# changelog

author: Petr Menšík <pemensik@redhat.com> - 2.4.0-4
changelog:
  - Move queryparse to separate subpackage
  - Recommend only gnuplot for resperf-report
  - Disabling queryparse for EPEL8


author: Petr Menšík <pemensik@redhat.com> - 2.7.1-1
changelog:
  - Remove dnsperf-data package. Provide dnsperf-data command to download sample instead.
  - Update to 2.7.1


author: David Cantrell <dcantrell@redhat.com> - 1.3-2
changelog:
  - Small change to the way Koji builds are submitted
  - Move the master branch to version 1.3
  - Drop DEBUG_PRINT in process_table()
  - Add doc/git.md to explain source control conventions
  - Change Suggests to Recommends in the spec file
  - Add kmidiff and politics to the inspections section of generic.yaml
  - Update TODO list
  - Use warn() for non-fatal errors in mkdirp()
  - Require libabigail >= 1.8 in rpminspect.spec.in
  - Enable multiple --headers-dir1 and --headers-dir2 args in abidiff
  - Swap out some more fprintf()/fflush() reporting with warn()
  - #include <err.h> in peers.c and rmtree.c
  - On fedora-rawhide CI jobs, install gcc-c++ and gcc-plugin-devel
  - Disable fedora-rawhide GitHub Action for now
  - Correctly handle the -w option on rpminspect(1) (#256)
  - Drop the relative path handling for the -w option
  - Build and install rc from source on opensuse-leap
  - Update doc/git.md on how to track upstream
  - Add .github/ and osdeps/ directories to extra-ci.yml
  - Build and install rc from source on opensuse-tumbleweed
  - Adjust curl(1) command line used for rc in opensuse CI jobs
  - Trying to figure out why the opensuse jobs produce curl errors
  - Another slight change to post.sh for the opensuse-leap CI job
  - s/PowerTools/powertools/g in the centos8 PKG_CMD definition
  - The output of html2text on opensuse systems is different
  - Rename HEADER_MAN to HEADER_MANPAGE (#264)
  - Add inspection_header_to_desc() to librpminspect (#264)
  - Add xunit output format support (#264)
  - Support the new output function call syntax (#264)
  - Move init_elf_data() to readelf.c, move data to struct rpminspect
  - Update inspect_elf.c unit tests for librpminspect changes
  - Remove check_ipv6() from inspect_elf.c
  - Create the badfuncs inspection
  - Update po/ translation files.
  - Add badfuncs test cases
  - Forgot to commit test_badfuncs.py.
  - Fix flake8 and black errors with test_badfuncs.py
  - Skip debug packages in filesize, display changes correctly
  - Fix spurious execstack failure
  - Fix YAML config file reading for BLOCK_INSPECTIONS
  - Expand dump_config() to cover all config file settings
  - Minor spelling fixes in strfuncs.c and making code explicit
  - Simplify list_to_string() so it handles 1-elements lists right
  - Add abspath() to canonicalize path strings
  - In the doc inspection, only show diff(1) output for text files (#254)
  - Add strxmlescape() to strfuncs.c in librpminspect (#264)
  - Output the system-out xunit portion as CDATA (#264)
  - Slightly change how strxmlescape() works
  - Add the runpath inspection to librpminspect
  - Rename test/data/lto.c to test/data/mathlib.c
  - Handle the empty string case in abspath()
  - Expand dump_cfg() to show runpath settings
  - Fix block handling problems in the YAML config reader
  - Note single builds cannot be rebases in is_rebase()
  - Hook up the driver for the runpath inspection
  - Install patchelf for tests on fedora and centos
  - Update TODO and README.md files
  - Pass -D to rpminspect in the test suite
  - Add integration tests for the runpath inspection
  - Python flake8 and black fixes in test_runpath.py
  - Fixes for GitHub Actions on Debian and Ubuntu
  - Disable Rust support in pip modules, more extra-ci fixes
  - Update pip and setuptools on debian and ubuntu CI jobs
  - Make sure pip is updated on debian, centos7, and centos8
  - Fixes for extra-ci on arch, centos7, centos8, and debian
  - Adjust docker image names for opensuse and arch
  - Add Gentoo Linux to the Extra CI set
  - extra-ci.yml typo fix for the gentoo job
  - Use gentoo/stage3 as the container for the gentoo CI job
  - Disable opensuse-tumbleweed and archlinux CI jobs
  - Make sure util/determine-os.sh picks up Gentoo Linux
  - In the runpath inspection, fail if DT_RPATH and DT_RUNPATH exist
  - Use pip install for PIP_CMD on gentoo
  - Set PIP_CMD to pip install -user for gentoo
  - Handle a NULL from list_to_string() in abspath()
  - Do not match path prefixes in the runpath inspection
  - Python black fixes for test_runpath.py
  - Stop doing an emerge --sync on the gentoo CI job
  - Replace emerge --sync with a manual portage sync
  - Use emerge-webrsync to update portage on gentoo
  - Add uthash and move the file matching code to it.
  - Typo fix in README.md
  - Fix some memory leaks found by valgrind
  - Create mkannounce.sh to help make release announcements easier
  - shellcheck fixes for mkannounce.sh


author: David Cantrell <dcantrell@redhat.com> - 1.4-1
changelog:
  - Start work on the 1.4 release
  - Trim git commit summary prefix from changelog lines
  - Report the program version number in the results (#309)
  - Handle compressed but otherwise empty man pages (#308)
  - Flake8 fixes for test_manpage.py
  - s/self.rpm/self.after_rpm/ in two test_manpage.py tests
  - Disable broken ELF heurisitic and size limit in libclamav
  - Modify dump_cfg() to write valid YAML to stdout (#306)
  - Migrate more code off hsearch and to uthash
  - Replace hsearch() with uthash in the kmod inspection
  - Update TEST_METADATA status in TODO and MISSING
  - Restrict style checks to specific directories
  - Replace hsearch() with uthash in the abidiff inspection
  - Change tsearch/twalk use to uthash
  - Correct misuse of entry with hentry variables (#321)
  - Normalize copyright boilerplates in source files
  - Use hentry->key over hentry->value in pathmigration
  - Adjust lib/meson.build for Fedora rawhide
  - Drop gate.yml and begin non-x86_64 arches in ci.yml
  - Add armv7, aarch64, and s390x to the other_arches job
  - Change init.c error reporting over to err/warn functions
  - Modify file triggers and matrix use in ci.yml
  - Split 32-bit osdeps out to post.sh scripts in osdeps/
  - Split style.yml in to shellcheck.yml and python.yml
  - Rewrite extra-ci.yml to use the matrix strategy method for GHA
  - Move the emulated CI jobs to extra-ci.yml
  - s/pkg/pki/ for the centos jobs
  - Debian and Ubuntu fixes for CI
  - Python pip on Debian is called pip
  - Try to fix just debian:stable
  - Enable debian:testing in extra-ci.yml
  - Enable centos8 in extra-ci.yml again
  - Enable centos7 in extra-ci.yml again
  - Enable opensuse-leap and gentoo in extra-ci.yml again
  - Run each test script individually on emulated targets
  - Try a different syntax for the emulated matrix jobs
  - Install s390 glibc headers on s390x fedora systems
  - Detect 32-bit and musl presence in test_elf.py
  - Skip lost -fPIC tests if gcc lacks -m32 support
  - Add stretch and buster to the emulated targets list
  - Drop Debian buster from the emulated targets
  - Install gcc-multilib only on Debian x86_64 and s390x systems
  - libc-dev:i386 -> libc6-dev:i386
  - Disable Debian targets in extra-ci temporarily
  - s/AUR/git/g in osdeps/arch/post.sh
  - In read_cfgfile(), keep track of block depth correctly (#329)
  - A few more yaml parsing fixes for block vs group
  - Recommend or Require libabigail >= 1.8.2
  - Finish normalizing all the error reporting statements
  - Advertise of rpminspect-report in the contrib README.
  - Report libclamav version and CVD versions (#258)
  - Ensure first argument of warn(3) is a format string.
  - Enable werror=true and warning_level=3 in default_options
  - Update the translation template file
  - Get rid of invalid free() in get_product_release()
  - Add inspection_id() to librpminspect
  - Update the po/rpminspect.pot template
  - Improve mkannounce.sh to handle stable and devel releases


author: David Cantrell <dcantrell@redhat.com> - 1.5-1
changelog:
  - Begin work on version 1.5
  - Use llabs() instead of labs() in the filesize inspection
  - Improve has invalid execstack flags reporting
  - Use long unsigned int to report size changes in patches
  - Fix some errors in the changedfiles inspection
  - Update the changedfiles test cases
  - Check DT_SONAME in is_elf_shared_library()
  - Skip debuginfo and debugsource files in abidiff
  - Make sure abidiff test cases add a DT_SONAME to the test lib
  - Report INFO level for patches findings by default
  - Python black fixes in test/test_abidiff.py
  - Update the test/test_patches.py cases for patches changes
  - Generate regular changelog in utils/srpm.h
  - Skip branches without targets in submit-koji-builds.sh
  - Fedora and CentOS systems in ci need diffstat
  - opensuse-leap CI job requires diffstat
  - Fix the Debian CI jobs in GitHub Actions
  - Fix and enable the Ubuntu extra-ci job in GitHub Actions
  - Use pip instead of pip3 for the Ubuntu command
  - Use apt-get -y install in
  - Enable the opensuse-tumbleweed GHA job again
  - Make sure the Gentoo GHA job has diffstat
  - Get the Arch Linux GHA job working again
  - Use ubuntu:latest for the ubuntu GHA image
  - Simplify the utils/determine-os.sh script
  - Update license table in README.md
  - Allow any number of builds specified for fetch only mode
  - Handle old or broken versions of libmagic in changedfiles
  - Update GitHub Action status badges in README.md
  - Fix $(OS) check in the Makefile
  - Fix the ubuntu GitHub Actions extra-ci job
  - Make sure the centos8 job has git available before cloning
  - Change strappend() to work as a variadic function
  - Use json_tokener_parse_ex() to get better error reporting
  - Fix reading of the javabytecode block in the config file
  - Catch missing/losing -fPIC correctly on .a ELF objects (#352)
  - Refactor elf_archive_tests() and its helper functions
  - Followup fix for find_no_pic, find_pic, and find_all
  - Install cpp-coveralls using pacman on Arch Linux
  - Install cpp-coveralls using pip on Arch Linux
  - Install cpp-coveralls in pre.sh on Arch Linux
  - Install required Python modules in pre.sh on Arch Linux
  - Do not upgrade pip on Arch Linux, go back to using pip.txt
  - Drop DEBUG_PRINT from source generated by pic_bits.sh
  - Do not run apt-get update as a second time on Debians systems
  - The lost PIC tests need to invoke gcc with -fno-PIC
  - Update the OpenSUSE Tumbleweed files, but disable it anyway
  - Define inspection_ignores in struct rpminspect
  - Clean up the config file section reading code
  - Add add_ignore() to init.c
  - Fix fetch only mode download directory
  - Stub out libcurl download progress callback function
  - Perform symbolic owner and group matching in ownership (#364)
  - Restrict download_progress() to systems with CURLOPT_XFERINFOFUNCTION
  - Read per-inspection ignore lists from the config file.
  - Add commented out per-inspection ignore blocks
  - Implement per-inspection path ignore support (#351)
  - Report annocheck failures correctly in librpminspect.
  - Note all regular expression settings use regex(7) syntax
  - Allow size_threshold: info in the config file (#261)
  - Check ignore list in files for path prefixes to ignore (#360)
  - Support a list of expected empty RPMs in the config file (#355)
  - Call mparse_reset() before mparse_readfd()
  - Do not crash with the -c option specifies a non-existent file
  - Update TODO list
  - Make sure brp-compress is disabled in test_manpage.py
  - Require/Recommend /usr/bin/annocheck
  - Note size_threshold can be the keyword info
  - Ensure ctxt->lastError.message is not NULL before strdup (#382)
  - Handle corrupt compressed files in changedfiles (#382)
  - Disable debugging output for the ignore lists in init.c
  - Drop debugging output in the xml inspection
  - Remove what working directories we can
  - Correctly find icons for desktop files in subpackages (#367)
  - Followup to the Icon= check in the desktop inspection (#367)
  - BuildRequires libmandoc-devel >= 1.14.5
  - Manually install mandoc on centos7 for now


author: Matthieu Saulnier <fantom@fedoraproject.org> - 0.11.0-2
changelog:
  - Package Review RHBZ#1995497:
    - Remove useless ldconfig scriptlets
    - Fix Requires tag of the doc subpackage
    - Fix summary and description of lib and devel subpackages
    - Reverse requirements between main package and libs subpackage
    - Move docfiles from libs subpackage to main package


author: Matthieu Saulnier <fantom@fedoraproject.org> - 0.13.1-2
changelog:
  - Disable python plugin support (python-unversioned-command package is not available)
  - Add patch to modify glib2 version in ./configure (2.62.0 is not available)
  - Add patch to add missing glib2 function
  - Add patch to add missing headers for the glib2 function


author: Henrik Nordstrom <henrik@henriknordstrom.net> 5.6.6-2
changelog:
  - Fixes for CVE-2022-1061 CVE-2022-1207 CVE-2022-1237 CVE-2022-1238
    CVE-2022-1240 CVE-2022-1244 CVE-2022-1283 CVE-2022-1284 CVE-2022-1296
    CVE-2022-1297


author: Phil Wyett <philip.wyett@kathenas.org> - 1.4.29-2
changelog:
  - Add patch: 0001_add_mime_text_formats_for_rdp_clibpoard.patch
  - Add patch: 0002_fix_unlock_crash.patch


author: Phil Wyett <philip.wyett@kathenas.org> - 1.4.29-4
changelog:
  - Fix flatpak build - Yaakov Selkowitz <yselkowi@redhat.com>.
  - Make Fedora greater than or equal to 37 use libsoup3 and webkit2gtk-4.1.


author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.57.5
   - image: clean snapd mount after preseeding
   - wrappers,snap/quota: clear LogsDirectory= in the service unit
     for journal namespaces
   - cmd/snap,daemon: allow zero values from client to daemon for
     journal rate-limit
   - interfaces: steam-support allow pivot /run/media and /etc/nvidia
     mount
   - o/ifacestate: introduce DebugAutoConnectCheck hook
   - release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2
   - autopkgtests: fix running autopkgtest on kinetic
   - interfaces: add microceph interface
   - interfaces: steam-support allow additional mounts
   - many: add stub services
   - interfaces: add kconfig paths to system-observe
   - i/b/system_observe: honour root dir when checking for
     /boot/config-*
   - interfaces: grant access to speech-dispatcher socket
   - interfaces: rework logic of unclashMountEntries


author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.57.6
    - SECURITY UPDATE: Local privilege escalation
      - snap-confine: Fix race condition in snap-confine when preparing a
        private tmp mount namespace for a snap
      - CVE-2022-3328


author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.58
   - many: Use /tmp/snap-private-tmp for per-snap private tmps
   - data: Add systemd-tmpfiles configuration to create private tmp dir
   - cmd/snap: test allowed and forbidden refresh hold values
   - cmd/snap: be more consistent in --hold help and err messages
   - cmd/snap: error on refresh holds that are negative or too short
   - o/homedirs: make sure we do not write to /var on build time
   - image: make sure file customizations happen also when we have
     defaultscause
   - tests/fde-on-classic: set ubuntu-seed label in seed partitions
   - gadget: system-seed-null should also have fs label ubuntu-seed
   - many: gadget.HasRole, ubuntu-seed can come also from system-seed-
     null
   - o/devicestate: fix paths for retrieving recovery key on classic
   - cmd/snap-confine: do not discard const qualifier
   - interfaces: allow python3.10+ in the default template
   - o/restart: fix PendingForSystemRestart
   - interfaces: allow wayland slot snaps to access shm files created
     by Firefox
   - o/assertstate: add Sequence() to val set tracking
   - o/assertstate: set val set 'Current' to pinned sequence
   - tests: tweak the libvirt interface test to work on 22.10
   - tests: use system-seed-null role on classic with modes tests
   - boot: add directory for data on install
   - o/devicestate: change some names from esp to seed/seed-null
   - gadget: add system-seed-null role
   - o/devicestate: really add error to new error message
   - restart,snapstate: implement reboot-required notifications on
     classic
   - many: avoid automatic system restarts on classic through new
     overlord/restart logic
   - release: Fix WSL detection in LXD
   - o/state: introduce WaitStatus
   - interfaces: Fix desktop interface rules for document portal
   - client: remove classic check for `snap recovery --show-
     keys`
   - many: create snapd.mounts targets to schedule mount units
   - image: enable sysfs overlay for UC preseeding
   - i/b/network-control: add permissions for using AF_XDP
   - i/apparmor: move mocking of home and overlay conditions to osutil
   - tests/main/degraded: ignore man-db update failures in CentOS
   - cmd/snap: fix panic when running snap w/ flag but w/o subcommand
   - tests: save snaps generated during image preaparation
   - tests: skip building snapd based on new env var
   - client: remove misleading comments in ValidateApplyOptions
   - boot/seal: add debug traces for bootchains
   - bootloader/assets: fix grub.cfg when there are no labels
   - cmd/snap: improve refresh hold's output
   - packaging: enable BPF in RHEL9
   - packaging: do not traverse filesystems in postrm script
   - tests: get microk8s from another branch
   - bootloader: do not specify Core version in grub entry
   - many: refresh --hold follow-up
   - many: support refresh hold/unhold to API and CLI
   - many: expand fully handling links mapping in all components, in
     the API and in snap info
   - snap/system_usernames,tests: Azure IoT Edge system usernames
   - interface: Allow access to
     org.freedesktop.DBus.ListActivatableNames via system-observe
     interface
   - o/devicestate,daemon: use the expiration date from the assertion
     in user-state and REST api (user-removal 4/n)
   - gadget: add unit tests for new install functions for FDE on
     classic
   - cmd/snap-seccomp: fix typo in AF_XDP value
   - tests/connected-after-reboot-revert: run also on UC16
   - kvm: allow read of AMD-SEV parameters
   - data: tweak apt integration config var
   - o/c/configcore: add faillock configuration
   - tests: use dbus-daemon instead of dbus-launch
   - packaging: remove unclean debian-sid patch
   - asserts: add keyword 'user-presence' keyword in system-user
     assertion (auto-removal 3/n)
   - interfaces: steam-support allow pivot /run/media and /etc/nvidia
     mount
   - aspects: initial code
   - overlord: process auto-import assertion at first boot
   - release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2
   - tests: fix lxd-mount-units in ubuntu kinetic
   - tests: new variable used to configure the kernel command line in
     nested tests
   - go.mod: update to newer secboot/uc22 branch
   - autopkgtests: fix running autopkgtest on kinetic
   - tests: remove squashfs leftovers in fakeinstaller
   - tests: create partition table in fakeinstaller
   - o/ifacestate: introduce DebugAutoConnectCheck hook
   - tests: use test-snapd-swtpm instead of swtpm-mvo snap in nested
     helper
   - interfaces/polkit: do not require polkit directory if no file is
     needed
   - o/snapstate: be consistent not creating per-snap save dirs for
     classic models
   - inhibit: use hintFile()
   - tests: use `snap prepare-image` in fde-on-classic mk-image.sh
   - interfaces: add microceph interface
   - seccomp: allow opening XDP sockets
   - interfaces: allow access to icon subdirectories
   - tests: add minimal-smoke test for UC22 and increase minimal RAM
   - overlord: introduce hold levels in the snapstate.Hold* API
   - o/devicestate: support mounting ubuntu-save also on classic with
     modes
   - interfaces: steam-support allow additional mounts
   - fakeinstaller: format SystemDetails result with %+v
   - cmd/libsnap-confine-private: do not panic on chmod failure
   - tests: ensure that fakeinstaller put the seed into the right place
   - many: add stub services for prompting
   - tests: add libfwupd and libfwupdplugin5 to openSUSE dependencies
   - o/snapstate: fix snaps-hold pruning/reset in the presence of
     system holding
   - many: add support for setting up encryption from installer
   - many: support classic snaps in the context of classic and extended
     models
   - cmd/snap,daemon: allow zero values from client to daemon for
     journal rate limit
   - boot,o/devicestate: extend HasFDESetupHook to consider unrelated
     kernels
   - cmd/snap: validation set refresh-enforce CLI support + spread test
   - many: fix filenames written in modeenv for base/gadget plus drive-
     by TODO
   - seed: fix seed test to use a pseudo-random byte sequence
   - cmd/snap-confine: remove setuid calls from cgroup init code
   - boot,o/devicestate: introduce and use MakeRunnableStandaloneSystem
   - devicestate,boot,tests: make `fakeinstaller` test work
   - store: send Snap-Device-Location header with cloud information
   - overlord: fix unit tests after merging master in
   - o/auth: move HasUserExpired into UserState and name it HasExpired,
     and add unit tests for this
   - o/auth: rename NewUserData to NewUserParams
   - many: implementation of finish install step handlers
   - overlord: auto-resolve validation set enforcement constraints
   - i/backends,o/ifacestate: cleanup backends.All
   - cmd/snap-confine: move bind-mount setup into separate function
   - tests/main/mount-ns: update namespace for 18.04
   - o/state: Hold pseudo-error for explicit holding, concept of
     pending changes in prune logic
   - many: support extended classic models that omit kernel/gadget
   - data/selinux: allow snapd to detect WSL
   - overlord: add code to remove users that has an expiration date set
   - wrappers,snap/quota: clear LogsDirectory= in the service unit for
     journal namespaces
   - daemon: move user add, remove operations to overlord device state
   - gadget: implement write content from gadget information
   - {device,snap}state: fix ineffectual assignments
   - daemon: support validation set refresh+enforce in API
   - many: rename AddAffected* to RegisterAffected*, add
     Change|State.Has, fix a comment
   - many: reset store session when setting proxy.store
   - overlord/ifacestate: fix conflict detection of auto-connection
   - interfaces: added read/write access to /proc/self/coredump_filter
     for process-control
   - interfaces: add read access to /proc/cgroups and
     /proc/sys/vm/swappiness to system-observe
   - fde: run fde-reveal-key with `DefaultDependencies=no`
   - many: don't concatenate non-constant format strings
   - o/devicestate: fix non-compiling test
   - release, snapd-apparmor: fixed outdated WSL detection
   - many: add todos discussed in the review in
     tests/nested/manual/fde-on-classic, snapstate cleanups
   - overlord: run install-device hook during factory reset
   - i/b/mount-control: add optional `/` to umount rules
   - gadget/install: split Run in several functions
   - o/devicestate: refactor some methods as preparation for install
     steps implementation
   - tests: fix how snaps are cached in uc22
   - tests/main/cgroup-tracking-failure: fix rare failure in Xenial and
     Bionic
   - many: make {Install,Initramfs}{{,Host},Writable}Dir a  function
   - tests/nested/manual/core20: fix manual test after changes to
     'tests.nested exec'
   - tests: move the unit tests system to 22.04 in github actions
     workflow
   - tests: fix nested errors uc20
   - boot: rewrite switch in SnapTypeParticipatesInBoot()
   - gadget: refactor to allow usage from the installer
   - overlord/devicestate: support for mounting ubuntu-save before the
     install-device hook
   - many: allow to install/update kernels/gadgets on classic with
     modes
   - tests: fix issues related to dbus session and localtime in uc18
   - many: support home dirs located deeper under /home
   - many: refactor tests to use explicit strings instead of
     boot.Install{Initramfs,Host}{Writable,FDEData}Dir
   - boot: add factory-reset cases for boot-flags
   - tests: disable quota tests on arm devices using ubuntu core
   - tests: fix unbound SPREAD_PATH variable on nested debug session
   - overlord: start turning restart into a full state manager
   - boot: apply boot logic also for classic with modes boot snaps
   - tests: fix snap-env test on debug section when no var files were
     created
   - overlord,daemon: allow returning errors when requesting a restart
   - interfaces: login-session-control: add further D-Bus interfaces
   - snapdenv: added wsl to userAgent
   - o/snapstate: support running multiple ops transactionally
   - store: use typed valset keys in store package
   - daemon: add `ensureStateSoon()` when calling systems POST api
   - gadget: add rules for validating classic with modes gadget.yaml
     files
   - wrappers: journal namespaces did not honor journal.persistent
   - many: stub devicestate.Install{Finish,SetupStorageEncryption}()
   - sandbox/cgroup: don't check V1 cgroup if V2 is active
   - seed: add support to load auto import assertion
   - tests: fix preseed tests for arm systems
   - include/lk: update LK recovery environment definition to include
     device lock state used by bootloader
   - daemon: return `storage-encryption` in /systems/<label> reply
   - tests: start using remote tools from snapd-testing-tools project
     in nested tests
   - tests: fix non mountable filesystem error in interfaces-udisks2
   - client: clarify what InstallStep{SetupStorageEncryption,Finish} do
   - client: prepare InstallSystemOptions for real use
   - usersession: Remove duplicated struct
   - o/snapstate: support specific revisions in UpdateMany/InstallMany
   - i/b/system_packages_doc: restore access to Libreoffice
     documentation
   - snap/quota,wrappers: allow using 0 values for the journal rate
     limit
   - tests: add kinetic images to the gce bucket for preseed test
   - multiple: clear up naming convention for thread quota
   - daemon: implement stub `"action": "install"`
   - tests/main/snap-quota-{install/journal}: fix unstable spread tests
   - tests: remove code for old systems not supported anymore
   - tests: third part of the nested helper cleanup
   - image: clean snapd mount after preseeding
   - tests: use the new ubuntu kinetic image
   - i/b/system_observe: honour root dir when checking for
     /boot/config-*
   - tests: restore microk8s test on 16.04
   - tests: run spread tests on arm64 instances in google cloud
   - tests: skip interfaces-udisks2 in fedora
   - asserts,boot,secboot: switch to a secboot version measuring
     classic
   - client: add API for GET /systems/<label>
   - overlord: frontend for --quota-group support (2/2)
   - daemon: add GET support for `/systems/<seed-label>`
   - i/b/system-observe: allow reading processes security label
   - many: support '--purge' when removing multiple snaps
   - snap-confine: remove obsolete code
   - interfaces: rework logic of unclashMountEntries
   - data/systemd/Makefile: add comment warning about "snapd." prefix
   - interfaces: grant access to speech-dispatcher socket (bug 1787245)
   - overlord/servicestate: disallow removal of quota group with any
     limits set
   - data: include snapd/mounts in preseeded blob
   - many: Set SNAPD_APPARMOR_REEXEC=1
   - store/tooling,tests: support UBUNTU_STORE_URL override env var
   - multiple: clear up naming convention for cpu-set quota
   - tests: improve and standardize debug section on tests
   - device: add new DeviceManager.encryptionSupportInfo()
   - tests: check snap download with snapcraft v7+ export-login auth
     data
   - cmd/snap-bootstrap: changes to be able to boot classic rootfs
   - tests: fix debug section for test uc20-create-partitions
   - overlord: --quota-group support (1/2)
   - asserts,cmd/snap-repair: drop not pursued
     AuthorityDelegation/signatory-id
   - snap-bootstrap: add CVM mode* snap-bootstrap: add classic runmode
   - interfaces: make polkit implicit on core if /usr/libexec/polkitd
     exists
   - multiple: move arguments for auth.NewUser into a struct (auto-
     removal 1/n)
   - overlord: track security profiles for non-active snaps
   - tests: remove NESTED_IMAGE_ID from nested manual tests
   - tests: add extra space to ubuntu bionic
   - store/tooling: support using snapcraft v7+ base64-encoded auth
     data
   - overlord: allow seeding in the case of classic with modes system
   - packaging/*/tests/integrationtests: reload ssh.service, not
     sshd.service
   - tests: rework snap-logs-journal test and add missing cleanup
   - tests: add spread test for journal quotas
   - tests: run spread tests in ubuntu kinetic
   - o/snapstate: extend support for holding refreshes
   - devicestate: return an error in checkEncryption() if KernelInfo
     fails
   - tests: fix sbuild test on debian sid
   - o/devicestate: do not run tests in this folder twice
   - sandbox/apparmor: remove duplicate hook into testing package
   - many: refactor store code to be able to use simpler form of auth
     creds
   - snap,store: drop support/consideration for anonymous download urls
   - data/selinux: allow snaps to read certificates
   - many: add Is{Core,Classic}Boot() to DeviceContext
   - o/assertstate: don't refresh enforced validation sets during check
   - go.mod: replace maze.io/x/crypto with local repo
   - many: fix unnecessary use of fmt.Sprintf
   - bootloader,systemd: fix `don't use Yoda conditions (ST1017)`
   - HACKING.md: extend guidelines with common review comments
   - many: progress bars should use the overridable stdouts
   - tests: remove ubuntu 21.10 from sru validation
   - tests: import remote tools
   - daemon,usersession: switch from HeaderMap to Header in tests
   - asserts: add some missing `c.Check()` in the asserts test
   - strutil: fix VersionCompare() to allow multiple `-` in the version
   - testutil: remove unneeded `fmt.Sprintf`
   - boot: remove some unneeded `fmt.Sprintf()` calls
   - tests: implement prepare_gadget and prepare_base and unify all the
     version
   - o/snapstate: refactor managed refresh schedule logic
   - o/assertstate, snapasserts: implementation of
     assertstate.TryEnforceValidationSets function
   - interfaces: add kconfig paths to system-observe
   - dbusutil: move debian patch into dbustest
   - many: change name and input of CheckProvenance to clarify usage
   - tests: Fix a missing parameter in command to wait for device
   - tests: Work-around non-functional --wait on systemctl
   - tests: unify the way the snapd/core and kernel are repacked in
     nested helper
   - tests: skip interfaces-ufisks2 on centos-9
   - i/b/mount-control: allow custom filesystem types
   - interfaces,metautil: make error handling in getPaths() more
     targeted
   - cmd/snap-update-ns: handle mountpoint removal failures with EBUSY
   - tests: fix pc-kernel repacking
   - systemd: add `WantedBy=default.target` to snap mount units
   - tests: disable microk8s test on 16.04


author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.58.1
   - secboot: detect lockout mode in CheckTPMKeySealingSupported
   - cmd/snap-update-ns: prevent keeping unneeded mountpoints
   - o/snapstate: do not infinitely retry when an update fails during
     seeding
   - interfaces/modem-manager: add permissions for NETLINK_ROUTE
   - systemd/emulation.go: use `systemctl --root` to enable/disable
   - snap: provide more error context in `NotSnapError`
   - interfaces: add read access to /run for cryptsetup
   - boot: avoid reboot loop if there is a bad try kernel
   - devicestate: retry serial acquire on time based certificate
     errors
   - o/devicestate: run systemctl daemon-reload after install-device
     hook
   - cmd/snap,daemon: add 'held' to notes in 'snap list'
   - o/snapshotstate: check snapshots are self-contained on import
   - cmd/snap: show user+gating hold info in 'snap info'
   - daemon: expose user and gating holds at /v2/snaps/{name}


author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.58.3
   - interfaces/screen-inhibit-control: Add support for xfce-power-
     manager
   - interfaces/network-manager: do not show ptrace read
     denials
   - interfaces: relax rules for mount-control `what` for functionfs
   - cmd/snap-bootstrap: add support for snapd_system_disk
   - interfaces/modem-manager: add net_admin capability
   - interfaces/network-manager: add permission for OpenVPN
   - httputil: fix checking x509 certification error on go 1.20
   - i/b/fwupd: allow reading host os-release
   - boot: on classic+modes `MarkBootSuccessfull` does not need a base
   - boot: do not include `base=` in modeenv for classic+modes installs
   - tests: add spread test that validates revert on boot for core does
     not happen on classic+modes
   - snapstate: only take boot participants into account in
     UpdateBootRevisions
   - snapstate: refactor UpdateBootRevisions() to make it easier to
     check for boot.SnapTypeParticipatesInBoot()


author: Neal Gompa <ngompa@datto.com> - 5.9.4-4
changelog:
  - Disable TPM/TSS 1.2 support for F36+ / RHEL9+
  - Resolves: rhbz#2033299 Drop TPM/TSS 1.2 support (trousers)


author: Arne Reiter <redhat@arnereiter.de> - 5.9.5-3
changelog:
  - Resolves: rhbz#2048108 - segfault at 18 ip 00007f4c7c0d841c sp 00007ffe49f61b70 error 4 in libc.so.6


author: Arne Reiter <redhat@arnereiter.de> - 5.9.6-1
changelog:
  - Resolves rhbz#2080070 strongswan-5.9.6 is available
  - Fixed missing format string in enum_flags_to_string()


author: Arne Reiter <redhat@arnereiter.de> - 5.9.8-1
changelog:
  - Resolves rhbz#2112274 strongswan-5.9.8 is available
  - Patch1 removes CFLAGS -Wno-format which interferes with -Werror=format-security
  - Add BuildRequire for autoconf and automake, now required for release
  - Remove obsolete patches


author: Jonathan Dieter <jdieter@gmail.com> - 1.2.0-1
changelog:
  - Add `--uncompressed` option to zck, allowing for embedding of uncompressed
    digests in the header
  - Various small bug fixes


author: Jonathan Dieter <jdieter@gmail.com> - 1.2.1-1
changelog:
  - Fixed bug that limited size of file that could be compressed using zchunk to 2GB
  - Fixed memory leak


author: Jonathan Dieter <jdieter@gmail.com> - 1.3.0-1
changelog:
  - Add option to generate a zchunk header from an uncompressed file without
    actually creating a zchunk file


