# changelog

author: Samuel Verschelde <stormi-xcp@ylix.fr> - 3.54.6-2.1
changelog:
  - Update to 3.54.6-2
  - *** Upstream changelog ***
  - * Thu Sep 28 2023 Mark Syms <mark.syms@citrix.com> - 3.54.6-2
  - - CP-40871: Enable rate limit control on unpause
  - * Thu Sep 07 2023 Mark Syms <mark.syms@citrix.com> - 3.54.6-1
  - - CP-40871: return the number of sectors coalesced from vhd-util
  - - CP-45025: Avoid retries except in a few specific cases
  - - CA-382087: Only write the bitmap if the contents have changed


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 3.54.6-3.1
changelog:
  - Sync with 3.54.6-3
  - *** Upstream changelog ***
  - * Fri Jan 26 2024 Mark Syms <mark.syms@citrix.com> - 3.54.6-3
  - - Rebuild against libxenstore.so.4


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 3.54.9-1.1
changelog:
  - Sync with 3.54.9-1
  - *** Upstream changelog ***
  - * Thu Apr 25 2024 Mark Syms <mark.syms@citrix.com> - 3.54.9-1
  - - Address various memory management issues
  - * Wed Mar 27 2024 Mark Syms <mark.syms@citrix.com> - 3.54.8-1
  - - CP-48048: Blktap fix code coverage (XS8 only)
  - - tap-ctl: Improve list output filtering
  - - CP-46763: When VBD queue is not ready call the driver completion
  - - CP-46778: always issue request via issue_requests
  - - CP-46771: separate queue checks for completed and new requests.
  - - CP-46764: mask ring event handlers before quiescing the queue
  - - CP-46764: When the VBD is quiesced skip checking for requests to submit
  - - Fix setting of CFLAGS for mockatests
  - - Do not free iconv cd if allocation fails
  - - Fix the order of linker options in CBT
  - - Fixup various bits of incorrect automake usage
  - - CA-384162: Send completions for all partial responses
  - - CA-390490: allocate vhd request before locking bat
  - - CP-48057: Add unit tests for drivers/scheduler.c


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 3.55.4-1.1
changelog:
  - Sync with 3.55.4-1
  - *** Upstream changelog ***
    * Tue Dec 03 2024 Mark Syms <mark.syms@cloud.com> - 3.55.4-1
    - CA-392151 lcache.c uses wrong buffer size definition
    - CA-403297: when storing read-through do not mirror
    * Mon Nov 18 2024 Mark Syms <mark.syms@cloud.com> - 3.55.3-1
    - CP-52620: enable local caching after opening all other images
    * Tue Nov 05 2024 Tim Smith <tim.smith@cloud.com> - 3.55.2-1
    - CA-387575 Remove static libraries and libtool archives from devel package
    - Correct name of exposed NBD server
    - CA-401174 Filedescriptor leak in NBD option negotiation
    * Mon Sep 16 2024 Tim Smith <tim.smith@cloud.com> - 3.55.1-1
    - Redo the revert of an incorrect NBD FD leak fix
    * Fri Sep 13 2024 Tim Smith <tim.smith@cloud.com> - 3.55.0-1
    - CP-46765 - Fix asan issues in unit tests
    - CA-396659: rationalise bitops and fix overflow issues
    - CA-396659: delete legacy debt utility vhd-update
    - Handle scheduler uuid overflow explictly
    - CP-50952 Autodetect NBD server protocol version on client connect
    - Fix use of incorrect label in error case
    - CA-397082 Properly fix FD leak in NBD server
    - CP-50955 Add a new-style NBD server for each VDI
    * Tue Aug 06 2024 Mark Syms <mark.syms@cloud.com> - 3.54.10-1
    - CA-391882: fix nbd connection fd leak bug
    - Remove some unnecessary build dependencies


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 3.55.5-2.1
changelog:
  - Sync with 3.55.5-2
  - Drop patch "Add an option to never resolve parent path when vhd-util query is
  called" already included in upstream v3.55.5
  - *** Upstream changelog ***
    * Tue Feb 11 2025 Mark Syms <mark.syms@cloud.com> - 3.55.5-2
    - CA-404370: enable NBD client only after completing handshake
    * Mon Jan 06 2025 Mark Syms <mark.syms@cloud.com> - 3.55.5-1
    - Add an option to never resolve parent path when vhd-util query is called


author: Ronan Abhamon <ronan.abhamon@vates.tech> - 3.55.5-2.3
changelog:
  - Fix a bad integer conversion that interrupts valid coalesce calls on large VDIs
  - Add 0002-CP-308382-fix-sign-conversion-in-coalesce.patch
  - Add 0003-Fix-coalesced-size-conversion-in-vhd-util-coalesce.patch


author: Anthoine Bourgeois <anthoine.bourgeois@vates.tech> - 3.55.5-6.1
changelog:
  - Sync with 3.55.5-6
  - Revert openssl 3 dependency from XS specfile (no change compared to previous XCP-ng release)
  - Drop patch 0002-CP-308382-fix-sign-conversion-in-coalesce.patch, upstream now
  - Drop patch 0003-Fix-coalesced-size-conversion-in-vhd-util-coalesce.patch, upstream now
  - *** Upstream changelog ***
    * Thu Jul 31 2025 Mark Syms <mark.syms@cloud.com> - 3.55.5-6
    - Fix coalesced size conversion in vhd-util-coalesce (CP-308382)
    * Mon Jun 23 2025 Mark Syms <mark.syms@cloud.com> - 3.55.5-5
    - Backport fix for CA-408175
    - CP-308382: fix sign conversion in coalesce
    * Mon Apr 07 2025 Mark Syms <mark.syms@cloud.com> - 3.55.5-4
    - CP-54256: log when reporting EOPNOTSUPP
    * Fri Feb 21 2025 Deli Zhang <deli.zhang@cloud.com> - 3.55.5-3
    - CP-50273: Move CCM dependency to OpenSSL 3


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.19-7
changelog:
  - Update IANA numbers
  - Apply patch from CentOS Stream, never applied upstream:
    Disable retry of pre-session "Get cipher suites" command as some
    BMCs are ignoring it (#1831158)
  - Apply patches from Debian, never applied upstream:
    - fix tsol buffer overflow,
      https://sourceforge.net/p/ipmitool/mailman/message/24405281/
    - fix non-analog sensor readings, https://sourceforge.net/p/ipmitool/bugs/490/
  - Update /var/run to /run in ipmievd.service that systemd warns about (#2100475)


author: Philippe Coval <philippe.coval@vates.tech> - 3.6.1-4.1
changelog:
  - Rebuild with openssl-3
  - Reapply changes from 3.3.3-1.1 on upstream base 3.6.1-4
    * Thu Aug 28 2025 Yann Dirson <yann.dirson@vates.tech> - 3.3.3-1.1
    - Refresh ldconfig cache on installation/removal
    * Thu Apr 30 2020 Ondrej Dubaj <odubaj@redhat.com> - 3.3.3-1
    - Rebase to version 3.3.3


author: Thierry Escande <thierry.escande@vates.tech> - 8.9.1-5.1
changelog:
  - Restore changes from original fc40 specfile
  - Add %bcond xcpng for specific XCP-ng build directives
  - Add %bcond build_minimal to disable libcurl-minimal package build
  - Update to curl v8.9.1 from el10 srpm
  - Port NSS cipher compat list patch and tests from XS8
  - Backport patch for CVE 2024-8096
  - *** Upstream changelog ***
    * Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 8.9.1-5
    - Bump release for October 2024 mass rebuild:
      Resolves: RHEL-64018
    * Mon Aug 19 2024 Jacek Migacz <jmigacz@redhat.com> - 8.9.1-4
    - correct indentation in test plan
    * Fri Aug 02 2024 Jacek Migacz <jmigacz@redhat.com> - 8.9.1-3
    - fix libcurl and libcurl-minimal conflict in test plan (RHEL-52103)
    * Fri Aug 02 2024 Jacek Migacz <jmigacz@redhat.com> - 8.9.1-2
    - add gating configuration (RHEL-52103)
    - sigpipe: init the struct so that first apply ignores (RHEL-53327)
    * Wed Jul 31 2024 Jacek Migacz <jmigacz@redhat.com> - 8.9.1-1
    - new upstream release (RHEL-50806)
    * Tue Jul 9 2024 Jacek Migacz <jmigacz@redhat.com> - 8.6.0-8
    - disable OpenSSL Engine API support (RHEL-30436)
    - setopt: Fix disabling all protocols (CVE-2024-2004)
    - http2: push headers better cleanup (CVE-2024-2398)
    * Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 8.6.0-7
    - Bump release for June 2024 mass rebuild
    * Mon Feb 12 2024 Jan Macku <jamacku@redhat.com> - 8.6.0-6
    - revert "receive max buffer" + add test case
    - temporarily disable test 0313
    - remove suggests of libcurl-minimal in curl-full
    * Mon Feb 12 2024 Jan Macku <jamacku@redhat.com> - 8.6.0-5
    - add Provides to curl-minimal
    * Wed Feb 07 2024 Jan Macku <jamacku@redhat.com> - 8.6.0-4
    - drop curl-minimal subpackage in favor of curl-full (#2262096)
    * Mon Feb 05 2024 Jan Macku <jamacku@redhat.com> - 8.6.0-3
    - ignore response body to HEAD requests


author: Philippe Coval <philippe.coval@vates.tech> - 3.3.29-10.1
changelog:
  - Remove installed gnutls-dane if no more supported
  - Remove unnecessary removal of non built files
  - Make c++ lib optional (disabled by default)


author: Jan Synáček <jsynacek@redhat.com> - 20160308-7
changelog:
  - ping hung when it cannot receive echo reply (#1362463)
  - arping documentation inconsistency (#1351704)


author: Jan Synáček <jsynacek@redhat.com> - 20160308-9
changelog:
  - IPv4 vs IPv6 inconsistency on return value of ping (#1362388)
  - ping6 does not use device specified with -I parameter (#1371824, #1424965)
  - double cap_free call in ping_common.c (#1410114)
  - ping assumes EACCESS errors are due to broadcast addresses (#1387315)
  - ping -t with multicast address without effect on ppc64 (#1373333)
  - arping -c <n> does not exit when the device is deleted (#1387542)


author: Philippe Coval <philippe.coval@vates.tech> - 1.15.1-22.1
changelog:
  - Skip keyring tests if keyring blocked by seccomp
  - Add explicit dependency to gcc
  - Make build dependency to latex optionnal
  - Rebuild with openssl-3


author: Petr Menšík <pemensik@redhat.com> - 1.7.0-14
changelog:
  - Add only extra flags to default RPM LDFLAGS
  - Fix multilib conflict of ldns-config (#1463423)
  - Make primary python3 in primary build, python2 in optional


author: Philippe Coval <philippe.coval@vates.tech> 1.7.0-21.1
changelog:
  - Update obsolete %patch macro
  - Reconfigure if patches are touching autotools file
  - Add patch for openssl-3 support
  - Rebuild for openssl-3


author: Steve Dickson <steved@redhat.com> 2.0.18-1
changelog:
  - Updated to latest stable upstream version: 2.0.18-stable
  - Moved documentation into its own rpm (bz 810138)


author: Philippe Coval <philippe.coval@vates.tech> - 2.0.21-4.1
changelog:
  - Rebuild with openssl-compat-10
  - Make openssl optional (enabled by default)
  - Update legacy %patchN syntax for rpmspec
  - Add make and gcc to BuildRequires


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 5.7.2-51.1
changelog:
  - Rebase on XS8's 5.7.2-51
  - Undo most changes from snmp.xs.conf, which are related to a proprietary implementation


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 5.7.2-51.2
changelog:
  - Add net-snmp-5.7.2-no-XENSERVER-MIB.xcp-ng.patch
  - Remove XenServer-specific options from /etc/sysconfig/snmpd


author: Thierry Escande <thierry.escande@vates.tech> - 5.7.2-51.3
changelog:
  - Backport patches for CVE-2022-24805, CVE-2022-24806, CVE-2022-24807,
    CVE-2022-24808, CVE-2022-24809, CVE-2022-24810, and CVE-2022-44793


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 5.7.2-52.1
changelog:
  - Rebase on 5.7.2-52
  - Replace our patch by upstream identical one
  - *** Upstream changelog ***
    * Wed Jul 31 2024 Deli Zhang <deli.zhang@cloud.com> - 5.7.2-52
    - CA-393002: Fix CVE-2022-24805 and CVE-2022-24809 issues


author: Philippe Coval <philippe.coval@vates.tech> - 5.9.3-8.1
changelog:
  - Rebuild for openssl-3
  - Remove obsolete net-snmp-5.7.2-CVE-2022-24806.patch
  - Rebase on 5.9.3-8
  - *** Upstream changelog ***
    * Mon Jan 20 2025 Deli Zhang <deli.zhang@cloud.com> - 5.9.3-8
    - CP-50295: Add epoch 1 for XS 8

    * Fri Jan 17 2025 Chunjie Zhu <chunjie.zhu@cloud.com> - 5.9.3-7
    - CP-53263: Remove net-tools

    * Fri Jan 17 2025 Stephen Cheng <stephen.cheng@cloud.com> - 5.9.3-6
    - CP-53229: Remove chrpath

    * Thu Nov 21 2024 Stephen Cheng <stephen.cheng@cloud.com> - 5.9.3-5
    - CP-50538 Remove perl related packages
    - CP-50538 Remove selinux from BuildRequires

    * Fri Aug 23 2024 Deli Zhang <deli.zhang@cloud.com> - 5.9.3-4
    - CP-44169: Add XenServer SNMP Agent so
    - CP-44170: Update default settings
    - CP-44429: Move snmpd.xs.conf from xenserver-release
    - CP-44429: Improve service config

    * Tue Jul 30 2024 Deli Zhang <deli.zhang@cloud.com> - 5.9.3-3
    - CP-50122: Revert perl-srpm-macros require

    * Fri Jul 26 2024 Deli Zhang <deli.zhang@cloud.com> - 5.9.3-2
    - CP-50122: Replace redhat-rpm-config with xenserver-config-rpm in XS9

    * Mon Sep 04 2023 Lin Liu <lin.liu@citrix.com> - 5.9.3-1
    - First imported release


author: Alex Brett <alex.brett@cloud.com> - 7.4p1-23.1 + 0.10.3-2
changelog:
  - Imported openssh-7.4p1-23.el7_9 from CentOS, including:
  - Fix for CVE-2023-38408
  - Fix for CVE-2021-41617
  - Fix for CVE-2018-15473
  - Fix for CVE-2017-15906


author: Thierry Escande <thierry.escande@vates.tech> - 7.4p1-23.2.1 + 0.10.3-2.23.2.1
changelog:
  - Harden default ciphers and algorithms
  - Disable GSSAPIAuthentication in sshd_config
  - Remove build dependency on xauth (used for X11 forwarding not supported on XCP-ng hosts)
  - Make use of xcpng_subrel macro for versioning
  - Disable gnome_askpass
  - Add BuildRequires for gcc


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 7.4p1-23.3.1 + 0.10.3-2.23.3.1
changelog:
  - Sync with 7.4p1-23.3 + 0.10.3-2.23.3
  - *** Upstream changelog ***
  - * Tue Jul 02 2024 Ross Lagerwall <ross.lagerwall@citrix.com> - 7.4p1-23.3 + 0.10.3-2
  - - CP-50166: Remove libsystemd integration
  - - CA-395182: Fix CVE-2024-6387 - use of non-async-signal-safe fn in sighandler


author: Philippe Coval <philippe.coval@vates.tech> - 9.8p1-1.2.1
changelog:
  - Refresh XCP-ng patches:
    - Drop unnecessary hardening and gssapi patches
    - Replace CVE-2025-26465 backport with upstream patch from 9.9p1
  - Sync with 9.8p1-1.2
  - *** Upstream changelog ***
  - * Fri Nov 07 2025 Alex Brett <alex.brett@citrix.com> - 9.8p1-1.2
  - - CA-420416: Remove diffie-hellman-group14-sha1 KexAlgorithm
  - * Thu Jan 02 2025 Deli Zhang <deli.zhang@cloud.com> - 9.8p1-1.1
  - - CA-400917: Disable PerSourcePenalties
  - - CA-401322: Revert sshd.pam to xs8 default
  - - CA-401322: Ensure new config files applied
  - * Fri Sep 13 2024 Deli Zhang <deli.zhang@citrix.com> - 9.8p1-1
  - - CP-50298: Upgrade to version 9.8p1
  - * Wed Jul 31 2024 Lin Liu <lin.liu@citrix.com> - 8.8p1-3
  - - CP-50477: Customize ssh configurations
  - * Mon Sep 25 2023 Lin Liu <lin.liu@citrix.com> - 8.8p1-2
  - - CP-45435: Permit root ssh login
  - * Thu Jul 20 2023 Lin Liu <lin.liu@citrix.com> - 8.8p1-1
  - - First imported release


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-22
changelog:
  - fix CVE-2021-23841 openssl: NULL pointer dereference
    in X509_issuer_and_serial_hash()
  - fix CVE-2021-23840 openssl: integer overflow in CipherUpdate
  - Resolves: rhbz#1932132, rhbz#1932126


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-23
changelog:
  - fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#1996054


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-24
changelog:
  - Updates patch openssl-1.0.2k-cve-2021-3712.patch to only free on push failure.
  - Resolves: rhbz#2039993


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.0.2k-25
changelog:
  - Fixes CVE-2022-2078 Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Related: rhbz#2067160


author: Guillaume Thouvenin <guillaume.thouvenin@vates.tech> - 1:1.0.2k-26.1
changelog:
  - Add openssl-1.0.2k-update-expiring-certificates.patch to fix build time tests
  - Added gcc to BuildRequires


author: Andrii Sultanov <andriy.sultanov@vates.tech> - 3.0.9-2.0.1.2
changelog:
  - Update to the upstream 3.0.9-2.0.1 package
  - Remove backported patches as OpenSSL 3.0.9 is not affected by the CVEs they
    were fixing: openssl-1.0.2k-cve-2019-1547.backport.patch,
    openssl-1.0.2k-cve-2019-1551.backport.patch, and
    openssl-1.0.2k-cve-2019-1563.backport.patch
  - Remove a patch fixing a build time test as it's no longer necessary on 3.0.9:
    openssl-1.0.2k-update-expiring-certificates.patch
  - *** Upstream changelog ***
    * Thu Jan 02 2025 Deli Zhang <deli.zhang@cloud.com> - 3.0.9-2.0.1
    - CP-52657: Fix CVE-2024-6119
    - CP-52243: Remove new ciphers
    - CP-50862: Add fips only config file
    - CP-50299: Revert epoch=1
    - CP-50299: Disable crypto-policies
    - CP-50299: Build with devtoolset-11

    * Thu Jul 27 2023 Lin Liu <lin.liu@citrix.com> - 3.0.9-2
    - Restore basearch

    * Thu Jul 27 2023 Lin Liu <lin.liu@citrix.com> - 3.0.9-1
    - First imported release


author: Andrii Sultanov <andriy.sultanov@vates.tech> - 1.0.2k-26.1.1
changelog:
  - First build - OpenSSL 1.0.2k-26 compatible package
  - Add backported patches from our OpenSSL package: openssl-1.0.2k-cve-2019-1547.backport.patch,
    openssl-1.0.2k-cve-2019-1551.backport.patch, openssl-1.0.2k-cve-2019-1563.backport.patch
    (the openssl-1.0.2k-update-expiring-certificates.patch was dropped since it
    was already included in the upstream package)
  - *** Upstream changelog ***
    * Thu Feb 13 2025 Lin Liu <deli.zhang@cloud.com> - 1.0.2k-26.1
    - CP-53507: Build OpenSSL 1.0.2k-26 compatible package

    * Thu Jul 18 2024 Lin Liu <Lin.Liu01@cloud.com> - 1.0.2k-26
    - First imported release


author: Philippe Coval <philippe.coval@vates.tech> - 1.0.2k-26.2.1
changelog:
  - Replace older openssl-devel (1.0 API) during transition
  - Release is set 26.2.1 (as a follow up of openssl-1:1.0.2k-26.2)


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 2.5.3-2.3.13.1
changelog:
  - Rebase on latest package from CH 8.3 Preview
  - Re-add changes to produce openvswitch-ipsec subpackage


author: David Morel <david.morel@vates.fr> - 2.5.3-2.3.13.2
changelog:
  - Backport fix for CVE-2023-1668: Remote traffic denial of service via crafted packets with IP proto 0
  - Comment out tests that fail
  - Enable make check in spec file


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 2.5.3-2.3.14.1
changelog:
  - Update to 2.5.3-2.3.14
  - Drop openvswitch-2.5.3-CVE-2023-1668.backport.patch, now patched in XenServer's RPM
  - *** Upstream changelog ***
  - * Tue Apr 18 2023 Ross Lagerwall <ross.lagerwall@citrix.com> - 2.5.3-2.3.14
  - - CA-376367: Fix CVE-2023-1668


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 2.17.7-1.1
changelog:
  - Update to 2.17.7-1
  - Add openvswitch-2.17.7-comment-failing-tests.XCP-ng.patch (Benjamin Reis)
  - Add openvswitch-2.17.7-add-pythonpath-ipsec.XCP-ng.patch (Benjamin Reis)
  - Get ipsec script and service from new sources (Benjamin Reis)
  - *** Upstream changelog ***
  - * Wed Aug 23 2023 Chunjie Zhu <chunjie.zhu@cloud.com> - 2.17.7-1
  - - CP-44181: upgrade to OVS LTS 2.17.7


author: David Morel <david.morel@vates.tech> - 2.17.7-1.2
changelog:
  - Apply fix for CVE-2023-3966, provided in advisory
  - Apply fix for CVE-2023-5366, provided in advisory


author: David Morel <david.morel@vates.tech> - 2.17.7-1.3
changelog:
  - Link with xs-openssl instead of openssl
  - Tweak ovs-ctl script that is used to start ovsdb-server, passing it
    --ssl-ciphers and --ssl-protocols command line parameters to disable weak
    ciphers.


author: David Morel <david.morel@vates.tech> - 2.17.7-1.5
changelog:
  - link back to openssl to avoid issues with XO sdn-controller
  - use ciphers that works with XO sdn-controller and should not be considered as weak-ciphers


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 2.17.7-2.1
changelog:
  - Sync with 2.17.7-2
  - *** Upstream changelog ***
  - * Thu Jun 13 2024 Lin Liu <Lin.Liu01@cloud.com> - 2.17.7-2
  - - CP-46117: Refresh patches to build with XS9


author: Gaëtan Lehmann <gaetan.lehmann@vates.tech> - 2.17.7-4.1
changelog:
  - Sync with 2.17.7-4
  - *** Upstream changelog ***
    * Wed Jan 22 2025 Alex Brett <alex.brett@cloud.com> - 2.17.7-4
    - CA-405118: Backport 3 patches to handle updated groff
    
    * Thu Dec 12 2024 Stephen Cheng <stephen.cheng@cloud.com> - 2.17.7-3
    - CP-50699: For xs9, move config file for openvswitch.service from xenserver-release


author: Deli Zhang <deli.zhang@cloud.com> - 2.7.5-92
changelog:
  - CP-50325: Use new api of ncurses-devel
  - CP-50323: Replace deprecated functions
  - CA-397616: Remove test_gdb test temporarily
  - CP-50323: Remove unused module test test_ftplib.py
  - CP-50323: Build with OpenSSL 3
  - CP-50323: Import python-2.7.5-90.el7.src.rpm


author: Kamil Dudka <kdudka@redhat.com> - 7.19.0-15
changelog:
  - allow to return -1 from the write callback (#857875) 
  - remove the patch for curl-config --static-libs no longer needed
  - run the tests against the just built pycurl, not the system one


author: Philippe Coval <philippe.coval@vates.tech> - 7.19.0-19.1
changelog:
  - Add gcc to BuildRequires
  - Define __python for modern parser
  - Update obsolete patch macro with autosetup
  - Rebuild with openssl-3


author: Deli Zhang <deli.zhang@cloud.com> - 3.6.8-20
changelog:
  - CP-53516: Fix build issue caused by expat upgrade
  - CP-50324: Replace deprecated functions
  - CP-50324: Remove python3-pip require
  - CA-397616: Remove test_gdb tests temporarily
  - CP-50324: Build with OpenSSL 3
  - CP-50324: Import python3-3.6.8-18.el7.src.rpm


author: Andrew Cooper <andrew.cooper3@citrix.com> - 3.4.1-1
changelog:
  - Update to 3.4.1
     - Fixes for CVE-2024-12084, CVE-2024-12085, CVE-2024-12086
                 CVE-2024-12087, CVE-2024-12088, CVE-2024-12747
  - Resync specfile


author: Manuel "lonely wolf" Wolfshant <wolfy@fedoraproject.org> - 2.64-7
changelog:
  - remove world readable permissions of the config file (#962988)
  - revive the authpass patch (#970123)
  - revive improved default config settings which were lost during rebase (#895708)


author: Gael Duperrey <gduperrey@vates.tech> - 1.9.15-3.1
changelog:
  - Synced from sudo-1.9.15-3.xs8.src.rpm
  - Removed XS-specific test of dist macro to determine buildrequires


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 1.9.15-4.1
changelog:
  - Sync with 1.9.15-4
  - *** Upstream changelog ***
  - * Thu Jul 4 2024 Lin Liu <Lin.Liu01@cloud.com> - 1.9.15-4
  -- - Drop python plugin as not required


author: Gaëtan Lehmann <gaetan.lehmann@vates.tech> - 1.9.15-5.1
changelog:
  - Sync with 1.9.15-5
  - *** Upstream changelog ***
    * Tue Nov 12 2024 Lin Liu <Lin.Liu01@cloud.com> - 1.9.15-5
    - CP-50489: Remove selinux


author: Martin Sehnoutka <msehnout@redhat.com> - 14:4.9.0-1
changelog:
  - New upstream version 4.9.0. Resolves: #1422473
  - Add legacy -P switch with warning. Related to #1422473 and #1292056


author: Martin Sehnoutka <msehnout@redhat.com> - 14:4.9.0-4
changelog:
  - Drop downstream patch (drop root privileges)
  - Add libcap-ng as a new build dependency
  - Related: #1262283


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 1.2.0-1.2
changelog:
  - Revert part of XCP-ng specific changes, as upstream varstored now uses /var/lib/varstored
    and certs should be available by default now.
  - Add varstored-1.2.0-fix-return-code-for-varstore-sb-state-user.XCP-ng.patch


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 1.2.0-1.3
changelog:
  - Update secureboot-certs script for recent UEFI cert handling in XAPI
  - Remove KEK and db cert databases for now, pending legal advice.


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 1.2.0-2.1
changelog:
  - Sync with 1.2.0-2
  - *** Upstream changelog ***
  - * Fri Jan 26 2024 Andrew Cooper <andrew.cooper3@citrix.com> - 1.2.0-2
  - - Rebuild against libxenstore.so.4


author: Thierry Escande <thierry.escande@vates.tech> - 1.2.0-2.2
changelog:
  - Auth: Add support to make KEK and DB files optional
  - Auth: Enable AUTH_ONLY_PK_REQUIRED build macro


author: Thierry Escande <thierry.escande@vates.tech> - 1.2.0-2.3
changelog:
  - Remove generation and installation of KEK and db files
  - Add helper script to remove pem file from source archive
  - Update source archive with pem files removed


author: Tu Dinh <ngoc-tu.dinh@vates.tech> - 1.2.0-2.4
changelog:
  - Add gen-sbvar.py
  - Add self-signed PK.auth blob
  - Generate {KEK,db,dbx}.auth using gen-sbvar.py
  - Update secureboot-certs to take builtin KEK/db/dbx
  - Update Secure Boot certs from microsoft/secureboot_objects@3f69ef4


author: Thierry Escande <thierry.escande@vates.tech> - 1.2.0-3.1
changelog:
  - Sync with 1.2.0-3
  - *** Upstream changelog ***
    * Wed Jan 22 2025 XenServer Rebuild <rebuild@xenserver.com> - 1.2.0-3
    - Add yangtze release branch
    - CP-53310: XenServer 9 rebuild


author: Tu Dinh <ngoc-tu.dinh@vates.tech> - 1.2.0-3.4
changelog:
  - Fix owner GUID of EFI_SIGNATURE_DATA structures
  - Restore dbx generation
  - Update dbx info to microsoft/secureboot_objects@e64d1a5c89e5 (v1.6.1)
  - Add fix-efivars.py script


