# changelog

author: Miroslav Suchý <msuchy@redhat.com> 1.97-1
changelog:
  - update copr keys
  - add script to check all keys
  - remove expired jenkins key
  - update expired intel security key
  - update expired navy linux key
  - update expired bluejeans key
  - add script to check expiration
  - Add the key for pkgs.k8s.io (Kubernetes)


author: Miroslav Suchý <msuchy@redhat.com> 1.99-1
changelog:
  - update copr keys
  - Add Qubes OS 4.2 release key
  - Split AlmaLinux OS 8 GPG public keys to fix microdnf
  - Update AlmaLinux OS 8 public key


author: David Michael <fedora.dm0@gmail.com> - 1.5-4
changelog:
  - Enable MicroLZMA support.
  - Switch the License tag to SPDX, and ship matching noneffective license files.


author: David Michael <fedora.dm0@gmail.com> - 1.6-3
changelog:
  - Backport patches for CVE-2023-33551 and CVE-2023-33552.
  - Change conditional build feature defaults for supporting EPEL 9.


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.97.1-1
changelog:
  - New version
    Resolves: rhbz#2256145
  - Fixed SMTP smuggling vulnerability
    Resolves: CVE-2023-51766


author: Jens Petersen <petersen@redhat.com> - 9.4.4-15
changelog:
  - https://www.haskell.org/ghc/blog/20221224-ghc-9.4.4-released.html
  - https://downloads.haskell.org/~ghc/9.4.4/docs/users_guide/9.4.4-notes.html


author: Jens Petersen <petersen@redhat.com> - 9.4.4-17
changelog:
  - suffix hadrian with ghc_major
  - only add ld.so.conf.d and remove RPATH if _ghcdynlibdir
  - do not duplicate libHSrts-*.so in filelist
  - add debian haddock-remove-googleapis-fonts.patch
  - update buildpath-abi-stability.patch
  - mv ld.so.conf.d out of rts block
  - use ghcliblib everywhere and add its subdirs
  - update abicheck with ghc_major
  - sync packaging changes: subpackage ghc-bignum, llvm13, -W, _ghcdynlibdir
  - build with ghc9.2


author: Jens Petersen <petersen@redhat.com> - 9.4.5-19
changelog:
  - https://www.haskell.org/ghc/blog/20230418-ghc-9.4.5-released.html
  - https://downloads.haskell.org/~ghc/9.4.5/docs/users_guide/9.4.5-notes.html
  - version bumps for base, bytestring, containers, parsec, text


author: Jens Petersen <petersen@redhat.com> - 9.4.5-21
changelog:
  - backport bcond perfbuild changes from ghc9.6
  - build the ghc.1 manpage with sphinx and version not to conflict
  - patch hadrian to build with Cabal-3.8
  - s390x: no longer apply unregisterized patches


author: Jens Petersen <petersen@redhat.com> - 9.4.6-22
changelog:
  - https://downloads.haskell.org/~ghc/9.4.6/docs/users_guide/9.4.6-notes.html
  - update license tags to SPDX
  - base subpkg now owns ghcliblib and ghclibplatform dirs (#2185357)


author: Jens Petersen <petersen@redhat.com> - 9.4.8-25
changelog:
  - s390x: patch from @stefansf (IBM) to fix llvm alignment in data sections
    which should fix certain runtime crashes (#2248097)


author: Fedora Release Engineering <releng@fedoraproject.org> - 7.1-1
changelog:
  - https://github.com/pmikova/java-runtime-decompiler/releases/tag/java-runtime-decompiler-7.1
  - moved to jrd 7.1
  - added desp on java-diff and new cplc
  - fixed(?) procyon wrapper
    - todo procyon crashes witout trace
  - removed jd wrapper (was new in 7.1, maybe will be added)
  - split plugins to subpkgs
  - added jrd-hex launcher
  - added hex launcher, added jrd symlinks


author: Fedora Release Engineering <releng@fedoraproject.org> - 7.3-1
changelog:
  - moved to 7.3
  - https://github.com/pmikova/java-runtime-decompiler/releases/tag/java-runtime-decompiler-7.3
  - https://github.com/pmikova/java-runtime-decompiler/releases/tag/java-runtime-decompiler-7.2


author: Fedora Release Engineering <releng@fedoraproject.org> - 8.0-1
changelog:
  - update dto 8.0
  - https://github.com/pmikova/java-runtime-decompiler/releases/tag/java-runtime-decompiler-8.0


author: Fedora Release Engineering <releng@fedoraproject.org> - 9.1-1
changelog:
  - update dto 9.1
  - https://github.com/judovana/java-runtime-decompiler/releases/tag/java-runtime-decompiler-9.1
  - https://github.com/judovana/java-runtime-decompiler/releases/tag/java-runtime-decompiler-9.0


author: Remi Collet <remi@remirepo.net> - 1.5.1-1
changelog:
  - update to 1.5.1
  - open https://jira.mongodb.org/browse/MONGOCRYPT-451 build with shared libbson
  - open https://jira.mongodb.org/browse/MONGOCRYPT-460 ABI/API breakage


author: Davide Cavalca <dcavalca@fedoraproject.org> - 2023.06.20-1
changelog:
  - Update to 2023.06.20
  - Update license tag and convert it to SPDX
  - Tweak package summary and description
  - Rework specfile to follow the Fedora packaging guidelines


author: Emmanuel Seyman <emmanuel@seyman.fr> - 0.73-43
changelog:
  - Use /usr/bin/perl instead of %{__perl}
  - Migrate to SPDX license
  - Use %{make_build} and %{make_install} where appropriate


author: Paul Howarth <paul@city-fan.org> - 1.5402-1
changelog:
  - Update to 1.5402
    - URL Change for MorningstarJP (GH#261)
    - Regex fix in FTfunds.pm and changed test cases ftfunds.t (GH#262)


author: Paul Howarth <paul@city-fan.org> - 1.5500-1
changelog:
  - Update to 1.55
    - Added YahooJSON currency rate module (GH#270)
    - Added TRV => CAD in AlphaVantage.pm (GH#265, GH#267)
    - Quick fix for YahooJSON.pm API
    - URL Change for MorningstarJP (GH#261)


author: Paul Howarth <paul@city-fan.org> - 1.5600-1
changelog:
  - Update to 1.56
    - Replaced Tradeville.pm with BVB.pm (GH#269)
    - Added new TwelveData module
    - Updated YahooJSON.pm and CurrencyRates/YahooJSON.pm to use
      https://query2.finance.yahoo.com/v11 (GH#284)
    - Bourso.pm - Squash anything but numbers and period in quote values
    - Renamed MStarUK.pm to MorningstarUK.pm
    - Added get_features method (GH#260)


author: Paul Howarth <paul@city-fan.org> - 1.5700-1
changelog:
  - Update to 1.57
    - Correct set exchange in YahooJSON.pm (GH#306)
    - Added close, change and p_change to Tradegate, XETRA and Sinvestor; added
      optional parameter INST_ID to specify the institute id; fixed bug in
      Tradegate, XETRA and Sinvestor for numbers equal or higher than 1.000
      (GH#304)
    - Added GoogleWeb module
    - YahooWeb module added (GH#296)
    - Added MarketWatch module
    - Replaced cached file with IO::String object in IndiaMutual.pm
    - Fixed missing date in AEX.pm (GH#298)
    - Fixed Examples in POD Documentation in a few modules (GH#295)
    - Move 'use strict' to be the first statement in TreasuryDirect.pm and
      TwelveData.pm (GH#290)
    - Remove old perl version requirement statements from TreasuryDirect.pm and
      TwelveData.pm (GH#290)
    - Removed Data::Dumper, which caused another test to fail from
      TreasuryDirect.pm (GH#290)
    - Fixed Fool.pm and fool.t (GH#289)


author: Paul Howarth <paul@city-fan.org> - 1.5800-1
changelog:
  - Update to 1.58
    - New module Consorsbank.pm (GH#329)
    - New module Stooq.pm (GH#203)
    - Bloomberg.pm - Changed modules to utilize cookie jar (GH#324, GH#331)
    - AlphaVantage.pm:
      - Apply currency scaling (GBp -> GBP) when symbol had additional ".X"
        suffix (GH#281)
      - Fixed check for "Information" JSON usually returned when daily API limit
        has been reached
    - YahooWeb.pm - Fixed incorrect pricing for single character symbols and
      changed URL to get trade date (GH#314, GH#319)
    - Another fix to the URL in YahooJSON and CurrencyRates/YahooJSON (GH#318)


author: Paul Howarth <paul@city-fan.org> - 1.5900-1
changelog:
  - Update to 1.59
    - Fixed XETRA, Tradegate and SInvestor after webpage was restructured (GH#350)
    - Fidelity.pm temporarily disabled (GH#346)
    - Finanzpartner.pm - Fix scraper, did not work if quote was higher than the
      previous day's quote
    - GoogleWeb.pm - Updated to retrieve mutual fund and BATS prices (GH#355)
    - BSEIndia.pm:
      - Updated to use standardized data file at URL
        https://www.bseindia.com/download/BhavCopy/Equity/BSE_EQ_BHAVCOPY_{DDMMYYYY}.ZIP
      - Eliminated need to use temp folders by storing standardized file data
        from URL into a variable
      - Updated names of source fields to conform to those in the standardized
        data file
      - Removed print when symbol not found (GH#335)
    - IndiaMutual.pm - Eliminated need to use temp folders by storing NAV file
      data from URL into a variable
    - TMX.pm - Correct a self-reference in documentation (GH#345)
    - Stooq.pm - Added new currencies and a fix for commodities' prices
    - YahooWeb.pm - Skip rows in the price table where the prices are "-"; this
      seems to happen sometimes with TIAA (and perhaps other) securities
      including TILIX and QCILIX
    - TSP.pm - Was not returning hash when the HTTP GET failed completely or the
      content did not contain the expected CSV file (GH#338)


author: Paul Howarth <paul@city-fan.org> - 0.6600-1
changelog:
  - Update to 0.66
    - Fix for CVE-2023-7101 (unvalidated input can lead to arbitrary code
      execution vulnerability)
      https://github.com/runrig/spreadsheet-parseexcel/issues/33
  - Use author-independent source URL
  - Use SPDX-format license tag
  - No longer need to fix document file permissions
  - Fix permissions verbosely
  - Don't assume "pm" suffix on manpage files


author: Paul Howarth <paul@city-fan.org> - 1.3.8-0.2.rc3
changelog:
  - Update to 1.3.8rc3
    - Support SSH hostkey rotation via OpenSSH extensions (GH#1323)
    - NLST did not behave consistently for relative paths (GH#1325)
    - Support AES Galois Counter Mode (AES-GCM) in SSH; support for the
      "aes128-gcm@openssh.com" and "aes256-gcm@openssh.com" ciphers has been
      added to mod_sftp (Bug #3759)
    - Implement an LDAPConnectTimeout directive, to configure the timeout used
      when connecting to LDAP servers (GH#1333)
    - Implement OpenSSH "Encrypt-Then-MAC" (ETM) algorithm extensions (GH#1330)
    - Implement AllowForeignAddress class matching for passive data transfers
      (GH#1346)
    - Implement support for PCRE2 (GH#1353)
    - ProFTPD wouldn't start with several locales (Bug #4466)
    - Auth sources providing space-bearing user/group names caused compliance
      issues with MLSD/MLST responses (GH#1367)
    - DeleteAbortedStores removed successfully transferred files unexpectedly
      (Bug #4467)
    - Omit EPRT/EPSV from FEAT response when denied by <Limit> configuration
      (GH#1383)
    - Support uploading to symlinked files (GH#1379)
    - Keepalive socket options should be set using IPPROTO_TCP, not SOL_SOCKET
      (GH#1401)
    - TCP keepalive SocketOptions should apply to control as well as data
      connection (GH#1402)
    - ProFTPD always used the same PassivePorts port for first transfer (GH#1396)
    - mod_sftp needs to handle unknown SSH messages in an RFC-compliant manner,
      ignoring rather than disconnecting (GH#1410)
    - Improve handling of some globally applied configuration directives (GH#1418)
    - Name-based virtual hosts not working as expected after upgrade from 1.3.7a
      to 1.3.7b (GH#1369)


author: Paul Howarth <paul@city-fan.org> - 1.3.8-0.3.rc4
changelog:
  - Update to 1.3.8rc4
    - mod_sftp should fail on startup when SFTP and TLS are both enabled for a
      vhost (GH#1434)
    - DelayTable not properly using documented default value; this is a
      regression caused by the changes for Bug#4020 (GH#1440)
    - Support customizing SSH ciphers, digests, key exchanges via SFTPClientMatch
      (GH#1444)
    - Ensure that mod_sftp algorithms work properly with OpenSSL 3.x (GH#1448)
    - BanOnEvent BadProtocol triggers segfault (GH#1445)
    - SFTP "check-file" implementation computes incorrect results (GH#1439)
    - Implement SFTPHostKeys directive for configuring the SSH host key
      algorithms (GH#1457)
    - Implement the "curve448-sha512" SSH key exchange algorithm (GH#1437)
    - Include directive broken when using wildcards for directory components
      (GH#1472)
    - mod_sftp fails to build using OpenSSL 1.0.x: undefined reference to
      'EVP_MD_CTX_reset' (Bug #4485)
    - Reload after omitting explicit ModulePath value causes fatal module load
      failures (GH#1476)
  - Drop pcre build dependency since we have been explicitly disabling it for the
    last 5 years anyway
  - Fix X448 support check to fail properly with OpenSSL 1.1.0 (GH#1488)


author: Paul Howarth <paul@city-fan.org> - 1.3.8-0.4.rc4
changelog:
  - Update mod_vroot to 0.9.10
    - Fix unexpected filtering behaviour with mod_vroot (#2104972, GH#1491)


author: Paul Howarth <paul@city-fan.org> - 1.3.8-1
changelog:
  - Update to 1.3.8
    - 1.3.8rc4 failed to build mod_sftp with OpenSSL 1.1.0 due to X448 check
      (GH#1488)
    - 1.3.8rc4 failed to build on Solaris due to missing type declarations
      (GH#1494)
    - mod_ifsession doesn't change the effect of SFTPMaxChannels (GH#1500)
    - mod_tls module unexpectedly allows TLS handshake after authentication in
      some configurations (GH#1533)
    - Disable FSCachePolicy by default (GH#1528)
    - Avoid logging "session closed" messages unless there is a corresponding
      "session opened" log message, to avoid user confusion (GH#1539)
    - Implement support for the CSID FTP command (GH#1550)
    - Unable to verify signed data: signature type 'rsa-sha2-512' does not match
      publickey algorithm 'ssh-rsa' (Bug #4491)
    - mod_auth_otp improperly allows keyboard-interactive logins for users
      lacking OTP entries (GH#1560)
  - Update mod_vroot to 0.9.11
    - Addresses a bad interaction with mod_auth_file, and failed login attempts,
      which can lead to inexplicably "stuck" processes that cannot be terminated
      (https://github.com/proftpd/proftpd/issues/1384)
  - Use SPDX-format license tag


author: Paul Howarth <paul@city-fan.org> - 1.3.8-4
changelog:
  - Ensure mod_rewrite is linked against libidn2 so that it loads properly
    (rhbz#2166454, https://github.com/proftpd/proftpd/issues/1590)
  - No longer need to explicitly remove libtool archives from Fedora 36 onwards


author: Paul Howarth <paul@city-fan.org> - 1.3.8a-1
changelog:
  - Update to 1.3.8a
    - Fix mod_sftp failure to handle SFTP requests to truncate files to zero size
      (GH#1581)
    - Fix mod_sftp improperly handling SFTP WRITE requests for files opened for
      appending (GH#1584)
    - Build-time detection of Linux POSIX ACL support was broken since 1.3.8rc2
      (GH#1568)
    - Fix failure to load mod_rewrite as a dynamic module due to
      incomplete/missing library linker flags (GH#1590)
    - <Class> section is allowed to be in <Global>, but From directive is not
      (GH#1597)
    - ExtendedLog SSH, SFTP classes not working as expected (GH#1617)
    - Fix mod_sftp not handling multiple concurrent open file handles/transfers
      well for logging (GH#1646)
    - "TLSRequired off" plus Protocols directive caused mod_tls to terminate the
      session abruptly (GH#1679)
    - Fix mod_tls failure to compile against OpenSSL 3.0.8 due to missing
      ENGINE_METHOD_ flags (GH#1689)
    - Unknown named connection error when using different SQL backends (GH#1659)
    - Fix mod_sql not properly closing all named backend connections on session
      exit (GH#1697)
    - SSH key exchanges failed unexpectedly with "unable to write X bytes of raw
      data" errors due to small ProFTPD buffer (GH#1694)
    - Fix high session memory usage caused by SFTP outgoing data buffering
      (GH#1678)
    - Out-of-bounds buffer read when handling FTP commands (GH#1683,
      CVE-2023-51713)
    - SFTP algorithm settings in <Global> section were not being used (GH#1712)


author: Paul Howarth <paul@city-fan.org> - 1.3.8b-1
changelog:
  - Update to 1.3.8b
    - Compiling ProFTPD 1.3.8a mod_sftp, mod_tls using libressl 3.7.3 failed
      (GH#1735)
    - Build system failed for specific module names (GH#1756)
    - "Terrapin" Prefix Truncation Attacks in SSH Specification affected mod_sftp
      (CVE-2023-48795, GH#1760)


author: Paul Howarth <paul@city-fan.org> - 1.3.8b-2
changelog:
  - Use libsodium to provide ed25519 key support for mod_sftp (#2256340)
  - Update logrotate snippet to use try-reload-or-restart rather than reload
    for distributions with systemd 229 or later (PR#3)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.80-1
changelog:
  - New version
    Resolves: rhbz#2255025
  - Fixed Terrapin vulnerability in some SSH protocol extensions
    Resolves: CVE-2023-48795


author: Paul Howarth <paul@city-fan.org> - 2.10.1-1
changelog:
  - Update to 2.10.1
    - CVE-2022-24302: Creation of new private key files using
      '~paramiko.pkey.PKey' subclasses was subject to a race condition between
      file creation and mode modification, which could be exploited by an
      attacker with knowledge of where the Paramiko-using code would write out
      such files; this has been patched by using 'os.open' and 'os.fdopen' to
      ensure new files are opened with the correct mode immediately (we've left
      the subsequent explicit 'chmod' in place to minimize any possible
      disruption, though it may get removed in future backwards-incompatible
      updates)
    - Add support for the '%C' token when parsing SSH config files (GH#1976)
    - Add support for OpenSSH's Windows agent as a fallback when Putty/WinPageant
      isn't available or functional (GH#1509, GH#1837, GH#1868)
    - Significantly speed up low-level read/write actions on
      '~paramiko.sftp_file.SFTPFile' objects by using 'bytearray'/'memoryview'
      (GH#892); this is unlikely to change anything for users of the higher level
      methods like 'SFTPClient.get' or 'SFTPClient.getfo', but users of
      'SFTPClient.open' will likely see orders of magnitude improvements for
      files larger than a few megabytes in size
    - Add 'six' explicitly to install-requires; it snuck into active use at some
      point but has only been indicated by transitive dependency on 'bcrypt'
      until they somewhat-recently dropped it (GH#1985); this will be short-lived
      until we drop Python 2 support


author: Paul Howarth <paul@city-fan.org> - 2.10.2-1
changelog:
  - Update to 2.10.2
    - Fix Python 2 compatibility breakage introduced in 2.10.1 (GH#2001)
  - Re-enable sftp tests, no longer failing under mock


author: Paul Howarth <paul@city-fan.org> - 2.10.3-1
changelog:
  - Update to 2.10.3
    - Certificate-based pubkey auth was inadvertently broken when adding SHA2
      support in version 2.9.0 (GH#1963, GH#1977)
    - Switch from module-global to thread-local storage when recording thread IDs
      for a logging helper; this should avoid one flavor of memory leak for
      long-running processes (GH#2002, GH#2003)


author: Paul Howarth <paul@city-fan.org> - 2.10.4-1
changelog:
  - Update to 2.10.4
    - Update 'camelCase' method calls against the 'threading' module to be
      'snake_case'; this and related tweaks should fix some deprecation warnings
      under Python 3.10 (GH#1838, GH#1870, GH#2028)
    - '~paramiko.pkey.PKey' instances' '__eq__' did not have the usual safety
      guard in place to ensure they were being compared to another 'PKey' object,
      causing occasional spurious 'BadHostKeyException', among other things
      (GH#1964, GH#2023, GH#2024)
    - Servers offering certificate variants of hostkey algorithms (e.g.
      'ssh-rsa-cert-v01@openssh.com') could not have their host keys verified by
      Paramiko clients, as it only ever considered non-cert key types for that
      part of connection handshaking (GH#2035)


author: Paul Howarth <paul@city-fan.org> - 2.11.0-1
changelog:
  - Update to 2.11.0
    - Align signature verification algorithm with OpenSSH re: zero-padding
      signatures that don't match their nominal size/length; this shouldn't
      affect most users, but will help Paramiko-implemented SSH servers handle
      poorly behaved clients such as PuTTY (GH#1933)
    - OpenSSH 7.7 and older has a bug preventing it from understanding how to
      perform SHA2 signature verification for RSA certificates (specifically
      certs - not keys), so when we added SHA2 support it broke all clients using
      RSA certificates with these servers; this has been fixed in a manner similar
      to what OpenSSH's own client does - a version check is performed and the
      algorithm used is downgraded if needed (GH#2017)
    - Recent versions of Cryptography have deprecated Blowfish algorithm support;
      in lieu of an easy method for users to remove it from the list of
      algorithms Paramiko tries to import and use, we've decided to remove it
      from our "preferred algorithms" list, which will both discourage use of a
      weak algorithm, and avoid warnings (GH#2038, GH#2039)
    - Windows-native SSH agent support as merged in 2.10 could encounter
      'Errno 22' 'OSError' exceptions in some scenarios (e.g. server not cleanly
      closing a relevant named pipe); this has been worked around and should be
      less problematic (GH#2008, GH#2010)
    - Add SSH config token expansion (eg '%h', '%p') when parsing 'ProxyJump'
      directives (GH#1951)
    - Apply unittest 'skipIf' to tests currently using SHA1 in their critical
      path, to avoid failures on systems starting to disable SHA1 outright in
      their crypto backends (e.g. RHEL 9) (GH#2004, GH#2011)


author: Paul Howarth <paul@city-fan.org> - 2.12.0-1
changelog:
  - Update to 2.12.0 (rhbz#2140281)
    - Add a 'transport_factory' kwarg to 'SSHClient.connect' for advanced users
      to gain more control over early Transport setup and manipulation (GH#2054,
      GH#2125)
    - Update '~paramiko.client.SSHClient' so it explicitly closes its wrapped
      socket object upon encountering socket errors at connection time; this
      should help somewhat with certain classes of memory leaks, resource
      warnings, and/or errors (though we hasten to remind everyone that Client
      and Transport have their own '.close()' methods for use in non-error
      situations!) (GH#1822)
    - Raise '~paramiko.ssh_exception.SSHException' explicitly when blank private
      key data is loaded, instead of the natural result of 'IndexError'; this
      should help more bits of Paramiko or Paramiko-adjacent codebases to
      correctly handle this class of error (GH#1599, GH#1637)
  - Use SPDX-format license tag


author: Paul Howarth <paul@city-fan.org> - 2.12.0-2
changelog:
  - Address CVE 2023-48795 (a.k.a. the "Terrapin Attack", a vulnerability found
    in the SSH protocol re: treatment of packet sequence numbers) as follows:
    - The vulnerability only impacts encrypt-then-MAC digest algorithms in tandem
      with CBC ciphers, and ChaCha20-poly1305; of these, Paramiko currently only
      implements ``hmac-sha2-(256|512)-etm`` in tandem with 'AES-CBC'
    - As the fix for the vulnerability requires both ends of the connection to
      cooperate, the below changes will only take effect when the remote end is
      OpenSSH ≥ 9.6 (or equivalent, such as Paramiko in server mode, as of this
      patch version) and configured to use the new "strict kex" mode
    - Paramiko will always attempt to use "strict kex" mode if offered by the
      server, unless you override this by specifying 'strict_kex=False' in
      'Transport.__init__'
    - Paramiko will now raise an 'SSHException' subclass ('MessageOrderError')
      when protocol messages are received in unexpected order; this includes
      situations like receiving 'MSG_DEBUG' or 'MSG_IGNORE' during initial key
      exchange, which are no longer allowed during strict mode
    - Key (re)negotiation, i.e. 'MSG_NEWKEYS', whenever it is encountered, now
      resets packet sequence numbers (this should be invisible to users during
      normal operation, only causing exceptions if the exploit is encountered,
      which will usually result in, again, 'MessageOrderError')
    - Sequence number rollover will now raise 'SSHException' if it occurs during
      initial key exchange (regardless of strict mode status)
  - Tweak 'ext-info-(c|s)' detection during KEXINIT protocol phase; the original
    implementation made assumptions based on an OpenSSH implementation detail
  - 'Transport' grew a new 'packetizer_class' kwarg for overriding the
    packet-handler class used internally; this is mostly for testing, but advanced
    users may find this useful when doing deep hacks
  - A handful of lower-level classes (notably 'paramiko.message.Message' and
    'paramiko.pkey.PKey') previously returned 'bytes' objects from their
    implementation of '__str__', even under Python 3, and there was never any
    '__bytes__' method; these issues have been fixed by renaming '__str__' to
    '__bytes__' and relying on Python's default "stringification returns the
    output of '__repr__'" behavior re: any real attempts to 'str()' such objects


author: Benjamin A. Beasley <code@musicinmybrain.net> - 20221105-6
changelog:
  - When PDF docs are disabled, omit the -doc subpackage
  - Do not package CONTRIBUTING.md, which is about interacting with upstream


