# changelog

author: Sérgio Basto <sergio@serjux.com> - 2.2-2
changelog:
  - Updated the remove of cardsets already included in PySolFC package (PySolFC-Cardsets--Minimal-2.2.0)
  - Convert to SPDX License


author: Than Ngo <than@redhat.com> - 119.0.6045.199-2
changelog:
  - fixed bz#2242271, built with bundleminizip in fedora > 39
  - fixed bz#2251884, built with fstack-protector-strong for improved security


author: Than Ngo <than@redhat.com> - 120.0.6099.109-1
changelog:
  - update to 120.0.6099.109
     * High CVE-2023-6702: Type Confusion in V8
     * High CVE-2023-6703: Use after free in Blink
     * High CVE-2023-6704: Use after free in libavif
     * High CVE-2023-6705: Use after free in WebRTC
     * High CVE-2023-6706: Use after free in FedCM
     * Medium CVE-2023-6707: Use after free in CSS


author: Than Ngo <than@redhat.com> - 120.0.6099.199-1
changelog:
  - new gn update, drop workaround for broken gn on epel 8/9
  - update to 120.0.6099.199
     * CVE-2024-0222: Use after free in ANGLE
     * CVE-2024-0223: Heap buffer overflow in ANGLE
     * CVE-2024-0224: Use after free in WebAudio
     * CVE-2024-0225: Use after free in WebGPU


author: Miroslav Suchý <msuchy@redhat.com> 1.97-1
changelog:
  - update copr keys
  - add script to check all keys
  - remove expired jenkins key
  - update expired intel security key
  - update expired navy linux key
  - update expired bluejeans key
  - add script to check expiration
  - Add the key for pkgs.k8s.io (Kubernetes)


author: Miroslav Suchý <msuchy@redhat.com> 1.99-1
changelog:
  - update copr keys
  - Add Qubes OS 4.2 release key
  - Split AlmaLinux OS 8 GPG public keys to fix microdnf
  - Update AlmaLinux OS 8 public key


author: Jos de Kloe <josdekloe@gmail.com> - 2.29.0-1
changelog:
  - Upgrade to upstream version 2.29.0
    Note that the source code now uses g++ in stead of gcc for compilation.


author: Paul Howarth <paul@city-fan.org> - 3.3.112-1
changelog:
  - Update to 3.3.112
    - VCD reader fixes for unnamed Icarus begin blocks
    - String data type crash fix in fst.c
  - Use SPDX-format license tag


author: Paul Howarth <paul@city-fan.org> - 3.3.115-1
changelog:
  - Update to 3.3.115
    - Fix VZT reader with -fstrict-aliasing
    - Fix use_multi_state condition in vzt_write.c
    - Fix for UNDEF vs strings at start of a vzt file
    - Fix sleep() time scaling redefine for mingw
    - Use MapViewOfFileEx for mmap on Windows (fstapi)
    - Define FST_DO_MISALIGNED_OPS on AArch64 (fstapi)
    - Fixed attrbegin short length problem


author: Paul Howarth <paul@city-fan.org> - 3.3.116-1
changelog:
  - Update to 3.3.116
    - Fix manpage/odt for vcd2fst command switch documentation for zlibpack
    - Add GDK_WINDOWING_WAYLAND check for gdkwayland.h header usage
    - Change sprintf to snprintf in fstapi.c
    - Fix init crash on show_base_symbols enabled


author: Paul Howarth <paul@city-fan.org> - 3.3.118-1
changelog:
  - Update to 3.3.118
    - Update xml2stems to handle newer "loc" vs. "fl" xml tags
    - Change preg_regex_c_1 decl to use regex_t* as datatype
    - Move gtkwave.appdata.xml to io.github.gtkwave.GTKWave.metainfo.xml
    - Fixed popen security advisories:
      - TALOS-2023-1786 (CVE-2023-35963, CVE-2023-35960, CVE-2023-35964,
  		       CVE-2023-35959, CVE-2023-35961, CVE-2023-35962)
    - Fixed FST security advisories:
      - TALOS-2023-1777 (CVE-2023-32650)
      - TALOS-2023-1783 (CVE-2023-35704, CVE-2023-35703, CVE-2023-35702)
      - TALOS-2023-1785 (CVE-2023-35956, CVE-2023-35957, CVE-2023-35958,
  		       CVE-2023-35955)
      - TALOS-2023-1789 (CVE-2023-35969, CVE-2023-35970)
      - TALOS-2023-1790 (CVE-2023-35992)
      - TALOS-2023-1791 (CVE-2023-35994, CVE-2023-35996, CVE-2023-35997,
  		       CVE-2023-35995)
      - TALOS-2023-1792 (CVE-2023-35128)
      - TALOS-2023-1793 (CVE-2023-36747, CVE-2023-36746)
      - TALOS-2023-1797 (CVE-2023-36864)
      - TALOS-2023-1798 (CVE-2023-36915, CVE-2023-36916)
    - Fixed evcd2vcd security advisories:
      - TALOS-2023-1803 (CVE-2023-34087)
    - Fixed VCD security advisories:
      - TALOS-2023-1804 (CVE-2023-37416, CVE-2023-37419, CVE-2023-37420,
  		       CVE-2023-37418, CVE-2023-37417)
      - TALOS-2023-1805 (CVE-2023-37447, CVE-2023-37446, CVE-2023-37445,
  		       CVE-2023-37444, CVE-2023-37442, CVE-2023-37443)
      - TALOS-2023-1806 (CVE-2023-37576, CVE-2023-37577, CVE-2023-37573,
  		       CVE-2023-37578, CVE-2023-37575, CVE-2023-37574)
      - TALOS-2023-1807 (CVE-2023-37921, CVE-2023-37923, CVE-2023-37922)
    - Fixed VZT security advisories:
      - TALOS-2023-1810 (CVE-2023-37282)
      - TALOS-2023-1811 (CVE-2023-36861)
      - TALOS-2023-1812 (CVE-2023-38618, CVE-2023-38621, CVE-2023-38620,
  		       CVE-2023-38619, CVE-2023-38623, CVE-2023-38622)
      - TALOS-2023-1813 (CVE-2023-38649, CVE-2023-38648)
      - TALOS-2023-1814 (CVE-2023-38651, CVE-2023-38650)
      - TALOS-2023-1815 (CVE-2023-38653, CVE-2023-38652)
      - TALOS-2023-1816 (CVE-2023-35004)
      - TALOS-2023-1817 (CVE-2023-39235, CVE-2023-39234)
    - Fixed LXT2 security advisories:
      - TALOS-2023-1818 (CVE-2023-39273, CVE-2023-39271, CVE-2023-39274,
  		       CVE-2023-39275, CVE-2023-39272, CVE-2023-39270)
      - TALOS-2023-1819 (CVE-2023-34436)
      - TALOS-2023-1820 (CVE-2023-39316, CVE-2023-39317)
      - TALOS-2023-1821 (CVE-2023-35057)
      - TALOS-2023-1822 (CVE-2023-35989)
      - TALOS-2023-1823 (CVE-2023-38657)
      - TALOS-2023-1824 (CVE-2023-39413, CVE-2023-39414)
      - TALOS-2023-1826 (CVE-2023-39443, CVE-2023-39444)
      - TALOS-2023-1827 (CVE-2023-38583)


author: Pavel Raiskup <praiskup@redhat.com> 38.3-1
changelog:
  - new URL for CenOS Stream 8 koji (msuchy@redhat.com)
  - Make --enablerepo=local work with centos-stream chroots (miro@hroncok.cz)


author: Pavel Raiskup <praiskup@redhat.com> 38.5-1
changelog:
  - drop includepkgs=devtoolset* from centos-{6,7} (orion@nwra.com)
  - Fedora 35 and 36 is EOL
  - remove useradd specific changes in configs - it is not needed for Mock 4+
  - openSUSE i586 has been moved out of the main repo into a port (f_krull@gmx.de)


author: Pavel Raiskup <praiskup@redhat.com> 38.6-1
changelog:
  - use python3 macro for post scriptlet (mroche@omenos.dev)
  - openEuler: use metalinks instead of baseurls (chenzeng2@huawei.com)


author: Pavel Raiskup <praiskup@redhat.com> 39.1-1
changelog:
  - Add openSUSE Leap 15.5 (neal@gompa.dev)
  - Move openSUSE Leap 15.3 to EOL (neal@gompa.dev)
  - Mageia 9 branched, Mageia Cauldron retargeted to Mageia 10 (neal@gompa.dev)


author: Pavel Raiskup <praiskup@redhat.com> 39.2-1
changelog:
  - Switch ELN to use a native bootstrap container image
  - Use the correct openSUSE Backports key for Leap 15.5 (neal@gompa.dev)
  - Properly handle /etc/mock/default.cfg on Fedora ELN (sbonazzo@redhat.com)


author: Pavel Raiskup <praiskup@redhat.com> 39.3-1
changelog:
  - Fedora 40+ to use DNF5 for building
  - Mandriva provides python-* not python3-* packages, use them
  - mark ELN bootstrap image as "ready" to speedup bootstrap preparation


author: Pavel Raiskup <praiskup@redhat.com> 39.4-1
changelog:
  - configure system_cachedir for dnf5
  - configs: EOL Fedora 37
  - config: add README.md with maintainers and issue trackers (frostyx@email.cz)


author: Lumír Balhar <lbalhar@redhat.com> - 1.6.3-1
changelog:
  - Remove .dist-info directory at the end of %pyproject_buildrequires
  - An incomplete .dist-info directory in $PWD can confuse tests in %check


author: Miro Hrončok <mhroncok@redhat.com> - 1.7.0-1
changelog:
  - %pyproject_buildrequires: Redirect stdout to stderr via Shell
  - Dependencies are recorded to a text file that is catted at the end
  - Fixes: rhbz#2183519


author: Miro Hrončok <mhroncok@redhat.com> - 1.8.0-1
changelog:
  - %pyproject_buildrequires: Add support for self-referential extras requirements
    Fixes: rhbz#2171343
  - Deprecate the provisional %{pyproject_build_lib} macro
    See https://lists.fedoraproject.org/archives/list/python-devel@lists.fedoraproject.org/thread/HMLOPAU3RZLXD4BOJHTIPKI3I4U6U7OE/


author: Paul Howarth <paul@city-fan.org> - 2.10.1-1
changelog:
  - Update to 2.10.1
    - CVE-2022-24302: Creation of new private key files using
      '~paramiko.pkey.PKey' subclasses was subject to a race condition between
      file creation and mode modification, which could be exploited by an
      attacker with knowledge of where the Paramiko-using code would write out
      such files; this has been patched by using 'os.open' and 'os.fdopen' to
      ensure new files are opened with the correct mode immediately (we've left
      the subsequent explicit 'chmod' in place to minimize any possible
      disruption, though it may get removed in future backwards-incompatible
      updates)
    - Add support for the '%C' token when parsing SSH config files (GH#1976)
    - Add support for OpenSSH's Windows agent as a fallback when Putty/WinPageant
      isn't available or functional (GH#1509, GH#1837, GH#1868)
    - Significantly speed up low-level read/write actions on
      '~paramiko.sftp_file.SFTPFile' objects by using 'bytearray'/'memoryview'
      (GH#892); this is unlikely to change anything for users of the higher level
      methods like 'SFTPClient.get' or 'SFTPClient.getfo', but users of
      'SFTPClient.open' will likely see orders of magnitude improvements for
      files larger than a few megabytes in size
    - Add 'six' explicitly to install-requires; it snuck into active use at some
      point but has only been indicated by transitive dependency on 'bcrypt'
      until they somewhat-recently dropped it (GH#1985); this will be short-lived
      until we drop Python 2 support


author: Paul Howarth <paul@city-fan.org> - 2.10.2-1
changelog:
  - Update to 2.10.2
    - Fix Python 2 compatibility breakage introduced in 2.10.1 (GH#2001)
  - Re-enable sftp tests, no longer failing under mock


author: Paul Howarth <paul@city-fan.org> - 2.10.3-1
changelog:
  - Update to 2.10.3
    - Certificate-based pubkey auth was inadvertently broken when adding SHA2
      support in version 2.9.0 (GH#1963, GH#1977)
    - Switch from module-global to thread-local storage when recording thread IDs
      for a logging helper; this should avoid one flavor of memory leak for
      long-running processes (GH#2002, GH#2003)


author: Paul Howarth <paul@city-fan.org> - 2.10.4-1
changelog:
  - Update to 2.10.4
    - Update 'camelCase' method calls against the 'threading' module to be
      'snake_case'; this and related tweaks should fix some deprecation warnings
      under Python 3.10 (GH#1838, GH#1870, GH#2028)
    - '~paramiko.pkey.PKey' instances' '__eq__' did not have the usual safety
      guard in place to ensure they were being compared to another 'PKey' object,
      causing occasional spurious 'BadHostKeyException', among other things
      (GH#1964, GH#2023, GH#2024)
    - Servers offering certificate variants of hostkey algorithms (e.g.
      'ssh-rsa-cert-v01@openssh.com') could not have their host keys verified by
      Paramiko clients, as it only ever considered non-cert key types for that
      part of connection handshaking (GH#2035)


author: Paul Howarth <paul@city-fan.org> - 2.11.0-1
changelog:
  - Update to 2.11.0
    - Align signature verification algorithm with OpenSSH re: zero-padding
      signatures that don't match their nominal size/length; this shouldn't
      affect most users, but will help Paramiko-implemented SSH servers handle
      poorly behaved clients such as PuTTY (GH#1933)
    - OpenSSH 7.7 and older has a bug preventing it from understanding how to
      perform SHA2 signature verification for RSA certificates (specifically
      certs - not keys), so when we added SHA2 support it broke all clients using
      RSA certificates with these servers; this has been fixed in a manner similar
      to what OpenSSH's own client does - a version check is performed and the
      algorithm used is downgraded if needed (GH#2017)
    - Recent versions of Cryptography have deprecated Blowfish algorithm support;
      in lieu of an easy method for users to remove it from the list of
      algorithms Paramiko tries to import and use, we've decided to remove it
      from our "preferred algorithms" list, which will both discourage use of a
      weak algorithm, and avoid warnings (GH#2038, GH#2039)
    - Windows-native SSH agent support as merged in 2.10 could encounter
      'Errno 22' 'OSError' exceptions in some scenarios (e.g. server not cleanly
      closing a relevant named pipe); this has been worked around and should be
      less problematic (GH#2008, GH#2010)
    - Add SSH config token expansion (eg '%h', '%p') when parsing 'ProxyJump'
      directives (GH#1951)
    - Apply unittest 'skipIf' to tests currently using SHA1 in their critical
      path, to avoid failures on systems starting to disable SHA1 outright in
      their crypto backends (e.g. RHEL 9) (GH#2004, GH#2011)


author: Paul Howarth <paul@city-fan.org> - 2.12.0-1
changelog:
  - Update to 2.12.0 (rhbz#2140281)
    - Add a 'transport_factory' kwarg to 'SSHClient.connect' for advanced users
      to gain more control over early Transport setup and manipulation (GH#2054,
      GH#2125)
    - Update '~paramiko.client.SSHClient' so it explicitly closes its wrapped
      socket object upon encountering socket errors at connection time; this
      should help somewhat with certain classes of memory leaks, resource
      warnings, and/or errors (though we hasten to remind everyone that Client
      and Transport have their own '.close()' methods for use in non-error
      situations!) (GH#1822)
    - Raise '~paramiko.ssh_exception.SSHException' explicitly when blank private
      key data is loaded, instead of the natural result of 'IndexError'; this
      should help more bits of Paramiko or Paramiko-adjacent codebases to
      correctly handle this class of error (GH#1599, GH#1637)
  - Use SPDX-format license tag


author: Paul Howarth <paul@city-fan.org> - 2.12.0-2
changelog:
  - Address CVE 2023-48795 (a.k.a. the "Terrapin Attack", a vulnerability found
    in the SSH protocol re: treatment of packet sequence numbers) as follows:
    - The vulnerability only impacts encrypt-then-MAC digest algorithms in tandem
      with CBC ciphers, and ChaCha20-poly1305; of these, Paramiko currently only
      implements ``hmac-sha2-(256|512)-etm`` in tandem with 'AES-CBC'
    - As the fix for the vulnerability requires both ends of the connection to
      cooperate, the below changes will only take effect when the remote end is
      OpenSSH ≥ 9.6 (or equivalent, such as Paramiko in server mode, as of this
      patch version) and configured to use the new "strict kex" mode
    - Paramiko will always attempt to use "strict kex" mode if offered by the
      server, unless you override this by specifying 'strict_kex=False' in
      'Transport.__init__'
    - Paramiko will now raise an 'SSHException' subclass ('MessageOrderError')
      when protocol messages are received in unexpected order; this includes
      situations like receiving 'MSG_DEBUG' or 'MSG_IGNORE' during initial key
      exchange, which are no longer allowed during strict mode
    - Key (re)negotiation, i.e. 'MSG_NEWKEYS', whenever it is encountered, now
      resets packet sequence numbers (this should be invisible to users during
      normal operation, only causing exceptions if the exploit is encountered,
      which will usually result in, again, 'MessageOrderError')
    - Sequence number rollover will now raise 'SSHException' if it occurs during
      initial key exchange (regardless of strict mode status)
  - Tweak 'ext-info-(c|s)' detection during KEXINIT protocol phase; the original
    implementation made assumptions based on an OpenSSH implementation detail
  - 'Transport' grew a new 'packetizer_class' kwarg for overriding the
    packet-handler class used internally; this is mostly for testing, but advanced
    users may find this useful when doing deep hacks
  - A handful of lower-level classes (notably 'paramiko.message.Message' and
    'paramiko.pkey.PKey') previously returned 'bytes' objects from their
    implementation of '__str__', even under Python 3, and there was never any
    '__bytes__' method; these issues have been fixed by renaming '__str__' to
    '__bytes__' and relying on Python's default "stringification returns the
    output of '__repr__'" behavior re: any real attempts to 'str()' such objects


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.28.06-1
changelog:
  - Update to 6.28.06
  - Drop patches root-testRooAbsL-test-compares-two-doubles-and-fails.patch and
    root-strlcpy.patch (fixed upstream)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.30.00-1
changelog:
  - Update to 6.30.00
  - Removed subpackages: root-io-gfal and root-roofit-common
  - Dropped patches: 6
  - New patches: 6


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.30.02-3
changelog:
  - Use "standardsymbolsps" instead of "symbol" when searching for the
    Symbols font in order to not find Noto Symbols instead


author: Ondřej Nosek <onosek@redhat.com> - 1.66-6
changelog:
  - Patch: Pre-push hook won't check private branches
  - Patch: Config file option to skip the hook script creation
  - Patch: Allow empty commits when `uses_rpmautospec`
  - Patch: Check remote file with correct hash
  - Patch: Ignore missing spec file in pre-push hook
  - Patch: import_srpm: allow pre-generated srpms


author: Ondřej Nosek <onosek@redhat.com> - 1.66-7
changelog:
  - Patch: Do not require 'sources' file for all namespaces
  - Use release's rpmdefines in unused sources check


author: Ondřej Nosek <onosek@redhat.com> - 1.66-11
changelog:
  - Patch: Support for checking exploded sources before push
  - Patch: Split git credential data on first = only


author: Ondřej Nosek <onosek@redhat.com> - 1.66-12
changelog:
  - Patch: Fix flake8 complaints
  - Patch: Prepare the lookaside cache code for retries
  - Patch: Lookaside cache operations retries
  - Patch: Make lookaside cache retries configurable


author: Ondřej Nosek <onosek@redhat.com> - 1.66-13
changelog:
  - Patch: *pkg import: Don't delete changelog generated by `rpmautospec convert`
  - Patch: *pkg import: Undo rpmautospec processing
  - Patch: Unittests for "Undo rpmautospec processing"


author: Miro Hrončok <mhroncok@redhat.com> - 1.66-14
changelog:
  - Actually add the patches:
  - Patch: *pkg import: Don't delete changelog generated by `rpmautospec convert`
  - Patch: *pkg import: Undo rpmautospec processing
  - Patch: Unittests for "Undo rpmautospec processing"


author: Ondřej Nosek <onosek@redhat.com> - 1.66-15
changelog:
  - Patch: Add option to mockbuild use default resultdir of mock (v3)
  - Patch: mockbuild`: new argument --extra-pkgs
  - Patch: `copr-build` passes extra_args to copr-cli command


author: John Zaitseff <J.Zaitseff@zap.org.au> - 7.15-1
changelog:
  - Updated the RPM package for a new release of Star Traders: version 7.15.
  - Added a dependency on make, as per current packaging guidelines.


author: John Zaitseff <J.Zaitseff@zap.org.au> - 7.16-1
changelog:
  - Updated the RPM package for a new release of Star Traders: version 7.16.
  - Added an AppStream-conforming metadata file.


author: John Zaitseff <J.Zaitseff@zap.org.au> - 7.18-1
changelog:
  - Updated the RPM package for a new release of Star Traders: version 7.18.
  - Added verification of upstream signature.


author: John Zaitseff <J.Zaitseff@zap.org.au> - 7.19-1
changelog:
  - Updated the RPM package for a new release of Star Traders: version 7.19.
  - Update rules for AppStream metainfo and desktop files.


