# changelog

author: Tim Semeijn <tim@goat.re> - 0.9.4-2
changelog:
  - Fix failing builds with *_poll build patch (3proxy-0.9.4-poll-build.patch)
  - Convert license to SPDX


author: Sérgio Basto <sergio@serjux.com> - 2.21.0-3
changelog:
  - Do not require pycotap to run PySol, pycotap is only needed for the single
    unittest ( https://github.com/shlomif/PySolFC/pull/353 )


author: Sérgio Basto <sergio@serjux.com> - 2.2-2
changelog:
  - Updated the remove of cardsets already included in PySolFC package (PySolFC-Cardsets--Minimal-2.2.0)
  - Convert to SPDX License


author: Than Ngo <than@redhat.com> - 122.0.6261.57-1
changelog:
  - update to 122.0.6261.57
     * High CVE-2024-1669: Out of bounds memory access in Blink
     * High CVE-2024-1670: Use after free in Mojo
     * Medium CVE-2024-1671: Inappropriate implementation in Site Isolation
     * Medium CVE-2024-1672: Inappropriate implementation in Content Security Policy
     * Medium CVE-2024-1673: Use after free in Accessibility
     * Medium CVE-2024-1674: Inappropriate implementation in Navigation
     * Medium CVE-2024-1675: Insufficient policy enforcement in Download
     * Low CVE-2024-1676: Inappropriate implementation in Navigation.


author: Than Ngo <than@redhat.com> - 122.0.6261.69-1
changelog:
  - update to 122.0.6261.69
  - fix build error on el8
  - bz#2265039, built with -fwrapv for improved memory safety
  - bz#2265043, built with -ftrivial-auto-var-init=zero for improved security and preditability


author: Than Ngo <than@redhat.com> - 122.0.6261.94-1
changelog:
  - upstream security release 122.0.6261.94
    * High : Type Confusion in V8
  - fixed bz#2265957, added correct platform in chromium use agent


author: Than Ngo <than@redhat.com> - 122.0.6261.111-1
changelog:
  - upstream security release 122.0.6261.111
     * High CVE-2024-2173: Out of bounds memory access in V8 
     * High CVE-2024-2174: Inappropriate implementation in V8
     * High CVE-2024-2176: Use after free in FedCM


author: Than Ngo <than@redhat.com> - 122.0.6261.128-1
changelog:
  - upstream security release 122.0.6261.128
     * High CVE-2024-2400: Use after free in Performance Manager


author: Than Ngo <than@redhat.com> - 123.0.6312.58-1
changelog:
  - update to 123.0.6312.58
     * High CVE-2024-2625: Object lifecycle issue in V8
     * Medium CVE-2024-2626: Out of bounds read in Swiftshader
     * Medium CVE-2024-2627: Use after free in Canvas
     * Medium CVE-2024-2628: Inappropriate implementation in Downloads
     * Medium CVE-2024-2629: Incorrect security UI in iOS
     * Medium CVE-2024-2630: Inappropriate implementation in iOS
     * Low CVE-2024-2631: Inappropriate implementation in iOS


author: Miroslav Suchý <msuchy@redhat.com> 1.35-1
changelog:
  - add argon2 as known exception to CC0-1.0
  - new license: LicenseRef-BSD-3-Clause-Clear-WITH-AdditionRef-AOMPL-1.0
  - new license: LicenseRef-BSD-2-Clause-WITH-AdditionRef-AOMPL-1.0
  - new license: GCR-docs
  - new license: AML-glslang
  - new license: Pixar


author: Miroslav Suchý <msuchy@redhat.com> 1.36-1
changelog:
  - new license: TCP-wrappers
  - new license: LicenseRef-Not-Copyrightable
  - new license: SAX-PD-2.0
  - new license: radvd


author: Miroslav Suchý <msuchy@redhat.com> 1.37-1
changelog:
  - add license HPND-Kevlin-Henney
  - add license FSFAP-no-warranty-disclaimer
  - add not allowed license LicenseRef-Nikto
  - add LicenseRef-Fedora-Firmware


author: Miroslav Suchý <msuchy@redhat.com> 1.38-1
changelog:
  - add GPL-2.0-or-later WITH Bison-exception-1.24
  - Add Unicode-3.0 license
  - Add ISC-Veillard license
  - Add mailprio license
  - Add BSD-Systemics-W3Works license
  - Modify .reuse/dep5
  - Add UltraPermissive notices for libmtp
  - public domain dedication for rwhoisd
  - public domain dedication for openshadinglanguage
  - public domain dedication for remind


author: Miroslav Suchý <msuchy@redhat.com> 1.39-1
changelog:
  - add LicenseRef-docbook-dtds
  - public domain dedication for iw
  - add HPND-MIT-disclaimer
  - add Caldera-no-preamble
  - Delete TOML files for licenses that cannot be found
  - Add xkeyboard-config-Zinoviev
  - Add Adobe-Display-Postscript
  - Add DEC-3-Clause
  - Add HPND-sell-MIT-disclaimer-xserver
  - add not allowed license LicenseRef-sph2pipe
  - add LGPL-2.1-or-later WITH GNU-compiler-exception
  - GNU-compiler-exception: GPL-3.0 -> GPL-2.0
  - firmware.txt: add license for microcode_ctl
  - firmware.txt: remove trailing whitespace
  - public domain dedication for jansson


author: Miroslav Suchý <msuchy@redhat.com> 1.40-1
changelog:
  - add HPND-UC
  - add GPL-2.0-or-later WITH GStreamer-exception-2008
  - add TGPPL-1.0 (and replace LicenseRef-TGPPL)


author: Miroslav Suchý <msuchy@redhat.com>
changelog:
  - add Sun-PPP license
  - add CC-BY-SA-3.0 WITH GNOME-examples-exception license
  - add GPL-2.0-or-later WITH Gmsh-exception license
  - add HPND-Fenneberg-Livingston license
  - add Brian-Gladman-2-Clause license
  - add gtkbook license
  - add UMich-Merit license
  - add Mackerras-3-Clause license
  - Add legacy name for "LGPL-3.0-or-later WITH openvpn-openssl-exception"
  - add softSurfer license
  - add LGPL-2.1-or-later WITH GStreamer-exception-2005 license
  - add UltraPermissive notice for libpng and perl-Image-PNG-Libpng
  - add BSD-3-Clause-acpica license
  - add SSLeay-standalone license
  - add BSD-2-Clause-Darwin license


author: Miroslav Suchý <msuchy@redhat.com>
changelog:
  - add CMU-Mach-nodoc license
  - add Mackerras-3-Clause-acknowledgment license
  - add bcrypt-Solar-Designer license
  - add HPND-INRIA-IMAG license
  - add OpenVision license
  - public domain dedications for irssi
  - add MIT-Khronos-old license
  - public domain dedications for openshadinglanguage
  - public domain dedication for util-linux
  - public domain dedications for rrdtool
  - public domain dedications for ppp
  - Add public domain text from minicom
  - add GPL-3.0-or-later WITH Autoconf-exception-generic


author: Miroslav Suchý <msuchy@redhat.com> 1.43-1
changelog:
  - rename LicenseRef-Threeparttable to threeparttable
  - Add “KST32B” license terms to UltraPermissive.txt
  - Add glibc public domain declarations


author: Miroslav Suchý <msuchy@redhat.com> 1.44-1
changelog:
  - add OAR License
  - include dictd md5 public domain text
  - public domain dedication for libdstr
  - Add LicenseRef-RSALv2 (not-allowed)
  - add swig to UltraPermissive
  - add LGPL-3.0-or-later WITH WxWindows-exception-3.1


author: Christian Heimes <cheimes@redhat.com> 0.8-1
changelog:
  - Fold common and registration-service into ipa-hcc-server
  - Default to stage
  - Add title and description to JSON schema
  - Use D-Bus service and simplify config
  - Download PKINIT chain from registration service
  - Add mock tests for mockapi service, refactor code
  - [HMS-1485] Add --location to auto-enrollment script
  - Verify with pylint and fix violations
  - Use server role to indicate presence of ipa-hcc plugin
  - [HMS-1485] Add IPA location information to domain
  - Add D-Bus service for checking host in HBI
  - [HMS-1475] Add tests for registration WSGI server
  - [HMS-1475] Refactor and test auto enrollment client
  - Test with RHEL 7.9 server
  - Remove dependency on requests
  - Rename smid -> rhsm_id, drop redundant rhsm_id from body
  - Move API handler in separate module, add JSON schema


author: Christian Heimes <cheimes@redhat.com> 0.9-1
changelog:
  - Last version with RHEL 7 / Python 2.7 support
  - [HMS-1607] Use inventory_id in API routes
  - [HMS-1607] Move common WSGI code into module
  - Include os-release id and version in HTTP header
  - [HMS-1479] Implement status check
  - Drop bundle file, add more ipaserver tests
  - Detect and block auto-enrollment with FQDN localhost
  - [HMS-1472] Switch from admintool to D-Bus CLI
  - Add tests for dbus service, fix hccapi
  - Move cert parsing into common function
  - Validate insights registration state


author: Christian Heimes <cheimes@redhat.com> 0.10-1
changelog:
  - [HMS-1788] Add simple GH CI workflow
  - [HMS-1779] Move secrets and settings to CI/CD variables
  - [HMS-1645] Replace bandit/flake8 with ruff linter
  - Add infrastructure for mypy type checks
  - [HMS-1645] Drop IPA 4.6 compatibility workarounds
  - [HMS-1645] Drop Python 2 compatibility
  - Run integration tests in FIPS mode
  - [HMS-1645] Drop support for RHEL 7


author: Christian Heimes <cheimes@redhat.com> 0.11-1
changelog:
  - HMS-2052 build: Use OpenAPI schema from idm-domains-api
  - HMS-2038 test: catch metadata misconfiguration early
  - fix: Move rpkg output out of .tox directory
  - HMS-2041 fix: Represent org id as string, not int
  - HMS-2038 test: Improve testing with backend compose
  - HMS-1991 fix: Tighten OpenAPI schema
  - HMS-2008 feat: Adopt JSON API error objects
  - Add definitions for missing JSON schemas
  - HMS-1991 feat: Generate schema JSON files from OpenAPI
  - HMS-1991: Refactor JSON schema
  - Add project and build definitions to pyproject.toml
  - HMS-1898: Fix and validate error response
  - HMS-1975: Remove check-host API endpoint
  - Improve CI and test with Python 3.9 (RHEL 9)
  - register: prompt for confirmation
  - HMS-1926: Friendly D-Bus error message
  - ipa-hcc CLI: print human-readable messages
  - Document how to configure for ephemeral
  - logging: pretty print API response
  - Reconcile JSON schema with idm-domains-backend OpenAPI
  - Add verbose logging to ipa-hcc
  - Prepare release 0.11
  - Ephemeral env support with fake headers
  - Improve Makefile and tox runner
  - yamllint: don't apply truthy test to map keys
  - Rename field 'cacerts' to 'ca_certs'
  - Reconcile domain response schema
  - Reconcile register/update domain schema
  - Document how to install build and test deps
  - HMS-1898 Reconcile error result schema
  - Ruff: silence F811 redefined-while-unused


author: Christian Heimes <cheimes@redhat.com> 0.12-1
changelog:
  - fix: use new Quay org for CI images
  - HMS-1789 tests: use @podengo/ipa-hcc COPR
  - fix: Support latest tox on Fedora 38
  - fix: Allow non-compact JWT serialization
  - fix: use OpenAPI from public GitHub repo
  - test: Build SRPM and RPMs on GHA
  - test: update packages in containers
  - fix: Don't hard-code inventory url
  - doc: Add documentation for developers
  - HMS-2195: fix: Use idmsvc as API slug
  - feat: update locations
  - fix: Fix typo in automember rule
  - HMS-2147 fix: use HostConfIpa schema in HostConfResponse
  - refactor: Use setuptools to install Python code
  - fix: store public JWK in separate file
  - HMS-1857 feat: signed assertion for host registration
  - HMS-1857 feat: Add multi-sig and host token
  - HMS-1289 fix: Remove inventory_id from HostConfResponse
  - HMS-1857 feat: Add JWK abstraction and helpers
  - feat: Update JSON schema from latest OpenAPI
  - HMS-2038 test: Smoke tests with idm-domains-backend
  - HMS-2068: Drop support for RHEL without PKINIT


author: Christian Heimes <cheimes@redhat.com> 0.13-1
changelog:
  - feat: Enhance reporting and logging
  - feat: Check remote status with HCC
  - refactor: Use context="hcc" in IPA API
  - infra: Log JSON error information
  - infra: Refresh cache and config file
  - fix: Use LDAP for public JWKs
  - refactor: Run ipa-client-automount
  - fix: Replace legacy with modern Insights API
  - fix: Limit hostname to 63 characters
  - fix: Use UEP CA to access prod cert-api
  - fix: Don't create global DNSResolver
  - feat: Add ipahcc-client-prepare
  - fix: Fake headers can use org_id/cn from RHSM cert
  - refactor: Change to --idmsvc-api-url
  - HMS-2348 feat: Add ephemeral fake header to auto-enrollment
  - test: Run CI on Fedora 39, drop 37
  - fix: Better error reporting for missing RHSM cert
  - fix: Fix typo fdqn -> fqdn
  - Fix: Keycloak SSO provider requires openid scope
  - doc: Add test instructions and hcc.conf info
  - HMS-2814 feat: IPA client installer and automount
  - test: idm-ci now requires local cloud auth
  - feat: Add sso.rh.c IdP provider definitions
  - HMS-2694 fix: Update JWST issuer and docs
  - HMS-2595 feat: Extend ipa-hcc to retrieve+store JWKs
  - test: Fix and improve coverage
  - fix: Update spec file URL
  - fix: Update git repo URL
  - HMS-2594: IPA plugin for HCC JWKs
  - test: Do not install KRA
  - HMS-2532 fix: attach to api commit
  - HMS-2491 test: Enable backend tests again
  - HMS-2491 test: Allow backend test to fail
  - HMS-2491 refactor: Separate GET signing keys
  - HMS-2491 test: Update test infra for DRT
  - HMS-2491 feat: Remove old domain registration
  - HMS-2491 feat: Update for domain token workflow
  - refactor: Remove env patching
  - HMS-2446 feat: New domain reg token
  - fix: Use gssproxy client keytab
  - HMS-2446 refactor: Move IPA API to WSGI framework
  - tests: Add test for deserialize()
  - tests: Check that serializing compact form gives a ValueError
  - feat: Add additional check json deserialization and update docs
  - feat: Rename deserialize_json to deserialize
  - feat: Do not allow compact serialization for MultiJWST
  - test: Enable mypy checker for tests
  - feat: Add domain token to mockapi
  - test: Run CI with Fedora 37 and 38
  - HMS-2070 feat: Remove D-Bus service


author: Christian Heimes <cheimes@redhat.com> 0.14-1
changelog:
  - Prepare ipa-hcc for Fedora packaging
  - infra: Add helper for stage console testing
  - Fix: pylint warning R1737
  - Fix: Typo in ipa-hcc-auto-enrollment sysconfig
  - Fix various infra issues
  - fix HMS-2066: Add timeout to confirmation prompt
  - test: Test on RHEL 9.3 / 8.9


author: Christian Heimes <cheimes@redhat.com> 0.16-1
changelog:
  - HMS-3840 feat: Detect configuration from rhsm.conf
  - ipahcc-stage-console now configures proxy
  - HMS-3821 feat: auto enrollment can set DNS resolver
  - More Fedora packaging fixes
  - Implement testing with Stage Console APIs
  - Implement console proxy settings


author: Lukas Javorsky <ljavorsk@redhat.com> - 2.7.6-5
changelog:
  - Rebuilt for minizip-ng transition Fedora change
  - Fedora Change: https://fedoraproject.org/wiki/Changes/MinizipNGTransition


author: Kevin Fenzi <kevin@scrye.com> - 1.34.0-2
changelog:
  - Carry scm policy plugin for hub, it's already upstream
  - Use dnf5 compatible 'group install' command
  - Allow specifying with a tag value what arches noarch builds happen on.
  - Fix image-build to not pass units to oz (to avoid GB/GiB issues)
  - Fix a typo in scheduler (already upstreamed)
  - Add back index for rpminfo table that was mistakenly dropped.


author: Paul Howarth <paul@city-fan.org> - 1.3.6c-2
changelog:
  - Retain a memory pool after an aborted transfer so that the %{transfer-status}
    LogFormat functionality still works
  - Own directory %{_sysconfdir}/logrotate.d


author: Paul Howarth <paul@city-fan.org> - 1.3.6c-3
changelog:
  - Avoid duplicate hostname and timestamps in syslog (#1808989)
    http://bugs.proftpd.org/show_bug.cgi?id=4185
    https://github.com/proftpd/proftpd/issues/1002
    https://github.com/proftpd/proftpd/pull/1009


author: Paul Howarth <paul@city-fan.org> - 1.3.6d-1
changelog:
  - Update to 1.3.6d
    - Fixed issue with FTPS uploads of large files using TLSv1.3
      (https://github.com/proftpd/proftpd/issues/959)
    - Fixed regression in the handling of '%{env:...}' configuration variables
      when the environment variable is not present
      (https://github.com/proftpd/proftpd/issues/857)
    - Second LIST of the same symlink shows different results
      (https://github.com/proftpd/proftpd/issues/940)
    - mod_sftp sends broken response when CREATETIME attribute is requested
      (https://github.com/proftpd/proftpd/issues/980)
    - Handle zero-length SFTP WRITE requests without error
      (http://bugs.proftpd.org/show_bug.cgi?id=4398)
    - PidFile should not be world-writable
      (https://github.com/proftpd/proftpd/issues/1018)
    - TLSv1.3 handshake fails due to missing session ticket key on some systems
      (https://github.com/proftpd/proftpd/issues/1014)
    - Lowercased FTP commands not properly identified
      (https://github.com/proftpd/proftpd/issues/1023)


author: Paul Howarth <paul@city-fan.org> - 1.3.6e-1
changelog:
  - Update to 1.3.6e
    - Fixed null pointer dereference in mod_sftp when using SCP incorrectly
      (https://github.com/proftpd/proftpd/issues/1043)


author: Paul Howarth <paul@city-fan.org> - 1.3.6e-3
changelog:
  - Avoid segfaults with TLSv1.3
    https://github.com/proftpd/proftpd/issues/1063
    https://github.com/proftpd/proftpd/commit/adf43dd4ddaab0332e74abc86bbcef9cf27ee54a
  - Use %license unconditionally


author: Paul Howarth <paul@city-fan.org> - 1.3.6e-4
changelog:
  - Fix memory disclosure to RADIUS servers by mod_radius (#2001690)
    https://github.com/proftpd/proftpd/issues/1284
    https://github.com/proftpd/proftpd/pull/1285


author: Paul Howarth <paul@city-fan.org> - 1.3.6e-6
changelog:
  - Fix one-byte out-of-bounds read, and daemon crash, because of mishandling of
    quote/backslash semantics (#2255609, GH#1683, CVE-2023-51713)
  - Use SPDX-format license tag


author: Paul Howarth <paul@city-fan.org> - 1.3.6e-7
changelog:
  - Fix slow reading of passwd/group files in mod_auth_file (#2270686, GH#1134,
    GH#1192, GH#1195, GH#1213)


author: Scott K Logan <logans@cottsay.net> - 0.2.1-2
changelog:
  - Rebuilt to change main python from 3.4 to 3.6 in EPEL 7
  - Handle automatic dependency generation (f30+)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.30.02-3
changelog:
  - Use "standardsymbolsps" instead of "symbol" when searching for the
    Symbols font in order to not find Noto Symbols instead


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.30.02-8
changelog:
  - Exclude failing gtest-math-matrix-test-testMatrixTSparse on Fedora 40
    (aarch64, ppc64le and s390x)


author: Mattias Ellert <ellert@ellert.se> - 6.30.04-1
changelog:
  - Update to 6.30.04
  - Drop patch root-adjust-test-for-failures-on-aarch64-ppc64le-s390x.patch
    (accepted upstrem)
  - Exclude failing TClingDataMemberInfo.Offset test on s390x


author: Julio González Gil <packages@juliogonzalez.es> - 1.91-1
changelog:
  - Update to 1.91 from https://github.com/s3fs-fuse/s3fs-fuse (#2061848)
    Full changelog: https://github.com/s3fs-fuse/s3fs-fuse/releases/tag/v1.91


author: Julio González Gil <packages@juliogonzalez.es> - 1.92-1
changelog:
  - Update to 1.92 from https://github.com/s3fs-fuse/s3fs-fuse (#2209081)
    Full changelog: https://github.com/s3fs-fuse/s3fs-fuse/releases/tag/v1.92


author: Dominik Mierzejewski <dominik@greysector.net> - 2.6.2-28
changelog:
  - apply Debian patch to fix CVE-2021-42260 (rhbz#2253716, rhbz#2253718)
  - apply Debian patch to fix CVE-2023-34194 and its duplicate, CVE-2023-40462
    (rhbz#2254376, rhbz#2254381)
  - fix incorrect text element encoding (upstream isssue #51)
  - compile and run tests


