# changelog

author: Sérgio Basto <sergio@serjux.com> - 2.2-2
changelog:
  - Updated the remove of cardsets already included in PySolFC package (PySolFC-Cardsets--Minimal-2.2.0)
  - Convert to SPDX License


author: José Matos <jamatos@fedoraproject.org> - 10.6.0-1
changelog:
  - update to 10.6.0
  - BR flexiblas for Fedora and lapack, openblas and atlas for EPEL
  - adapt armadillo-devel accordingly


author: Jos de Kloe <josdekloe@gmail.com> - 2.29.0-1
changelog:
  - Upgrade to upstream version 2.29.0
    Note that the source code now uses g++ in stead of gcc for compilation.


author: Maxwell G <gotmax@e.email> - 8-32
changelog:
  - Explicitly Require python3-rpm-generators
  - Remove %__pythondist_provides from pythondist.attr.
  - Ensure that packages built against alternative python stacks do not have
    python3dist(x) Provides.
  - Related: rhbz#1776941.


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.96-2
changelog:
  - Fixed "tainted search query is not properly quoted" for greylisting,
    patch provided by Marcel Härry <mh+fedora@scrit.ch>


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.96.1-1
changelog:
  - New version
    Resolves: rhbz#2241735
    Resolves: rhbz#2241538
    Resolves: rhbz#2241540
    Resolves: rhbz#2241525
    Resolves: rhbz#2241526
    Resolves: rhbz#2241528
    Resolves: rhbz#2241530
    Resolves: rhbz#2241531
    Resolves: rhbz#2241533
    Resolves: rhbz#2241542
    Resolves: rhbz#2241543


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.97.1-1
changelog:
  - New version
    Resolves: rhbz#2256145
  - Fixed SMTP smuggling vulnerability
    Resolves: CVE-2023-51766


author: Miroslav Suchý <msuchy@redhat.com> 1.29-1
changelog:
  - Add byacc public domain declaration
  - recognize and allow MPL-2.0+ license
  - public-domain-text.txt: Add a dedication found in zpaq
  - New license: MMIXware
  - not allowed license LicenseRef-Iozone
  - new license: Utah Raster Toolkit Run Length Encoded License
  - add license GPL-2.0-only WITH x11vnc-openssl-exception
  - not allowed license LicenseRef-Misti-Fonts
  - new license TTYP0
  - add license GPL-2.0-or-later WITH stunnel-exception
  - Add GPL-2.0-or-later WITH SANE-exception
  - Fix man-pages public-domain and UltraPermissive locations
  - generate additional grammar with all licenses inluding not allowed ones
  - cleanup: remove mkdsv.py


author: Miroslav Suchý <msuchy@redhat.com> 1.30-1
changelog:
  - new license: LGPL-3.0-or-later WITH openvpn-openssl-exception
  - new license: BSD-3-Clause-Sun
  - new license: BSD-Systemics
  - new license: FBM
  - new license: LGPL-2.0-or-later WITH Libtool-exception
  - new license: Ferguson-Twofish
  - Add Public Domain for varnish
  - new license: MPEG-SSG
  - Add cursor-misc from xorg-x11-fonts to UltraPermissive
  - new not allowed license: MPEG-4 Audio
  - new license: pnmstitch
  - Add snprintf as allowed
  - Add xlock as allowed
  - Add BSD-4.3RENO as allowed
  - Add public domain entry for winitzki-cyrillic X11 font
  - Public Domain: Add mobile-broadband-provider-info
  - Add public domain entry used by some xorg-x11-fonts
  - Add Volatility Software License 1.0 to Not Allowed Licenses
  - Add misc-cyrillic from xorg-x11-fonts to UltraPermissive
  - Add public domain entry for aopalliance
  - Add public domain entry for plexus-utils
  - not allowed license LicenseRef-pgplot
  - Fix a typo in xz-java package name


author: Miroslav Suchý <msuchy@redhat.com> 1.31-1
changelog:
  - new license: GPL-2.0-or-later WITH Autoconf-exception-macro
  - new license: LGPL-3.0-or-later WITH Autoconf-exception-macro
  - new license: HPND-export-US-modify
  - Add a public domain dedication from the SWORD Project
  - Add LPPL-1.2 as not-allowed, add LPPL-1.3a+ as allowed
  - new license: LGPL-2.1-only WITH Qt-LGPL-exception-1.1
  - new license: SGI-OpenGL
  - Add jhash public domain dedication for QEMU
  - Add QEMU to the rijndael (AES) public domain license reference
  - new license: SSH-short
  - new license: GPL-2.0-or-later WITH UBDL-exception
  - new license: McPhee-slideshow
  - new license: HPND-DEC
  - new license: magaz
  - new license: ulem
  - new license: fwlw
  - new license: Kastrup
  - Fix names of Linux-syscall-note TOML files
  - Add reference to EDK2 package public domain code
  - new license: HPND-sell-regexpr
  - new license: Cronyx
  - new license: Lucida-Bitmap-Fonts
  - new license: LPPL-1.3c
  - new license: swrule
  - new license: BSD-Inferno-Nettverk
  - Some code in OpenSSH has a Public Domain license
  - new license: ssh-keyscan
  - new license: HPND-Pbmplus
  - Add public domain text from mingw-headers/mingw-winpthreads packages
  - Add public domain test from Augeas project
  - new license: BSD-Attribution-HPND-disclaimer
  - new not allowed license: LicenseRef-Tyrian
  - Add public domain entry for squid


author: Miroslav Suchý <msuchy@redhat.com> 1.32-1
changelog:
  - new not allowed license LicenseRef-Riverbank-SIP
  - new license: LGPL-2.1-only_WITH_Linux-syscall-note
  - new license: LicenseRef-Fedora-Logos
  - new license: GPL-3.0-or-later WITH GNU-compiler-exception
  - new license: HPND-doc-sell
  - new license: BSD-3-Clause-flex
  - new license: HPND-doc
  - new license: LGPL-2.1-or-later WITH GCC-exception-2.0
  - Add GPL-2.0-or-later WITH GPL-3.0-linking-source-exception
  - new license: BSD-3-Clause-HP
  - new license: GFDL-1.3-no-invariants-only
  - new license: OLDAP-2.7
  - new license: Adobe-Utopia
  - new license: python-ldap
  - new license: lsof


author: Miroslav Suchý <msuchy@redhat.com> 1.33-1
changelog:
  - add packages_with_exceptions to JSON schema
  - document packages_with_exceptions for LicenseRef-Fedora-Logos
  - document packages_with_exceptions for LicenseRef-TCGL
  - document packages_with_exceptions for FDK-AAC
  - include packages_with_exceptions field in json and in toml validation
  - Template - document exception of not-allowed license
  - not allowed license LicenseRef-novint


author: Miroslav Suchý <msuchy@redhat.com> 1.35-1
changelog:
  - add argon2 as known exception to CC0-1.0
  - new license: LicenseRef-BSD-3-Clause-Clear-WITH-AdditionRef-AOMPL-1.0
  - new license: LicenseRef-BSD-2-Clause-WITH-AdditionRef-AOMPL-1.0
  - new license: GCR-docs
  - new license: AML-glslang
  - new license: Pixar


author: Miroslav Suchý <msuchy@redhat.com> 1.36-1
changelog:
  - new license: TCP-wrappers
  - new license: LicenseRef-Not-Copyrightable
  - new license: SAX-PD-2.0
  - new license: radvd


author: Miroslav Suchý <msuchy@redhat.com> 1.37-1
changelog:
  - add license HPND-Kevlin-Henney
  - add license FSFAP-no-warranty-disclaimer
  - add not allowed license LicenseRef-Nikto
  - add LicenseRef-Fedora-Firmware


author: Miroslav Suchý <msuchy@redhat.com> 1.38-1
changelog:
  - add GPL-2.0-or-later WITH Bison-exception-1.24
  - Add Unicode-3.0 license
  - Add ISC-Veillard license
  - Add mailprio license
  - Add BSD-Systemics-W3Works license
  - Modify .reuse/dep5
  - Add UltraPermissive notices for libmtp
  - public domain dedication for rwhoisd
  - public domain dedication for openshadinglanguage
  - public domain dedication for remind


author: Fedora Release Engineering <releng@fedoraproject.org> - 7.1-1
changelog:
  - https://github.com/pmikova/java-runtime-decompiler/releases/tag/java-runtime-decompiler-7.1
  - moved to jrd 7.1
  - added desp on java-diff and new cplc
  - fixed(?) procyon wrapper
    - todo procyon crashes witout trace
  - removed jd wrapper (was new in 7.1, maybe will be added)
  - split plugins to subpkgs
  - added jrd-hex launcher
  - added hex launcher, added jrd symlinks


author: Fedora Release Engineering <releng@fedoraproject.org> - 7.3-1
changelog:
  - moved to 7.3
  - https://github.com/pmikova/java-runtime-decompiler/releases/tag/java-runtime-decompiler-7.3
  - https://github.com/pmikova/java-runtime-decompiler/releases/tag/java-runtime-decompiler-7.2


author: Fedora Release Engineering <releng@fedoraproject.org> - 8.0-1
changelog:
  - update dto 8.0
  - https://github.com/pmikova/java-runtime-decompiler/releases/tag/java-runtime-decompiler-8.0


author: Fedora Release Engineering <releng@fedoraproject.org> - 9.1-1
changelog:
  - update dto 9.1
  - https://github.com/judovana/java-runtime-decompiler/releases/tag/java-runtime-decompiler-9.1
  - https://github.com/judovana/java-runtime-decompiler/releases/tag/java-runtime-decompiler-9.0


author: Remi Collet <remi@remirepo.net> - 1.5.1-1
changelog:
  - update to 1.5.1
  - open https://jira.mongodb.org/browse/MONGOCRYPT-451 build with shared libbson
  - open https://jira.mongodb.org/browse/MONGOCRYPT-460 ABI/API breakage


author: Pavel Raiskup <praiskup@redhat.com> 3.4-1
changelog:
  - make device mapper control device available if supported (neal@gompa.dev)
  - check for target specific qemu-user-static (msuchy@redhat.com)


author: Pavel Raiskup <praiskup@redhat.com> 3.5-1
changelog:
  - check for qemu-user-static raises InvalidArchitecture()
  - forcearch: map armv7hl to the /usr/bin/qemu-arm-static binary
  - more pedantic check for the qemu-*-static binaries


author: Pavel Raiskup <praiskup@redhat.com> 4.0-1
changelog:
  - cleanup the bootstrap image logic so it works if Mock is run in container
  - rebuild: kill orphans when mounted
  - bootstrap: delay the buildroot-in-bootstrap recursive mount
  - use shlex instead of pipes
  - fix bootstrap_* prefixed config_opts options
  - manual page: fix the "how to fill an issue" info
  - support for DNF5 added
  - use -N instead of -n for useradd (msuchy@redhat.com)
  - mock: don't use distutils copy_tree()


author: Pavel Raiskup <praiskup@redhat.com> 4.1-1
changelog:
  - bootstrap: fix certificate copying into the bootstrap chroot
  - don't strictly require any package manager
  - config: properly configure package manager commands
  - unify the fallback-detection for host/bootstrap/bootstrap-image
  - bind_mount plug-in: pre-create dest directory before bind-mounting a file
  - bootstrap: use DNF5 in package manager fallbacks
  - fix --dnf-cmd traceback with the new package_manager logic


author: Pavel Raiskup <praiskup@redhat.com> 5.2-1
changelog:
  - Fix '~' user source expansion for --copyout
  - Compatibility fix with EL 8
  - Log out the command-line arguments
  - Make sure that 'state' is always finished
  - README.md: cleaning up
  - Post-release administrivia


author: Pavel Raiskup <praiskup@redhat.com> 5.3-1
changelog:
  - orphanskill: log command line arguments of the terminated process
  - docs: migrate the community from IRC to Matrix
  - dnf5: don't output to a PTY (mail@evangoo.de)
  - new rpmautospec plugin (sgallagh@redhat.com, nils@redhat.com)
  - fix bash completion with multiple file arguments (orion@nwra.com)
  - only %prep once when running %generate_buildrequires multiple times (miro@hroncok.cz)
  - Dynamic BuildRequires: Prevent generation of unsatisfied dependency (miro@hroncok.cz)
  - Identify buildroot package management earlier (praiskup@redhat.com)
  - Dump also dnf5 info into logs


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.80-1
changelog:
  - New version
    Resolves: rhbz#2255025
  - Fixed Terrapin vulnerability in some SSH protocol extensions
    Resolves: CVE-2023-48795


author: Paul Howarth <paul@city-fan.org> - 2.10.1-1
changelog:
  - Update to 2.10.1
    - CVE-2022-24302: Creation of new private key files using
      '~paramiko.pkey.PKey' subclasses was subject to a race condition between
      file creation and mode modification, which could be exploited by an
      attacker with knowledge of where the Paramiko-using code would write out
      such files; this has been patched by using 'os.open' and 'os.fdopen' to
      ensure new files are opened with the correct mode immediately (we've left
      the subsequent explicit 'chmod' in place to minimize any possible
      disruption, though it may get removed in future backwards-incompatible
      updates)
    - Add support for the '%C' token when parsing SSH config files (GH#1976)
    - Add support for OpenSSH's Windows agent as a fallback when Putty/WinPageant
      isn't available or functional (GH#1509, GH#1837, GH#1868)
    - Significantly speed up low-level read/write actions on
      '~paramiko.sftp_file.SFTPFile' objects by using 'bytearray'/'memoryview'
      (GH#892); this is unlikely to change anything for users of the higher level
      methods like 'SFTPClient.get' or 'SFTPClient.getfo', but users of
      'SFTPClient.open' will likely see orders of magnitude improvements for
      files larger than a few megabytes in size
    - Add 'six' explicitly to install-requires; it snuck into active use at some
      point but has only been indicated by transitive dependency on 'bcrypt'
      until they somewhat-recently dropped it (GH#1985); this will be short-lived
      until we drop Python 2 support


author: Paul Howarth <paul@city-fan.org> - 2.10.2-1
changelog:
  - Update to 2.10.2
    - Fix Python 2 compatibility breakage introduced in 2.10.1 (GH#2001)
  - Re-enable sftp tests, no longer failing under mock


author: Paul Howarth <paul@city-fan.org> - 2.10.3-1
changelog:
  - Update to 2.10.3
    - Certificate-based pubkey auth was inadvertently broken when adding SHA2
      support in version 2.9.0 (GH#1963, GH#1977)
    - Switch from module-global to thread-local storage when recording thread IDs
      for a logging helper; this should avoid one flavor of memory leak for
      long-running processes (GH#2002, GH#2003)


author: Paul Howarth <paul@city-fan.org> - 2.10.4-1
changelog:
  - Update to 2.10.4
    - Update 'camelCase' method calls against the 'threading' module to be
      'snake_case'; this and related tweaks should fix some deprecation warnings
      under Python 3.10 (GH#1838, GH#1870, GH#2028)
    - '~paramiko.pkey.PKey' instances' '__eq__' did not have the usual safety
      guard in place to ensure they were being compared to another 'PKey' object,
      causing occasional spurious 'BadHostKeyException', among other things
      (GH#1964, GH#2023, GH#2024)
    - Servers offering certificate variants of hostkey algorithms (e.g.
      'ssh-rsa-cert-v01@openssh.com') could not have their host keys verified by
      Paramiko clients, as it only ever considered non-cert key types for that
      part of connection handshaking (GH#2035)


author: Paul Howarth <paul@city-fan.org> - 2.11.0-1
changelog:
  - Update to 2.11.0
    - Align signature verification algorithm with OpenSSH re: zero-padding
      signatures that don't match their nominal size/length; this shouldn't
      affect most users, but will help Paramiko-implemented SSH servers handle
      poorly behaved clients such as PuTTY (GH#1933)
    - OpenSSH 7.7 and older has a bug preventing it from understanding how to
      perform SHA2 signature verification for RSA certificates (specifically
      certs - not keys), so when we added SHA2 support it broke all clients using
      RSA certificates with these servers; this has been fixed in a manner similar
      to what OpenSSH's own client does - a version check is performed and the
      algorithm used is downgraded if needed (GH#2017)
    - Recent versions of Cryptography have deprecated Blowfish algorithm support;
      in lieu of an easy method for users to remove it from the list of
      algorithms Paramiko tries to import and use, we've decided to remove it
      from our "preferred algorithms" list, which will both discourage use of a
      weak algorithm, and avoid warnings (GH#2038, GH#2039)
    - Windows-native SSH agent support as merged in 2.10 could encounter
      'Errno 22' 'OSError' exceptions in some scenarios (e.g. server not cleanly
      closing a relevant named pipe); this has been worked around and should be
      less problematic (GH#2008, GH#2010)
    - Add SSH config token expansion (eg '%h', '%p') when parsing 'ProxyJump'
      directives (GH#1951)
    - Apply unittest 'skipIf' to tests currently using SHA1 in their critical
      path, to avoid failures on systems starting to disable SHA1 outright in
      their crypto backends (e.g. RHEL 9) (GH#2004, GH#2011)


author: Paul Howarth <paul@city-fan.org> - 2.12.0-1
changelog:
  - Update to 2.12.0 (rhbz#2140281)
    - Add a 'transport_factory' kwarg to 'SSHClient.connect' for advanced users
      to gain more control over early Transport setup and manipulation (GH#2054,
      GH#2125)
    - Update '~paramiko.client.SSHClient' so it explicitly closes its wrapped
      socket object upon encountering socket errors at connection time; this
      should help somewhat with certain classes of memory leaks, resource
      warnings, and/or errors (though we hasten to remind everyone that Client
      and Transport have their own '.close()' methods for use in non-error
      situations!) (GH#1822)
    - Raise '~paramiko.ssh_exception.SSHException' explicitly when blank private
      key data is loaded, instead of the natural result of 'IndexError'; this
      should help more bits of Paramiko or Paramiko-adjacent codebases to
      correctly handle this class of error (GH#1599, GH#1637)
  - Use SPDX-format license tag


author: Paul Howarth <paul@city-fan.org> - 2.12.0-2
changelog:
  - Address CVE 2023-48795 (a.k.a. the "Terrapin Attack", a vulnerability found
    in the SSH protocol re: treatment of packet sequence numbers) as follows:
    - The vulnerability only impacts encrypt-then-MAC digest algorithms in tandem
      with CBC ciphers, and ChaCha20-poly1305; of these, Paramiko currently only
      implements ``hmac-sha2-(256|512)-etm`` in tandem with 'AES-CBC'
    - As the fix for the vulnerability requires both ends of the connection to
      cooperate, the below changes will only take effect when the remote end is
      OpenSSH ≥ 9.6 (or equivalent, such as Paramiko in server mode, as of this
      patch version) and configured to use the new "strict kex" mode
    - Paramiko will always attempt to use "strict kex" mode if offered by the
      server, unless you override this by specifying 'strict_kex=False' in
      'Transport.__init__'
    - Paramiko will now raise an 'SSHException' subclass ('MessageOrderError')
      when protocol messages are received in unexpected order; this includes
      situations like receiving 'MSG_DEBUG' or 'MSG_IGNORE' during initial key
      exchange, which are no longer allowed during strict mode
    - Key (re)negotiation, i.e. 'MSG_NEWKEYS', whenever it is encountered, now
      resets packet sequence numbers (this should be invisible to users during
      normal operation, only causing exceptions if the exploit is encountered,
      which will usually result in, again, 'MessageOrderError')
    - Sequence number rollover will now raise 'SSHException' if it occurs during
      initial key exchange (regardless of strict mode status)
  - Tweak 'ext-info-(c|s)' detection during KEXINIT protocol phase; the original
    implementation made assumptions based on an OpenSSH implementation detail
  - 'Transport' grew a new 'packetizer_class' kwarg for overriding the
    packet-handler class used internally; this is mostly for testing, but advanced
    users may find this useful when doing deep hacks
  - A handful of lower-level classes (notably 'paramiko.message.Message' and
    'paramiko.pkey.PKey') previously returned 'bytes' objects from their
    implementation of '__str__', even under Python 3, and there was never any
    '__bytes__' method; these issues have been fixed by renaming '__str__' to
    '__bytes__' and relying on Python's default "stringification returns the
    output of '__repr__'" behavior re: any real attempts to 'str()' such objects


author: John Zaitseff <J.Zaitseff@zap.org.au> - 7.15-1
changelog:
  - Updated the RPM package for a new release of Star Traders: version 7.15.
  - Added a dependency on make, as per current packaging guidelines.


author: John Zaitseff <J.Zaitseff@zap.org.au> - 7.16-1
changelog:
  - Updated the RPM package for a new release of Star Traders: version 7.16.
  - Added an AppStream-conforming metadata file.


author: John Zaitseff <J.Zaitseff@zap.org.au> - 7.18-1
changelog:
  - Updated the RPM package for a new release of Star Traders: version 7.18.
  - Added verification of upstream signature.


author: John Zaitseff <J.Zaitseff@zap.org.au> - 7.19-1
changelog:
  - Updated the RPM package for a new release of Star Traders: version 7.19.
  - Update rules for AppStream metainfo and desktop files.


author: Orion Poplawski <orion@nwra.com> - 6.0.13-1
changelog:
  - Update to 6.0.13
  - Add policy to allow zabbix scripts to run chronyc as chronyc_t (bz#2160180)
  - Add policy to allow zabbix agent to run rpm read-only
  - Fix up alternatives scripts to allow better upgrades from other zabbix packages


