fixes make
    local.


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.4-41
changelog:
  - Fix fallout from the stack guard page fixes.
    (mm-fix-page-table-unmap-for-stack-guard-page-properly.patch,
     mm-fix-up-some-user-visible-effects-of-the-stack-guard-page.patch)


author: Ben Skeggs <bskeggs@redhat.com> 2.6.34.2-34
changelog:
  - nouveau: fix inter-engine race when under memory pressure (rhbz#602956)
  - Disable CONFIG_MULTICORE_RAID456


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.2-33
changelog:
  - Linux 2.6.34.2
  - Drop commented-out patches.
  - Drop ancient linux-2.6-mac80211-age-scan-results-on-resume.patch
  - Fix matroxfb font corruption (#617687)
  - Don't resurrect dead task credentials (#591015)
  - Fix "ext4 and xfs wrong data returned on read after write if
    file size was changed with ftruncate" (#617699)


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.2-32.rc1
changelog:
  - Linux 2.6.34.2-rc1
  - Comment out upstream merged patches:
      pci-pm-do-not-use-native-pcie-pme-by-default.patch
      linux-2.6-acpi-sleep-live-sci-live.patch (slightly different upstream patch)
      drm-i915-make-G4X-style-PLL-search-more-permissive.patch
      drm-intel-945gm-stability-fixes.patch
      drm-radeon-fix-shared-ddc-handling.patch
      drm-i915-add-reclaimable-to-page-allocations.patch
      drm-i915-fix-hibernate-memory-corruption.patch
      iwlwifi-Recover-TX-flow-stall-due-to-stuck-queue.patch
      iwlwifi-recover_from_tx_stall.patch
      mac80211-do-not-wipe-out-old-supported-rates.patch
      mac80211-fix-supported-rates-IE-if-AP-doesnt-give-us-its-rates.patch
      iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch
      ata-generic-handle-new-mbp-with-mcp89.patch
      ata-generic-implement-ata-gen-flags.patch
      x86-debug-send-sigtrap-for-user-icebp.patch
      ethtool-fix-buffer-overflow.patch
      sched-fix-over-scheduling-bug.patch
      kbuild-fix-modpost-segfault.patch
      acpica-00-linux-2.6.git-0f849d2cc6863c7874889ea60a871fb71399dd3f.patch
      acpica-01-linux-2.6.git-a997ab332832519c2e292db13f509e4360495a5a.patch
      acpica-02-linux-2.6.git-e4e9a735991c80fb0fc1bd4a13a93681c3c17ce0.patch
      acpica-03-linux-2.6.git-fd247447c1d94a79d5cfc647430784306b3a8323.patch
      acpica-04-linux-2.6.git-c9a8bbb7704cbf515c0fc68970abbe4e91d68521.patch
      acpica-05-linux-2.6.git-ce43ace02320a3fb9614ddb27edc3a8700d68b26.patch
      acpica-06-linux-2.6.git-9d3c752de65dbfa6e522f1d666deb0ac152ef367.patch
      acpi-pm-do-not-enable-gpes-for-system-wakeup-in-advance.patch
      cifs-fix-malicious-redirect-problem-in-the-dns-lookup-code.patch
      usb-obey-the-sysfs-power-wakeup-setting.patch
  - Fix up virtqueue-wrappers.patch to apply after 2.6.34.2 due to:
      virtio_net-fix-oom-handling-on-tx.patch
  - Revert -stable DRM patches already in our drm-next patch:
      amd64-agp-probe-unknown-agp-devices-the-right-way.patch
      i915-fix-lock-imbalance-on-error-path.patch
      drm-i915-hold-the-spinlock-whilst-resetting-unpin_work-along-error-path.patch
  - Fix up drm-next.patch to apply after 2.6.34.2 due to:
      drm-i915-gen3-page-flipping-fixes.patch
      drm-i915-don-t-queue-flips-during-a-flip-pending-event.patch
  - Drop patches now upstream from linux-2.6-v4l-dvb-uvcvideo-update.patch:
      V4L/DVB: uvcvideo: Add support for unbranded Arkmicro 18ec:3290 webcams
      V4L/DVB: uvcvideo: Add support for V4L2_PIX_FMT_Y16
  - Temporarily comment out ssb_check_for_sprom.patch due to ugly conflicts with:
      ssb-handle-netbook-devices-where-the-sprom-address-is-changed.patch


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.1-31
changelog:
  - Backport initial dist-git fixes from master (377da6d08)
  - Modify the prep stage so multiple trees can be prepped in a
    single shared git directory.


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.1-30
changelog:
  - usb-obey-the-sysfs-power-wakeup-setting.patch:
    Restore ability of USB devices to wake the machine (#617559)


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.1-29
changelog:
  - cifs-fix-malicious-redirect-problem-in-the-dns-lookup-code.patch:
    Fix a malicious redirect problem in the DNS lookup code (CVE-2010-2524)


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.1-28
changelog:
  - input-synaptics-relax-capability-id-checks-on-new-hardware.patch:
    Make mouse driver recognize newer synaptics hardware as touchpad.


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.1-27
changelog:
  - ACPI GPE enable/disable patches: fix system powering back on
    after shutdown (#613239) (and possibly #615858)


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.1-25
changelog:
  - kvm-mmu-fix-conflict-access-permissions-in-direct-sp.patch:
    Fix crash in guest Python programs (#610911)


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.1-20
changelog:
  - pci-fall-back-to-original-bios-bar-addresses.patch:
    Fix 2.6.34 problems with assigning PCI addresses (KORG#16263)


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.1-19
changelog:
  - drm-i915-add-reclaimable-to-page-allocations.patch:
    Additional fix for hibernation memory corruption bugs.


author: Hans de Goede <hdegoede@redhat.com> 2.6.34.1-17
changelog:
  - Fix inotify-fix-inotify-oneshot-support.patch so that it compiles
  - Various small updates / fixes to the uvcvideo driver:
    - Support dynamic menu controls (#576023)
    - Fix the apple iSight camera not working (#600998)


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.1-16
changelog:
  - inotify-fix-inotify-oneshot-support.patch,
    inotify-send-IN_UNMOUNT-events.patch:
    Fix broken oneshot support and missing umount events. (#607327)


author: Ben Skeggs <bskeggs@redhat.com> 2.6.34.1-15
changelog:
  - nouveau: fix lvds regression (#601002)
  - nouveau: bring back acpi edid support, with fixes (#613284)
  - nouveau: remove dcb1.5 quirk that breaks things (#595645)


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.1-14
changelog:
  - Truncate the obsolete git bluetooth and firewire patches, use
    ApplyOptionalPatch for bluetooth, cpufreq and firewire patches.


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.1-12
changelog:
  - pci-pm-do-not-use-native-pcie-pme-by-default.patch:
    fix PCIe hotplug interrupts firing continuously. (#613412)
  - Update pci-acpi-disable-aspm-if-no-osc.patch so it works
    with the above patch.
  - Drop linux-2.6-defaults-pciehp.patch: pciehp_passive mode
    does not exist anymore.


author: Ben Skeggs <bskeggs@redhat.com> 2.6.34.1-11
changelog:
  - nouveau: bring back patches lost from 2.6.34 update + add some more to
    fix at least rhbz#532711 and rhbz#593046
  - remove patches relating to nouveau that are now unused


author: Dave Jones <davej@redhat.com>
changelog:
  - Remove a bunch of x86 options from config files that get set
    automatically, and can't be overridden.


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.1-9
changelog:
  - crypto-aesni-kill-module_alias.patch: kill MODULE_ALIAS to prevent
    aesni-intel from autoloading.


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.1-7
changelog:
  - Restore PowerPC VIO modalias patch; use the upstream version.
  - Drop Mac G5 thermal shutdown patch, now upstream.


author: Chuck Ebbert <cebbert@redhat.com> 2.6.34.1-5
changelog:
  - pci-change-error-messages-to-kern-info.patch:
    Use new upstream patch to silence more useless messages.


author: Chuck Ebbert <cebbert@redhat.com>
changelog:
  - pci-acpi-disable-aspm-if-no-osc.patch, pci-aspm-dont-enable-too-early.patch
    PCI layer fixes for problems with hardware that doesn't support ASPM.


author: Chuck Ebbert <cebbert@redhat.com>
changelog:
  - Linux 2.6.34.1-rc1
  - Drop patches merged upstream:
      btrfs-should-add-permission-check-for-setfacl.patch (CVE-2010-2071)
      iwlwifi-recalculate-average-tpt-if-not-current.patch
      iwlwifi-fix-internal-scan-race.patch
  - Revert DRM patches we already have:
      drm-i915-rebind-bo-if-currently-bound-with-incorrect-alignment.patch
      drm-radeon-fix-the-r100-r200-ums-block-0-page-fix.patch
      drm-radeon-r100-r200-ums-block-ability-for-userspace-app-to-trash-0-page-and-beyond.patch
      drm-radeon-kms-atom-fix-typo-in-lvds-panel-info-parsing.patch
      drm-radeon-kms-reset-ddc_bus-in-object-header-parsing.patch
      drm-edid-fix-1024x768-85hz.patch
      drm-i915-reject-bind_to_gtt-early-if-object-aperture.patch
      drm-i915-fix-82854-pci-id-and-treat-it-like-other-85x.patch
  - Revert broken -stable patch:
      perf-fix-endianness-argument-compatibility-with-opt_boolean-and-introduce-opt_incr.patch


author: Dave Jones <davej@redhat.com>
changelog:
  - Disable workaround for obscure SMP pentium pro errata.
    I miss the 1990s too, but it's time to move on.
    If anyone actually needs this it would be better done using
    the apply_alternatives infrastructure.


author: Kyle McMartin <kyle@redhat.com>
changelog:
  - drm-revert-drm-fbdev-rework-output-polling-to-be-back-in-core.patch
    Revert eb1f8e4f, bisected by Nicolas Kaiser. Thanks! (rhbz#599190)
    (If this works, will try to root-cause.)
  - rebase previous patch on top of above reversion


author: Kyle McMartin <kyle@redhat.com>
changelog:
  - Suck in patch from Dave Miller in 2.6.35 to add async hash testing,
    hopefully fixes error from previous commit. (But making it modular
    is still a good idea.)


author: Kyle McMartin <kyle@redhat.com>
changelog:
  - make ghash-clmulni modular to get rid of early boot noise (rhbz#586954)
    (not a /fix/ but it should at least quiet boot down a bit if you have
     the cpu support)


author: Kyle McMartin <kyle@redhat.com>
changelog:
  - Snag some more DRM commits into drm-next.patch that I missed the first
    time.
  - Fix up radeon_pm toggle to work with the upstream code.


author: Prarit Bhargava <prarit@redhat.com>
changelog:
  - Turn off CONFIG_I2O on x86.
    It is broken on 64-bit address spaces (i686/PAE, x86_64), and frankly, I'm
    having trouble finding anyone who actually uses it.


author: Kyle McMartin <kyle@redhat.com>
changelog:
  - Fix build by nuking superfluous "%{expand" which was missing a
    trailing '}'. You may now reward me with an array of alcoholic
    beverages, I so richly deserve for spending roughly a full
    day staring at the diff of the spec.


author: Kyle McMartin <kyle@redhat.com>
changelog:
  - Provide a knob to enable radeon_pm to allow users to test
    that functionality. Add radeon.pm=1 to your kernel cmdline
    in order to enable it. (It still defaults to off though.)


author: Derek Atkins <warlord@MIT.EDU>
changelog:
  - update kversis script, add 'kvers' operation
  - fix bug that 2.6 smp/hugemem kernels don't provide
    kernel-foo = 2.6.34.8-68.scriptsxenreboot.fc13 with 'smp', 'hugemem', etc.
  - add patch to remove res_search from the afs-krb5 configure


author: Nalin Dahyabhai <nalin@redhat.com> 1.7.1-19
changelog:
  - kadmind: add modified upstream patch to fix free() on an invalid pointer
    (MITKRB5-SA-2011-004, CVE-2011-0285)


author: Derek Atkins <warlord@MIT.EDU>
changelog:
  - update kversis script, add 'kvers' operation
  - fix bug that 2.6 smp/hugemem kernels don't provide
    kernel-foo = 2.6.34.9-69.fc13 with 'smp', 'hugemem', etc.
  - add patch to remove res_search from the afs-krb5 configure


author: Geoffrey Thomas <geofft@mit.edu> 7.20.1-5.scripts
changelog:
  - disable credential delegation over Negotiate (CVE-2011-2192)
    Patch from upstream: http://curl.haxx.se/docs/adv_20110623.html


author: Kamil Dudka <kdudka@redhat.com> 7.20.1-5
changelog:
  - do not send QUIT to a dead FTP control connection (#650255)
  - prevent FTP client from hanging on unrecognized ABOR response (#649347)
  - return more appropriate error code in case FTP server session idle
    timeout has exceeded (#650255)
  - prevent FTP server from hanging on closed data connection (#643656)
  - proxy tunnel support for LDAP requests (#655134)


author: Kamil Dudka <kdudka@redhat.com> 7.20.1-4
changelog:
  - modify system headers to work around a gcc bug (#617757)
  - curl -T now ignores file size of special files (#622520)
  - fix kerberos proxy authentication for https (#625676)
  - fix curl -J to chop filename at next semicolon (upstream commit d76874a)


author: Kamil Dudka <kdudka@redhat.com> 7.20.0-4
changelog:
  - make curl-config multilib ready again (#584107)
  - upstream patch preventing SSL handshake timeout underflow
  - eliminated 1s delay in vast mojority of test-cases, patch contributed
    by Paul Howarth


author: Kamil Dudka <kdudka@redhat.com> 7.20.0-3
changelog:
  - add missing quote in libcurl.m4 (#576252)
  - throw CURLE_SSL_CERTPROBLEM in case peer rejects a certificate (#565972)


author: Kamil Dudka <kdudka@redhat.com> 7.20.0-1
changelog:
  - new upstream release - added support for IMAP(S), POP3(S), SMTP(S) and RTSP
  - dropped patches applied upstream
  - dropped curl-7.16.0-privlibs.patch no longer useful
  - a new patch forcing -lrt when linking the curl tool and test-cases


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-11
changelog:
  - upstream patch adding a new option -J/--remote-header-name
  - dropped temporary workaround for #545779


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-3
changelog:
  - fix crash on doubly closed NSPR descriptor, patch contributed
    by Kevin Baughman (#534176)
  - new version of patch for broken TLS servers (#525496, #527771)


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-1
changelog:
  - new upstream release, dropped applied patches
  - workaround for broken TLS servers (#525496, #527771)


author: Kamil Dudka <kdudka@redhat.com> 7.19.6-4
changelog:
  - use pkg-config to find nss and libssh2 if possible
  - better patch (not only) for SCP/SFTP polling
  - improve error message for not matching common name (#516056)


author: Kamil Dudka <kdudka@redhat.com> 7.19.6-3
changelog:
  - avoid tight loop during a sftp upload
  - http://permalink.gmane.org/gmane.comp.web.curl.library/24744


author: Kamil Dudka <kdudka@redhat.com> 7.19.6-1
changelog:
  - new upstream release, dropped applied patches
  - changed NSS code to not ignore the value of ssl.verifyhost and produce more
    verbose error messages (#516056)


author: Kamil Dudka <kdudka@redhat.com> 7.19.5-8
changelog:
  - do not pre-login to all PKCS11 slots, it causes problems with HW tokens
  - try to select client certificate automatically when not specified, thanks
    to Claes Jakobsson


author: Kamil Dudka <kdudka@redhat.com> 7.19.4-6
changelog:
  - upstream patch fixing memory leak in lib/nss.c (#453612)
  - remove redundant dependency of libcurl-devel on libssh2-devel


author: Jindrich Novy <jnovy@redhat.com> 7.19.4-2
changelog:
  - drop .easy-leak patch, causes problems in pycurl (#488791)
  - fix libcurl-devel dependencies (#488895)


author: Jindrich Novy <jnovy@redhat.com> 7.19.4-1
changelog:
  - update to 7.19.4 (fixes CVE-2009-0037)
  - fix leak in curl_easy* functions, thanks to Kamil Dudka
  - drop nss-fix patch, applied upstream


author: Jindrich Novy <jnovy@redhat.com> 7.18.1-2
changelog:
  - spec cleanup, thanks to Paul Howarth (#225671)
    - drop BR: libtool
    - convert CHANGES and README to UTF-8
    - _GNU_SOURCE in CFLAGS is no more needed
    - remove bogus rpath


author: Jindrich Novy <jnovy@redhat.com> 7.18.1-1
changelog:
  - update to curl 7.18.1 (fixes #397911)
  - add ABI docs for libcurl
  - remove --static-libs from curl-config
  - drop curl-config patch, obsoleted by @SSL_ENABLED@ autoconf
    substitution (#432667)


author: Jindrich Novy <jnovy@redhat.com> 7.17.1-3
changelog:
  - drop useless ldap library detection since curl doesn't
    dlopen()s it but links to it -> BR: openldap-devel
  - enable LDAPS support (#225671), thanks to Paul Howarth
  - BR: krb5-devel to reenable GSSAPI support
  - simplify build process
  - update description


author: Jindrich Novy <jnovy@redhat.com> 7.17.1-1
changelog:
  - update to curl 7.17.1
  - include patch to enable SSL usage in NSS when a socket is opened
    nonblocking, thanks to Rob Crittenden (rcritten@redhat.com)


author: Jindrich Novy <jnovy@redhat.com> 7.16.4-5
changelog:
  - add support for the NSS PKCS#11 pem reader so the command-line is the
    same for both OpenSSL and NSS by Rob Crittenden (rcritten@redhat.com)
  - switch to NSS again


author: Jindrich Novy <jnovy@redhat.com> 7.16.3-1
changelog:
  - update to 7.16.3
  - drop .print patch, applied upstream
  - next series of merge review fixes by Paul Howarth
  - remove aclocal stuff, no more needed
  - simplify makefile arguments
  - don't reference standard library paths in libcurl.pc
  - include docs/CONTRIBUTE


author: Jindrich Novy <jnovy@redhat.com> 7.16.2-4
changelog:
  - another series of review fixes (#225671),
    thanks to Paul Howarth
  - check version of ldap library automatically
  - don't use %makeinstall and preserve timestamps
  - drop useless patches


author: Jindrich Novy <jnovy@redhat.com> - 7.16.0-2
changelog:
  - fix BuildRoot
  - add Requires: pkgconfig for curl-devel
  - move LDFLAGS and LIBS to Libs.private in libcurl.pc.in (#213278)


author: Ivana Varekova <varekova@redhat.com> - 7.15.1-2
changelog:
  - fix multilib problem - #181290 - 
    curl-devel.i386 not installable together with curl-devel.x86-64


author: Joe Orton <jorton@redhat.com> 7.12.3-3
changelog:
  - don't pass /usr to --with-libidn to remove "-L/usr/lib" from
    'curl-config --libs' output on x86_64.


author: Adrian Havill <havill@redhat.com> 7.12.3-1
changelog:
  - Upgrade to 7.12.3, which uses poll() for FDSETSIZE limit (#134794)
  - require libidn-devel for devel subpkg (#141341)
  - remove proftpd kludge; included upstream


author: Adrian Havill <havill@redhat.com> 7.12.1-1
changelog:
  - upgrade to 7.12.1
  - enable GSSAPI auth (#129353)
  - enable I18N domain names (#134595)
  - workaround for broken ProFTPD SSL auth (#134133). Thanks to
    Aleksandar Milivojevic


author: Adrian Havill <havill@redhat.com> 7.10.6-7
changelog:
  - aclocal before libtoolize
  - move OpenLDAP license so it's present as a doc file, present in
    both the source and binary as per conditions


author: Joe Orton <jorton@redhat.com> 7.9.8-2
changelog:
  - fix `curl-config --libs` output for libdir!=/usr/lib
  - remove docs/LIBCURL from docs list; remove unpackaged libcurl.la
  - libtoolize and reconf


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - include curl-config in curl-devel
  - update to 7.8 to fix memory leak and strlcat() symbol pollution from libcurl


author: Tim Powers <timp@redhat.com>
changelog:
  - update to 7.4.1 to fix bug #20337, problems with curl -c
  - not using patch anymore, it's included in the new source. Keeping
    for reference


author: Tim Powers <timp@redhat.com>
changelog:
  - changelog started
  - general cleanups, changed prefix to /usr, added manpage to files section
  - including in Powertools


author: Thomas Vander Stichele <thomas at apestaart dot org>
changelog:
  - 1.0.11.1-5
  - Clarify license based on https://github.com/dajobe/redland-bindings/commit/e5cf494c69f541ad3d357b69c821a85865dbdbc4
  - More changes from package review
  - Incorporate upstream ruby patch
  - Incorporate upstream python patch


author: Thomas Vander Stichele <thomas at apestaart dot org>
changelog:
  - 1.0.11.1-4
  - Updates after package review
  - Adhere to ruby/python/php macros and guidelines
  - Add comments linking to upstream patches
  - Support parallel make
  - Remove brp-python-bytecompile
  - Remove unneeded BuildRequires
  - Change php module to executable so it gets stripped
  - Change permissions on example for documentation


author: Thomas Vander Stichele <thomas at apestaart dot org>
changelog:
  - 1.0.4.1-2
  - added db4-devel
  - added patches for python and ruby sitearch, so 64-bit build works
  - use brb-python-bytecompile so we have .pyc and .pyo on < FC5
  - fix up perl installed files
  - added php bindings


author: Thomas Vander Stichele <thomas at apestaart dot org>
changelog:
  - 1.0.4.1-1
  - new release
  - added openssl-devel, postgresql-devel,sqlite-devel and mysql-devel
    buildrequires


author: Dave Beckett <dave.beckett@bristol.ac.uk>
changelog:
  - require raptor 1.2.0
  - update for removal of python distutils
  - require python 2.2.0+
  - require perl 5.8.0+
  - build and require mysql
  - do not build and require threestore


author: Dave Beckett <dave.beckett@bristol.ac.uk>
changelog:
  - require raptor 1.1.0
  - require libxml 2.4.0 or newer
  - added pkgconfig redland.pc
  - split redland/devel package shared libs correctly


