# changelog

author: Steve Grubb <sgrubb@redhat.com> 2.8.4-1
changelog:
  resolves: #1559032 - Rebase audit package to 2.8.4 to pick up bug fixes
  resolves: #1573889 - auditd busy loop in rotate_logs() with num_logs < 2
  resolves: #1534748 - incorrect addr field when using IPv6 for remote logging
  resolves: #1515903 - ausearch-expression man page missing \timestamp_ex
  resolves: #1511606 - aureport AVC report header is incomplete
  resolves: #1504251 - make auditd dump internal state for log writing status


author: Steve Grubb <sgrubb@redhat.com> 2.8.5-1
changelog:
  resolves: #1651761 - Rebase audit package to 2.8.5 to pick up bug fixes
  resolves: #1462178 - audit rule arch changed from b32 to b64 on ppc64le
  resolves: #1614833 - audispd loops reloading config 
  resolves: #1622194 - audisp-remote memory leak when using krb5 
  resolves: #1625156 - audisp-remote wont connect if remote ending action not reconnect
  resolves: #1628626 - aureport -a --failed does not display user_avc events 
  resolves: #1648005 - tcp listener socket fails when ipv6.disable=1 boot command
  resolves: #1650670 - space left in auditd.conf expressed as a percentage 
  resolves: #1663285 - ausearch device/inode missing when using a single file 
  resolves: #1672287 - max_log_file_action "keep_logs" doesn't behave as described


author: asarai@suse.com
changelog:
  - Update to catatonit v0.1.1, which includes a fix for the libtool requirement.
    This lets us build on much older distributions.


author: asarai@suse.com
changelog:
  - Fix build to correctly build a static binary (which will allow it to work in
    all containers). This was caused by forgetting to include
    'glibc-devel-static'. I've added a check to ensure it doesn't happen by
    accident again.
  - Add catatonit-rpmlintrc to include filters for "static binary" warnings,
    since this is intentional.


author: asarai@suse.com
changelog:
  - Update to catatonit v0.1.3, which includes a fix for docker compatiblity so
    that dockerd doesn't give spurrious warnings.


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang
    endlessly when pid1 died in very specific ways. bsc#1176155


author: asarai@suse.com
changelog:
  - Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to
    socket activation or features somewhat adjacent to socket activation (such as
    passing file descriptors).
  - Update catatonit-rpmlintrc in order to cover that static binaries are now an
    error not a warning.


author: dimstar@opensuse.org
changelog:
  - Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only
    once. Fix build with autocnf 2.71 / automake 1.16.5.


author: rbrown@suse.com
changelog:
  - Update to catatont v0.1.7
  - This release adds the ability for catatonit to be used as the only
    process in a pause container, by passing the -P flag (in this mode no
    subprocess is spawned and thus no signal forwarding is done).


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-3
changelog:
  - Fix typos in test/dispol
  - Set flex as default lexer
  - Fix checkmodule output message
  - Build policy on systems not supporting DCCP protocol
  - Fail if module name different than output base filename


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-6
changelog:
  - Add ibendport ocontext handling
  - Add support for ibendportcon labels
  - Add ibpkey ocontext handling
  - Add support for ibpkeycon labels
  - Add binary module support for xperms


author: John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
changelog:
  - Update to version 0.7.0:
    * Spec changes:
      + Use more RFC2119 style language in specification (must, should...)
      + add notes about ADD/DEL ordering
      + Make the container ID required and unique.
      + remove the version parameter from ADD and DEL commands.
      + Network interface name matters
      + be explicit about optional and required structure members
      + add CHECK method
      + Add a well-known error for "try again"
      + SPEC.md: clarify meaning of 'routes'
    * Library changes:
      + pkg/types: Makes IPAM concrete type
      + libcni: return error if Type is empty
      + skel: VERSION shouldn't block on stdin
      + non-pointer instances of types.Route now correctly marshal to JSON
      + libcni: add ValidateNetwork and ValidateNetworkList functions
      + pkg/skel: return error if JSON config has no network name
      + skel: add support for plugin version string
      + libcni: make exec handling an interface for better downstream testing
      + libcni: api now takes a Context to allow operations to be timed out or cancelled
      + types/version: add helper to parse PrevResult
      + skel: only print about message, not errors
      + skel,invoke,libcni: implementation of CHECK method
      + cnitool: Honor interface name supplied via CNI_IFNAME environment variable.
      + cnitool: validate correct number of args
      + Don't copy gw from IP4.Gateway to Route.GW When converting from 0.2.0
      + add PrintTo method to Result interface
      + Return a better error when the plugin returns none
  - Install sleep binary into CNI plugin directory
  - Restore build.sh script which was removed upstream


author: John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
changelog:
  - Update to version 0.7.1 (bsc#1160460):
    * Library changes:
      + invoke : ensure custom envs of CNIArgs are prepended to process envs
      + add GetNetworkListCachedResult to CNI interface
      + delegate : allow delegation funcs override CNI_COMMAND env automatically in heritance
    * Documentation & Convention changes:
      + Update cnitool documentation for spec v0.4.0
      + Add cni-route-override to CNI plugin list
    * Build and test changes:
      + Release: bump go to v1.12


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Updated plugins to v0.7.4:
    - Add host-device plugin, which simply moves a device from the
      host network namespace
    - Portmap now uses a more efficient rule structure
    - host-local can receive ranges as a RuntimeArgument
    - DHCP daemon can be containerized
    - DHCP now correctly parses routes
    - Various Windows build fixes
    - Waiting for DAD is skipped when possible
    - Bridge now uses a stable mac
    - Fix a regression where the interface's MAC address was no
      longer populated in the return type.


author: John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
changelog:
  - Updated plugins to v0.8.0:
    + New plugins:
    * bandwidth - limit incoming and outgoing bandwidth
    * firewall - add containers to firewall rules
    * sbr - convert container routes to source-based routes
    * static - assign a fixed IP address
    * win-bridge, win-overlay: Windows plugins
    + Plugin features / changelog:
    * CHECK Support
    * macvlan:
    - Allow to configure empty ipam for macvlan
    - Make master config optional
    * bridge:
    - Add vlan tag to the bridge cni plugin
    - Allow the user to assign VLAN tag
    - L2 bridge Implementation.
    * dhcp:
    - Include Subnet Mask option parameter in DHCPREQUEST
    - Add systemd unit file to activate socket with systemd
    - Add container ifName to the dhcp clientID, making the
      clientID value
    * flannel:
    - Pass through runtimeConfig to delegate
    * host-local:
    - host-local: add ifname to file tracking IP address used
    * host-device:
    - Support the IPAM in the host-device
    - Handle empty netns in DEL for loopback and host-device
    * tuning:
    - adds 'ip link' command related feature into tuning
    + Bug fixes & minor changes
    * Correctly DEL on ipam failure for all plugins
    * Fix bug on ip revert if cmdAdd fails on macvlan and host-device
    * host-device: Ensure device is down before rename
    * Fix -hostprefix option
    * some DHCP servers expect to request for explicit router options
    * bridge: release IP in case of error
    * change source of ipmasq rule from ipn to ip
    + Build fixes:
    * test: add coveralls support
    * plugins: correctly output build version, cosmetic cleanups
    * Move Windows tests to Travis
  - from version v0.7.5:
    + This release takes a minor change to the portmap plugin:
    * Portmap: append, rather than prepend, entry rules
    + This fixes a potential issue where firewall rules may
      be bypassed by port mapping
  - Include patch to fix the build on i586:
    + 0001_use_Go_facilities_to_get_a_socket.patch
  - Use new build_linux.sh script instead of removed build.sh


author: John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
changelog:
  - Updated plugins to v0.8.1:
    + Bugs:
    * bridge: fix ipMasq setup to use correct source address
    * fix compilation error on 386
    * bandwidth: get bandwidth interface in host ns through
      container interface
    + Improvements:
    * Release: bump go to v1.12
    * host-device: add pciBusID property
  - Drop patches merged upstream:
    + 0001_use_Go_facilities_to_get_a_socket.patch


author: John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
changelog:
  - Update plugins to v0.8.2
    + New features:
    * Support "args" in static and tuning
    * Add Loopback DSR support, allow l2tunnel networks
      to be used with the l2bridge plugin
    * host-local: return error if same ADD request is seen twice
    * bandwidth: fix collisions
    * Support ips capability in static and mac capability in tuning
    * pkg/veth: Make host-side veth name configurable
    + Bug fixes:
    * Fix: failed to set bridge addr: could not add IP address to "cni0": file exists
    * host-device: revert name setting to make retries idempotent (#357).
    * Vendor update go-iptables. Vendor update go-iptables to
      obtain commit f1d0510cabcb710d5c5dd284096f81444b9d8d10
    * Update go.mod & go.sub
    * Remove link Down/Up in MAC address change to prevent route flush (#364).
    * pkg/ip unit test: be agnostic of Linux version, on Linux 4.4 the syscall
      error message is "invalid argument" not "file exists"
    * bump containernetworking/cni to v0.7.1


author: sgrunert@suse.com
changelog:
  - Update to version 0.8.3:
    * Enhancements:
    * static: prioritize the input sources for IPs (#400).
    * tuning: send gratuitous ARP in case of MAC address update (#403).
    * bandwidth: use uint64 for Bandwidth value (#389).
    * ptp: only override DNS conf if DNS settings provided (#388).
    * loopback: When prevResults are not supplied to loopback plugin, create results to return (#383).
    * loopback support CNI CHECK and result cache (#374).
    * Better input validation:
    * vlan: add MTU validation to loadNetConf (#405).
    * macvlan: add MTU validation to loadNetConf (#404).
    * bridge: check vlan id when loading net conf (#394).
    * Bugfixes:
    * bugfix: defer after err check, or it may panic (#391).
    * portmap: Fix dual-stack support (#379).
    * firewall: don't return error in DEL if prevResult is not found (#390).
    * bump up libcni back to v0.7.1 (#377).
    * Tests:
    * integration: fix ip address collision in integration tests (#409).
    * testutils: newNS() works in a rootless user namespace (#401).
    * Bump Go version (#386).
    * Cleanup netns after test suite (#375).
    * Docs:
    * contributing doc: revise test script name to run (#396).
    * contributing doc: describe cnitool installation (#397).


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update to version 0.8.4 (bsc#1160460):
    * add support for mips64le
    * Add missing cniVersion in README example
    * bump go-iptables module to v0.4.5
    * iptables: add idempotent functions
    * portmap doesn't fail if chain doesn't exist
    * fix portmap port forward flakiness
    * Add Bruce Ma and Piotr Skarmuk as owners


author: John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
changelog:
  - Update to version 0.8.6 (bsc#1172410 CVE-2020-10749)
    * New features
    * Support device id in host device plugin (#471).
    * win-bridge: add support for portMappings capability (#475).
    * Make host-device to work with virtio net device (#453).
    * Small improvements
    * ptp, bridge: disable accept_ra on the host-side interface (#484).
    * modify the error url of windowscontainer (#460).
    * portmap: Apply the DNAT hairpin to the whole subnet (#469). The DNAT hairpin
      rule only allow the * container itself to access the ports it is exposing thru
      the host IP. Other containers in the same subnet might also want to access this
      service via the host IP, so apply this rule to the whole subnet instead of just
      for the container.
    * Unlock OS thread after netns is restored (#455).
    * Bugfixes
    * plugins/meta/sbr: Adjusted ipv6 address mask to /128 (#479). A /64 mask was used
      which routed an entire cidr based on source, not only the bound address.
    * check bridge's port state (#468). fix #463
    * Reset the route flag before moving the rule (#472).
    * replace juju/errors because of CNCF license scan (#458). ref to #457
    * loopback: Fix ipv6 address checks (#442). Fixes a minor bug in loopback plugin.
      The IPv6 address check loops over IPv4 addresses.
  - from version 0.8.5
    * Bugfixes
    * bridge: Fix for the case where kernel doesn't have CONFIG_BRIDGE_VLAN_FILTERING
      (#434) fixes #370.
    * vlan: Fix vlan plugin returning error when device is already removed (#438).
    * Improvements
    * sysctl: Improve support of sysctl name separators (#437).


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Add TimedOutMessage to config to share with go code
  - Fix format string to limit the size of the string to 10
    characters


author: Ralf Haferkamp <rhafer@suse.com>
changelog:
  - Update to v2.0.10 (bsc#1160460, bsc#1164390, jsc#ECO-1048,
    jsc#SLE-11485, jsc#SLE-11331):
    - journal logging: write to /dev/null instead of -1


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update to v2.0.11
    - log: reject --log-tag with k8s-file
    - chmod std files pipes
    - adjust score to -1000 to prevent conmon from ever being OOM
      killed
    - container OOM: verify cgroup hasn't been cleaned up before
      reporting OOM


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update to v2.0.14
    - drop usage of splice(2)
    - avoid hanging on stdin
    - stdio: sometimes quit main loop after io is done
    - ignore sigpipe


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update to v2.0.20 (bsc#1175821)
    - journald: fix logging container name
    - container logging: Implement none driver - "off", "null" or
      "none" all work.
    - ctrl: warn if we fail to unlink
    - Drop fsync calls
    - Reap PIDs before running exit command
    - Fix log path parsing
    - Add --sync option to prevent conmon from double forking
    - Add --no-sync-log option to instruct conmon to not sync the
      logs of the containers upon shutting down. This feature fixes a
      regression where we unconditionally dropped the log sync. It is
      possible the container logs could be corrupted on a sudden
      power-off. If you need container logs to remain in consistent
      state after a sudden shutdown, please update from v2.0.19 to
      v2.0.20


author: Jindrich Novy <jnovy@redhat.com> - 2:2.0.27-2
changelog:
  - switch to master branch to fix /dev/null ownership issues
    (https://github.com/containers/conmon/commit/372fa19211cfeabdb2bad52a4ab8a4d1b0b0063c)
  - Related: #1954702


author: Jindrich Novy <jnovy@redhat.com> - 2:2.0.26-3
changelog:
  - fix "Permission on /dev/null are changing from 666 to 777 after running podman as root [rhel-8.4.0.z]"
  - Resolves: #1961682


author: dmueller@suse.com
changelog:
  - Update to version 2.0.21:
    * bump to v2.0.21
    * protect against kill(-1)
    * Makefile: enable debuginfo generation
    * Remove go.sum file and add go.mod
    * Fail if conmon config could not be written
    * nix: remove double definition for e2fsprogs
    * Speedup static build by utilizing CI cache on `/nix` folder
    * Fix nix build for failing e2fsprogs tests
    * test: fix CI
    * Use Podman for building


author: sgrunert@suse.com
changelog:
  - Update to version 2.0.22:
    * added man page
    * attach: always chdir
    * conn_sock: Explicitly free a heap-allocated string
    * refactor I/O and add SD_NOTIFY proxy support


author: alexandre.vicenzi@suse.com
changelog:
  - Update to version 2.0.26:
    * conn_sock: do not fail on EAGAIN
    * fix segfault from a double freed pointer
    * Fix a bug where conmon could never spawn a container, because
      a disagreement between the caller and itself on where the attach
      socket was.
    * improve --full-attach to ignore the socket-dir directly. that
      means callers don't need to specify a socket dir at all (and
      can remove it)
    * add full-attach option to allow callers to not truncate a very
      long path for the attach socket
    * close only opened FDs
    * set locale to inherit environment


author: alexandre.vicenzi@suse.com
changelog:
  - Update to version 2.0.27:
    * bump to v2.0.27
    * Add CRI-O integration test GitHub action
    * exec: don't fail on EBADFD
    * close_fds: fix close of external fds
    * Add arm64 static build binary
    * bump to v2.0.27-dev


author: alexandre.vicenzi@suse.com
changelog:
  - Update to version 2.0.29:
    * Reset OOM score back to 0 for container runtime
    * call functions registered with atexit on SIGTERM
    * conn_sock: fix potential segfault


author: info@paolostivanin.com
changelog:
  - Update to version 2.0.30:
    * Remove unreachable code path
    * exit: report if the exit command was killed
    * exit: fix race zombie reaper
    * conn_sock: allow watchdog messages through the notify socket proxy
    * seccomp: add support for seccomp notify


author: Jindrich Novy <jnovy@redhat.com> - 2:2.0.27-2
changelog:
  - switch to master branch to fix /dev/null ownership issues
    (https://github.com/containers/conmon/commit/372fa19211cfeabdb2bad52a4ab8a4d1b0b0063c)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 2:2.0.27-4
changelog:
  - update to the latest content of https://github.com/containers/conmon/tree/master
    (https://github.com/containers/conmon/commit/3161452)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 2:2.0.27-5
changelog:
  - update to the latest content of https://github.com/containers/conmon/tree/master
    (https://github.com/containers/conmon/commit/b033cb5)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 2:2.0.27-6
changelog:
  - update to the latest content of https://github.com/containers/conmon/tree/master
    (https://github.com/containers/conmon/commit/75e067e)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 2:2.1.2-2
changelog:
  - update to latest content of https://github.com/containers/conmon/releases/tag/2.1.2
    (https://github.com/containers/conmon/commit/2bc95ee697e87d5f7b77063cf83fc32739addafe)
  - Related: #2061390


author: Paul Wouters <pwouters@redhat.com> - 1.4.2-8
changelog:
  - Resolves: rhbz#CVE-2015-6496
  - Fold in upstream patches since 1.4.2 release up to git 900d7e8
  - Fold in upstream patch set of 2015-08-18 for coverity issues


author: Paul Wouters <pwouters@redhat.com> - 1.4.4-3
changelog:
  - Resolves: rhbz#1425552 (explicitely Require: libnetfilter_conntrack >= 1.0.6 as it is same .so version)


author: Paul Wouters <pwouters@redhat.com> - 1.4.4-4
changelog:
  - Resolves: rhbz#1578059 Greatest NVR version of conntrack-tools for ppc64le and x86_64 are different


author: Phil Sutter <psutter@redhat.com> - 1.4.4-5
changelog:
  - Add git commit info to IPv6 NAT support patch
  - Backport: conntrackd: helpers: dhcpv6: Fix potential array overrun
  - Backport: nfct: Drop dead code in nfct_timeout_parse_params()
  - Backport: src: Fix for implicit-fallthrough warnings


author: jengelh@inai.de
changelog:
  - Update to new upstream release 1.4.2
    * This release includes bugfixes and the connlabel support.


author: jengelh@inai.de
changelog:
  - Update to new git snapshot 1.4.2.g26
    * Chromecast/SSDP support, SSDP userspace helper
    * TFTP userspace helper support
    * Support for attaching expectations via nfqueue
    * Fix directory lookup for helper plugins
    * Fixes a possible crash if conntrackd sees DCCP, SCTP and ICMPv6
    traffic and the corresponding kernel modules that track this
    traffic are not available. [bnc#942419, CVE-2015-6496]


author: jengelh@inai.de
changelog:
  - Update to new upstream release 1.4.3
    * conntrack: fix expectation entry creation
    * expect: Fix wrong memset usage
    * cthelper: don't pass up a 0 length queue
    * conntrackd: allow strings with underscore from flex scanner
    * conntrack: fix setting labels in updates


author: jengelh@inai.de
changelog:
  - Update to new upstream release 1.4.4
    * conntrackd: add systemd support
    * conntrack: support delete by label
    * conntrack: add support for netmask filtering
    * conntrack: add support for CIDR notation
    * conntrack: Add missing tables "dying" and "unconfirmed"
    to usage output.


author: jengelh@inai.de
changelog:
  - submission from lars@linux-schulserver.de, partially applied
  - split out new subpackage "conntrackd" for the eponymous
    daemon (has systemd dependencies)
  - add systemd service, logrotate config, sample sysconfig,
    and sample config file.


author: jengelh@inai.de
changelog:
  - Update to new upstream release 1.4.5
    * new synproxy support
    * improved logging support (both stdout/stderr and log files)
    * new mDNS ct helper
    * deprecate unix backlog configuration
    * drop old/obsolete/deprecated conntrackd.conf config options
    * improved support for UPnP in the SSDP ct helper
    * add stronger TCP flags support
    * conntrack CLI tool: new support for IPv6 NAT
    * nfct CLI tool: some improvements to the build (-z lazy)


author: mkubecek@suse.cz
changelog:
  - Fix 1.4.5 parser issues (bsc#1141480):
    conntrackd-use-strncpy-to-unix-path.patch
    conntrackd-Use-strdup-in-lexer.patch
    conntrackd-use-correct-max-unix-path-length.patch


author: mkubecek@suse.cz
changelog:
  - conntrackd-cthelper-Add-new-SLP-helper.patch:
    userspace conntrack helper for SLP (Service Location Protocol) to
    replace SUSE specific kernel helper (rejected by upstream) from
    openSUSE / SLE kernel packages (FATE#324143 bsc#1127886)
  - run autoreconf before build (patch above touches Makefile.am)
  - add commented out conntrack helper config example to default
    conntrackd.conf
  - drop deprecated (and ignored) options Nice and UNIX/Backlog from
    default conntrackd.conf


author: Phil Sutter <psutter@redhat.com> - 1.4.7-1
changelog:
  - config: Fix -Wimplicit-function-declaration
  - network: Fix -Wstrict-prototypes
  - build: don't suppress various warnings
  - build: conntrack-tools requires libnetfilter_conntrack >= 1.0.9
  - New version 1.4.7


author: Dan Walsh <dwalsh@fedoraproject.org> - 2.76-1
changelog:
  - Allow containers to use fuse file systems by default
  - Allow containers to sendto dgram socket of container runtimes
  - Needed to run container runtimes in notify socket unit files.


author: Jindrich Novy <jnovy@redhat.com> - 2:2.130.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.130.0
  - don't use macros in changelog
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 2:2.134.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.134.0
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 2:2.135.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.135.0
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 2:2.137.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.137.0
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 2:2.138.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.138.0
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 2:2.139.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.139.0
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 2:2.142.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.142.0
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 2:2.143.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.143.0
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 2:2.144.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.144.0
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 2:2.164.1-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.164.1
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 2:2.164.2-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.164.2
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 2:2.165.1-2
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.165.1
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 2:2.167.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.167.0
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 2:2.170.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.170.0
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 2:2.171.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.171.0
  - Related: #2021990


author: Jindrich Novy <jnovy@redhat.com> - 2:2.172.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.172.0
  - Related: #2021990


author: Jindrich Novy <jnovy@redhat.com> - 2:2.172.1-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.172.1
  - Related: #2021990


author: Jindrich Novy <jnovy@redhat.com> - 2:2.176.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.176.0
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 2:2.177.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.177.0
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 2:2.178.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.178.0
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 2:2.179.1-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.179.1
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 2:2.180.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.180.0
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:2.181.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.181.0
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:2.183.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.183.0
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:2.187.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.187.0
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:2.188.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.188.0
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:2.189.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.189.0
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:2.199.0-1
changelog:
  - revert back to https://github.com/containers/container-selinux/releases/tag/v2.199.0
    (2.200.0 fails to build as it relies on the new selinux-policy which is not there yet)
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 2:2.205.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.205.0
  - remove user_namespace class, thanks to Lokesh Mandvekar
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 2:2.205.0-2
changelog:
  - use conditionals from https://github.com/containers/container-selinux/blob/main/container-selinux.spec.rpkg
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 2:2.211.1-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.211.1
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 2:2.213.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.213.0
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 2:2.215.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.215.0
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 2:2.218.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.218.0
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 2:2.219.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.219.0
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 2:2.221.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.221.0
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 3:2.222.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.222.0
  - Related: Jira:RHEL-2112


author: Jindrich Novy <jnovy@redhat.com> - 3:2.224.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.224.0
  - Related: Jira:RHEL-2112


author: Lokesh Mandvekar <lsm5@redhat.com> - 3:2.226.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.226.0
  - Remove dependency on policycoreutils-python-utils
  - Related: Jira:RHEL-2112
  - Related: Jira:RHEL-18316


author: Jindrich Novy <jnovy@redhat.com> - 3:2.227.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.227.0
  - Related: RHEL-2112


author: Jindrich Novy <jnovy@redhat.com> - 3:2.228.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.228.0
  - Related: RHEL-2112


author: Jindrich Novy <jnovy@redhat.com> - 3:2.228.1-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.228.1
  - Related: RHEL-2112


author: Jindrich Novy <jnovy@redhat.com> - 3:2.229.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.229.0
  - Related: RHEL-2112


author: Jindrich Novy <jnovy@redhat.com> - 3:2.230.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.230.0
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 3:2.231.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.231.0
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 3:2.232.1-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.232.1
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 3:2.233.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.233.0
  - Resolves: RHEL-58997


author: Jindrich Novy <jnovy@redhat.com> - 3:2.234.2-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.234.2
  - Related: RHEL-60277


author: Jindrich Novy <jnovy@redhat.com> - 4:2.235.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.235.0
  - Resolves: RHEL-85434


author: asarai@suse.com
changelog:
  - Merge -kubic packages back into the main Virtualization:containers packages.
    This is done using _multibuild to add a "kubic" flavour, which is then used
    to conditionally compile patches and other kubic-specific features.
    bsc#1105000


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Add backport of https://github.com/containerd/containerd/pull/2764, which is
    required for us to build containerd on i586 SLE-12 (where /bin/sh doesn't
    like emoji in shell scripts). bsc#1102522 bsc#1113313
    + 0001-makefile-remove-emoji.patch


author: clee@suse.com
changelog:
  - Update go requirements to >= go1.10 to fix
    * bsc#1118897 CVE-2018-16873
      go#29230 cmd/go: remote command execution during "go get -u"
    * bsc#1118898 CVE-2018-16874
      go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
    * bsc#1118899 CVE-2018-16875
      go#29233 crypto/x509: CPU denial of service


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
    bsc#1124308
    * Fix rare deadlock on FIFO creation with timeout
    * Fix a bug that a container can't be stopped or inspected when its
      corresponding image is deleted
    * Fix a bug that the cri plugin handles containerd events outside of
      k8s.io namespace
    more changes at:
    https://github.com/containerd/containerd/releases/tag/v1.2.2
    Changelogs from previous versions also included in this update:
      https://github.com/containerd/containerd/releases/tag/v1.2.1
      https://github.com/containerd/containerd/releases/tag/v1.2.0
      https://github.com/containerd/containerd/releases/tag/v1.1.4
      https://github.com/containerd/containerd/releases/tag/v1.1.3
  - Remove required_dockerrunc commit pinning, as it just lead to issues.
  - Remove upstreamed patches.
    - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update containerd to v1.2.4
    * cri: Set /etc/hostname
    * cri: Fix env performance issue
    * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
      bsc#1121967 CVE-2019-5736
    * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
    * Windows: NewDirectIOFromFIFOSet
    * Changelogs from previous versions also included in this update:
      https://github.com/containerd/containerd/releases/tag/v1.2.3


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Update to containerd v1.2.5, which is required for v18.09.5-ce.
    bsc#1128376 boo#1134068
    https://github.com/containerd/containerd/releases/tag/v1.2.5


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
    bsc#1139649
  - Remove containerd-test (it's not useful for actual testing).


author: asarai@suse.com
changelog:
  [ This patch was only released in SLES and Leap. ]
  - Add patch for CVE-2022-23648. bsc#1196441
    + CVE-2022-23648.patch


author: asarai@suse.com
changelog:
  - Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441
  - Remove upstreamed patch:
    - CVE-2022-23648.patch


author: asarai@suse.com
changelog:
  - Update to containerd v1.5.12. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.5.12>


author: asarai@suse.com
changelog:
  [ This patch was only released in SLES and Leap. ]
  - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145
    + bsc1200145-Limit-the-response-size-of-ExecSync.patch


author: asarai@suse.com
changelog:
  - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements
    of Docker v20.10.17-ce. bsc#1200145
  - Remove upstreamed patches:
    - bsc1200145-Limit-the-response-size-of-ExecSync.patch


author: asarai@suse.com
changelog:
  - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
    CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.6.9>


author: asarai@suse.com
changelog:
  - Update to containerd v1.6.11. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.6.11>


author: asarai@suse.com
changelog:
  - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.6.11>


author: asarai@suse.com
changelog:
  - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
    release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.6.12>


author: asarai@suse.com
changelog:
  - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.6.16>


author: asarai@suse.com
changelog:
  - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.6.19>
    Includes fixes for:
    - CVE-2023-25153 bsc#1208423
    - CVE-2023-25173 bsc#1208426


author: asarai@suse.com
changelog:
  - Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
  - Switch to Go 1.16.x compiler, in line with upstream.


author: asarai@suse.com
changelog:
  - Update to containerd v1.4.11, to fix CVE-2021-41103. bsc#1191355
  - Switch to Go 1.16.x compiler, in line with upstream.


author: Eli Uriegas <eli.uriegas@docker.com> - 1.2.9-3.1
changelog:
  - containerd 1.2.9 release
  - Addresses CVE-2019-9512 (Ping Flood), CVE-2019-9514 (Reset Flood), and CVE-2019-9515 (Settings Flood).


author: Eli Uriegas <eli.uriegas@docker.com> - 1.2.10-3.1
changelog:
  - containerd 1.2.10 release
  - Addresses CVE-2019-16884 (AppArmor bypass)
  - Bump runc to 3e425f80a8c931f88e6d94a8c831b9d5aa481657 (1.0.0-rc8 + CVE-2019-16884)


author: Evan Hazlett <evan@docker.com> - 1.2.11-3.1
changelog:
  - Update the runc vendor to v1.0.0-rc9 which includes an additional
    mitigation for CVE-2019-16884
  - Add local-fs.target to service file to fix corrupt image after unexpected
    host reboot
  - Update Golang runtime to 1.12.13, which includes security fixes to the
    crypto/dsa package made in Go 1.12.11 (CVE-2019-17596), and fixes to the
    go command, runtime, syscall and net packages (Go 1.12.12)
  - CRI: Fix shim delete error code to avoid unnecessary retries in the CRI plugin


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.2.11-3.2
changelog:
  - Update Golang runtime to 1.12.15, which includes fixes in the net/http package
    and the runtime on ARM64


author: Derek McGowan <derek@docker.com> - 1.2.12-3.1
changelog:
  - Update the runc vendor to v1.0.0-rc10 which includes a mitigation for
    CVE-2019-19921.
  - Update the opencontainers/selinux which includes a mitigation for
    CVE-2019-16884.
  - Update Golang runtime to 1.12.16, mitigating the CVE-2020-0601
    certificate verification bypass on Windows, and CVE-2020-7919,
    which only affects 32-bit architectures.
  - A fix to prevent SIGSEGV when starting containerd-shim
  - Fix to prevent high system load/CPU utilization with liveness and readiness
    probes
  - Fix to prevent docker exec hanging if an earlier docker exec left a zombie
    process
  - CRI: Update the gopkg.in/yaml.v2 vendor to v2.2.8 with a mitigation for
    CVE-2019-11253


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.2.13-3.1
changelog:
  - Update to containerd 1.2.13, which fixes a regression introduced in v1.2.12
    that caused container/shim to hang on single core machines, and fixes an issue
    with blkio.
  - Update Golang runtime to 1.12.17.


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.2.13-3.2
changelog:
  - Build packages for RHEL-7 on s390x, CentOS 8, and Fedora 32
  - Add libseccomp as required dependency


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.11-3.1
changelog:
  - Update containerd to v1.6.11
  - Update Golang runtime to 1.18.9, which includes fixes for CVE-2022-41717,
    CVE-2022-41720, and CVE-2022-41720.


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.18-3.1
changelog:
  - update containerd binary to v1.6.18, which includes fixes for CVE-2023-25153
    and CVE-2023-25173.
  - update Golang runtime to 1.19.6, which includes fixes for CVE-2022-41722,
    CVE-2022-41725, CVE-2022-41724, and CVE-2022-41723.


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.20-3.1
changelog:
  - update containerd binary to v1.6.20.
  - update runc binary to v1.1.5, which includes fixes for CVE-2023-25809,
    CVE-2023-27561, and CVE-2023-28642.


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.21-3.1
changelog:
  - update containerd binary to v1.6.21
  - update runc binary to v1.1.7
  - Update Golang runtime to 1.19.9


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.22-3.1
changelog:
  - update containerd binary to v1.6.22
  - update runc binary to v1.1.8
  - Update Golang runtime to 1.19.11


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.24-3.1
changelog:
  - update containerd binary to v1.6.24
  - update runc binary to v1.1.9
  - Update Golang runtime to 1.20.8


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.25-3.1
changelog:
  - update containerd binary to v1.6.25
  - update runc binary to v1.1.10
  - Update Golang runtime to 1.20.10


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.27-3.1
changelog:
  - update containerd binary to v1.6.27
  - update runc binary to v1.1.11
  - Update Golang runtime to 1.20.13


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.28-3.1
changelog:
  - update containerd binary to v1.6.28.
  - update runc binary to v1.1.12, which includes fixes for CVE-2024-21626.


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.4.13-3.1
changelog:
  - Update containerd to v1.4.13 to address CVE-2022-23648
  - Update runc to v1.0.3
  - Update Golang runtime to 1.16.15


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.7-3.1
changelog:
  - Update containerd to v1.6.7
  - Update runc to v1.1.3
  - Update Golang runtime to 1.17.13 to address CVE-2022-32189


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.33-3.1
changelog:
  - Update containerd binary to v1.6.33
  - Update Golang runtime to 1.21.11, which includes fixes for CVE-2024-24789, CVE-2024-24790.


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.7.19-3.1
changelog:
  - Update containerd binary to v1.7.19
  - Update Golang runtime to 1.21.12, which includes a fix for CVE-2024-24791.


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.7.22-3.1
changelog:
  - Update containerd binary to v1.7.22
  - Update runc binary to v1.1.14
  - Update Golang runtime to 1.22.7


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.7.24-3.1
changelog:
  - Update containerd binary to v1.7.24
  - Update systemd unit to start containerd service after dbus.service
  - Update runc binary to v1.2.2


author: Paweł Gronowski <pawel.gronowski@docker.com> - 1.7.25-3.1
changelog:
  - Update containerd binary to v1.7.25
  - Update runc binary to v1.2.4
  - Update the license fields to use the recommented SPDX identifier


author: Lokesh Mandvekar <lsm5@redhat.com> - 0.7.4-1
changelog:
  - Resolves: #1664009 - bump to v0.7.4
  - remove unused devel and unit-test* packages
  - update go build env


author: Jindrich Novy <jnovy@redhat.com> - 0.8.3-3
changelog:
  - fix "CVE-2020-10749 containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters"
  - Resolves: #1842334


author: Jindrich Novy <jnovy@redhat.com> - 0.8.6-2
changelog:
  - propagate proper CFLAGS to CGO_CFLAGS to assure code hardening and optimization
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1:1.0.1-2
changelog:
  - revert back to https://github.com/containernetworking/plugins/releases/tag/v1.0.1
  - Related: #2001445


author: Lokesh Mandvekar <lsm5@redhat.com> - 2:1-21
changelog:
  - do not specify infra_image in containers.conf
  - needed to resolve gating test failures
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.2-5
changelog:
  - use infra_image = registry.redhat.io/ubi8/pause in contiainers.conf
    (unlike previous one ubi8/pause doesn't require authentication)
  - Related: #1934947


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.2-6
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/e7880c4)
  - Related: #1938234


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.2-7
changelog:
  - update documentation and configs according to the current
    versions of vendored projects
  - Related: #1938234


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.3-1
changelog:
  - assure runc is set as default runtime in RHEL8
  - update shortnames from upstream
  - sync vendored component versions with upstream
  - Related: #1954702


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.2-9
changelog:
  - revert back to state of 3.0-8.4.0
  - sync shortnames with pyxis
  - improve shortnames
  - Related: #1954702


author: jmassaguerpla@suse.com
changelog:
  - Make cgroup-driver for kubelet be cgroupfs for SLE to be consistent
    with the cri-o configuration


author: Richard Brown <rbrown@suse.com>
changelog:
  - Add prevent-local-loopback-teardown-rh1754154.patch to stop local loopback interfaces being torndown before cluster is bootstrapped


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Removed the usage of `name_` variables to reduce the error
    proneness
  - Fixed systemd unit install locations for crio-wipe.service and
    crio-shutdown.service (bsc#1161056)


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Remove prevent-local-loopback-teardown-rh1754154.patch which is
    now included in upstream
  - Update to v1.17.0:
    * Major Changes
    - Allow CRI-O to manage IPC and UTS namespaces, in addition to
      Network
    - Add support for drop-in configuration files
    - Added image pull and network setup metrics
    - Image decryption support
    - Remove unneeded host_ip configuration value
    * Minor Changes
    - Setup container environment variables before user
    - Move default version file location to a tmpfs
    - Failures to stop the network will now cause a stop sandbox
      request to fail
    - Persist container exit codes across reboot
    - Add conmonmon: a conmon monitoring loop to protect against
      conmon being OOM'd
    - Add namespaces{-_}dir CLI and config option
    - Add disk usage for ListContainerStats
    - Introduce new runtime field to restrict devices in privileged
      mode


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Put default configuration in /etc/crio/crio.conf.d/00-default.conf
    in replacement for /etc/crio/crio.conf


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update to v1.17.1:
    * Drop conmonmon
    * Update docs and completions for crio wipe --force
    * wipe: Add a force flag for skipping version check
    * Restore sandbox selinux labels directly from config.json
    * klog: don't write to /tmp
    * Pass down the integer value of the stop signal
    * exec: Close pipe fds to prevent hangs
    * Unwrap errors from label.Relabel() before checking for ENOTSUP
    * oci: Handle timeouts correctly for probes


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update to version 1.18.3:
    - Fix a bug where a sudden reboot causes incomplete image writes.
      This could cause image storage to be corrupted, resulting in an
      error layer not known.
    - Fixed bug where pod names would sometimes leak on creation,
      causing the kubelet to fail to recreate
    - If conmon is v2.0.19 or greater, ExecSync requests will not
      double fork, causing systemd to have fewer conmons re-parented
      to it


author: Fabian Vogt <fvogt@suse.com>
changelog:
  - Suggest katacontainers instead of recommending it. It's not
    enabled by default, so it's just bloat


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - API Change
    - CRI-O now manages namespace lifecycles by default
  - Feature
    - Add --version-file-persist, a place to put the version file in
      persistent storage. Now, crio wipe wipes containers if
    - -version-file is not present
    - Add big_files_temporary_dir to allow customization of where
      large temporary files are put
    - Add build support for setting SOURCE_DATE_EPOCH
    - Added `--metrics-socket`/`metrics_socket` configuration option
      to allow exposing the metrics endpoint on a local socket path
    - Added `crio_image_layer_reuse` metric which counts layer reuses
      during image pull
    - Added `privileged` field to container status `info`
    - Added behavior to allow filtering by a partial Pod Sandbox ID
    - Added configuration validation to ensure a `conmon_cgroup ==
      "pod"` if `cgroup_manager == "cgroupfs"`
    - Added latest `crun` version to static binary bundle
    - Added metrics-exporter and [documentation]
    - Added new metrics `crio_image_pulls_failures` and
      `crio_image_pulls_successes`. For more information please refer
      to the [CRI-O metrics guide]
    - Container HostPort with SCTP protocol is supported.
    - Containers running `init` or `systemd` are now given a new
      selinux label `container_init_t`, giving it selinux privileges
      more appropriate for the workload
    - If users want the container_kvm_t label when using a runtime
      that supports kvm separation, they will need to either set the
      runtime_type to "vm" or have "kata" in the runtime name. E.g
      [crio.runtime.runtimes.my-kata-runtime]
      runtime_path = ""
      runtime_type = "oci"
      runtime_root = "/run/kata"
      or
      [crio.runtime.runtimes.my-kata-runtime]
      runtime_path = ""
      runtime_type = "vm"
      runtime_root = "/run/kata"
    - Re-add the behavior that string slices can be passed to the CLI
      comma separated, for example `--default-capabilities
      CHOWN,KILL`
    - Removed `socat` runtime dependency which was needed for pod
      port forwarding
    - Return pod image, pid and spec in sandbox_status CRI verbose
      mode
  - Design
    - Hooks_dir entries are now created if they don't exist
  - Documentation
    - Added `crun` container runtime to `crio.conf`
    - Added dependency report to generated release notes
    - The changelog is now rendered by a custom go template and
      contains the table of contents
  - Bug or Regression
    - Adding additional runtime handler doesn't require the user to
      copy existing default runtime handler configuration. The
      existing default runtime handler configuration will be
      preserved while adding the new runtime handler.
    - ExecSync requests will ask conmon to not double fork, causing
      systemd to have fewer conmons re-parented to it. conmon v2.0.19
      or greater is required for this feature.
    - Fix handling of the --cni-plugin-dir and other multivalue
      command line flags
    - Fix path to bash via `/usr/bin/env` in crio-shutdown.service
    - Fix the container cgroup in case cgroupfs cgroup manager is
      used
    - Fix working set calculation
    - Fixed `crio version` binary mode parsing on musl toolchains
    - Fixed a bug where crictl only showed pod level stats, not
      container level stats.
    - Fixed a bug where exec sync requests (manually or automatically
      triggered via readiness/liveness probes) overwrite the runtime
      `info.runtimeSpec.process.args` of the container status
    - Fixed bug where Pod creation would fail if Uid was not
      specified in Metadata of sandbox config passed in a run pod
      sandbox request
    - Fixed bug where pod names would sometimes leak on creation,
      causing the kubelet to fail to recreate
    - Fixed crio restart behavior to make sure that Pod creation
      timestamps are restored and the order in the list of pods stays
      stable across restarts
    - Fixed wrong linkmode output
    - Reflects resource updates under the container spec.
  - Other
    - Added info logs for image pulls and image status
    - Cleanup default info logging
    - Cleanup go module and vendor files.
    - Pod creation now fails if conmon cannot be moved to the cgroup
      specified in `conmon_cgroup`. Our default value for
      `conmon_cgroup` is `system.slice`, which is invalid for
      cgroupfs. As such, if you use cgroupfs, you should change
      `conmon_cgroup` to `pod`
    - Removed `crio-wipe.service` and `crio-shutdown.service` systemd
      units from the static bundle since they are not required
  - Uncategorized
    - Add `--drop-infra-ctr` option to ask CRI-O to drop the infra
      container when a pod level pid namespace isn't requested. This
      feature is considered experimental
    - Adds a new optional field, runtime_type, to the "--runtimes"
      option.
    - Cleanup and update nix derivation for static builds
    - Fix a bug where a sudden reboot causes incomplete image writes.
      This could cause image storage to be corrupted, resulting in an
      error `layer not known`.
    - Fix bug where empty config fields having to do with storage
      cause `/info` requests to return incorrect information
    - Fixes panic when /sys/fs/cgroup can't be stat'ed
    - If the default_runtime is changed from the default
      configuration, the corresponding existing default entry in the
      runtime map in the configuration will be ignored.
    - Remove support for `--runtime` flag
    - Updated `crictl.yaml` configuration inside the repository to
      reflect cri-tools v1.19.0 changes
  - Dependency-Change
    - Compile with go 1.15


author: rbrown@suse.com
changelog:
  - Update to version 1.19.1:
    * bump to v1.19.1
    * don't do unnecesary iptables restore
    * switch CRI-O to use its own hostport manager
    * dual-stack host port manager
    * fix upstream hostport manager
    * Add README to hostport folder
    * fork hosport kubernetes code
    * [1.19] vendor: bump containers/storage to v1.20.5
    * runtime_vm: Ensure closeIOChan is not nil inside CloseStdin's function
    * runtime: parse oom file for VM type runtimes
    * runtime_vm: Ignore ttrpc.ErrClosed when removing a container
    * runtime_vm: StopContainers() should not fail when the VM is shutdown
    * runtime_vm: Don't let wait() return ttrpc.ErrClosed
    * runtime_vm: Fix updateContainerStatus() logic
    * runtime_vm: set Pid and InitPid for VM runtimes
    * internal/config/node: add checkFsMayDetachMounts
    * Fix bogus CI test failures
    * test/config: fix shellcheck warning
    * test/config: fix "config dir should fail with invalid option"
    * server: cleanup container in runtime after failed creation


author: alexandre.vicenzi@suse.com
changelog:
  - Update to version 1.20.2:
    * bump to latest c/storage 1.24 branch
    * Remove check for CI env variable for release-notes and dependencies
    * fix lint
    * test: pin cri-tools to 1.20
    * bump to v1.20.2
    * Run GitHub actions on release branches
    * Pin gocapability to v0.0.0-20180916011248-d98352740cb2
    * [PATCH 9/9] add method comment
    * [PATCH 8/9] restore irqbalance config only on system restart
  - Add vendor.tar.gz to avoid dependency downloads
  - Add config-fix-tz.patch to fix crio validation error while building


author: alexandre.vicenzi@suse.com
changelog:
  - Update to version 1.21.0:
    * bump to v1.21.0
    * config: drop registries field as it is no longer supported
    * Revert "test: drop unneeded sed statement"
    * WIP: add debug print
    * test: drop unneeded sed statement
    * config: fix template insecure_registries field
    * config: drop commented config lines
    * build(deps): bump google.golang.org/grpc from 1.36.1 to 1.37.0
    * Bump OpenShift CI cri-tools version and fix build path
    * build(deps): bump github.com/containers/image/v5 from 5.10.5 to 5.11.0
    * Bump cri-tools to v1.21.0
    * Update Kubernetes to v1.21.0
    * Add container out of memory metrics
    * [CLI] "crio config" only prints the fields that are differet than the default.
    * Set short name mode to permissive
    * docs-validation: update to handle workloads
    * Fix unnecessary conversion lint report
    * add tests for workloads
    * integrate with server
    * config: update workloads structure
    * Clarify release cadence and version skew
    * Add correct start time to initial log output
    * Add support for workload settings
    * refactor handling of allowed_annotations
    * Do not push main binary into cachix cache
    * resourcestore: introduce ResourceCleaner
    * Use internal logging when context available
    * build(deps): bump github.com/coreos/go-systemd/v22 from 22.3.0 to 22.3.1
    * server: remove dead code
    * sandbox: use defined CRI type for NamespaceOption
    * config: remove dead code
    * oci: remove dead code
    * lib: remove dead code
    * build(deps): bump github.com/containers/podman/v3
    * build(deps): bump k8s.io/client-go from 0.20.1 to 0.20.5
    * update pause image to 3.5 for non-root
    * build(deps): bump github.com/soheilhy/cmux from 0.1.4 to 0.1.5
    * build(deps): bump google.golang.org/grpc from 1.34.0 to 1.36.1
    * build(deps): bump github.com/containers/buildah from 1.19.8 to 1.20.0
    * build(deps): bump github.com/prometheus/client_golang
    * build(deps): bump github.com/godbus/dbus/v5 from 5.0.3 to 5.0.4
    * build(deps): bump k8s.io/cri-api from 0.20.1 to 0.20.5
    * build(deps): bump github.com/containers/podman/v3
    * build(deps): bump k8s.io/kubernetes from 1.13.0 to 1.20.5
    * crio-wipe: only clear storage if CleanShutdownFile is supported
    * Add static bundle node e2e tests to GitHub actions
    * Reload the main config file when reloading configs
    * crio wipe: only completely wipe storage after a reboot
    * Bump static binary dependency versions
    * Add dependabot config file
    * runtimeVM: Fix shimv2 binary name construction
    * config,runtimeVM: Improve runtime_path validation
    * oci_test: Add basic coverage to "RuntimeType()"
    * oci_test: Add basic coverage to "privileged_without_host_devices"
    * oci_test: Leave invalidRuntime on its own line
    * tweak scope dependencies
    * Do not return `<none>` placeholders for images any more
    * Fix invalid libcontainer GetExecUser call
    * Update dependencies
    * config: Don't fail if the non default runtime doesn't pass validation
    * Remove check for CI env variable for release-notes and dependencies
    * cgmgr: add CreateSandboxCgroup method
    * inspect: send container PID for dropped infra sandbox
    * oci: specify sbox id when creating spoofed container
    * Run GitHub actions on release branches
    * Update bats to v1.3.0 (#4661)
    * use happy-eyeballs for port-forwarding
    * fix mock issues
    * fix lint issues
    * install: drop support matrix and update instructions
    * do not store context in runtime vm
    * Fix lint GitHub action
    * pkg/container: take process args
    * Use and publish version marker for CRI-O
    * Add GitHub API pages support to `get` script
    * add libbtrfs-dev to unit tests
    * Revert "server: use IsAlive() more"
    * Fix GitHub actions cache key
    * Bug 1881694: Add pull source as info level log
    * test: use latest conmon
    * runtime_vm: Create the global fifo inside the runtime root path
    * stats: fix log spam
    * Support CRI seccomp security profiles
    * oci: add unit tests for stop timeouts
    * oci: don't update stop timeout if it's earlier than old one
    * oci: update timeout even if we're ignoring kill
    * oci: don't wait too long on a long stop
    * oci: check process is still around with kill
    * Add integration test for started/finished container time
    * fix: Don't set `image-endpoint` in crictl config
    * feat: Add CLI option to set registries.conf.d path
    * Add allowed io.containers.trace-syscall annotation to static bundle
    * Make `get` script independent from `make`
    * test: correct the env variable for dropping the infra container
    * Add metric to grab latency of individual cri calls
    * Fix `get` script commit SHA retrieval
    * Add arm64 static build to GitHub actions
    * Fix GitHub actions workflow syntax
    * Updates yq commnands for yq v4
    * gh-actions:  also run on release branches
    * pkg/sandbox: add InitInfraContainer endpoint
    * test: reconfigure how runtimes are passed in
    * test: add runtime() function
    * sandbox/container: drop context
    * test: drop workaround for crun
    * pkg/sandbox: cleanup unused funcs/files
    * fix doc log_level adding trace option
    * Fix oci container update config
    * Update e2e-aws logic for 4.8
    * nsmgr: take Initalize method
    * Switch to go 1.16 for GitHub actions and remove scripts/build-test-image
    * config: remove and create the correct dir
    * Update nix pin with `make nixpkgs`
    * server: mount cgroup with rslave
    * crio wipe: ensure a clean shutdown
    * Move integration tests to GitHub actions
    * Run release-notes GitHub action after dependencies
    * Bumps github.com/containers/ocicrypt from 1.0.3 to 1.1.0.
    * config/node: refactor checking for CollectMode
    * Fix GitHub actions checkout permissions
    * change binary version to 1.21.0-dev
    * Set conmon scope KillSignal to SIGPIPE
    * Move repo modification jobs to GitHub actions
    * bump protobuf to 1.3.2
    * Log container stop timeout
    * ResourceStore: add close method
    * Allow seccomp hook tracing for separate containers
    * ResourceStore: extend tests to test WatcherForResource
    * ResourceStore: update tests to all run
    * ResourceStore: update docs for WatcherForResource
    * ResourceStore: don't segfault
    * server: support setting raw unified cgroupv2 settings
    * vendor: update runtime-specs
    * cgroup: implement fix for swap memcg on cgroup v2
    * server: leave swap mem limit unset if not supported
    * test: skip ServiceAccountIssuerDiscovery test
    * hostport manager clean up host ports
    * allows stream timeout to be set from config
    * config: pre-create pinns directories
    * Bump containers image to v5.10.1
    * Move unit tests to GitHub actions
    * Move go1.14 and 386 builds to GitHub actions
    * set kubelet node IP
    * Fix validate-completions GitHub action
    * Add integration test for pprof over unix socket
    * Add a flag for enabling profile over unix socket
    * Lookup echo command for unit tests
    * Move static build to GitHub actions
    * pinns: Fixup 'pwarn' output to match 'pwarnf' output
    * pinns: Don't put errno in the exit message for argument checks
    * nsmgr: use host option
    * nsmgr: Use config struct for NewPodNamespaces
    * pinns: support pinning host ns
    * Remove implicit GitHub action `name` fields
    * Move docs and completions validation to GitHub actions
    * Bump golangci-lint to v1.35.2
    * Make config tests work rootless
    * Make rootless namespace unit test execution work
    * config: fix template to show infra_ctr_cpus option
    * Do not log file path on ioutil.ReadFile
    * fixes version_test.go
    * Close the stdin/tty on server start to avoid shortname prompts
    * docs: fix http link
    * docs: update kubeadm tutorial
    * Fix `make lint`
    * Return runtime API version based on protocol
    * Update compatibility matrix to mention v1.20
    * add method comment
    * restore irqbalance config only on system restart
    * add blurb in doc and more informative name for unit tests
    * add is-enabled check for irqbalance service
    * fix unit tests
    * add unit tests
    * fix bash/zsh completions
    * fix the docs validation
    * handle irqbalance service
    * runtime_vm: set finished time when containers stop
    * nsmgr: fix/add calls to GetNamespace
    * managed namespaces: move to dedicated package
    * Provide integration test for infra-ctr-cpuset feature
    * Set CPUs for the infra containers during the creation
    * Add shell completion for infra-containers-cpu flag
    * Add new infra-containers-cpus to the CLI and config file
    * refine `registries` deprecation message
    * Circle CI: install test/registries.conf
    * crio.8.md: runroot defaults to /run/containers/storage
    * support short-name aliases
    * pull: do check for blocked registries
    * config: deprecate registries
    * Rollback gocapability vendor bump
    * vendor: bump containers/storage to v1.24.4
    * Update nix pin with `make nixpkgs`
    * contrib/test/int: add Kata Containers runtime support
    * contrib/test/int: enforce linking in parallel build process
    * contrib/test/int: build parallel from sources in CentOS
    * contrib/test/int: allow to skip user namespace testing
    * contrib/test/int: allow to configure test timeout
    * Capitalize Kubernetes
    * modify the error url of podctl
    * Add Digital Science to adopters
    * crio.service: Request to be run before kubelet.service
    * pinns: make binary not always static
    * server: use IsAlive() more
    * Support CRI v1 and v1alpha2 at the same time
    * drop support for ManageNSLifecycle
    * test/timeout.bats: increase timeout to fix flakes
    * release-notes: fix flags
    * test/timeout.bats: fix comments
    * int/resourcestore: fix comment about Put
    * test/image.bats: simplify some loops
    * test/helpers.bats: simplify cleanup_*
    * contrib/test/int: rm node-e2e test
    * contrib/test/int: fix iptables rule
    * critest: add unix:// prefix
    * critest.yml: don't skip test on RHEL
    * test: add timeout.bats
    * bump network creation timeout to 5 minutes
    * resourcecache: add watcher idiom
    * server: use ResourceCache instead of dropping progress
    * Add unit tests for ResourceCache
    * Introduce ResourceCache
    * moves shmsize to a handler allowed annotation
    * image pull: close progress chan
    * test/ctr.bats: fix a "ctr execsync" flake
    * Fix the functions' name in completions
    * make: drop link to crio.service
    * test: rm "run ctr with image with Config.Volumes"
    * test: add no-pull-on-run=true
    * test/devices.bats: fix "additional device permissions" case
    * test/devices.bats: rm unneeded run
    * test/devices.bats: skip earlier
    * Bandwidht CNI plugin reserved an upper limit on burst,in which banned include boundary. See: https://github.com/containernetworking/plugins/blob/v0.8.7/plugins/meta/bandwidth/main.go#L113
  - Drop config-fix-tz.patch as upstream dependency was patched


author: alexandre.vicenzi@suse.com
changelog:
  - Update to version 1.21.2:
    * oci: be more precise about channels and routines
    * oci: wait for runtime to write pidfile before starting timer
    * oci: refactor fsnotify usage
    * vendor: add notify package
    * version: bump to v1.21.2
    * server: use cnimgr to wait for cni plugin ready before creating a pod
    * server: use cnimgr for runtime status
    * config: add cnimgr
    * Introduce cnimgr
    * server: prevent segfault by not using a potentially nil sandbox
    * network: pass pod UID to ocicni when performing network operations
    * vendor: bump ocicni to 4ea5fb8752cfe
    * Bump c/storage to v1.32.3
    * oci: kill runtime process on exec if exec pid isn't written yet
    * oci: don't pre-create pid file
    * dbus: update retryondisconnect to handle eagain too
    * simplify checking for dbus error
    * utils: close dbus conn channel
    * dbusmgr: protect against races in NewDbusConnManager
    * cgmgr: reuse dbus connection
    * cgmgr: create systemd manager constructor
    * try again on EAGAIN from dbus
    * test: fix cgroupfs workload tests
    * Disable short name mode
    * workloads: don't set conmon cpuset if systemd doesn't support AllowedCPUs
    * test: add test for conmon in workloads
    * workloads: setup on conmon cgroup
    * Bump runc to get public RangeToBits function
    * server: export InfraName and drop references to leaky
    * storage: succeed in DeleteContainer if container is unknown
    * bump to v1.21.1
    * Fix CI
    * oci: drop internal ExecSync structs
    * oci: do not use conmon for exec sync
    * bump c/storage to 1.31.1
    * bump runc to 1.0.0-rc94
    * Fix unit tests
    * Add support to drop ALL and add back few capabilities
    * server: call CNI del in separate routine in restore
    * server: reduce log verbosity on restore
    * reduce listen socket permissions to 0660
    * test: adapt crio wipe tests to handle new behavior
    * ignore storage.ErrNotAContainer
    * move internal wipe to only wipe images
    * server: properly remove sandbox network on failed restore
    * runtimeVM: Use internal context to ensure goroutines are stopped
    * Fix go.sum
    * sandbox remove: unmount shm before removing infra container
    * use more ContainerServer.StopContainer
    * sandbox: fix race with cleanup
    * server: don't unconditionally fail on sandbox cleanup
    * server: group namespace cleanup with network stop
    * resourcestore: run cleanup in parallel
    * test: add test for delayed cleanup of network on restart
    * InternalWipe: retry on failures
    * server: get hooks after we've check if a sandbox is already stopped
    * server: move newPodNetwork to a more logical place
    * Add resource cleaner retry functionality
    * test: add test for internal_wipe
    * server: add support for internal_wipe
    * crio wipe: add support for internal_wipe
    * config: add InternalWipe
    * server: breakup stop/remove all functions with internal helpers
    * storage: remove RemovePodSandbox function
    * server: reuse container removal code for infra
    * Cleanup pod network on sandbox removal
    * test: add test for absent_mount_sources_to_reject
    * server: add support for absent_mount_sources_to_reject
    * config: add absent_mount_sources_to_reject option
    * server: use background context for network stop
    * resource store: prevent segfault on cleanup step
    * Pin gocapability to v0.0.0-20180916011248-d98352740cb2
    * config: fix type of privileged_without_host_devices
    * Fix podman name in README
    * Fix RuntimeDefault seccomp behavior if disabled
    * Add After=crio.service dependency to containers and conmon
    * Use extra context for runtime VM
    * workloads: move to more concrete type
    * workloads: update how overrides are specified
    * main: still rely on logrus (rather than using the internal log)
    * container server: fix silly typo
    * nsmgr: remove duplicate IsNSOrErr call
    * nsmgr: fix some leaks with GetNamespace
    * bump to containers/image 5.11.1
    * Bug 1942608: do not list the image with error locating manifest
    * runtimeVM: Calculate the WorkingSetBytes stats
    * runtimeVM: Use containerd/cgroups for metrics
    * runtimeVM: Move metricsToCtrStats() around
    * runtimeVM: Vendor typeurl instead of maintain our own copy


author: alexandre.vicenzi@suse.com
changelog:
  - Update to version 1.22.0:
      Dependency-Change
    * Update runc within static binary bundle to v1.0.1
    * Update static binary bundle runc version to v1.0.0-rc94.
    * Update static binary bundle runc version to v1.0.0-rc95.
    * Updated crun in static binary bundle to v0.20.1
      Deprecation
    * The internal_wipe option is now true by default.
      Further, it is being deprecated, and will be unconditionally true in the future.
      API Change
    * Update how the resources for a workload is specified. Now, to override a workload,
      the pod must have the annotation $prefix/$ctr_name = {"$resource_type": "$resource_value"}.
      The workloads feature has also been marked as experimental, which should have happened
      from the beginning.
      Feature
    * Added --metrics-collectors/metrics_collectors configuration to enable or disable certain metrics.
    * All metrics collectors are enabled per default.
    * Added crio_image_pulls_layer_size histogram metric to get insights about all pulled layer sizes.
    * Added build tags as well as AppArmor and seccomp status to crio version output.
    * Added generation of self-signed certificates for the secure metrics endpoint
    * if the provided cert and key paths are not available on disk.
    * Added secure metrics endpoint configuration options
    * Added structural logging of container ID, sandbox ID and process ID on container start.
    * Automatically reload metrics TLS certificate and key if any of those specified files change.
    * CNI plugins are now passed a K8S_POD_UID environment variable containing the pod UID
      this sandbox was started for.
    * Changed the logging behavior of klog messages to be included in the CRI-O logs.
    * The klog info verbositry is converted to CRI-O debug to lower the log verbosity.
    * Cri-o now does not limit the DNS search paths.
    * Enable the "volatile" option for the overlay drivers when it is supported by the underlying kernel.
    * Rootless: enable resource limit when cgroup v2 controllers are delegated.
    * Support io.kubernetes.cri.blockio-class container annotation for specifying blockio class.
    * Support blockio.resources.beta.kubernetes.io/pod pod annotation for specifying the default blockio
      class to all containers in the pod.
    * Support blockio.resources.beta.kubernetes.io/container.NAME pod annotation for specifying
      the blockio class of the NAME container in the pod.
    * Add blockio_config_file config file option (and corresponding --blockio-config-file for command line)
      for configuring blockio classes and their cgroups blockio controller parameters.
    * Support io.kubernetes.cri.rdt-class container annotation for specifying RDT class.
    * Add rdt_config_file config file option (and corresponding --rdt-config-file for command line)
      for configuring the resctrl pseudo-filesystem.
    * The config field drop_infra_ctr is now true by default
    * The runtime_config_path option, which allows to specify the path of the runtime configuration file,
      is now supported by CRI-O. This is specific to the VM runtime type.
    * Validate certificate dates for TLS metrics endpoint
      Design
    * Drop support for the crio.shutdown.
    * ExecSync requests now don't use conmon, instead calling the runtime directly, which reduces overhead.
      Bug or Regression
    * Add support for absent_mount_sources_to_reject, which allows admins to configure paths that,
      when mounted into a container despite not existing on the host, causes a container creation
      request to fail. This is useful for paths like /etc/hostname, which causes trouble as a directory,
      but possibly shouldn't be created as a file either (in the case of a dynamic hostname).
    * Add symlink /proc/mounts on /etc/mtab to container
    * Add the config field internal_wipe which moves the responsibility of wiping containers after a reboot
      and images after an upgrade from the external binary crio wipe to the main crio server.
      This has a handful of advantages, the main one being crio is now better able to cleanup CNI resources after a reboot.
    * Allow users to customize conmon's resources if a pod is in a workload.
    * CRI-O now logs when it is using cgroupv2
    * Fix a bug in internal_wipe that would mean CNI resources would be leaked across reboots.
    * Fix a bug where CRI-O can't work with runc 1.0.0-rc93 because of an incorrectly specified list of capabilities
    * Fix a bug where CRI-O would leak opened files for namespaces on a server restore
    * Fix a bug where crio config would print a string for privileged_without_host_devices, not a boolean
    * Fix a bug where a container exec process received a little less time than the timeout provided
    * Fix a bug where an exec sync timeout would fail to cleanup the runtime exec process
    * Fix a bug where cAdvisor couldn't read the disk usage of a pod with a dropped infra container
    * Fix a bug where duplicate requests would stall even if the pod or container was already created
    * Fix a bug where server startup was significantly slowed down by attempting to clean up CNI resources after a reboot.
    * Fix a performance regression with exec probes
    * Fix a segfault when CRI-O has takes more than 8 minutes to create a pod or container
    * Fix an RSS regression with exec sync requests
    * Fix an issue where a container started with a terminal fails on exec sync calls
    * Fix drop ALL and add back few caps behavior to not include the default configured capabilities
    * Fix potential panic when reopening a container's log
    * Fixed bug where it was not possible to run containers using the default or no seccomp profile on
    * seccomp disabled builds/machines
    * Fixed bug where runtime VM created containers never reach their completed state.
    * Fixed linkmode detection for on en_US systems crio version
    * Fixed runtime panic for layers lockfile if its parent directory does not exist.
    * Added support for repositories in auth.json
    * Re-attempt setting up conmon's cgroup if it fails on EAGAIN from dbus
    * Reduce the permission on the listen socket to 0660
    * Reuse connection when connecting to dbus, as well as reattempt the connection if it fails temporarily
    * The privileged_without_host_devices flag can now be given a an additional parameter to configure a runtime
    * Wait for CNI plugins to be ready before starting non-host-network pods, to allow pods that may run CNI
      plugins to start faster
      Other (Cleanup or Flake)
    * Add systemd After=crio.service to containers and conmon
    * Switched build artifacts to be published via the cri-o bucket.
    * Use build tag for linkmode detection on crio version.
      Uncategorized
    * Add Particule as adopters
    * Add --device-ownership-from-security-context which allows an admin to specify devices be configured
      to be owned by the container user and group, rather than unconditionally *   being root.
    * Added internal/process/defunct_processes.go and crio_processes_defunct metric to collect
      the total number of defunct/zombie processes in a node.
    * Raise a warning when creating a bind mount on the container root


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update cri-tools to v1.13.0:
    * CRI CLI (crictl):
    * Adds --auth options for pull command
    * Fixes URL parsing for exec and attach
    * Upgrades Go version to 1.11.1
    * Enables Windows CI on travis
    * Switches Windows default endpoints to npipe
    * Updates version matrix information for the project
    * Adds container name filter to ps command
    * Adds metadata to filters
    * Prints annotations and labels for inspect command
    * CRI validation testing (critest)
    * Add tests for multiple containers in a pod
    * Adds runtime handler support for critest
    * Adds exec sync timeout test cases
    * Fixes readonly filesystem test cases
  - Add `crictl.yaml` to install directory
  - Fix build for ppc64
  - Require golang >= 1.11


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update cri-tools to v1.14.0:
    * CRI CLI (crictl)
    * Adds imagefsinfo subcommand for CRI ImageFSInfo() method.
    * Adds support to filter containers by image.
    * Fixes a bug when removing multiple containers.
    * Reduces the default connection timeout value.
    * Fixes the exit code for crictl exec.
    * Updated the instructions fro godep.
    * Adds support of -q for crictl info.
    * Adds support of zsh completion.
    * Upgrades kubernetes version to 1.14.
    * CRI validation testing (critest)
    * Adds a benchmark testcase for measuring the time of creating pod and a
      container.
    * Changes streaming tests to omit newlines on echo
    * Adds support of critest for Windows container runtime.
    * Updates test environment to xenial and fixes docker installation.
    * Updates Go version to 1.12.


author: Michal Jura <mjura@suse.com>
changelog:
  - Update cri-tools to v1.15.0:
    * Add registry prefix option
    * Revert "Skip test "image status should support all kinds of references" for docker runtime"
    * Upgrade Kuberntes version to v1.15.0
    * Fix typo in parallel
    * Skip test "image status should support all kinds of references" since dockershim doesn't support it
    * Fallback to repo digest name if repoTag is <none>:<none>
    * feature: add display; support live monitoring critool stats
    * Test image status for various references.
    * fix debug in config file
    * Update `rmp` to test for running sandbox
    * Fix logDirectory typo in examples.
    * Search program directory for config as fallback
    * Improve error message for failed to connect
    * Set SelinuxRelabel to true for bind mounts
    * Include gcs bucket release.
    * Use same version as previous example
    * Add `curl` to download example


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update to v1.16.0:
    * crictl:
    * Add container 'run' subcommand.
    * Pull image on container creation.
    * Treat first crictl stats argument as filter ID.
    * Add -a (remove all) option to rmp.
    * Create directory for config file.
    * Add container rm --force, -f and --all, -a flags.
    * Add images aliases image, img.
    * Add --all, -a flag to image removal (rmi).
    * Update Kubernetes vendors to 1.16.0 and add addiontion IPs for Pods.
    * critest:
    * Add registry prefix option.
    * Add test for MaskedPaths and ReadonlyPaths.
    * Switch to multi-arch nonewprivs image.
    * Use arch specific hostnet-nginx image.
    * Use a dedicated image for all reference test.
    * Use IsAppArmorEnabled of Kubernetes instead of local one.
    * Fix exec test timeout issues.


author: Richard Brown <rbrown@suse.com>
changelog:
  - Update to v1.16.1:
    * crictl:
    * Fix empty fields in crictl inspect(p/i) result.
    * Pass pod config when pulling image during container creation.
    * Fix crictl stats panic.
    * critest
    * Skip hostnetwork portforward test on windows.
    * Add hostname test.


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update to v1.17.0:
    * crictl
    * Bump cri-tools version in markdown docs
    * Vendor kubernetes v1.17.0
    * Update golang dependencies
    * Print the previous log of the container(just like kubectl)
    * Add rmi --prune command
    * Update README.md to contain latest version hint
    * Download golangci-lint via wget
    * Fix pod and container name filter for JSON/YAML output
    * Fix e2e tests by pinning CRI-O and conmon
    * Fixed Tim St. Clair's username
    * Add fish shell completion support


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update to v1.18.0:
    * Main Changes
    * Update Kubernetes to v1.18.0
    * Switch to urfave/cli/v2
    * CRI CLI (crictl)
    * Use ContextDialer to fix build
    * Add go-template option for inspect commands
    * Fix invalid log_path in docs
    * CRI validation testing (critest)
    * Make apparmor failure test more flexible
    * Start container before fetching metrics
    * Cleanup container create test to reduce duplication
    * Add container stats test


author: Stephen Augustus <saugustus@vmware.com> - 1.15.1
changelog:
  - Source cri-tools from https://github.com/kubernetes-sigs/cri-tools
    instead of https://github.com/kubernetes-incubator/cri-tools


author: Stephen Augustus <saugustus@vmware.com> - 1.15.1
changelog:
  - Bump minimum versions of all kubernetes dependencies
  - Remove conditional logic for unsupported versions of Kubernetes


author: Stephen Augustus <saugustus@vmware.com> - 1.18.4
changelog:
  - Source CNI plugins from https://storage.googleapis.com/k8s-artifacts-cni/release
    instead of https://dl.k8s.io/network-plugins


author: Stephen Augustus <saugustus@vmware.com> - 1.18.4
changelog:
  - Source cri-tools from https://storage.googleapis.com/k8s-artifacts-cri-tools/release
    instead of https://github.com/kubernetes-sigs/cri-tools


author: Adrian Reber <adrian@lisas.de> - 3.12-0.1
changelog:
  - Updated to 3.12 (pre-release)
  - Create libs subpackage
  - Build against SELinux (Fedora and RHEL8)
  - Build against libbsd (Fedora)


author: Jindrich Novy <jnovy@redhat.com> - 3.15-3
changelog:
  - add Requires: criu-libs = %{version}-%{release} in criu-devel
  - add gating tests
  - Related: #1934415


author: tiwai@suse.de
changelog:
  - Update to criu 3.13:
    New features:
    * VDSO: arm32 support
    * Add TLS support for page server communications
    * "Ignore" mode for --manage-cgroups
    * Restore SO_BROADCAST option for inet sockets
    Bugfixes:
    * Auxiliary events were left in inotify queues
    * Lazy-pages daemon didn't detect stack pages and surrounders
      properly and marked them as "lazy"
    * Memory and resource leakage were detected by coverity, cppcheck
      and clang
    Improvements:
    * Use gettimeofday() directly from vdso for restore timings
    * Reformat all .py code into pep8 style


author: Guillaume GARDET <guillaume.gardet@opensuse.org>
changelog:
  - Disable LTO on aarch64 and armv7
  - Add '-Wno-error=deprecated' to fix build on armv7
  - Exclude armv6 since criu/arch/arm/bitops.S uses 'dmb ish' which
    is armv7+


author: tiwai@suse.de
changelog:
  - Update to criu 3.14:
    New features:
    * C/R of memfd memory mappings and file descriptors
    * Add time namespace support
    * Add the read pre-dump mode which uses process_vm_readv
    * Add --cgroup-yard option
    * Add support of the cgroup v2 freezer
    * Add support of opened O_PATH fds
    Bugfixes:
    * Fix C/R ia32 processes on AMD #398
    * Fix cross-compilation
    * Many fixes here and there
    Improvements:
    * Use clone3() with set_tid to restore processes
    * Clean up compel headers
    * Use the new mount API
  - Add libgnutls-devel to buildreq


author: tiwai@suse.de
changelog:
  - Update to criu 3.15:
    see details at https://criu.org/Download/criu/3.15
    New features:
    * Introduced criu-image-streamer
    * Added MIPS support
    * Allow checkpointing out of existing PID namespace and restoring
      into existing PID namespace
    * Added additional file validation mechanisms
    * Added support to checkpoint and restore BPF hash maps
    (BPF_MAP_TYPE_HASH) and array maps (BPF_MAP_TYPE_ARRAY)
    * Initial cgroups v2 support
  - Fix build with nftables package:
    0002-Fix-build-with-nftables-installed-in-different-direc.patch


author: tiwai@suse.de
changelog:
  - Update to criu 3.16:
    see details at https://criu.org/Download/criu/3.16
    New features:
    * criu-ns helper script
    * support checkpoint/restore of stacked apparmor profiles
    * add nftables based network locking/unlocking
    * allow restoring of precreated veth devices
    Improvements:
    * better support for restoring containers into existing pods
    * pidfd based pid reuse detection for RPC clients
    * license change for all files in the images/ directory to MIT
    * use clang-format for automatic code indentation
  - Drop criu-protobuf-c-1.4-underscore-fix.patch
    as obsoleted


author: tiwai@suse.de
changelog:
  - Update to criu 3.16.1:
    see details at https://criu.org/Download/criu/3.16.1
    Bugfixes:
    * Switch criu-ns helper script from unversioned 'python' to
      'python3' for easier distribution packaging
    Improvements:
    * Add '--join-ns' interface to libcriu to allow joining namespaces
      via libcriu like CLI and RPC already allow
  - Change Source URL to github


author: tiwai@suse.de
changelog:
  - update to criu 3.1:
    New features:
    * Each boolean option now has the --no-$option pair
    * RSS explorer in CRIT
    * Multiple plugins in compel
    * Run-time check of 32-mmap BUG on x86
    * C/R of 32-bit futex robust list on x86
    Optimizations/improvements:
    * Start time is improved significantly with kerndat cache
    * Sigaction image is merged into Core
    * Unneeded stages are skipped during restore
    * Restore w/o namespaces uses host /proc
    * Restore w/o namespaces doesn't parse host mounts (not needed)
    * Single-threaded tasks do not parse /proc/pid/task/ in vain
    * BFD engine is used for more /proc files
    * More verbosity in libsoccr
    * Fsnotify dump w/o namespaces doesn't walk mounts tree
    Bugfixes:
    * Python bindings left zombie in self-dump mode
    * The last_pid sys-control was reset by restore
    * Threads caps were compared with mistake
    * make install put crit/pycriu to wrong place if DESTDIR was not set
    * Fsnotifies C/R w/o namespaces restored with errors
    * Inherited control terminal restore was failed (but dump succeeded)
  - update to criu 3.2:
    Optimizations/improvements:
    * Invisible files restore is de-serialized
    * VMAs restore performance is improved significantly
    - Mappings of the same file re-use the descriptor, not re-open it
      every time
    - Not-COW-ed mappings are restored in-place and are not mremmap()ed
    - Empty RO mappings are mmap()ed as such and thus not re-mprotect()ed
      at the end
    * More verbosity in case TCP locking fails (#292)
    * More verbosity in case VDSO magic mismatch
    * Restore or legacy epoll target descriptors and fsnotify marks is
      unified with common case
    Bugfixes:
    * Restoring fanotify marks from old images (<1.3) dropped the mark
    * Binfmt_misc mount could be mounted into wrong place
    * Compilation failed with gcc 6.3.0 (#315)
    * Waiting helpers could race with sigchild handler and would result
      in restore failure
    * Missing VVAR page in 32bit tasks wasn't skipped and resulted in
      restore failure
    * After restore consumption of files is increased (was fixed as
      side effect of mmap optimization)
    Deprecation/Removal:
    * Deprecated separate images for fsnotify marks
  - Fix the installation of python stuff:
    criu-py-install-fix.diff
  - Fix the build for ppc64:
    criu-correct-ppc64-AT_VECTOR_SIZE_ARCH.patch


author: tiwai@suse.de
changelog:
  - update to criu 3.2.1: bug fix release,
    * Restoring a stack fails on recent kernels due to kernel changes
    * Restoring on a host with LSM profiles failed


author: bwiedemann@suse.com
changelog:
  - update to criu 3.3
    * Add --tcp-close option to help migration of Docker containers
    * Allow to override build time to fix build-compare (boo#1047218)


author: tiwai@suse.de
changelog:
  - update to criu 3.4:
    New features:
    * Support for s390x architecture
    Improvements:
    * Unexpected death of restored tasks is reported with more
      details in logs
    * Merged many images containing info about files into one big
      files.img
    * When helper utility fails (ip, iptables, tar) its name is
      printed in logs
    Bugfixes:
    * Compilation failed on newer glibcs (ucontext_t)
    * Dying helper task could deadlock the restore process
    * Install-related makefile variables weren't configurable for
      distro build
    * SIT (ipv6-to-v4 tunnel) presence on host blocked dump of any
      containers
    * Potential NULL dereference when dumping net namespace
    * Dump via page server might not work across different criu
      versions
    * Failure to restore a subtask could be ignored by the restore
      command
    * EOF on page-server socket wasn't handled
  - Dropped obsoleted patch:
    criu-correct-ppc64-AT_VECTOR_SIZE_ARCH.patch
  - Add s390x to exclusivearch


author: aavindraa@gmail.com
changelog:
  - update to criu 3.6:
    New features
    * C/R for files (except for unix sockets, ttys and epolls) sent
      over unix sockets
    * C/R for threads with different creds
    * Ipv6 over ipv4 tunnel (SIT device)
    Bugfixes
    * Some s390x registers were not restored by native sigrestore way
    * Overflow when parsing autofs info from /proc file
    * Dumps of anon shared memory with sysvipc one raced with each
      other clashing and corrupting image file names
    * The "dumpable" flag was not restore on shmem regions
    * Trash bits leaked into image when dumping fsnotify on some
      kernels
    * Lock/unlock of iptables from different criu processes raced with
      each other
    * Closed TCP connection with non-empty send queue blocked the dump
    * When --empty-ns for netns was set on dump only, the restore
      failed (Docker case)
  - includes changes from 3.5:
    see https://criu.org/Download/criu/3.5 for details


author: aavindraa@gmail.com
changelog:
  - add 0001-images.py-remove-shebang.patch
    * fixes a lint warning about a non-executable python file being
      executable due to a superfluous shebang
    * upstream: https://lists.openvz.org/pipermail/criu/2017-November/039907.html
  - run spec-cleaner


author: avindra@opensuse.org
changelog:
  - update to criu 3.7:
    New features
    * Pipes usage statistics
    * Run page server as non-daemon via RPC
    * C/R of
    - SO_REUSEPORT option
    - IPv4-mapped inet sockets
    - Net_prio CGroups
    - Overmounted shared mountpoints
    - Non-broken and breaking leases
    Improvements
    * Show criu and kernel versions in logs
    * CRIT decodes socket families, protocols and types
    * Much less pipes is needed for pre-dump, which is especially
      useful for big mem migration
    Bugfixes
    * Files in /proc/pid/map_file could be opened by non-exiting
      name (with 0x prefix) and it was fixed in kernel
    * CRIU log levels were used to configure logging for libsoccr
      thus breaking its logs
    * Overflow in various IDs caused bad image names
    * Compat (32bit) syscalls lost signedness in compel
    * Corked sockets lost cork flag
    * Preadv() syscall was declared with error which resulted in
      dump errors on 32-bit processors
    * Musl compilation failed
    * Ghost files in / dump failed
    * Crash when releasing context for ghost files, due to free()-ing
      shmalloc()-ed area
    * Lazy restore could receive partial page and crashed
    * Erroneous closing of lazy pages connection caused restore to
      hang
    * Lazy memory fetch restore could start before tasks are restored
  - Remove 0001-images.py-remove-shebang.patch
    * upstreamed in 8e45ce4905d186abafb7c20abb3b00207fefdb53


author: avindra@opensuse.org
changelog:
  - update to criu 3.8:
    New features
    * C/R of
    - Multiple network namespaces
    - Overmounted tmpfs mounts
    - Unix sockets and epoll descriptors in SCM messages
    Improvements
    * Rework service descriptors not to cause fdtable enormous grows
    Bugfixes
    * FP state wasn't reported on Skylake due to a kernel bug
    * gcc 8 warning fixes
    * Resource leaked on error paths
    * Attributes of sit devices with value 0 were not saved into
      images (and were restored into default values)
    * Tasks with pgid of a zombie hung the resture
    * Ghost files on RO bind-mounts of an RW mount couldn't be
      restored
    * Random memory corruptions during lazy restore
  - cleanup with spec-cleaner
  - switch to https urls
  - list binaries and man pages explicitly
  - remove rest of static libs to fix rpm lint errors


author: tiwai@suse.de
changelog:
  - Add python-devel to BuildReq explicitly, as a preparation for
    fallback to asciidoctor (bsc#1075764)


author: tiwai@suse.de
changelog:
  - update to criu 3.8.1: a bug-fix release
    FDstore was initialized twice (re-initialized) causing e.g.
    - -shell-job restore to fail


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Update to Docker 19.03.0-ce. See upstream changelog in the packaged
    /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1142413
  - Remove upstreamed patches:
    - bsc1001161-0001-oci-include-the-domainname-in-kernel.domainname.patch
    - bsc1001161-0002-cli-add-a-separate-domainname-flag.patch
    - bsc1047218-0001-man-obey-SOURCE_DATE_EPOCH-when-generating-man-pages.patch
    - bsc1128746-0001-integration-cli-don-t-build-test-images-if-they-alre.patch
  - Rebase pacthes:
    * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
    * packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
    * private-registry-0001-Add-private-registry-mirror-support.patch
    * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
    * secrets-0002-SUSE-implement-SUSE-container-secrets.patch


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Update to Docker 19.03.1-ce. See upstream changelog in the packaged
    /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2019-14271


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Fix default installation such that --userns-remap=default works properly
    (this appears to be an upstream regression, where --userns-remap=default
    doesn't auto-create the group and results in an error on-start). boo#1143349


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Update to Docker 19.03.2-ce. See upstream changelog in the packaged
    /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1150397


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Drop containerd.service workaround (we've released enough versions without
    containerd.service -- there's no need to support package upgrades that old).
  - Update to Docker 19.03.3-ce. See upstream changelog in the packaged
    /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1153367


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Update to Docker 19.03.4-ce. See upstream changelog in the packaged
    /usr/share/doc/packages/docker/CHANGELOG.md.


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Update to Docker 19.03.5-ce. See upstream changelog in the packaged
    /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1158590


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Add backport of https://github.com/docker/docker/pull/39121. bsc#1122469
    + bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch


author: asarai@suse.com
changelog:
  - Update to Docker 20.10.6-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/#20106>. bsc#1184768
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  - Backport upstream fix <https://github.com/moby/moby/pull/42273> for btrfs
    quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
    + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch


author: asarai@suse.com
changelog:
  - Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
    bsc#1190670
    + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch


author: asarai@suse.com
changelog:
  - Update to Docker 20.10.9-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/#20109>. bsc#1191355
    CVE-2021-41089 bsc#1191015 CVE-2021-41091 bsc#1191434
    CVE-2021-41092 bsc#1191334 CVE-2021-41103 bsc#1191121
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
    * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
  - Switch to Go 1.16.x compiler, in line with upstream.


author: asarai@suse.com
changelog:
  - Update to Docker 20.10.11-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/#201011>. bsc#1192814
    bsc#1193273 CVE-2021-41190
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  - Remove upstreamed patches:
    - 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch


author: asarai@suse.com
changelog:
  - Update to Docker 20.10.12-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/#201012>.
  - Remove CHANGELOG.md. It hasn't been maintained since 2017, and all of the
    changelogs are currently only available online.


author: asarai@suse.com
changelog:
  - Update to Docker 20.10.14-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/#201014>. bsc#1197517
    CVE-2022-24769


author: asarai@suse.com
changelog:
  - Add patch to update golang.org/x/crypto for CVE-2021-43565 and CVE-2022-27191.
    bsc#1193930 bsc#1197284
    * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch


author: asarai@suse.com
changelog:
  - Update to Docker 20.10.17-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/#201017>. bsc#1200145
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
    * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch


author: asarai@suse.com
changelog:
  - Backport <https://github.com/containerd/fifo/pull/32> to fix a crash-on-start
    issue with dockerd. bsc#1200022
    + 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch


author: asarai@suse.com
changelog:
  - Add apparmor-parser as a Recommends to make sure that most users will end up
    with it installed even if they are primarily running SELinux.


author: asarai@suse.com
changelog:
  - Update to Docker 20.10.21-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/#201021>. bsc#1206065
    bsc#1205375 CVE-2022-36109
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
    * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
    * 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
  - The PRIVATE-REGISTRY patch will now output a warning if it is being used (in
    preparation for removing the feature). This feature was never meant to be
    used by users directly (and is only available in the -kubic/CaaSP version of
    the package anyway) and thus should not affect any users.


author: dmueller@suse.com
changelog:
  - update to 20.10.23-ce.
    * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
  - drop kubic flavor as kubic is EOL. this removes:
    kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch


author: tboerger@suse.com
changelog:
  - Updated fix-requirements.patch for new code base
  - Update to version 1.7.1
    * 1.7.1
      + Fixed a bug where the output of docker-compose config for v1 files would
      be an invalid configuration file.
      + Fixed a bug where docker-compose config would not check the validity of
      links.
      + Fixed an issue where docker-compose help would not output a list of
      available commands and generic options as expected.
      + Fixed an issue where filtering by service when using docker-compose logs
      would not apply for newly created services.
      + Fixed a bug where unchanged services would sometimes be recreated in in
      the up phase when using Compose with Python 3.
      + Fixed an issue where API errors encountered during the up phase would not
      be recognized as a failure state by Compose.
      + Fixed a bug where Compose would raise a NameError because of an undefined
      exception name on non-Windows platforms.
      + Fixed a bug where the wrong version of docker-py would sometimes be
      installed alongside Compose.
      + Fixed a bug where the host value output by docker-machine config default
      would not be recognized as valid options by the docker-compose command line.
      + Fixed an issue where Compose would sometimes exit unexpectedly while
      reading events broadcasted by a Swarm cluster.
      + Corrected a statement in the docs about the location of the .env file,
      which is indeed read from the current directory, instead of in the same location as the Compose file.
    * 1.7.0
      + docker-compose logs no longer follows log output by default. It now
      matches the behaviour of docker logs and exits after the current logs are
      printed. Use -f to get the old default behaviour.
      + Booleans are no longer allows as values for mappings in the Compose file
      (for keys environment, labels and extra_hosts). Previously this was a
      warning. Boolean values should be quoted so they become string values.
      + Compose now looks for a .env file in the directory where it's run and
      reads any environment variables defined inside, if they're not already set
      in the shell environment. This lets you easily set defaults for variables
      used in the Compose file, or for any of the COMPOSE_* or DOCKER_*
      variables.
      + Added a --remove-orphans flag to both docker-compose up and docker-compose
      down to remove containers for services that were removed from the Compose
      file.
      + Added a --all flag to docker-compose rm to include containers created by
      docker-compose run. This will become the default behavior in the next
      version of Compose.
      + Added support for all the same TLS configuration flags used by the docker
      client: --tls, --tlscert, --tlskey, etc.
      + Compose files now support the tmpfs and shm_size options.
      + Added the --workdir flag to docker-compose run
      + docker-compose logs now shows logs for new containers that are created
      after it starts.
      + The COMPOSE_FILE environment variable can now contain multiple files,
      separated by the host system's standard path separator (: on Mac/Linux, ;
      on Windows).
      + You can now specify a static IP address when connecting a service to a
      network with the ipv4_address and ipv6_address options.
      + Added --follow, --timestamp, and --tail flags to the docker-compose logs
      command.
      + docker-compose up, and docker-compose start will now start containers in
      parallel where possible.
      + docker-compose stop now stops containers in reverse dependency order
      instead of all at once.
      + Added the --build flag to docker-compose up to force it to build a new
      image. It now shows a warning if an image is automatically built when the
      flag is not used.
      + Added the docker-compose exec command for executing a process in a running
      container.
      + docker-compose down now removes containers created by docker-compose run.
      + A more appropriate error is shown when a timeout is hit during up when
      using a tty.
      + Fixed a bug in docker-compose down where it would abort if some resources
      had already been removed.
      + Fixed a bug where changes to network aliases would not trigger a service
      to be recreated.
      + Fix a bug where a log message was printed about creating a new volume when
      it already existed.
      + Fixed a bug where interrupting up would not always shut down containers.
      + Fixed a bug where log_opt and log_driver were not properly carried over
      when extending services in the v1 Compose file format.
      + Fixed a bug where empty values for build args would cause file validation
      to fail.


author: jmassaguerpla@suse.com
changelog:
  - add python as a requirement, otherwise python is not installed
    and then you get the error
      AttributeError: 'module' object has no attribute 'ssl'


author: jmassaguerpla@suse.com
changelog:
  - Remove the conflict with python-requests
    I am tired of this kind of errors. I am relaxing this requirement.
    fix bsc#997918: TW 20160901: unable to dup since docker-compose
    conflicts with python-requests


author: opensuse-packaging@opensuse.org
changelog:
  - Update to version 1.8.1 to be in sync with latest docker (bsc#1004927):
    * Remove surrounding quotes from TLS paths, if present
    * Fix command hint in bundle to pull services instead of images
    * Improve volumespec parsing on windows platforms
    * Update docker-py dependency to latest release
    * Catch APIError while printing container logs
    * Only allow log streaming if logdriver is json-file or journald
    * Fix integration test on Docker for Mac
    * Force default host on windows to the default TCP host (instead of npipe)
    * Bump docker-py dependency
    * Bump 1.8.1


author: cobexer@gmail.com
changelog:
  - Update to version 1.17.0:
    * Bump 1.17.0
    * Miscellaneous test fixes
    * Add flake8 to dev requirements
    * flake8 error on master branch (fixes #5298)
    * Add bash completion for `up --no-start`
    * Bump 1.17.0-rc1
    * flake8
    * Add check_duplicate=True when creating network
    * Add specific handling for pywintypes.error
    * Config command generates invalid volumes (fixes #5176)


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Update to version git.6da50d1978302f04c3e2089e29112ea24812f05b which is
    required for Docker v18.09.0-ce.
    * Make DSR an overlay-specific driver "option"
    * Set east-west load balancing to use direct routing
    * Add getter function for Default Address Pools
    * Global Default Address Pool support
    * Move SSD image to docker
    * Give LB sandboxes predictable names
    * Fix handling of the resolv.conf
    * Create internal directory


author: clee@suse.com
changelog:
  - Update go requirements to >= go1.10 to fix
    * bsc#1118897 CVE-2018-16873
      go#29230 cmd/go: remote command execution during "go get -u"
    * bsc#1118898 CVE-2018-16874
      go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
    * bsc#1118899 CVE-2018-16875


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Update to version git.2cfbf9b1f98162a55829a21cc603c76072a75382 which is
    required for Docker v18.09.1-ce bsc#1124308:
    * account for removal of configs.HookState
    * vndr runc 96ec217
    * Update golint tool
    * debian has iptables-legacy and iptables-nft now
    * Make DSR an overlay-specific driver "option"
    * Set east-west load balancing to use direct routing
    * Add getter function for Default Address Pools
    * Global Default Address Pool support


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Update to version git.4725f2163fb214a6312f3beae5991f838ec36326 which is
    required for Docker v18.09.5-ce: bsc#1128376 boo#1134068
    * Revert "Merge pull request #2286 from thaJeztah/18.09_backport_iptables_legacy"
    * Bump Go to 1.10.7
    * Fix possible nil pointer exception
    * Fix gosimple
    * account for removal of configs.HookState
    * vndr runc 96ec217
    * Update golint tool
    * debian has iptables-legacy and iptables-nft now
    * Make DSR an overlay-specific driver "option"
    * Set east-west load balancing to use direct routing


author: asarai@suse.com
changelog:
  - Update to version git.872f0a83c98add6cae255c8859e29532febc0039 which is
    required for Docker v18.09.6-ce.
    * Pick a random host port if the user does not specify a host port.
    * Cleanup the cluster provider when the agent is closed
    * Adding error log if peerAdd fails
    * Adding synchronization to endpoint addition/deletion to prevent network connectivity issue
    * Revert "Merge pull request #2286 from thaJeztah/18.09_backport_iptables_legacy"
    * Bump Go to 1.10.7
    * Fix possible nil pointer exception
    * Fix gosimple
    * account for removal of configs.HookState


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Update to version git.e7933d41e7b206756115aa9df5e0599fc5169742, which is
    required for Docker v18.09.7-ce. bsc#1139649


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Update to version git.fc5a7d91d54cc98f64fc28f9e288b46a0bee756c, which is
    required for Docker v19.03.0-ce. bsc#1142413


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update to runc 6635b4f0c6af, which is required for Docker v18.09.3-ce.
  - Remove patches that were merged upstream:
    * CVE-2019-5736.patch


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Backport various upstream patches to fix some kernel regression related to
    O_TMPFILE. bsc#1131314 bsc#1131553
    * bsc1131553-0001-nsenter-cloned_binary-various-cleanups.patch


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce.
    bsc#1128376 boo#1134068
  - Remove patches which were merged upstream:
    - bsc1131553-0001-nsenter-cloned_binary-various-cleanups.patch


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Update to runc 425e105d5a03, which is required for Docker v18.09.7-ce.
    bsc#1139649
  - Remove docker-runc-test (it's not useful for actual testing).


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Update to runc 3e425f80a8c9, which is required for Docker 19.03.3-ce.
    bsc#1153367
  - Rebase CVE-2019-16884 fix (3e425f80a8c9 doesn't contain the entire fix).
    bsc#1152308
    - CVE-2019-16884.patch


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Backport https://github.com/opencontainers/runc/pull/2391 to help fix
    bsc#1168481.
    + bsc1168481-0001-cgroup-devices-major-cleanups-and-minimal-transition.patch


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Update to runc v1.0.0-rc10, which is required for Docker 19.03.11-ce.
    bsc#1172377
  - Remove upstreamed patches:
    - CVE-2019-16884.patch
    - CVE-2019-19921.patch
  - Synchronise patches with 'runc' package:
    + bsc1149954-0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch
    * bsc1168481-0001-cgroup-devices-major-cleanups-and-minimal-transition.patch


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Add fix for CVE-2019-5736 (effectively copying /proc/self/exe during re-exec
    to avoid write attacks to the host runc binary). bsc#1121967
    + CVE-2019-5736.patch
  - Add docker-runc-rpmlintrc for docker-runc-test.


author: Thomas Woerner <twoerner@redhat.com> - 2.0.10-9
changelog:
  - fixed missing systemd unit file (RHBZ#818953)
    merged fedora patches from Tom Callaway
  - fixed NETWORK test in the init script (RHBZ#1026784)
  - fixed needed rpmdiff failures (RHBZ#883988)


author: Thomas Woerner <twoerner@redhat.com> - 2.0.10-14
changelog:
  - Fixed persmissions of ebtables.service (RHBZ#1288586)
  - Added upstream patch to add noflush option to ebtables-restore (RHBZ#1334271)


author: Eric Garver <egarver@redhat.com> - 0.6.3-3
changelog:
  - backport recent upstream stable fixes
  - backport fix --remove-rules deleting all direct rules
  - backport fix unable to delete rich rule forward-port
  - backport fix forward-port for external zone hijacking internal zone
  - backport fix testsuite iptables locking


author: Eric Garver <egarver@redhat.com> - 0.8.2-2
changelog:
  - fix(cli): add ipset type hash:mac is incompatible with the family parameter
  - fix(cli): add --zone is an invalid option with --direct
  - fix: update dynamic DCE RPC ports in freeipa-trust service
  - fix: core: rich: Catch ValueError on non-numeric priority values
  - fix(rich): icmptypes with one family
  - fix(direct): rule in a zone chain
  - plus additional upstream stable fixes


author: Eric Garver <egarver@redhat.com> - 0.8.2-3
changelog:
  - fix(nftables): packet marks with masks
  - fix(nftables): icmp types with code == 0
  - fix(rich icmptype): verify rule and icmptype families
  - fix(zone): cache rule_str for rich rules
  - improvement(service): IPsec: Update description and add TCP port 4500
  - feat(service): add collectd service
  - feat(service): Add rpc-rquotad.service


author: Eric Garver <egarver@redhat.com> - 0.9.3-12
changelog:
  - feat(config): add CleanupModulesOnExit configuration option
  - change default CleanupModulesOnExit=yes


author: mrostecki@suse.com
changelog:
  - Remove the patch which enforces usage of iptables instead of
    nftables (jsc#SLE-16300):
    * 0001-firewall-backend-Switch-default-backend-to-iptables.patch
  - Add firewalld zone for the docker0 interface. This is the
    workaround for lack of nftables support in docker. Without that
    additional zone, containers have no Internet connectivity.
    (rhbz#1817022, jsc#SLE-16300)
  - Update to 0.9.1:
    * Bugfixes:
    * docs(firewall-cmd): clarify lockdown whitelist command paths
    * fix(dbus): getActivePolicies shouldn't return a policy if a zone is not active
    * fix(policy): zone interface/source changes should affect all using zone


author: mrostecki@suse.com
changelog:
  - Update to 0.9.3 (jsc#SLE-17336):
    * docs(dbus): fix invalid method names
    * fix(forward): iptables: ipset used as zone source
    * fix(rich): non-printable characters removed from rich rules
    * docs(firewall-cmd): small description grammar fix
    * fix(rich): limit table to strip non-printables to C0 and C1
    * fix(zone): add source with mac address


author: mrostecki@suse.com
changelog:
  - Disable FlushAllOnReload option to not retain interface to zone
    assignments and direct rules when using --reload option.
    * 0002-Disable-FlushAllOnReload-option.patch


author: mrostecki@suse.com
changelog:
  - Add patch which fixes the zone configuration (bsc#1191837)
    * 0001-chore-fw_zone-call-permanent-config-checks-at-runtim.patch


author: sflees@suse.de
changelog:
  - Fix regression introduced in previous patch (an api change to a
    function also needed backporting) (bsc#1198814)
    * feature-upstream-new-check-config-1.patch
    * feature-upstream-new-check-config-2.patch


author: mohd.saquib@suse.com
changelog:
  - Fix firewall-offline-cmd fails with ERROR: Calling pre func
    Added following patch (bsc#1206928)
    [+ 0003-firewall-offline-cmd-fail-fix.patch]


author: Jindrich Novy <jnovy@redhat.com> - 0.7.2-4
changelog:
  - replace "fuse-overlayfs segfault" patch with improved one
    due to application to a different context
  - Resolves: #1805017


author: Jindrich Novy <jnovy@redhat.com> - 1.1.2-3
changelog:
  - fix "error bind mounting /dev from host into mount namespace"
    (the openat2 syscall is not yet supported by the RHEL8 kernel)
  - Resolves: #1867447


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update to v0.7.2
    - introduce inodes cache
    - correctly read inode for unix sockets
    - avoid hash map lookup when possible
    - use st_dev for the ino key
    - check whether writeback is supported
    - set_attrs: don't require write to S_IFREG
    - ioctl: do not reuse fi->fh for directories
    - fix skip whiteout deletion optimization
    - store the new mode after chmod


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update to v0.7.3
    - fix build with -fno-common
    - fix possible segmentation fault in direct_fsync()
    - use the data store to create missing whiteouts
    - after a rename, force a directory reload


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update to v0.7.4
    - fix fallocate for deleted files.
    - ignore O_DIRECT.  It causes issues with libfuse not using an
      aligned buffer, causing write(2) to fail with EINVAL.
    - on copyup, do not copy the opaque xattr.
    - fix a wrong lookup for whiteout files, that could happen on a
      double unlink.


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update to v0.7.6 (bsc#1160460)
    - do not look in lower layers for the ino if there is no origin
      xattr set
    - attempt to use the file path if the operation on the fd fails
      with ENXIO


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update to v0.7.7
    - make sure the destination is deleted before doing a rename(2).
      It prevents a left over directory to cause delete to fail with
      EEXIST.
    - honor --debug.


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update to v0.7.8
    - report correctly the number of links for a directory also for
      subsequent stat calls
    - stop looking up the ino in the lower layers if the file could
      not be opened


author: Ralf Haferkamp <rhafer@suse.com>
changelog:
  - Update to v1.1.0
    - use openat2(2) when available.
    - accept "ro" as mount option.
    - fix set mtime for a symlink.
    - fix some issues reported by static analysis.
    - fix potential infinite loop on a short read.
    - fix creating a directory if the destination already exists
      in the upper layer.


author: Dirk Mueller <dmueller@suse.com>
changelog:
  - udpate to 1.1.2 (bsc#1175821)
    - fix build issues with libmusl.
    - fix memory leak when creating whiteout files.
    - fix lookup for overflow uid when it is different than the overflow gid.


author: Pavel Reichl <preichl@redhat.com> - 2.9.7-16
changelog:
  - Back-port max_pages support,
  - caching symlinks in kernel page cache,
  - and in-kernel readdir caching
  - Fixed rhbz#2080000


author: Dave Dykstra <dwd@fedoraproject.org> - 3.4.2-4
changelog:
  - Bump release number in order to larger than a rebuild of fuse package
    done before separation pull request was merged.


author: Andreas Stieger <andreas.stieger@gmx.de>
changelog:
  - git 2.25.1:
    * "git commit" now honors advise.statusHints
    * various updates, bug fixes and documentation updates


author: Andreas Stieger <andreas.stieger@gmx.de>
changelog:
  - git 2.26.0 (bsc#1167890, jsc#SLE-11608):
    * "git rebase" now uses a different backend that is based on the
      'merge' machinery by default. The 'rebase.backend' configuration
      variable reverts to old behaviour when set to  'apply'
    * Improved handling of sparse checkouts
    * Improvements to many commands and internal features


author: Andreas Stieger <andreas.stieger@gmx.de>
changelog:
  - git 2.26.1:
    * CVE-2020-5260: Specially crafted URLs with newline characters
      could have been used to make the Git client to send credential
      information for a wrong host to the attacker's site boo#1168930


author: Andreas Stieger <andreas.stieger@gmx.de>
changelog:
  - git 2.26.2:
    * CVE-2020-11008: Specially crafted URLs may have tricked the
      credentials helper to providing credential information that
      is not appropriate for the protocol in use and host being
      contacted (boo#1169936)


author: Michal Suchanek <msuchanek@suse.de>
changelog:
  - With recent switch to protocol v2 people are reporting fetches transferring
    unreasonable amount of data. Upstream proposes switching the protocol back
    until the issue is properly diagnosed. The regression is problematic for
    people with lower network connection speed (bsc#1170741).
    Added: Revert-fetch-default-to-protocol-version-2.patch


author: Michal Suchanek <msuchanek@suse.com>
changelog:
  - Protocol v2 in_vain fixes (bsc#1170741, bsc#1170939).
    Dropped: Revert-fetch-default-to-protocol-version-2.patch
    Added:   0001-fetch-pack-return-enum-from-process_acks.patch
      0002-fetch-pack-in-protocol-v2-in_vain-only-after-ACK.patch
      0003-fetch-pack-in-protocol-v2-reset-in_vain-upon-ACK.patch


author: andreas.stieger@gmx.de
changelog:
  - git 2.35.2 (CVE-2022-24765, bsc#1198234):
    * CVE-2022-24765: git may execute commands defined by other users
      from unexpected worktrees


author: olaf@aepfle.de
changelog:
  - Require bash in git-daemon because the service file uses it
  - Reword git-daemon.service description to get a useful sentence
    in journalctl -b


author: andreas.stieger@gmx.de
changelog:
  - git 2.35.3:
    * usability fix-up for CVE-2022-24765 bsc#1198234:
      '*' can be used as the value for the `safe.directory` variable
      to signal that the user considers that any directory is safe.
    * The code that was meant to parse the new `safe.directory`
      configuration variable was not checking what configuration
      variable was being fed to it


author: danilo.spinella@suse.com
changelog:
  - Follow up fix for CVE-2022-24765, potential command injection
    via git worktree.
    (CVE-2022-29187, bsc#1201431)
    * fix-CVE-2022-29187.patch


author: danilo.spinella@suse.com
changelog:
  - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to
    arbitrary heap writes and remote code execution
    (CVE-2022-39260, bsc#1204456)
    fix-CVE-2022-39260.patch
  - Fix CVE-2022-39253, dereference issue with symbolic links via
    the `--local` clone mechanism
    (CVE-2022-39253, bsc#1204455)
    fix-CVE-2022-39253.patch


author: danilo.spinella@suse.com
changelog:
  - Fix CVE-2022-41903, heap overflow in `git archive` and
    `git log --format`
    (CVE-2022-41903, bsc#1207033)
    * fix-CVE-2022-41903.patch
  - Fix CVE-2022-23521, gitattributes parsing integer overflow
    (CVE-2022-23521, bsc#1207032)


author: danilo.spinella@suse.com
changelog:
  - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked
    into using its local clone optimization even when using a non-local transport
    (CVE-2023-22490, bsc#1208027)
  - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the
    user who is running "git apply"
    (CVE-2023-23946, bsc#1208028)
    * fix-CVE-2023-22490-1.patch
    * fix-CVE-2023-22490-2.patch
    * fix-CVE-2023-22490-3.patch
    * fix-CVE-2023-22490-4.patch


author: psimons@suse.com
changelog:
  - Apply "CVE-2023-25652.patch" to fix a security vulnerability
    where by feeding a specially crafted input to `git apply
    - -reject`, a path outside the working tree could be overwritten
    with partially controlled contents (corresponding to the rejected
    hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686]
  - Apply "CVE-2023-25815.patch" to fix a security vulnerability that
    exists when Git is compiled with runtime prefix support and runs
    without translated messages, then it still used the gettext
    machinery to display messages, which subsequently potentially
    looked for translated messages in unexpected places. This allowed
    for malicious placement of crafted messages. [CVE-2023-25815,
    bsc#1210686]
  - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch",
    "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a
    security vulnerability that occurred when renaming or deleting a
    section from a configuration file, then certain malicious
    configuration values might have been misinterpreted as the
    beginning of a new configuration section, leading to arbitrary
    configuration injection. [CVE-2023-29007, bsc#1210686]


author: Simon Lukasik <slukasik@redhat.com> - 1.3.0-6
changelog:
  - Resolve multilib conflict of gpgme-config (#341351)
  - Resolve multilib conflict of gpgme.h (#341351)


author: Tomas Mraz <tmraz@redhat.com> - 1.3.2-1
changelog:
  - new upstream version
  - re-enable gpg tests (original patch by John Morris <john@zultron.com>)
  - quiet configure warning 'could not find g13'
  - there is no libgpgme-pth anymore


author: Andrea Claudi <aclaudi@redhat.com> [4.18.0-15.el8]
changelog:
  - netns: make netns_{save,restore} static (Andrea Claudi) [1719759]
  - ip vrf: use hook to change VRF in the child (Andrea Claudi) [1719759]
  - netns: switch netns in the child when executing commands (Andrea Claudi) [1719759]
  - m_mirred: don't bail if the control action is missing (Andrea Claudi) [1711760]
  - tc: introduce support for chain templates (Andrea Claudi) [1710291]
  - ip: reset netns after each command in batch mode (Andrea Claudi) [1671016]


author: Andrea Claudi <aclaudi@redhat.com> [5.3.0-2.el8]
changelog:
  - man: ip.8: Add missing vrf subcommand description (Andrea Claudi) [1780010]
  - xfrm: not try to delete ipcomp states when using deleteall (Andrea Claudi) [1808634]
  - ip-xfrm: Fix help messages (Andrea Claudi) [1796045]
  - man: rdma.8: Add missing resource subcommand description (Andrea Claudi) [1786576]
  - man: rdma-statistic: Add filter description (Andrea Claudi) [1786565]
  - tc: implement support for action flags (Andrea Claudi) [1770671]
  - Update kernel headers (Andrea Claudi) [1770671]
  - Update kernel headers (Andrea Claudi) [1770671]


author: Andrea Claudi <aclaudi@redhat.com> [5.3.0-3.el8]
changelog:
  - xfrm: also check for ipv6 state in xfrm_state_keep (Andrea Claudi) [1828033]
  - man: bridge.8: fix bridge link show description (Andrea Claudi) [1817571]
  - ip: fix ip route show json output for multipath nexthops (Andrea Claudi) [1738633]
  - ip link: xstats: fix TX IGMP reports string (Andrea Claudi) [1796041]
  - nstat: print useful error messages in abort() cases (Andrea Claudi) [1824896]


author: Andrea Claudi <aclaudi@redhat.com> [5.3.0-4.el8]
changelog:
  - tc: f_flower: add options support for erspan (Andrea Claudi) [1830485]
  - tc: f_flower: add options support for vxlan (Andrea Claudi) [1830485]
  - tc: m_tunnel_key: add options support for erpsan (Andrea Claudi) [1830485]
  - tc: m_tunnel_key: add options support for vxlan (Andrea Claudi) [1830485]
  - iproute_lwtunnel: add options support for erspan metadata (Andrea Claudi) [1830485]
  - iproute_lwtunnel: add options support for vxlan metadata (Andrea Claudi) [1830485]
  - iproute_lwtunnel: add options support for geneve metadata (Andrea Claudi) [1830485]
  - Update kernel headers (Andrea Claudi) [1830485]
  - man: ip.8: add reference to mptcp man-page (Andrea Claudi) [1812207]
  - man: mptcp man page (Andrea Claudi) [1812207]
  - ss: allow dumping MPTCP subflow information (Andrea Claudi) [1812207]
  - Update kernel headers (Andrea Claudi) [1812207]
  - Update kernel headers (Andrea Claudi) [1812207]
  - add support for mptcp netlink interface (Andrea Claudi) [1812207]
  - Update kernel headers and import mptcp.h (Andrea Claudi) [1812207]
  - ip: xfrm: add espintcp encapsulation (Andrea Claudi) [1844045]
  - Update kernel headers and import udp.h (Andrea Claudi) [1844045]


author: Andrea Claudi <aclaudi@redhat.com> [5.3.0-5.el8]
changelog:
  - man: tc-ct.8: Add manual page for ct tc action (Andrea Claudi) [1844637]
  - tc: flower: Add matching on conntrack info (Andrea Claudi) [1844637]
  - tc: Introduce tc ct action (Andrea Claudi) [1844637]
  - tc: add NLA_F_NESTED flag to all actions options nested block (Andrea Claudi) [1844637]
  - Import tc_act/tc_ct.h uapi file (Andrea Claudi) [1844637]
  - ss: allow dumping kTLS info (Andrea Claudi) [1812207]
  - devlink: Add health error recovery status monitoring (Andrea Claudi) [1821039]


author: Andrea Claudi <aclaudi@redhat.com> [5.9.0-2.el8]
changelog:
  - tc: flower: fix json output with mpls lse (Andrea Claudi) [1885770]
  - tc-mpls: fix manpage example and help message string (Andrea Claudi) [1885770]
  - tc-vlan: fix help and error message strings (Andrea Claudi) [1885770]
  - m_mpls: test the 'mac_push' action after 'modify' (Andrea Claudi) [1885770]
  - m_mpls: add mac_push action (Andrea Claudi) [1885770]
  - m_vlan: add pop_eth and push_eth actions (Andrea Claudi) [1885770]
  - Update kernel headers (Andrea Claudi) [1885770]


author: Andrea Claudi <aclaudi@redhat.com> - 6.2.0-2.el9
changelog:
  - macvlan: Add bclim parameter (Andrea Claudi) [2186945]
  - Update kernel headers (Andrea Claudi) [2186945]


author: Andrea Claudi <aclaudi@redhat.com> - 6.2.0-5.1.el9
changelog:
  - man: ip-link.8: add a note for gso_ipv4_max_size (Andrea Claudi)
  - iplink: add gso and gro max_size attributes for ipv4 (Andrea Claudi)
  - Update kernel headers (Andrea Claudi)
  - ss: Add support for dumping TCP bound-inactive sockets. (Andrea Claudi)


author: Thomas Woerner <twoerner@redhat.com> - 6.19-5
changelog:
  - New service sub package to provide the ipset service (RHBZ#1136257)
    Service and start-stop script from F-24
  - Fixed ipset package summary (RHBZ#1195171)
    Spec file derived from F-24


author: Thomas Woerner <twoerner@redhat.com> - 6.19-6
changelog:
  - Use /etc/sysconfig/ipset-config in service as EnvironmentFile (RHBZ#1136257)
  - Use /etc/sysconfig/ipset for data as in RHEL-6 (RHBZ#1136257)
  - No save on reload, but legacy save action (RHBZ#1136257)


author: Thomas Woerner <twoerner@redhat.com> - 6.29-1
changelog:
  - Rebase to 6.29 (RHBZ#1351299)
  - Fixes:
    - Backport ipset capability to run in namespaces (RHBZ#1226051)
    - Fix service save with empty ipset list and existing ipset save file
      (RHBZ#1377621)
    - Fix internal error at printing to output buffer (RHBZ#1395865)


author: Stefano Brivio <sbrivio@redhat.com> - 6.38-1
changelog:
  - Rebase to 6.38 (RHBZ#1557600):
    - hash:ipmac type support added to ipset, userspace part (Tomasz Chilinski)
  - Refactor /etc/sysconfig/ipset.start-stop
  - Fixes:
    - IPSet Service Monolithic Operation (RHBZ#1440741)
    - "systemctl start ipset" doesn't handle existing ipset's having counters
      (RHBZ#1502212)


author: Stefano Brivio <sbrivio@redhat.com> - 7.1-1
changelog:
  - Rebase to 7.1 (RHBZ#1649080):
    - Add compatibility support for strscpy()
    - Correct the manpage about the sort option
    - Add missing functions to libipset.map
    - configure.ac: Fix build regression on RHEL/CentOS/SL (Serhey Popovych)
    - Implement sorting for hash types in the ipset tool
    - Fix to list/save into file specified by option (reported by Isaac Good)
    - Introduction of new commands and protocol version 7, updated kernel include files
    - Add compatibility support for async in pernet_operations
    - Use more robust awk patterns to check for backward compatibility
    - Prepare the ipset tool to handle multiple protocol version
    - Fix warning message handlin
    - Correct to test null valued entry in hash:net6,port,net6 test
    - Library reworked to support embedding ipset completely
    - Add compatibility to support kvcalloc()
    - Validate string type attributes in attr2data() (Stefano Brivio)
    - manpage: Add comment about matching on destination MAC address (Stefano Brivio)
      (RHBZ#1649079)
    - Add compatibility to support is_zero_ether_addr()
    - Fix use-after-free in ipset_parse_name_compat() (Stefano Brivio) (RHBZ#1649073)
    - Fix leak in build_argv() on line parsing error (Stefano Brivio) (RHBZ#1649073)
    - Simplify return statement in ipset_mnl_query() (Stefano Brivio) (RHBZ#1649073)
    - tests/check_klog.sh: Try dmesg too, don't let shell terminate script (Stefano Brivio) 
  - Fixes:
    - Fix all shellcheck warnings in init script (RHBZ#1649073)
    - Make error reporting consistent, introduce different severities (RHBZ#1649877)
    - While restoring, on invalid entries, remove them and retry (RHBZ#1650297)
    - Fix covscan SC2166 warning in init script (RHBZ#1649073)
    - Hardcode triggerin, triggerun versions for ipset-service (RHBZ#1646666)


author: Stefano Brivio <sbrivio@redhat.com> - 6.38-3
changelog:
  - Fix loading of sets with dependencies on other sets (RHBZ#1647096), and
    hardcode 6.38-1.el7 for ipset-service upgrade and downgrade triggers, so that
    we don't run into issues with z-stream updates


author: Stefano Brivio <sbrivio@redhat.com> - 7.1-1
changelog:
  - Rebase to 7.1 (RHBZ#1649090):
    - Add compatibility support for strscpy()
    - Correct the manpage about the sort option
    - Add missing functions to libipset.map
    - configure.ac: Fix build regression on RHEL/CentOS/SL (Serhey Popovych)
    - Implement sorting for hash types in the ipset tool
    - Fix to list/save into file specified by option (reported by Isaac Good)
    - Introduction of new commands and protocol version 7, updated kernel include files
    - Add compatibility support for async in pernet_operations
    - Use more robust awk patterns to check for backward compatibility
    - Prepare the ipset tool to handle multiple protocol version
    - Fix warning message handlin
    - Correct to test null valued entry in hash:net6,port,net6 test
    - Library reworked to support embedding ipset completely
    - Add compatibility to support kvcalloc()
    - Validate string type attributes in attr2data() (Stefano Brivio)
    - manpage: Add comment about matching on destination MAC address (Stefano Brivio)
      (RHBZ#1649079)
    - Add compatibility to support is_zero_ether_addr()
    - Fix use-after-free in ipset_parse_name_compat() (Stefano Brivio) (RHBZ#1649085)
    - Fix leak in build_argv() on line parsing error (Stefano Brivio) (RHBZ#1649085)
    - Simplify return statement in ipset_mnl_query() (Stefano Brivio) (RHBZ#1649085)
    - tests/check_klog.sh: Try dmesg too, don't let shell terminate script (Stefano Brivio) 
  - Fixes:
    - Fix all shellcheck warnings in init script (RHBZ#1649085)
    - Make error reporting consistent, introduce different severities (RHBZ#1683711)
    - While restoring, on invalid entries, remove them and retry (RHBZ#1683713)
    - Fix covscan SC2166 warning in init script (RHBZ#1649085)


author: Phil Sutter - 1.4.21-27
changelog:
  - libxt_tcpmss: Detect invalid ranges (RHBZ#1128510)
  - ip(6)tables-save/restore: Exit if invalid option was given (RHBZ#1465078)
  - ip(6)tables-save/restore: Require value to -W option (RHBZ#1465078)
  - ip(6)tables-save/restore: Don't accept -W without -w (RHBZ#1465078)
  - Ignore security table when setting policies (RHBZ#1494012)
  - Fix spec file changing SRPM content (RHBZ#1531290)


author: Phil Sutter - 1.4.21-29
changelog:
  - Do not attempt to unload any modules when stopping the firewall (RHBZ#1520534)
  - Fix for covscan warnings (RHBZ#1525980)


author: Phil Sutter <psutter@redhat.com> - 1.4.21-31
changelog:
  - Fix iptables-restore with empty comment in rule (RHBZ#1668475)
  - Fix parsing and printing of -m ipvs --vproto option (RHBZ#1679726)
  - Fix for wrong location of devgroup definition file (RHBZ#1657075)
  - Fix for non-numeric devgroup name output (RHBZ#1657075)
  - Reject negative realm values (RHBZ#1657075)


author: Phil Sutter <psutter@redhat.com> - 1.4.21-34
changelog:
  - Fix iptables-restore for rules with '-' and 't' in comments (RHBZ#1749700)
  - Make services start before network-pre.target is reached (RHBZ#1736765)


author: Phil Sutter <psutter@redhat.com> - 1.8.4-16
changelog:
  - tests/shell: Add test for bitwise avoidance fixes
  - ebtables: Optimize masked MAC address matches
  - nft: Optimize class-based IP prefix matches
  - nft: Fix for broken address mask match detection
  - nft: cache: Make nft_rebuild_cache() respect fake cache
  - tests: shell: Improve concurrent noflush restore test a bit
  - nft: Fix for concurrent noflush restore calls
  - nft: Fix error reporting for refreshed transactions
  - nft: Make batch_add_chain() return the added batch object


author: Phil Sutter <psutter@redhat.com> - 1.8.4-17
changelog:
  - extensions: dccp: Fix for DCCP type 'INVALID'
  - tests: shell: Merge and extend return codes test
  - nft: Fix command name in ip6tables error message
  - extensions: libxt_CT: add translation for NOTRACK
  - extensions: libipt_icmp: Fix translation of type 'any'
  - tests/shell: Test for fixed extension registration
  - libxtables: Register multiple extensions in ascending order
  - libxtables: Simplify pending extension registration
  - libxtables: Make sure extensions register in revision order


author: Phil Sutter <psutter@redhat.com> - 1.8.4-18
changelog:
  - xtables-translate: Fix translation of odd netmasks
  - nft: Fix bitwise expression avoidance detection
  - xtables-monitor: 'LL=0x304' is not very convenient, print LOOPBACK instead.
  - xtables-monitor: print packet first
  - xtables-monitor: fix packet family protocol
  - xtables-monitor: fix rule printing
  - xtables-monitor: Fix ip6tables rule printing


author: Phil Sutter <psutter@redhat.com> - 1.8.4-20
changelog:
  - extensions: SECMARK: Use a better context in test case
  - extensions: sctp: Translate --chunk-types option
  - extensions: sctp: Fix nftables translation
  - extensions: SECMARK: Implement revision 1
  - nft: cache: Retry if kernel returns EINTR


author: Phil Sutter <psutter@redhat.com> - 1.8.4-21
changelog:
  - extensions: hashlimit: Fix tests with HZ=100
  - ebtables: Dump atomic waste
  - doc: ebtables-nft.8: Adjust for missing atomic-options


author: Phil Sutter <psutter@redhat.com> - 1.8.4-23
changelog:
  - libxtables: Fix unsupported extension warning corner case
  - tests: shell: Check overhead in iptables-save and -restore
  - nft: Fix EPERM handling for extensions without rev 0
  - Improve error messages for unsupported extensions
  - xshared: Fix response to unprivileged users
  - libxtables: Register only the highest revision extension
  - Use proto_to_name() from xshared in more places
  - libxtables: Boost rule target checks by announcing chain names
  - libxtables: Implement notargets hash table
  - nft: Reject standard targets as chain names when restoring
  - xshared: Merge and share parse_chain()
  - xshared: Prefer xtables_chain_protos lookup over getprotoent
  - nft: Speed up immediate parsing
  - nft: Simplify immediate parsing


author: Phil Sutter <psutter@redhat.com> - 1.8.5-11
changelog:
  - iptables-restore: Drop dead code
  - iptables-apply: Eliminate shellcheck warnings
  - ebtables: Exit gracefully on invalid table names


author: Philip J Perry <phil@elrepo.org> 1.0.20210808-1
changelog:
  - Update to 1.0.20210808 git snapshot
  - Rebuilt for RHEL 8.5
  - Fix SB-signing issue caused by /usr/lib/rpm/brp-strip
    [https://bugzilla.redhat.com/show_bug.cgi?id=1967291]
  - Update stripping of modules


author: Philip J Perry <phil@elrepo.org> 1.0.20220627-3
changelog:
  - Rebuilt for RHEL 8.7
  - Fix backport of ktime_get_coarse_boottime_ns on RHEL 8.7
    [https://elrepo.org/bugs/view.php?id=1283]


author: Philip J Perry <phil@elrepo.org> 1.0.20220627-4
changelog:
  - Rebuilt against kernel-4.18.0-425.10.1.el8_7
    [http://lists.elrepo.org/pipermail/elrepo/2023-January/006336.html]


author: rbrown@suse.com
changelog:
  - Update to version 1.20.1:
    * Revert "Use host IP instead of localhost for control plane component kubeconfig files."
    * etcd version for 1.19 is 3.4.13 for cve fixes
    * Flush FibreChannel devices before deleting
    * Fix FibreChannel volume plugin corrupting filesystem on detach
    * vendor: update cAdvisor to v0.38.6
    * Update CHANGELOG/CHANGELOG-1.20.md for v1.20.0
    * Revert "iAdd host IP to etcd listen client URLs."
    * fix migration logic
    * Add AcceleratorStats to cri_stats_provider


author: dmueller@suse.com
changelog:
  - Update to version 1.20.2:
    * move all variables in sampleAndWaterMarkHistograms::innerSet
    * use default unkown sock for kubeadm cmd if cri detect is not needed
    * cherry-pick part of #97451: fix nodeport quota check failure during creating clusterip
    * Release reserved GCE IP address after ensure completes.
    * Ensure reproducible builds when build through docker
    * Fix cadvisor machine metrics
    * Create OWNERS for most of the API Priority and Fairness impl
    * fix the deadlock in priority and fairness config controller
    * Cherry pick 443 and 448 from cloud provider azure
    * Fix bug in CPUManager with race on map acccess
    * clean up executing request on panic
    * fix azure file secret not found issue
    * fix: azure file latency issue for metadata-heavy workload
    * Update CHANGELOG/CHANGELOG-1.20.md for v1.20.1
    * Add more logging for Mount error


author: rbrown@suse.com
changelog:
  - Update to version 1.20.5:
    * Updating EndpointSliceMirroring controller to wait for cache to be updated
    * Updating EndpointSlice controller to wait for cache to be updated
    * Add tests for populated volumes
    * Fix comment on getPodVolumeSubpathListFromDisk
    * Fix tests to test for new behavior
    * Add warnings after cleanup back
    * Automatically remove orphaned pod's dangling volumes
    * Count pod overhead as an entity's resource usage
    * Ensure only one LoadBalancer rule is created when HA mode is enabled
    * Fix issue in checking domain socket for plugin watcher
    * Use Lstat in plugin watcher to avoid Windows problem
    * Skip visiting empty secret and configmap names
    * Number of sockets is assumed to be same as NUMA nodes
    * disables APF if the aggregated apiserver cannot locate the core kube-apiserver
    * Fix repeatedly aquire the inhibit lock
    * Sync node status during kubelet node shutdown
    * remove executable permission bits
    * Upgrading vendored dependencies
    * Upgrading cAdvisor to 0.38.8
    * Update CHANGELOG/CHANGELOG-1.20.md for v1.20.4
    * build/OWNERS: Add Dan and Sascha as reviewers
    * OWNERS(CHANGELOG): Move reviewers/approvers to CHANGELOG/ dir
    * Bump konnectivity-client to v0.0.15 in release-1.20
    * Storage e2e: Remove pd csi driver installation in GKE
    * Update CHANGELOG/CHANGELOG-1.20.md for v1.20.3
    * kube-cross: update image to use v1.15.8-legacy-1
    * [go1.15] build: Update to k/repo-infra@v0.1.4 (supports go1.15.8)
    * Use go-runner:buster-v2.3.1 image (built on go1.15.8)
    * staging/publishing: Set default go version to go1.15.8
    * Update to go1.15.8
    * Fix dbus shutdown events not continuing if they are not valid
    * Revert "make hostPort match test linuxonly"
    * Revert "conformance changes"
    * kube-proxy: clear conntrack entries after rules are in place
    * Use -LiteralPath instead of -Path
    * Escape the special character in vsphere windows path
    * Include unit test
    * Adjust defer to correctly call
    * do not remove volume dir when saveVolumeData fails
    * kubeadm: drop explicit constant override in version test
    * kubeadm: get k8s CI version markers from k8s infra bucket
    * dockershim hostport respect IPFamily
    * dockershim hostport manager use HostIP
    * Balance nodes in scheduling e2e
    * e2e: Pod should avoid nodes that have avoidPod annotation: clean remaining pods
    * Cherry pick of #98254:Fix the kube-scheduler binary's description of the --config parameter is inaccurate
    * fix kube-scheduler cannot send event because the Note field is too large
    * Fix nil pointer dereference in disruption controller
    * Update region_pd e2e test to support PV have GA topology
    * Recover CSI volumes from dangling attachments
    * IsVolumeAttachedToNode() renamed to GetAttachState(), and returns 3 states instead of combining "uncertain" and "detached" into "false"
    * Fixes Attach Detach Controller reconciler race reading ActualStateOfWorld and operation pending states; fixes reconciler_test mock detach to account for multiple attaches on a node
    * Fix translation of Cinder storage classess to CSI
    * OWNERS(CHANGELOG): Add release-engineering-reviewers as reviewers
    * OWNERS(CHANGELOG): Add release-engineering-reviewers as approvers
    * Resolve IP addresses of host-only in filtered dialer
    * Deflake ingress updates
    * make podTopologyHints protected by lock
    * ignore cgroup driver check in windows node upgrade
    * OWNERS(sig-release): Add CHANGELOG aliases
    * OWNERS(build-image): Add Release Managers as reviewers
    * OWNERS(releng): Sync Release Managers
    * OWNERS(sig-release): Remove SIG Release approvers alias
    * aggregate errors when putting vmss
    * fix azure file migration issue
    * kubelet: Fix mirrorPodTerminationMap leak
    * kubelet: Delete static pods gracefully
    * kubeadm: change the default image repository for CI images from gcr.io/kubernetes-ci-images to gcr.io/k8s-staging-ci-images
    * kubelet logs print 'kubelet nodes sync' frequently
    * reduce buckets for etcd_request_duration_seconds
    * Merge pull request #96876 from howieyuen/no-execute-taint-missing
    * cleanup subnet in frontend ip configs
    * conformance changes
    * make hostPort match test linuxonly
    * Clean up namespaced children of missing virtual parents with incorrectly cluster-scoped nodes
    * Add unit test for child scope mismatch with missing parent
    * vendor: update cAdvisor to v0.38.7
    * Use volumeHandle as PV name when translating EBS inline volume
    * Update CHANGELOG/CHANGELOG-1.20.md for v1.20.2
    * kubectl-convert import known versions
    * Revert "Merge pull request #92817 from kmala/kubelet"
    * WIP: node sync at least once
    * fixes nil panic for nil delegated auth options
    * Lower the frequency of volume plugin deprecation warning
    * handle webhook authenticator and authorizer error
    * fix the panic when kubelet registers if a node object already exists with no Status.Capacity or Status.Allocatable
    * Avoid checking the entire backend service URL for FR equality.
    * Use non privileged ports


author: rbrown@suse.com
changelog:
  - Update to version 1.20.6:
    * azure: fix node public IP not able to fetch issues from IMDS
    * Fix test now that empty struct are tracked in mangaed fields
    * make generated_files
    * Update bazel and dependencies.
    * Update to use cliflag.NamedFlagSets
    * Address comments.
    * Update NodeIPAM wrapper
    * Delete build file based on latest changes.
    * Update extension mechanism and related sample.
    * Address review comments
    * Address review comments
    * Modify integration test to fill CCM test gap
    * Update test
    * Move initialize cloud provider with client builder reference inside controller start func
    * Separate example func and add README.md
    * Separate func
    * Add demonstration of wiring nodeIPAMController config object
    * Remove cloud provider name as input parameter.
    * Fix flag passing in CCM.
    * Use apply to create objects in TestApplyStatus
    * Stop skipping APIService in apply test
    * Stop clearing OpenAPIConfig for kube-aggregator
    * Declare TCP default for service port protocol
    * Add ability to skip OpenAPI handler installation
    * do not tag user created public IPs
    * apf: fix test flake
    * update gogo/protobuf to v1.3.2
    * Fixed describe ingress causing SEGFAULT
    * Update sigs.k8s.io/structured-merge-diff to v4.0.3
    * Stop probing a pod during graceful shutdown
    * apf: handle error from PollImmediateUntil
    * staging/publishing: Set default go version to go1.15.10
    * webhook config manager: HasSynced returns true when the manager is synced with existing webhookconfig objects at startup
    * update metadata-concealment to 1.6 for removing legacy checking
    * slice mirroring controller mirror annotations
    * additional subnet configuration for AWS ELB
    * Revert "Automated cherry pick of #97417: fix azure file secret not found issue"
    * Use the correct volum handle format for GCE regional PD.
    * Increasing maximum number of ports allowed in EndpointSlice
    * Support > 5 ports in L4 ILB.
    * build: Update to k/repo-infra@v0.1.5 (supports go1.15.10)
    * Use go-runner:v2.3.1-go1.15.10-buster.0 image (built on go1.15.10)
    * Update to go1.15.10
    * Update CHANGELOG/CHANGELOG-1.20.md for v1.20.5
    * fix a bug where only service with less than 100 ports can have GCE load balancer
    * bazel
    * deepcopy statefulsets
    * full deepcopy on munged pod spec
    * remove pod toleration toleration seconds mutation
    * add markers for inspected validation mutation hits
    * move secret mutation from validation to prepareforupdate
    * remove unnecessary mutations in validation
    * tweak validation to avoid mutation
    * For LoadBalancer Service type don't create a HNS policy for empty or invalid external loadbalancer IP
    * Moving docker options to daemon.json
    * e2e fix: loosen configmap to 10 in resource quota
    * api-server add --lease-max-object-count
    * apiserver add metric etcd_lease_object_counts
    * apiserver add --lease-reuse-duration-seconds to config lease reuse duration
    * Bump Cluster Autoscaler to v1.20.0


author: alexandre.vicenzi@suse.com
changelog:
  - Update to version 1.20.7:
    * staging/publishing: Set default go version to go1.15.12
    * build: Update to k/repo-infra@v0.1.7 (supports go1.15.12)
    * Use go-runner:v2.3.1-go1.15.12-buster.0 image (built on go1.15.12)
    * Update to go1.15.12
    * fix: not tagging static public IP
    * Add test create service with ns
    * Set namespace when using kubectl create service
    * Automated cherry pick of #101377: Fix validation in kubectl create ingress (#101428)
    * Updating EndpointSlice controllers to avoid duplicate creations
    * Update pkg/volume/azure_file/azure_provision.go
    * Normalize share name to not include capital letters
    * Extend pod start timeout to 5min for storage subpath configmap test
    * fix: set "host is down" as corrupted mount
    * no watch endpointslice in userpace mode
    * Ensure service deleted when the Azure resource group has been deleted
    * Updating EndpointSlice validation to match Endpoints validation
    * Make parallel build memory threshold configurable
    * fix: azure file namespace issue in csi translation
    * pkg/kubelet: improve the node informer sync check
    * Additional CVE-2021-3121 fix
    * Fix startupProbe behaviour changed
    * Fix test
    * staging/publishing: Set default go version to go1.15.10
    * build: Update to k/repo-infra@v0.1.6 (supports go1.15.11)
    * Use go-runner:v2.3.1-go1.15.11-buster.0 image (built on go1.15.11)
    * Update to go1.15.11
    * add duration encoder to structured logger
    * Update CHANGELOG/CHANGELOG-1.20.md for v1.20.6
    * exec test should not run in Parallel as feature gate is not locked
    * hack/update-bazel.sh
    * respect ExecProbeTimeout
    * apf: exempt probes /healthz /livez /readyz
    * DelegatingAuthenticationOptions TokenReview request timeout
    * list pod list once to avoid timeout
    * Cleanup portforward streams after their usage
    * fix smb mount issue on Windows


author: rbrown@suse.com
changelog:
  - Update to version 1.20.9:
    * Bump to golang 1.15.14 in build/**
    * Bump to golang 1.15.14 in cluster/** and staging/**
    * Bump to golang 1.15.14 in test/**
    * Update debian-iptables image to buster-v1.6.5
    * Update debian-base image to buster-v1.8.0
    * Bump SMD to v4.1.2 to pick up #102749 fix
    * generate scheduler merge patches on the pod status instead of the full pod
    * p&f e2e test: log response header for better troubleshooting
    * Loadbalancer IngressIP policy should be configured as non-DSR to enable routing mesh by default
    * Do not throw error when we can't get canonical path
    * Fix Node Resources plugins score when there are pods with no requests
    * Update CHANGELOG/CHANGELOG-1.20.md for v1.20.8
    * Remove error wrap from logs
    * staging/publishing: Set default go version to go1.15.13
    * build: Update to k/repo-infra@v0.1.8 (supports go1.15.13)
    * Use go-runner:v2.3.1-go1.15.13-buster.0 image (built on go1.15.13)
    * Update to go1.15.13
    * feat: remove ephemeral-storage etcd requirement
    * endpointslicemirroring controller mirror address status
    * sched: fix a bug that a preemptor pod exists as a phantom
    * Revert "Cleanup portforward streams after their usage"
    * Remove unnecessary snapshot ability check
    * serviceOwnsFrontendIP shouldn't report error when the public IP doesn't match
    * Fix VolumeAttachment garbage collection for migrated PVs
    * Return UnschedulableAndUnresolvable when looking up volume-related resources returns NotFound error
    * Return UnschedulableAndUnresolvable instead of Error when failing to lookup pvc or storageclass in VolumeZone plugin
    * Ignore transient errors when gather stats
    * Speed up PV provisioning for vsphere driver
    * fix error of setting negative value for containerLogMaxSize
    * Upgrade konnectivity-client for GRPC connection fixes
    * Update etcd image revision
    * Update debian-base to buster-v1.7.0
    * Update debian-iptables to buster-v1.6.1
    * Respect annotation size limit for SSA last-applied.
    * Remove unnecessary quotes from get-kube scripts
    * Fix expired unit test certs
    * fix: delete non existing disk issue
    * Azure: avoid setting cached Sku when updating VMSS and VMSS instances
    * Update cos-gpu-installer image
    * Ref counting is only applicable to Remote endpoints
    * Make watch order conformance test reliable
    * Update CHANGELOG/CHANGELOG-1.20.md for v1.20.7
    * fix removing pods from podTopologyHints mapping
    * fix: avoid nil-pointer panic when checking the frontend IP configuration
    * Use CSI driver to determine unique name for migrated in-tree plugins
    * Add jitter to lease controller
    * Avoid caching the VMSS instances whose network profile is nil
    * chunk target operatation for aws targetGroup
    * Fix watchForLockfileContention memory leak
    * Fix cleanupMountpoint issue for Windows
    * Fixed the Dockerfile for the build-image to build from KUBE_BASE_IMAGE_REGISTRY


author: rbrown@suse.com
changelog:
  - Update to version 1.20.10:
    * Bump to golang 1.15.15 in build/**
    * Bump to golang 1.15.15 in cluster/** and staging/**
    * Bump to golang 1.15.15 in test/**
    * Avoid spurious calls to update/delete validation
    * Fix metrics reporting for the deprecated watch path
    * Update configure-helper.sh
    * Update configure-helper.sh
    * Update configure-helper.sh
    * Fix: ignore not a VMSS error for VMAS nodes in reconcileBackendPools
    * feat: Provide IPv6 support for internal load balancer
    * Update to using apiserver-network-proxy v1.22
    * Make CSR cleaner tolerate objects with invalid status.certificate
    * disable aufs module
    * update comments and owners file for pkg/util/removeall
    * kubelet: do not call RemoveAll on volumes directory for orphaned pods
    * APF e2e: wait for steady state before proceeding
    * Update CHANGELOG/CHANGELOG-1.20.md for v1.20.9
    * Updated to use konnectivity client v0.0.21, and implemented placeholder context
    * include google/go-cmp in client-go/dynamic/fake/BUILD
    * Simplify use of the fake dynamic client
    * fix: return empty VMAS name if using standalone VM
    * Fix race in attachdetach tests
    * Fix frameworkImpl.extenders being not set
    * Fix closing of decorated watcher channel on timeout
    * update bazel
    * (scheduler e2e) Create balanced pods in parallel


author: rbrown@suse.com
changelog:
  - Update to version 1.20.11:
    * Fix a small regression in Service updates
    * Service: Fix semantics for Update wrt allocations
    * Fix buckets initialization
    * fix: ensure InstanceShutdownByProviderID return false for creating Azure VMs
    * fix: skip case sensitivity when checking Azure NSG rules
    * Keep MakeMountArgSensitive and add a new signature that receives flags
    * Update the unit tests to handle mountFlags
    * Add missing interface method in mount_unsupported.go
    * Pass additional flags to subpath mount to avoid flakes in certain conditions
    * Update CHANGELOG/CHANGELOG-1.20.md for v1.20.10
    * Copy golang license to staging copies
    * delete stale UDP conntrack entries for loadbalancer IPs
    * job controller: don't mutate shared cache object
    * Set idle and readheader timeouts


author: rbrown@suse.com
changelog:
  - Update to version 1.20.13:
    * defer close the rotated log open
    * Add tests for checking bind mounts
    * Check subpath file
    * Add check for subpaths
    * Manual cherry pick of kube-openapi changes for release-1.20 Bump kube-openapi against kube-openapi/release-1.20 branch
    * Update bazel
    * Fixed unit test SELinux support
    * Add shortcut for SELinux detection
    * Don't guess SELinux support on error
    * Use separate pathSpec for local and remote to properly handle cleaning paths
    * support more than 100 disk mounts on Windows
    * Support cgroupv2 in node problem detector test
    * Update debian, debian-iptables images to pick up CVEs fixes
    * Fixing how EndpointSlice Mirroring handles Service selector transitions
    * Fix race condition in logging when request times out
    * Update CHANGELOG/CHANGELOG-1.20.md for v1.20.12
    * Run storage hostpath e2e test client pod as privileged
    * Ignore VMs in vmss delete backend pools
    * fix: skip not found nodes when reconciling LB backend address pools
    * fix: consolidate logs for instance not found error
    * Revert 102925: Fix Node Resources plugins score when there are pods with no requests
    * e2e scheduling priorities: do not reference control loop variable
    * tests: Wait for the network connectivity first
    * 'New' Event namespace validate failed
    * Update CHANGELOG/CHANGELOG-1.20.md for v1.20.11
    * Refine locking in API Priority and Fairness config controller
    * kube-controller-manager: properly check generic ephemeral volume feature
    * Fix null JSON round tripping
    * Propagate conversion errors
    * integration test
    * fix 104329: check for headless before trying to release the ClusterIPs
    * Fix use variables in the loop in vsphere_util
    * Address review comments
    * Add docs about process of discovering disks from new nodes
    * Fix unknown dangling volumes
    * fix detach disk issue on deleting node
    * fix: ignore the case when comparing azure tags in service annotation
    * fix: ignore the case when updating tags
    * backported PR#97721 from v1.21 ("fix slice controller logging for services ipfamily")
    * remove listx from OWNERS, OWNERS_ALIASES
    * Add explicit capability for online volume expansion
    * Bump golang.org/x/text to v0.3.6


author: Nikola Forró <nforro@redhat.com> - 0.41-17
changelog:
  - backport several upstream fixes
  - set Delegate property for cgconfig service to make sure complete
    cgroup hierarchy is always created by systemd


author: Nikola Forró <nforro@redhat.com> - 0.41-12
changelog:
  - resolves: #1406927
    start cgred service after nss-user-lookup target
    show warnings about unsuccessful user/group lookups


author: Nikola Forró <nforro@redhat.com> - 0.41-17
changelog:
  - show warning when "tasks" file can not be opened
  - extend description of "controllers" section in cgrules.conf man page
    resolves: #1561736


author: Ismail Dönmez <idonmez@suse.com>
changelog:
  - Update to version 3.3.0
    * The auto_unmount mode now works correctly in combination with
      autofs.
    * The FUSE_CAP_READDIRPLUS_AUTO capability is no longer enabled by
      default unless the file system defines both a readdir() and a
      readdirplus() handler.
    * The description of the FUSE_CAP_READDIRPLUS_AUTO flag has been
      improved.
    * Allow open /dev/fuse file descriptors to be passed via mountpoints
      of the special format /dev/fd/%u. This allows mounting to be
      handled by the parent so the FUSE filesystem process can run
      fully unprivileged.
    * Add a drop_privileges option to mount.fuse3 which causes it to open
      /dev/fuse and mount the file system itself, then run the FUSE file
      filesystem fully unprivileged and unable to re-acquire privilege
      via setuid, fscaps, etc.
    * Documented under which conditions the fuse_lowlevel_notify_*
      functions may block.
    * The chmod, chown, truncate, utimens and getattr handlers of
      the high-level API now all receive an additional struct
      fuse_file_info pointer. There are more API changes, consult
      https://github.com/libfuse/libfuse/releases/tag/fuse-3.3.0
      for details.


author: Paolo Stivanin <info@paolostivanin.com>
changelog:
  - Update to 3.4.2
    * The examples/passthrough_ll.c example filesystem has been significantly extended.
    * Support for copy_file_range has been added.
    * Build system updates for non-Linux systems.
    * Fixed a memory leak
    * Added OpenAFS and HFS+ to whitelist
    * Docu updates


author: Jan Engelhardt <jengelh@inai.de>
changelog:
  - Amend License: field with BSD2c, from
    https://github.com/libfuse/libfuse/commit/4c699e7debd99b178b9574e7dd20f36937ef296e#diff-3f1e2bdc537057b6ac2f74d095a431b8


author: Paolo Stivanin <info@paolostivanin.com>
changelog:
  - Update to 3.5.0:
    * Changed ioctl commands to "unsigned int" in order to support
      commands which do not fit into a signed int. Commands issued
      by applications are still truncated to 32 bits.
    * Added SMB2 to whitelist (so users can now mount FUSE
      filesystems on mountpoints within SMB 2.0 filesystems).
    * Added a new cache_readdir flag to fuse_file_info to enable
      caching of readdir results. Supported by kernels 4.20 and newer.
    * Add support and documentation for FUSE_CAP_NO_OPENDIR_SUPPORT.


author: Ismail Dönmez <idonmez@suse.com>
changelog:
  - Update to version 3.6.0
    * Added a new example (passthrough_hp). The functionality is
      similar to passthrough_ll, but the implementation focuses
      on performance and correctness rather than simplicity.
    * Added support for fuse kernel feature max_pages which allows
      to increase the maximum number of pages that can be used per
      request. This feature was introduced in kernel 4.20.
      max_pages is set based on the value in max_write.
      By default max_write will be 1MiB now for kernels that
      support max_pages. If you want smaller buffers or writes
      you have to set max_write manually.


author: Ismail Dönmez <idonmez@suse.com>
changelog:
  - Update to version 3.6.1 (bsc#1137860)
    * Fixed version number (release 3.6.0 was shipped with a declared
      version of 3.0.0).


author: wolfgang.frisch@suse.com
changelog:
  - Link test as position independent executable (bsc#1184124).
    + bug-1184124-link-tests-as-PIE.patch


author: heming.zhao@suse.com
changelog:
  - vgextend crash when extending VG with missing PV (bsc#1191019)
    + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch


author: heming.zhao@suse.com
changelog:
  - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
    + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
  - LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
    + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch


author: mwilck@suse.com
changelog:
  - udev: create symlinks and watch even in suspended state (bsc#1195231)
    + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch


author: heming.zhao@suse.com
changelog:
  - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
    + change lvm.conf item external_device_info_source from none to udev
    + bug-1179691_config-set-external_device_info_source-none.patch


author: heming.zhao@suse.com
changelog:
  - lvm reports udev database has incomplete information on devices (bsc#1202011)
    + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch


author: heming.zhao@suse.com
changelog:
  - lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
    - change %post behaviour, only do deleting job for non-link folder


author: heming.zhao@suse.com
changelog:
  - lvmlockd is not supporting sanlock (bsc#1203482)
    - set 1 for _supportsanlock in lvm2.spec for enabling sanlock.


author: heming.zhao@suse.com
changelog:
  - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
    - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163


author: amit.chaudhary@suse.com
changelog:
  - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
    - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch


author: Robert Scheck <robert@fedoraproject.org> 1.1.6-7
changelog:
  - Run autoreconf to recognize aarch64 (#925813)
  - Conditionalized usage of %{_lib} vs %{_libdir} for RHEL < 7
  - Tight run-time dependencies between sub-packages via %{?_isa}


author: mvyskocil@suse.com
changelog:
  - update to 1.1.6
    * obsoleted libnet-1.1.2.1-uninitialized-fix.diff
    * obsoleted libnet-1.1.5-arrray-fix.diff
    * fixes the PF_PACKET detection (bnc#810138)
    * includes many bugfixes from Debian
    * ICMPv6 and IPv6 related bugfixes
    * and many more


author: mvyskocil@suse.com
changelog:
  - Update to 1.2
    no changelog available
  - add libnet-1.2.0-drop-man-build.patch to not fail on non existing
    manual pages


author: tchvatal@suse.com
changelog:
  - Update to actual released tarball which is versioned 1.2-rc3
  - Cleanup with spec-cleaner
  - No reason to not have this library in /usr so move it there
  - Add patch libnet-1.2-rc.patch needed to set proper version in
    automake.


author: Phil Sutter <psutter@redhat.com> - 1.0.0-22
changelog:
  - src: fix incorrect building and parsing of the NFCTH_POLICY_SETX attribute
  - examples: kill the "invalid argument" error in nftc-helper-add
  - examples: fix double free in nftc-helper-add
  - include: Sync with kernel headers
  - src: fix use after free


author: jengelh@inai.de
changelog:
  - Update to initial official release 1.0.0
    * This library provides the infrastructure for the user-space
    helper infrastructure available since the Linux kernel 3.6.


author: cshorler@googlemail.com
changelog:
  - Add fix_h_expect_policy_free.patch to fix crash due to following
    a just-freed pointer [bnc#908875]


author: jengelh@inai.de
changelog:
  - Remove version from subinclude directory; it tends to break
    recompiles of third software after a library update.


author: jengelh@inai.de
changelog:
  - Update to first official tarball release 1.0.0
    * Add ICMPv6 support
    * add new parameter type to nfct_timeout_snprintf


author: jengelh@inai.de
changelog:
  - Drop %version from subincludedir, it tends to break recompiles of
    already-built trees on library updates.


author: Phil Sutter <psutter@redhat.com> [1.0.6-5.el7]
changelog:
  - expr: lookup: give support for inverted matching (Phil Sutter) [1441084]
  - tests: stricter string attribute validation (Phil Sutter) [1441084]


author: Phil Sutter <psutter@redhat.com> [1.0.6-6.el7]
changelog:
  - chain: dynamically allocate name (Phil Sutter) [1353320]
  - src: Avoid returning uninitialized data (Phil Sutter) [1353319]
  - expr/limit: Drop unreachable code in limit_to_type() (Phil Sutter) [1353312]
  - ruleset: Initialize ctx.flags before calling nftnl_ruleset_ctx_set() (Phil Sutter) [1353322]
  - src: Fix nftnl_*_get_data() to return the real attribute length (Phil Sutter) [1353322]
  - expr/ct: prevent array index overrun in ctkey2str() (Phil Sutter) [1353309]
  - utils: Don't return directly from SNPRINTF_BUFFER_SIZE (Phil Sutter) [1353311]
  - set: prevent memleak in nftnl_jansson_parse_set_info() (Phil Sutter) [1353311]


author: Phil Sutter <psutter@redhat.com> [1.0.8-2.el7]
changelog:
  - trace: Check return value of mnl_attr_parse_nested() (Phil Sutter) [1510538]
  - set_elem: Don't return garbage in nftnl_set_elems_parse() (Phil Sutter) [1510538]
  - ruleset: Avoid reading garbage in nftnl_ruleset_cb() (Phil Sutter) [1510538]
  - object: Avoid returning garbage in nftnl_obj_do_parse() (Phil Sutter) [1510538]
  - gen: Remove a pointless call to mnl_nlmsg_get_payload() (Phil Sutter) [1510538]
  - data_reg: Add a missing break in nftnl_data_reg_snprintf (Phil Sutter) [1510538]


author: Phil Sutter <psutter@redhat.com> [1.1.1-3.el8]
changelog:
  - src: chain: Fix nftnl_chain_rule_insert_at() (Phil Sutter) [1666495]
  - src: chain: Add missing nftnl_chain_rule_del() (Phil Sutter) [1666495]
  - flowtable: Fix for reading garbage (Phil Sutter) [1661327]
  - flowtable: Fix memleak in nftnl_flowtable_parse_devs() (Phil Sutter) [1661327]
  - flowtable: Fix use after free in two spots (Phil Sutter) [1661327]
  - flowtable: Add missing break (Phil Sutter) [1661327]
  - object: Avoid obj_ops array overrun (Phil Sutter) [1661327]


author: Phil Sutter <psutter@redhat.com> [1.1.4-2.el8]
changelog:
  - obj/ct_timeout: Fix NFTA_CT_TIMEOUT_DATA parser (Phil Sutter) [1758673]
  - set_elem: Validate nftnl_set_elem_set() parameters (Phil Sutter) [1758673]
  - obj/ct_timeout: Avoid array overrun in timeout_parse_attr_data() (Phil Sutter) [1758673]
  - set: Don't bypass checks in nftnl_set_set_u{32,64}() (Phil Sutter) [1758673]
  - obj/tunnel: Fix for undefined behaviour (Phil Sutter) [1758673]
  - set_elem: Fix return code of nftnl_set_elem_set() (Phil Sutter) [1758673]
  - obj: ct_timeout: Check return code of mnl_attr_parse_nested() (Phil Sutter) [1758673]


author: Phil Sutter <psutter@redhat.com> [1.1.5-2.el8]
changelog:
  - chain: Correctly check realloc() call (Phil Sutter) [1778952]
  - flowtable: Correctly check realloc() call (Phil Sutter) [1778952]
  - chain: Fix memleak in error path of nftnl_chain_parse_devs() (Phil Sutter) [1778952]
  - flowtable: Fix memleak in error path of nftnl_flowtable_parse_devs() (Phil Sutter) [1778952]


author: Phil Sutter <psutter@redhat.com> [1.1.5-3.el8]
changelog:
  - set_elem: Introduce support for NFTNL_SET_ELEM_KEY_END (Phil Sutter) [1795223]
  - set: Add support for NFTA_SET_DESC_CONCAT attributes (Phil Sutter) [1795223]
  - include: resync nf_tables.h cache copy (Phil Sutter) [1795223]


author: Phil Sutter <psutter@redhat.com> [1.1.5-5.el8]
changelog:
  - set: expose nftnl_set_elem_nlmsg_build() (Phil Sutter) [2040754]
  - expr: dynset: release stateful expression from .free path (Phil Sutter) [2040478]
  - set_elem: missing set and build for NFTNL_SET_ELEM_EXPR (Phil Sutter) [2040478]


author: astieger@suse.com
changelog:
  - PCRE2, a re-working of the original PCRE library to provide an
    entirely new API, version 10.10. Not source compatible.
  - copy of the pcre package, with the following adjustments:
    * required name changes
    * adjust pcre-8.21-multilib.patch to pcre2-10.10-multilib.patch
    * drop upstreamed pcre-8.32-visibility.patch
    * --enable-{utf8,unicode-properties} became --enable-unicode
    * drop cpp subpackage
    * make test -> check
    * enable 32 bit character support


author: astieger@suse.com
changelog:
  - PCRE2 10.20:
    * Callouts with string arguments and the
      pcre2_callout_enumerate() function have been implemented.
    * The PCRE2_NEVER_BACKSLASH_C option, which locks out the use of
      \C, is added.
    * The PCRE2_ALT_CIRCUMFLEX option lets ^ match after a newline at
      the end of a subject in multiline mode.
    * The way named subpatterns are handled has been refactored. The
      previous approach had several bugs.
    * The handling of \c in EBCDIC environments has been changed to
      conform to the perlebcdic document. (Incompatible change)
    * Bugs have been mended, many of them discovered by fuzzers.


author: jengelh@inai.de
changelog:
  - Update to new upstream release 10.21
    * Improve JIT matching speed of patterns starting with + or *.
    * Use memchr() to find the first character in an unanchored match
    in 8-bit mode in the interpreter. This gives a significant speed
    improvement.
    * 10.20 broke the handling of [[:>:]] and [[:<:]] in that
    processing them could involve a buffer overflow if the
    following character was an opening parenthesis.
    * 10.20 also introduced a bug in processing this pattern:
    /((?x)(*:0))#(?'/, which was fixed.
    * A callout with a string argument containing an opening square
    bracket, for example /(?C$[$)(?<]/, was incorrectly processed and
    could provoke a buffer overflow.
    * A possessively repeated conditional group that could match an empty
    string, for example, /(?(R))*+/, was incorrectly compiled.
    * The Unicode tables have been updated to Unicode 8.0.0.
    * An empty comment (?#) in a pattern was incorrectly processed and
    could provoke a buffer overflow.
    * Fix infinite recursion in the JIT compiler when certain patterns
    /such as (?:|a|){100}x/ are analysed.
    * Some patterns with character classes involving [: and \\ were
    incorrectly compiled and could cause reading from uninitialized
    memory or an incorrect error diagnosis. Examples are:
    /[[:\\](?<[::]/ and /[[:\\](?'abc')[a:].
    * A missing closing parenthesis for a callout with a string argument
    was not being diagnosed, possibly leading to a buffer overflow.
    * If (?R was followed by - or + incorrect behaviour happened instead
    of a diagnostic.
    * Fixed an issue when \p{Any} inside an xclass did not read the current
    character.
    * About 80 more fixes, which you can read about in the ChangeLog
    shipped with the libpcre2-8-0 package.


author: astieger@suse.com
changelog:
  - pcre2 10.22:
    * The POSIX wrapper function regcomp() did not used to
      support back references and subroutine calls if called with the
      REG_NOSUB option. It now does.
    * A new function, pcre2_code_copy(), is added, to make a copy of a
      compiled pattern.
    * Support for string callouts is added to pcre2grep.
    * Added the PCRE2_NO_JIT option to pcre2_match().
    * The pcre2_get_error_message() function now returns with a
      negative error code if the error number it is given is unknown.
    * Several updates have been made to pcre2test and test scripts
    * Fix CVE-2016-3191: workspace overflow for (*ACCEPT) with deeply
      nested parentheses (boo#971741)


author: astieger@suse.com
changelog:
  - pcre2 10.23:
    * major re-factoring of the pcre2_compile.c file
    * Back references are now permitted in lookbehind assertions when
      there are no duplicated group numbers (that is, (?| has not
      been used), and, if the reference is by name, there is only one
      group of that name. The referenced group must, of course be of
      fixed length.
    * \g{+<number>} (e.g. \g{+2} ) is now supported. It is a "forward
      back reference" and can be useful in repetitions
      (compare \g{-<number>} ). Perl does not recognize this syntax.
    * pcre2grep now automatically expands its buffer up to a maximum
      set by --max-buffer-size.
    * The -t option (grand total) has been added to pcre2grep.
    * A new function called pcre2_code_copy_with_tables() exists to
      copy a compiled pattern along with a private copy of the
      character tables that is uses.


author: astieger@suse.com
changelog:
  - pcre2grep can now read .gz and .bz2 files directly
  - pcre2test is now built to support line editing


author: jengelh@inai.de
changelog:
  - Update to new upstream release 10.30
    * The main interpreter, pcre2_match(), has been refactored into
      a new version that does not use recursive function calls for
      remembering backtracking positions. The new implementation
      allows backtracking into recursive group calls in patterns,
      making it more compatible with Perl. For patterns that have a
      lot of backtracking, the heap is now used, and there is
      explicit limit on the amount, settable by
      pcre2_set_heap_limit(). The "recursion limit" is retained,
      but is renamed as "depth limit".
    * The new option PCRE2_ENDANCHORED insists that a pattern match
      must end at the end of the subject.
    * The new option PCRE2_EXTENDED_MORE implements Perl's /xx
      feature, and pcre2test is upgraded to support it. Setting
      within the pattern by (?xx) is Also supported.
    * (?n) can be used to set PCRE2_NO_AUTO_CAPTURE, because Perl
      now has this.
    * Additional pattern compile options in the compile context are
      now available: PCRE2_EXTRA_ALLOW_SURROGATE_ESCAPES and
      PCRE2_EXTRA_BAD_ESCAPE_IS LITERAL.
    * The newline type PCRE2_NEWLINE_NUL is now available.
    * The match limit value now also applies to pcre2_dfa_match()
      as there are patterns that can use up a lot of resources
      without necessarily recursing very deeply.
    * Various minor security fixes found by fuzzers:
      + bsc#1037165: crash for forward reference in lookbehind with
      PCRE2_ANCHORED
      + CVE-2017-8786: heap-based buffer overflow write in pcre2test
      (bsc#1036942)
      + CVE-2017-7186: DoS by triggering an invalid Unicode property
      lookup (bsc#1030066)
  - Switch source URLs to use HTTP.


author: avindra@opensuse.org
changelog:
  - Update to new upstream release 10.31
    * New pcre2_config() options: PCRE2_CONFIG_NEVER_BACKSLASH_C and
      PCRE2_CONFIG_COMPILED_WIDTHS.
    * New pcre2_pattern_info() option PCRE2_INFO_EXTRAOPTIONS to
      retrieve the extra compile time options.
    * Public names for all pcre2_compile() error numbers.
    * Added PCRE2_CALLOUT_STARTMATCH and PCRE2_CALLOUT_BACKTRACK
      bits to a new field callout_flags in callout blocks.
  - use https for main site
  - cleanup with spec-cleaner


author: coolo@suse.com
changelog:
  - update to 0.15
    - make protobuf_c_message_init() into a function (Issue #49, daveb)
    - Fix for freeing memory after unpacking bytes w/o a default-value.
      (Andrei Nigmatulin)
    - minor windows portability issues (use ProtobufC_FD) (Pop Stelian)
    - --with-endianness={little,big} (Pop Stelian)
    - bug setting up values of has_idle in public dispatch,
      make protobuf_c_dispatch_run() use only public members (daveb)
    - provide cmake support and some Windows compatibility (Nikita Manovich)


author: dimstar@opensuse.org
changelog:
  - Update to version 1.1.0:
    + Fix a bug when merging optional byte fields.
    + Documentation updates.
    + Implement oneof support (Issue #174). Protobuf 2.6.0 or newer
      is now required to build protobuf-c.
    + Print leading comments for enum, message, and field definitions
      into generated header files (Issue #175).
  - Changes from version 1.0.2:
    + Fix a build failure with Protobuf 2.6.0 related to aliased enum
      constants (Issue #163).
    + Protobuf 2.5.0 or newer is now required to build protobuf-c
      (Issue #166). This is due to the fix for #163.
    + Eliminate void pointer arithmetic (Issue #167).
    + Always define PROTOBUF_C__DEPRECATED, even on compilers that
      are not GCC (Issue #167).
    + Work around the lack of the 'inline' keyword in Microsoft
      compilers (Issue #167).
    + Add a CMakeLists.txt file as a fallback build system for
      Windows (Issue #168).
    + Fix a build failure in the test suite that occurred with a
      parallel make running on a system with a large number of CPUs
      (Issue #156, #169).
  - Changes from version 1.0.1:
    + Explicitly set the .data field of ProtobufCBinaryData's to NULL
      when unpacking a zero length byte string (Issue #157).
  - For a list of changes between 0.15 and 1.0.0, please refer to the
    extensive ChangeLog file.
  - Bump soname to 1, following upstream.
  - Update Url tag: project moved over to github.
  - Update license to be BSD-3-Clause and install LICENSE file.


author: meissner@suse.com
changelog:
  - Update to version 1.1.1:
    [ Ilya Lipnitskiy ]
    * Munge C block comment delimiters in protobuf comments, preventing syntax
      errors in generated header files (Issue #180, #185).
    * Add static qualifier to ProtobufCEnumValue and ProtobufCEnumValueIndex
      variables in generated output.
    [ Oleg Efimov ]
    * Fix -Wpointer-sign compiler diagnostics in the test suite.
    * Check for NULL pointers in protobuf_c_message_free_unpacked() (Issue #177).
    * Exclude protoc-c and downloaded protobuf sources from Coveralls report.
    [ Andrey Myznikov ]
    * Fix incorrect 'short_name' field values in ProtobufCServiceDescriptor
      variables in generated output.


author: dimstar@opensuse.org
changelog:
  - Update to version 1.3.0:
    * Add test case for the issue in #220 (#254).
    * Fix issue #251, "Bad enums with multiple oneofs" (#256).
    * Add warning flags to my_CFLAGS (#257).
    * Fix namespace errors when compiled with latest protobuf (#280).
    * Bump minimum required header version for proto3 syntax (#282).
    * Relax autoconf constraint from v2.64 to v2.63 so that it works
      on older Linux distros (#233).
    * Fix bigendian -Wunused-label warning (#215).a
    * proto3 support (#228).
    * Remove leftover FIXME comment (#258).
    * Fix proto3 "is zeroish" evaluation (#264).
    * Small cleanup in oneof handling (#265).
    * Rework is_zeroish one more time (#267).
    * proto3: make strings default to "" instead of NULL (#274).
    * CMake: Allow protobuf-c to be included via include_subdirectory
      (#245).
  - Changes from version 1.2.1:
    * protoc-c: Generate code that uses the universal zero initializer
      {0} when initializing a oneof union (#187, #205).
  - Changes from version 1.2.0:
    * Implement the "optimize_for = CODE_SIZE" option (#183).
    * Eliminate undefined behavior in zigzag functions (#198).
    * Pack negative enum values correctly (#199).
    * Fix protobuf_c_message_get_packed_size() on 16-bit systems
      (#196, #197).
    * Update link to Autotools Mythbuster to canonical site (#201).
    * Skip test suite when cross-compiling (#184).


author: jengelh@inai.de
changelog:
  - Update to new upstream release 1.3.1
    * Restore protobuf-2.x compatibility
    * Convert uses of protobuf's scoped_ptr.h to C++11 std::unique_ptr,
      needed to compile against protobuf 3.6.1.
  - Rename %soname to %sover to better reflect its use.


author: jengelh@inai.de
changelog:
  - Update to new upstream release 1.3.2
    * Fix proto3 repeated scalar field default packing behavior
    * Fix out-of-bounds read in scan_length_prefixed_data()
  - Remove protobuf-c-namespace.patch (merged)


author: Matej Cepl <mcepl@suse.com>
changelog:
  - Unify packages among openSUSE:Factory and SLE versions.
    (bsc#1159035) ; add missing records to this changelog.
  - Add idle.desktop and idle.appdata.xml to provide IDLE in menus
    (bsc#1153830)


author: Dominique Leuenberger <dimstar@opensuse.org>
changelog:
  - Drop appstream-glib BuildRequires and no longer call
    appstream-util validate-relax: eliminate a build cycle between
    as-glib and python. The only thing would would gain by calling
    as-uril is catching if upstream breaks the appdata.xml file in a
    future release. Considering py2 is dying, chances for a new
    release, let alone one breaking the xml file, are slim.


author: Tomáš Chvátal <tchvatal@suse.com>
changelog:
  - Add provides in gdbm subpackage to provide dbm symbols. This
    allows us to use %%{python_module dbm} as a dependency and have
    it properly resolved for both python2 and python3


author: Matej Cepl <mcepl@suse.com>
changelog:
  - Add python-2.7.17-switch-off-failing-SSL-tests.patch to switch
    off tests coliding with the combination of modern Python and
    ancient OpenSSL on SLE-12.


author: Matej Cepl <mcepl@suse.com>
changelog:
  - Add CVE-2020-8492-urllib-ReDoS.patch fixing the security bug
    "Python urrlib allowed an HTTP server to conduct Regular
    Expression Denial of Service (ReDoS)" (bsc#1162367)


author: Matej Cepl <mcepl@suse.com>
changelog:
  - Change to Requires: libpython%{so_version} == %{version}-%{release}
    to python-base to keep both packages always synchronized (add
    %{so_version}) (bsc#1162224).


author: Matej Cepl <mcepl@suse.com>
changelog:
  - Add CVE-2019-9674-zip-bomb.patch to improve documentation
    warning about dangers of zip-bombs and other security problems
    with zipfile library. (bsc#1162825 CVE-2019-9674)


author: Matej Cepl <mcepl@suse.com>
changelog:
  - Add CVE-2019-18348-CRLF_injection_via_host_part.patch to
    disallow control characters in hostnames in httplib,
    addressing CVE-2019-18348. Such potentially malicious header
    injection URLs now cause a InvalidURL to be raised.
    (bsc#1155094)


author: Matej Cepl <mcepl@suse.com>
changelog:
  - Add CVE-2019-20907_tarfile-inf-loop.patch fixing bsc#1174091
    (CVE-2019-20907, bpo#39017) avoiding possible infinite loop
    in specifically crafted tarball.
    Add recursion.tar as a testing tarball for the patch.


author: Steve Kowalik <steven.kowalik@suse.com>
changelog:
  - Add CVE-2020-26116-httplib-header-injection.patch fixing bsc#1177211
    (CVE-2020-26116, bpo#39603) no longer allowing special characters in
    the method parameter of HTTPConnection.putrequest in httplib, stopping
    injection of headers. Such characters now raise ValueError.


author: Matej Cepl <mcepl@suse.com>
changelog:
  - Replace bundled wheels for pip and setuptools with the updated ones
    (bsc#1176262 CVE-2019-20916).


author: Paul Moore <pmoore@redhat.com> - 2.2.1-1
changelog:
  - Removed '--disable-static' from the build to ensure that scmp_sys_resolver
    is self contained and resolve RPATH issues


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-8
changelog:
  - Save linked policy, skip re-link when possible
  - Replace access(,F_OK) checks to make setuid programs work (#1186431)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-9
changelog:
  - Update semanage to allow runtime labeling of Infiniband Pkeys (#1466274)
  - Update semanage to allow runtime labeling of ibendports (#1466274)
  - Keep copy of file_contexts.homedirs in policy store (#1409813)
  - Add support for listing fcontext.homedirs file (#1409813)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-12
changelog:
  - Do not change file mode of seusers and users_extra (#1512639)
  - Improve warning for installing disabled module (#1337199)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-14
changelog:
  - Include user name in ROLE_REMOVE audit events (#1622045)
  - Improve "reset umask before creating directories"


author: astieger@suse.com
changelog:
  - update to 1.0.3:
    * SIMD code removed
    * performance improvements
  - package library
  - conflicts with libmd-devel


author: astieger@suse.com
changelog:
  - better printing of errors, and allow hashing stdin
    add sha1collisiondetection-1.0.3-io-fixes.patch


author: tiwai@suse.de
changelog:
  - Fix include header path to /usr/include/sha1dc/sha1.h as supposed
    by upstream installation
  - Remove conflicts with libmd-devel, as we changed the header path


author: Jindrich Novy <jnovy@redhat.com> - 4.3.0-3
changelog:
  - fix static analysis issues merged upstream
    (https://gitlab.freedesktop.org/slirp/libslirp/-/merge_requests/41)
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 4.3.0-4
changelog:
  - fix "CVE-2020-10756 QEMU: slirp: networking out-of-bounds read information disclosure vulnerability"
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 4.4.0-1
changelog:
  - Fix CVE-2021-3592 CVE-2021-3593 CVE-2021-3594 CVE-2021-3595 out-of-bounds access
  - Related: #1934415


author: Pavel Raiskup <praiskup@redhat.com> - 2.4.2-14
changelog:
  - allow root to copy files into NFS in libtoolize (#740079)
  - pre-filter sed's input by dd (#636045)


author: Phil Sutter <psutter@redhat.com> [0.8-6.el7]
changelog:
  - netlink_linearize: exthdr op must be u32 (Phil Sutter) [1524246]
  - src: fix protocol context update on big-endian systems (Phil Sutter) [1523016]


author: Phil Sutter <psutter@redhat.com> [0.8-9.el7]
changelog:
  - evaluate: explicitly deny concatenated types in interval sets (Phil Sutter) [1576426]
  - Deprecate add/insert rule 'position' argument (Phil Sutter) [1571968]
  - doc: reword insert position, this expects rule handle to insert, not a relative postition (Phil Sutter) [1571968]
  - nft.8: Fix reject statement documentation (Phil Sutter) [1571938]
  - netlink_delinearize: Fix resource leaks (Phil Sutter) [1504157]
  - netlink: Complain if setting O_NONBLOCK fails (Phil Sutter) [1504157]
  - hash: Fix potential null-pointer dereference in hash_expr_cmp() (Phil Sutter) [1504157]
  - evaluate: Fix memleak in stmt_reject_gen_dependency() (Phil Sutter) [1504157]
  - erec: Avoid passing negative offset to fseek() (Phil Sutter) [1504157]
  - cli: Drop pointless check in cli_append_multiline() (Phil Sutter) [1504157]
  - monitor: Make JSON/XML output respect output_fp (Phil Sutter) [1504157]
  - monitor: Make trace events respect output_fp (Phil Sutter) [1504157]
  - Review switch statements for unmarked fall through cases (Phil Sutter) [1504157]


author: Phil Sutter <psutter@redhat.com> [0.8-11.el7]
changelog:
  - src: Reject 'export vm json' command (Phil Sutter) [1646336]
  - monitor: Drop fake XML support (Phil Sutter) [1646336]
  - src: bail out when exporting ruleset with unsupported output (Phil Sutter) [1646336]


author: Phil Sutter <psutter@redhat.com> [0.8-13.el7]
changelog:
  - doc: Add minimal description of (v)map statements (Phil Sutter) [1628974]
  - nft.8: Update meta pkt_type value description (Phil Sutter) [1628694]


author: Phil Sutter <psutter@redhat.com> [0.9.3-16.el8]
changelog:
  - src: Set NFT_SET_CONCAT flag for sets with concatenated ranges (Phil Sutter) [1820684]
  - include: Resync nf_tables.h cache copy (Phil Sutter) [1820684]


author: Phil Sutter <psutter@redhat.com> [0.9.3-17.el8]
changelog:
  - json: don't leave dangling pointers on hlist (Phil Sutter) [1900565]
  - json: Fix seqnum_to_json() functionality (Phil Sutter) [1900565]
  - json: echo: Speedup seqnum_to_json() (Phil Sutter) [1900565]
  - proto: Fix ARP header field ordering (Phil Sutter) [1896334]
  - proto: add sctp crc32 checksum fixup (Phil Sutter) [1895804]
  - mergesort: unbreak listing with binops (Phil Sutter) [1891790]
  - evaluate: missing datatype definition in implicit_set_declaration() (Phil Sutter) [1877022]
  - evaluate: Perform set evaluation on implicitly declared (anonymous) sets (Phil Sutter) [1877022]
  - src: store expr, not dtype to track data in sets (Phil Sutter) [1877022]


author: Phil Sutter <psutter@redhat.com> [0.9.3-19.el8]
changelog:
  - evaluate: Reject quoted strings containing only wildcard (Phil Sutter) [1818117]
  - tests: monitor: use correct $nft value in EXIT trap (Phil Sutter) [1919203]
  - monitor: Fix for use after free when printing map elements (Phil Sutter) [1919203]
  - tests: Disable tests known to fail on RHEL8 (Phil Sutter) [1919203]


author: Phil Sutter <psutter@redhat.com> [0.9.3-20.el8]
changelog:
  - src: Optimize prefix matches on byte-boundaries (Phil Sutter) [1934926]
  - src: Support odd-sized payload matches (Phil Sutter) [1934926]
  - spec: Add an rpminspect.yaml file to steer rpminspect (Phil Sutter) [1962184]
  - spec: Explicitly state dist string in Release tag (Phil Sutter) [1962184]


author: Phil Sutter <psutter@redhat.com> [0.9.3-21.el8]
changelog:
  - tests: shell: Fix bogus testsuite failure with 100Hz (Phil Sutter) [1919203]
  - doc: nft.8: Extend monitor description by trace (Phil Sutter) [1820365]
  - include: missing sctp_chunk.h in Makefile.am (Phil Sutter) [1979334]
  - exthdr: Implement SCTP Chunk matching (Phil Sutter) [1979334]
  - scanner: sctp: Move to own scope (Phil Sutter) [1979334]
  - scanner: introduce start condition stack (Phil Sutter) [1979334]
  - json: Simplify non-tcpopt exthdr printing a bit (Phil Sutter) [1979334]
  - json: tcp: add raw tcp option match support (Phil Sutter) [1979334]
  - tcp: add raw tcp option match support (Phil Sutter) [1979334]
  - tcpopt: allow to check for presence of any tcp option (Phil Sutter) [1979334]
  - tcpopt: split tcpopt_hdr_fields into per-option enum (Phil Sutter) [1979334]
  - tcpopt: rename noop to nop (Phil Sutter) [1979334]
  - tcpopts: clean up parser -> tcpopt.c plumbing (Phil Sutter) [1979334]
  - parser: merge sack-perm/sack-permitted and maxseg/mss (Phil Sutter) [1979334]
  - tests/py: Move tcpopt.t to any/ directory (Phil Sutter) [1979334]


author: Phil Sutter <psutter@redhat.com> [0.9.3-22.el8]
changelog:
  - json: Drop pointless assignment in exthdr_expr_json() (Phil Sutter) [1999059]
  - parser_json: Fix for memleak in tcp option error path (Phil Sutter) [1999059]
  - parser_bison: Fix for implicit declaration of isalnum (Phil Sutter) [1999059]
  - parser_json: Fix error reporting for invalid syntax (Phil Sutter) [1994141]


author: Phil Sutter <psutter@redhat.com> [0.9.3-23.el8]
changelog:
  - tests: cover baecd1cf2685 ("segtree: Fix segfault when restoring a huge interval set") (Phil Sutter) [1908127]
  - segtree: Fix segfault when restoring a huge interval set (Phil Sutter) [1908127]


author: Phil Sutter <psutter@redhat.com> [0.9.3-24.el8]
changelog:
  - tests: shell: better parameters for the interval stack overflow test (Phil Sutter) [1908127]
  - tests: shell: $NFT needs to be invoked unquoted (Phil Sutter) [1908127]


author: Phil Sutter <psutter@redhat.com> [0.9.3-25.el8]
changelog:
  - mnl: do not build nftnl_set element list (Phil Sutter) [2047821]
  - tests: py: add dnat to port without defining destination address (Phil Sutter) [2030773]
  - evaluate: fix inet nat with no layer 3 info (Phil Sutter) [2030773]
  - evaluate: attempt to set_eval flag if dynamic updates requested (Phil Sutter) [2039594]
  - src: support for restoring element counters (Phil Sutter) [2039594]
  - netlink: remove unused parameter from netlink_gen_stmt_stateful() (Phil Sutter) [2039594]


author: Phil Sutter <psutter@redhat.com> [0.9.3-26.el8]
changelog:
  - libnftables: call nft_cmd_expand() only with CMD_ADD (Phil Sutter) [2073287]
  - src: add CMD_OBJ_SETELEMS (Phil Sutter) [2073287]
  - src: rename CMD_OBJ_SETELEM to CMD_OBJ_ELEMENTS (Phil Sutter) [2073287]
  - rule: fix element cache update in __do_add_setelems() (Phil Sutter) [2073287]
  - rule: memleak in __do_add_setelems() (Phil Sutter) [2073287]
  - tests: shell: auto-removal of chain hook on netns removal (Phil Sutter) [2070924]
  - mnl: do not use expr->identifier to fetch device name (Phil Sutter) [2070924]


author: Phil Sutter <psutter@redhat.com> [1.0.4-1.el8]
changelog:
  - Synchronize patch level with nftables-1.0.4-10.el9 (Phil Sutter) [2211076]
  - Rebase onto version 1.0.4 (Phil Sutter) [2211076]


author: Phil Sutter <psutter@redhat.com> [1.0.4-2.el8]
changelog:
  - Add expected error records for testsuite runs (Phil Sutter) [2211076]
  - tests: monitor: Summarize failures per test case (Phil Sutter) [2211076]


author: Phil Sutter <psutter@redhat.com> [1.0.4-3.el8]
changelog:
  - spec: Rename variables to avoid a clash (Phil Sutter) [INTERNAL]
  - rule: check address family in set collapse (Phil Sutter) [RHEL-5160]


author: vcizek@suse.com
changelog:
  - update to 0.17017
    - Bleadperl broke Error.pm's tests -
    - https://rt.cpan.org/Ticket/Display.html?id=74770
    - Applied a patch to check for optional trailing periods.
    - Thanks to ANDK for the report and RURBAN for the patch


author: coolo@suse.com
changelog:
  - updated to 0.17020
    Error.pm #0.17020
    - Correct typos.
    - https://rt.cpan.org/Ticket/Display.html?id=85023
    Error.pm #0.17019
    - Change to Shlomi Fish's new E-mail and web address.
    - Clarify the licence of lib/Error/Simple.pm .
    - https://rt.cpan.org/Ticket/Display.html?id=81277
    - Thanks to Marcela
    Error.pm #0.17018
    - Add a $VERSION variable for Error::Simple.
    - thanks to Kevin Dawson for the report.
    - Add scripts/bump-version-number.pl .
    - This can be used to bump the version numbers globally.


author: coolo@suse.com
changelog:
  - updated to 0.17021
    Error.pm #0.17021
    - Fix for the format of the new Carp (in bleadperl)
    - https://rt.cpan.org/Ticket/Display.html?id=88137
    - Thanks to Zefram for the report and patch.


author: coolo@suse.com
changelog:
  - updated to 0.17022
    - Add "use warnings;" to everything (CPANTS Kwalitee).
    - Add a separate LICENSE file (CPANTS Kwalitee).


author: coolo@suse.com
changelog:
  - updated to 0.17023
    see /usr/share/doc/packages/perl-Error/ChangeLog
    Feb 12 2015 <shlomif@shlomifish.org> (Shlomi Fish)
      Error.pm #0.17023
    - Minimal version of Module-Build reduced to 0.280801
    - https://rt.cpan.org/Public/Bug/Display.html?id=102062


author: coolo@suse.com
changelog:
  - updated to 0.17024
    see /usr/share/doc/packages/perl-Error/ChangeLog
    May 30 2015 <shlomif@shlomifish.org> (Shlomi Fish)
      Error.pm #0.17024
    - Add link to the VCS repository in META.yml


author: coolo@suse.com
changelog:
  - updated to 0.17025
    see /usr/share/doc/packages/perl-Error/ChangeLog
    Aug 07 2017 <shlomif@shlomifish.org> (Shlomi Fish)
      Error.pm #0.17025
    - Fix 'use Error::Simple' overriding the $VERSION
    - https://rt.cpan.org/Public/Bug/Display.html?id=122713
    - Thanks to Matthew Horsfall for the report.


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-21
changelog:
  - fix "podman launches a container with systemd instance inside - bind mounts of systemd cgroup entries are being leaked in host mount namespace"
  - Resolves: #1860506


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-22
changelog:
  - revert regressions introduced by 0001-bump-github.com-containers-buildah-to-v1.11.5.patch
    regressed bugzilla list follows:
  - Related: #1817743, #1792243, #1784950


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-23
changelog:
  - fix "CVE-2020-14040 podman: golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash [rhel-7]"
  - Resolves: #1854715


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-25
changelog:
  - use proper patch to address "podman does not use $TMPDIR loading a tar file."
  - Resolves: #1877699


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-26
changelog:
  - fix "CVE-2020-14370 podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API [rhel-7]"
  - Resolves: #1881062


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-28
changelog:
  - fix "CVE-2021-20188 podman: container users permissions are not respected in privileged containers [rhel-7.9.z]"
  - Resolves: #1918282


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update to v2.0.4
    * Fixed a bug where the output of podman image search did not
      populate the Description field as it was mistakenly assigned to
      the ID field.
    * Fixed a bug where podman build - and podman build on an HTTP
      target would fail.
    * Fixed a bug where rootless Podman would improperly chown the
      copied-up contents of anonymous volumes (#7130).
    * Fixed a bug where Podman would sometimes HTML-escape special
      characters in its CLI output.
    * Fixed a bug where the podman start --attach --interactive
      command would print the container ID of the container attached
      to when exiting (#7068).
    * Fixed a bug where podman run --ipc=host --pid=host would only
      set --pid=host and not --ipc=host (#7100).
    * Fixed a bug where the --publish argument to podman run, podman
      create and podman pod create would not allow binding the same
      container port to more than one host port (#7062).
    * Fixed a bug where incorrect arguments to podman images --format
      could cause Podman to segfault.
    * Fixed a bug where podman rmi --force on an image ID with more
      than one name and at least one container using the image would
      not completely remove containers using the image (#7153).
    * Fixed a bug where memory usage in bytes and memory use
      percentage were swapped in the output of podman stats
    - -format=json.
    * Fixed a bug where the libpod and compat events endpoints would
      fail if no filters were specified (#7078).
    * Fixed a bug where the CgroupVersion field in responses from the
      compat Info endpoint was prefixed by "v" (instead of just being
      "1" or "2", as is documented).


author: Thorsten Kukuk <kukuk@suse.com>
changelog:
  - Change hard requires for AppArmor to Recommends. They are not
    needed for runtime or with SELinux but already installed if
    AppArmor is used [jsc#SMO-15]


author: Michael Ströder <michael@stroeder.com>
changelog:
  - Update to v2.0.5 (bsc#1175821)
    * Features
    - Rootless Podman will now add an entry to /etc/passwd for the user who ran Podman if run with --userns=keep-id.
    - The podman system connection command has been reworked to support multiple connections, and reenabled for use!
    - Podman now has a new global flag, --connection, to specify a connection to a remote Podman API instance.
    * Changes
    - Podman's automatic systemd integration (activated by the --systemd=true flag, set by default) will now activate for containers using /usr/local/sbin/init as their command, instead of just /usr/sbin/init and /sbin/init (and any path ending in systemd).
    - Seccomp profiles specified by the --security-opt seccomp=... flag to podman create and podman run will now be honored even if the container was created using --privileged.
    * Bugfixes
    - Fixed a bug where the podman play kube would not honor the hostIP field for port forwarding (#5964).
    - Fixed a bug where the podman generate systemd command would panic on an invalid restart policy being specified (#7271).
    - Fixed a bug where the podman images command could take a very long time (several minutes) to complete when a large number of images were present.
    - Fixed a bug where the podman logs command with the --tail flag would not work properly when a large amount of output would be printed ((#7230)[https://github.com//issues/7230]).
    - Fixed a bug where the podman exec command with remote Podman would not return a non-zero exit code when the exec session failed to start (e.g. invoking a non-existent command) (#6893).
    - Fixed a bug where the podman load command with remote Podman would did not honor user-specified tags (#7124).
    - Fixed a bug where the podman system service command, when run as a non-root user by Systemd, did not properly handle the Podman pause process and would not restart properly as a result (#7180).
    - Fixed a bug where the --publish flag to podman create, podman run, and podman pod create did not properly handle a host IP of 0.0.0.0 (attempting to bind to literal 0.0.0.0, instead of all IPs on the system) (#7104).
    - Fixed a bug where the podman start --attach command would not print the container's exit code when the command exited due to the container exiting.
    - Fixed a bug where the podman rm command with remote Podman would not remove volumes, even if the --volumes flag was specified (#7128).
    - Fixed a bug where the podman run command with remote Podman and the --rm flag could exit before the container was fully removed.
    - Fixed a bug where the --pod new:... flag to podman run and podman create would create a pod that did not share any namespaces.
    - Fixed a bug where the --preserve-fds flag to podman run and podman exec could close the wrong file descriptors while trying to close user-provided descriptors after passing them into the container.
    - Fixed a bug where default environment variables ($PATH and $TERM) were not set in containers when not provided by the image.
    - Fixed a bug where pod infra containers were not properly unmounted after exiting.
    - Fixed a bug where networks created with podman network create with an IPv6 subnet did not properly set an IPv6 default route.
    - Fixed a bug where the podman save command would not work properly when its output was piped to another command (#7017).
    - Fixed a bug where containers using a systemd init on a cgroups v1 system could leak mounts under /sys/fs/cgroup/systemd to the host.
    - Fixed a bug where podman build would not generate an event on completion (#7022).
    - Fixed a bug where the podman history command with remote Podman printed incorrect creation times for layers (#7122).
    - Fixed a bug where Podman would not create working directories specified by the container image if they did not exist.
    - Fixed a bug where Podman did not clear CMD from the container image if the user overrode ENTRYPOINT (#7115).
    - Fixed a bug where error parsing image names were not fully reported (part of the error message containing the exact issue was dropped).
    - Fixed a bug where the podman images command with remote Podman did not support printing image tags in Go templates supplied to the --format flag (#7123).
    - Fixed a bug where the podman rmi --force command would not attempt to unmount containers it was removing, which could cause a failure to remove the image.
    - Fixed a bug where the podman generate systemd --new command could incorrectly quote arguments to Podman that contained whitespace, leading to nonfunctional unit files (#7285).
    - Fixed a bug where the podman version command did not properly include build time and Git commit.
    - Fixed a bug where running systemd in a Podman container on a system that did not use the systemd cgroup manager would fail (#6734).
    - Fixed a bug where capabilities from --cap-add were not properly added when a container was started as a non-root user via --user.
    - Fixed a bug where Pod infra containers were not properly cleaned up when they stopped, causing networking issues (#7103).
    * API
    - Fixed a bug where the libpod and compat Build endpoints did not accept the application/tar content type (instead only accepting application/x-tar) (#7185).
    - Fixed a bug where the libpod Exists endpoint would attempt to write a second header in some error conditions (#7197).
    - Fixed a bug where compat and libpod Network Inspect and Network Remove endpoints would return a 500 instead of 404 when the requested network was not found.
    - Added a versioned _ping endpoint (e.g. http://localhost/v1.40/_ping).
    - Fixed a bug where containers started through a systemd-managed instance of the REST API would be shut down when podman system service shut down due to its idle timeout (#7294).
    - Added stronger parameter verification for the libpod Network Create endpoint to ensure subnet mask is a valid value.
    - The Pod URL parameter to the Libpod Container List endpoint has been deprecated; the information previously gated by the Pod boolean will now be included in the response unconditionally.
    * Misc
    - Updated Buildah to v1.15.1
    - Updated containers/image library to v5.5.2


author: Michael Ströder <michael@stroeder.com>
changelog:
  - Update to v2.0.6
    * Fixed a bug where running systemd in a container on a cgroups v1 system would fail.
    * Fixed a bug where /etc/passwd could be re-created every time a container
      is restarted if the container's /etc/passwd did not contain an entry
      for the user the container was started as.
    * Fixed a bug where containers without an /etc/passwd file specifying
      a non-root user would not start.
    * Fixed a bug where the --remote flag would sometimes not make
      remote connections and would instead attempt to run Podman locally.


author: Ralf Haferkamp <rhafer@suse.com>
changelog:
  - Cleanup %install section to use "make install"
  - install missing systemd units for the new Rest API (bsc#1175957)
    and a few man-pages that where missing before
  - Drop varlink API related bits (in favor of the new API)
  - fix install location for zsh completions


author: rhafer@suse.com
changelog:
  - Added patch varlink.patch to disable needless varlink code
    generation. This would cause compile failures in OBS.
    (https://github.com/containers/podman/pull/7854)
  - Cleanup %build section a bit and no longer build in GOPATH.
    This shouldn't be needed anymore.
  - Path BUILDFLAGS via enviroment variable to allow it being
    appended to the corresponding Makefile variable instead of
    completely overriding it.
  - Install new auto-update system units
  - Update to v2.1.1 (bsc#1178392):
    * Changes
    - The `podman info` command now includes the cgroup manager
      Podman is using.
    * API
    - The REST API now includes a Server header in all responses.
    - Fixed a bug where the Libpod and Compat Attach endpoints
      could terminate early, before sending all output from the
      container.
    - Fixed a bug where the Compat Create endpoint for containers
      did not properly handle the Interactive parameter.
    - Fixed a bug where the Compat Kill endpoint for containers
      could continue to run after a fatal error.
    - Fixed a bug where the Limit parameter of the Compat List
      endpoint for Containers did not properly handle a limit of 0
      (returning nothing, instead of all containers) [#7722].
    - The Libpod Stats endpoint for containers is being deprecated
      and will be replaced by a similar endpoint with additional
      features in a future release.
  - Changes in v2.1.0
    * Features
    - A new command, `podman image mount`, has been added. This
      allows for an image to be mounted, read-only, to inspect its
      contents without creating a container from it [#1433].
    - The `podman save` and `podman load` commands can now create
      and load archives containing multiple images [#2669].
    - Rootless Podman now supports all `podman network` commands,
      and rootless containers can now be joined to networks.
    - The performance of `podman build` on `ADD` and `COPY`
      instructions has been greatly improved, especially when a
      `.dockerignore` is present.
    - The `podman run` and `podman create` commands now support a
      new mode for the `--cgroups` option, `--cgroups=split`.
      Podman will create two cgroups under the cgroup it was
      launched in, one for the container and one for Conmon. This
      mode is useful for running Podman in a systemd unit, as it
      ensures that all processes are retained in systemd's cgroup
      hierarchy [#6400].
    - The `podman run` and `podman create` commands can now specify
      options to slirp4netns by using the `--network` option as
      follows:  `--net slirp4netns:opt1,opt2`. This allows for,
      among other things, switching the port forwarder used by
      slirp4netns away from rootlessport.
    - The `podman ps` command now features a new option,
      `--storage`, to show containers from Buildah, CRI-O and other
      applications.
    - The `podman run` and `podman create` commands now feature a
      `--sdnotify` option to control the behavior of systemd's
      sdnotify with containers, enabling improved support for
      Podman in `Type=notify` units.
    - The `podman run` command now features a `--preserve-fds`
      opton to pass file descriptors from the host into the
      container [#6458].
    - The `podman run` and `podman create` commands can now create
      overlay volume mounts, by adding the `:O` option to a bind
      mount (e.g. `-v /test:/test:O`). Overlay volume mounts will
      mount a directory into a container from the host and allow
      changes to it, but not write those changes back to the
      directory on the host.
    - The `podman play kube` command now supports the Socket
      HostPath type [#7112].
    - The `podman play kube` command now supports read-only mounts.
    - The `podman play kube` command now supports setting labels on
      pods from Kubernetes metadata labels.
    - The `podman play kube` command now supports setting container
      restart policy [#7656].
    - The `podman play kube` command now properly handles
      `HostAlias` entries.
    - The `podman generate kube` command now adds entries to
      `/etc/hosts` from `--host-add` generated YAML as `HostAlias`
      entries.
    - The `podman play kube` and `podman generate kube` commands
      now properly support `shareProcessNamespace` to share the PID
      namespace in pods.
    - The `podman volume ls` command now supports the `dangling`
      filter to identify volumes that are dangling (not attached to
      any container).
    - The `podman run` and `podman create` commands now feature a
      `--umask` option to set the umask of the created container.
    - The `podman create` and `podman run` commands now feature a
      `--tz` option to set the timezone within the container [#5128].
    - Environment variables for Podman can now be added in the
      `containers.conf` configuration file.
    - The `--mount` option of `podman run` and `podman create` now
      supports a new mount type, `type=devpts`, to add a `devpts`
      mount to the container. This is useful for containers that
      want to mount `/dev/` from the host into the container, but
      still create a terminal.
    - The `--security-opt` flag to `podman run` and `podman create`
      now supports a new option, `proc-opts`, to specify options
      for the container's `/proc` filesystem.
    - Podman with the `crun` OCI runtime now supports a new option
      to `podman run` and `podman create`, `--cgroup-conf`, which
      allows for advanced configuration of cgroups on cgroups v2
      systems.
    - The `podman create` and `podman run` commands now support a
      `--override-variant` option, to override the architecture
      variant of the image that will be pulled and ran.
    - A new global option has been added to Podman,
      `--runtime-flags`, which allows for setting flags to use when
      the OCI runtime is called.
    - The `podman manifest add` command now supports the
      `--cert-dir`, `--auth-file`, `--creds`, and `--tls-verify`
      options.
    * Security
    - This release resolves CVE-2020-14370, in which environment
      variables could be leaked between containers created using
      the Varlink API.
    * Changes
    - Podman will now retry pulling an image 3 times if a pull
      fails due to network errors.
    - The `podman exec` command would previously print error
      messages (e.g. `exec session exited with non-zero exit code
    - 1`) when the command run exited with a non-0 exit code. It
      no longer does this. The `podman exec` command will still
      exit with the same exit code as the command run in the
      container did.
    - Error messages when creating a container or pod with a name
      that is already in use have been improved.
    - For read-only containers running systemd init, Podman creates
      a tmpfs filesystem at `/run`. This was previously limited to
      65k in size and mounted `noexec`, but is now unlimited size
      and mounted `exec`.
    - The `podman system reset` command no longer removes
      configuration files for rootless Podman.
    * API
    - The Libpod API version has been bumped to v2.0.0 due to a
      breaking change in the Image List API.
    - Docker-compatible Volume Endpoints (Create, Inspect, List,
      Remove, Prune) are now available!
    - Added an endpoint for generating systemd unit files for
      containers.
    - The `last` parameter to the Libpod container list endpoint
      now has an alias, `limit` [#6413].
    - The Libpod image list API new returns timestamps in Unix
      format, as integer, as opposed to as strings
    - The Compat Inspect endpoint for containers now includes port
      information in NetworkSettings.
    - The Compat List endpoint for images now features limited
      support for the (deprecated) `filter` query parameter [#6797].
    - Fixed a bug where the Compat Create endpoint for containers
      was not correctly handling bind mounts.
    - Fixed a bug where the Compat Create endpoint for containers
      would not return a 404 when the requested image was not
      present.
    - Fixed a bug where the Compat Create endpoint for containers
      did not properly handle Entrypoint and Command from images.
    - Fixed a bug where name history information was not properly
      added in the Libpod Image List endpoint.
    - Fixed a bug where the Libpod image search endpoint improperly
      populated the Description field of responses.
    - Added a `noTrunc` option to the Libpod image search endpoint.
    - Fixed a bug where the Pod List API would return null, instead
      of an empty array, when no pods were present [#7392].
    - Fixed a bug where endpoints that hijacked would do perform
      the hijack too early, before being ready to send and receive
      data [#7195].
    - Fixed a bug where Pod endpoints that can operate on multiple
      containers at once (e.g. Kill, Pause, Unpause, Stop) would
      not forward errors from individual containers that failed.
    - The Compat List endpoint for networks now supports filtering
      results [#7462].
    - Fixed a bug where the Top endpoint for pods would return both
      a 500 and 404 when run on a non-existant pod.
    - Fixed a bug where Pull endpoints did not stream progress back
      to the client.
    - The Version endpoints (Libpod and Compat) now provide version
      in a format compatible with Docker.
    - All non-hijacking responses to API requests should not
      include headers with the version of the server.
    - Fixed a bug where Libpod and Compat Events endpoints did not
      send response headers until the first event occurred [#7263].
    - Fixed a bug where the Build endpoints (Compat and Libpod) did
      not stream progress to the client.
    - Fixed a bug where the Stats endpoints (Compat and Libpod) did
      not properly handle clients disconnecting.
    - Fixed a bug where the Ignore parameter to the Libpod Stop
      endpoint was not performing properly.
    - Fixed a bug where the Compat Logs endpoint for containers did
      not stream its output in the correct format [#7196].


author: Jindrich Novy <jnovy@redhat.com> - 3.2.0-4
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/master
    (https://github.com/containers/podman/commit/9788289)
  - Related: #1954702


author: Jindrich Novy <jnovy@redhat.com> - 3.2.0-5
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/master
    (https://github.com/containers/podman/commit/8eefca5)
  - Related: #1954702


author: Jindrich Novy <jnovy@redhat.com> - 3.2.0-6
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/master
    (https://github.com/containers/podman/commit/ed6f399)
  - Related: #1954702


author: Jindrich Novy <jnovy@redhat.com> - 3.2.0-7
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/master
    (https://github.com/containers/podman/commit/b6405c1)
  - Related: #1954702


author: Jindrich Novy <jnovy@redhat.com> - 3.2.0-8
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/master
    (https://github.com/containers/podman/commit/034470e)
  - Related: #1954702


author: Jindrich Novy <jnovy@redhat.com> - 3.2.0-9
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/master
    (https://github.com/containers/podman/commit/54bed10)
  - Related: #1954702


author: Jindrich Novy <jnovy@redhat.com> - 3.2.0-10
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/master
    (https://github.com/containers/podman/commit/57b6425)
  - Related: #1954702


author: Jindrich Novy <jnovy@redhat.com> - 3.2.0-11
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/master
    (https://github.com/containers/podman/commit/8dcd5b8)
  - Related: #1954702


author: Jindrich Novy <jnovy@redhat.com> - 3.2.0-12
changelog:
  - require at least conmon >= 2.0.25 to assure rootless podman is able to start containers
  - Related: #1954702


author: michael@stroeder.com
changelog:
  - Update to version 3.4.0:
    * Features
    - Pods now support init containers! Init containers are containers which run before the rest of the pod starts. There are two types of init containers: "always", which always run before the pod is started, and "once", which only run the first time the pod starts and are subsequently removed. They can be added using the podman create command's --init-ctr option.
    - Support for init containers has also been added to podman play kube and podman generate kube - init containers contained in Kubernetes YAML will be created as Podman init containers, and YAML generated by Podman will include any init containers created.
    - The podman play kube command now supports building images. If the --build option is given and a directory with the name of the specified image exists in the current working directory and contains a valid Containerfile or Dockerfile, the image will be built and used for the container.
    - The podman play kube command now supports a new option, --teardown, which removes any pods and containers created by the given Kubernetes YAML.
    - The podman generate kube command now generates annotations for SELinux mount options on volume (:z and :Z) that are respected by the podman play kube command.
    - A new command has been added, podman pod logs, to return logs for all containers in a pod at the same time.
    - Two new commands have been added, podman volume export (to export a volume to a tar file) and podman volume import) (to populate a volume from a given tar file).
    - The podman auto-update command now supports simple rollbacks. If a container fails to start after an automatic update, it will be rolled back to the previous image and restarted again.
    - Pods now share their user namespace by default, and the podman pod create command now supports the --userns option. This allows rootless pods to be created with the --userns=keep-id option.
    - The podman pod ps command now supports a new filter with its --filter option, until, which returns pods created before a given timestamp.
    - The podman image scp command has been added. This command allows images to be transferred between different hosts.
    - The podman stats command supports a new option, --interval, to specify the amount of time before the information is refreshed.
    - The podman inspect command now includes ports exposed (but not published) by containers (e.g. ports from --expose when --publish-all is not specified).
    - The podman inspect command now has a new boolean value, Checkpointed, which indicates that a container was stopped as a result of a podman container checkpoint operation.
    - Volumes created by podman volume create now support setting quotas when run atop XFS. The size and inode options allow the maximum size and maximum number of inodes consumed by a volume to be limited.
    - The podman info command now outputs information on what log drivers, network drivers, and volume plugins are available for use (#11265).
    - The podman info command now outputs the current log driver in use, and the variant and codename of the distribution in use.
    - The parameters of the VM created by podman machine init (amount of disk space, memory, CPUs) can now be set in containers.conf.
    - The podman machine ls command now shows additional information (CPUs, memory, disk size) about VMs managed by podman machine.
    - The podman ps command now includes healthcheck status in container state for containers that have healthchecks (#11527).
    * Changes
    - The podman build command has a new alias, podman buildx, to improve compatibility with Docker. We have already added support for many docker buildx flags to podman build and aim to continue to do so.
    - Cases where Podman is run without a user session or a writable temporary files directory will now produce better error messages.
    - The default log driver has been changed from file to journald. The file driver did not properly support log rotation, so this should lead to a better experience. If journald is not available on the system, Podman will automatically revert to the file.
    - Podman no longer depends on ip for removing networks (#11403).
    - The deprecated --macvlan flag to podman network create now warns when it is used. It will be removed entirely in the Podman 4.0 release.
    - The podman machine start command now prints a message when the VM is successfully started.
    - The podman stats command can now be used on containers that are paused.
    - The podman unshare command will now return the exit code of the command that was run in the user namespace (assuming the command was successfully run).
    - Successful healthchecks will no longer add a healthy line to the system log to reduce log spam.
    - As a temporary workaround for a lack of shortname prompts in the Podman remote client, VMs created by podman machine now default to only using the docker.io registry.
    * Bugfixes
    - Fixed a bug where whitespace in the definition of sysctls (particularly default sysctls specified in containers.conf) would cause them to be parsed incorrectly.
    - Fixed a bug where the Windows remote client improperly validated volume paths (#10900).
    - Fixed a bug where the first line of logs from a container run with the journald log driver could be skipped.
    - Fixed a bug where images created by podman commit did not include ports exposed by the container.
    - Fixed a bug where the podman auto-update command would ignore the io.containers.autoupdate.authfile label when pulling images (#11171).
    - Fixed a bug where the --workdir option to podman create and podman run could not be set to a directory where a volume was mounted (#11352).
    - Fixed a bug where systemd socket-activation did not properly work with systemd-managed Podman containers (#10443).
    - Fixed a bug where environment variable secrets added to a container were not available to exec sessions launched in the container.
    - Fixed a bug where rootless containers could fail to start the rootlessport port-forwarding service when XDG_RUNTIME_DIR was set to a long path.
    - Fixed a bug where arguments to the --systemd option to podman create and podman run were case-sensitive (#11387).
    - Fixed a bug where the podman manifest rm command would also remove images referenced by the manifest, not just the manifest itself (#11344).
    - Fixed a bug where the Podman remote client on OS X would not function properly if the TMPDIR environment variable was not set (#11418).
    - Fixed a bug where the /etc/hosts file was not guaranteed to contain an entry for localhost (this is still not guaranteed if --net=host is used; such containers will exactly match the host's /etc/hosts) (#11411).
    - Fixed a bug where the podman machine start command could print warnings about unsupported CPU features (#11421).
    - Fixed a bug where the podman info command could segfault when accessing cgroup information.
    - Fixed a bug where the podman logs -f command could hang when a container exited (#11461).
    - Fixed a bug where the podman generate systemd command could not be used on containers that specified a restart policy (#11438).
    - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the UID and GID on the client were higher than 65536 (#11474).
    - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the context directory was a symlink (#11732).
    - Fixed a bug where the --network flag to podman play kube was not properly parsed when a non-bridge network configuration was specified.
    - Fixed a bug where the podman inspect command could error when the container being inspected was removed as it was being inspected (#11392).
    - Fixed a bug where the podman play kube command ignored the default pod infra image specified in containers.conf.
    - Fixed a bug where the --format option to podman inspect was nonfunctional under some circumstances (#8785).
    - Fixed a bug where the remote Podman client's podman run and podman exec commands could skip a byte of output every 8192 bytes (#11496).
    - Fixed a bug where the podman stats command would print nonsensical results if the container restarted while it was running (#11469).
    - Fixed a bug where the remote Podman client would error when STDOUT was redirected on a Windows client (#11444).
    - Fixed a bug where the podman run command could return 0 when the application in the container exited with 125 (#11540).
    - Fixed a bug where containers with --restart=always set using the rootlessport port-forwarding service could not be restarted automatically.
    - Fixed a bug where the --cgroups=split option to podman create and podman run was silently discarded if the container was part of a pod.
    - Fixed a bug where the podman container runlabel command could fail if the image name given included a tag.
    - Fixed a bug where Podman could add an extra 127.0.0.1 entry to /etc/hosts under some circumstances (#11596).
    - Fixed a bug where the remote Podman client's podman untag command did not properly handle tags including a digest (#11557).
    - Fixed a bug where the --format option to podman ps did not properly support the table argument for tabular output.
    - Fixed a bug where the --filter option to podman ps did not properly handle filtering by healthcheck status (#11687).
    - Fixed a bug where the podman run and podman start --attach commands could race when retrieving the exit code of a container that had already been removed resulting in an error (e.g. by an external podman rm -f) (#11633).
    - Fixed a bug where the podman generate kube command would add default environment variables to generated YAML.
    - Fixed a bug where the podman generate kube command would add the default CMD from the image to generated YAML (#11672).
    - Fixed a bug where the podman rm --storage command could fail to remove containers under some circumstances (#11207).
    - Fixed a bug where the podman machine ssh command could fail when run on Linux (#11731).
    - Fixed a bug where the podman stop command would error when used on a container that was already stopped (#11740).
    - Fixed a bug where renaming a container in a pod using the podman rename command, then removing the pod using podman pod rm, could cause Podman to believe the new name of the container was permanently in use, despite the container being removed (#11750).
    * API
    - The Libpod Pull endpoint for Images now has a new query parameter, quiet, which (when set to true) suppresses image pull progress reports (#10612).
    - The Compat Events endpoint now includes several deprecated fields from the Docker v1.21 API for improved compatibility with older clients.
    - The Compat List and Inspect endpoints for Images now prefix image IDs with sha256: for improved Docker compatibility (#11623).
    - The Compat Create endpoint for Containers now properly sets defaults for healthcheck-related fields (#11225).
    - The Compat Create endpoint for Containers now supports volume options provided by the Mounts field (#10831).
    - The Compat List endpoint for Secrets now supports a new query parameter, filter, which allows returned results to be filtered.
    - The Compat Auth endpoint now returns the correct response code (500 instead of 400) when logging into a registry fails.
    - The Version endpoint now includes information about the OCI runtime and Conmon in use (#11227).
    - Fixed a bug where the X-Registry-Config header was not properly handled, leading to errors when pulling images (#11235).
    - Fixed a bug where invalid query parameters could cause a null pointer dereference when creating error messages.
    - Logging of API requests and responses at trace level has been greatly improved, including the addition of an X-Reference-Id header to correlate requests and responses (#10053).
    * Misc
    - Updated Buildah to v1.23.0
    - Updated the containers/storage library to v1.36.0
    - Updated the containers/image library to v5.16.0
    - Updated the containers/common library to v0.44.0


author: michael@stroeder.com
changelog:
  - Update to version 3.4.1:
    * Bugfixes
    - Fixed a bug where podman machine init could, under some circumstances,
      create invalid machine configurations which could not be started (#11824).
    - Fixed a bug where the podman machine list command would not properly
      populate some output fields.
    - Fixed a bug where podman machine rm could leave dangling sockets from
      the removed machine (#11393).
    - Fixed a bug where podman run --pids-limit=-1 was not supported (it now
      sets the PID limit in the container to unlimited) (#11782).
    - Fixed a bug where podman run and podman attach could throw errors about
      a closed network connection when STDIN was closed by the client (#11856).
    - Fixed a bug where the podman stop command could fail when run on a
      container that had another podman stop command run on it previously.
    - Fixed a bug where the --sync flag to podman ps was nonfunctional.
    - Fixed a bug where the Windows and OS X remote clients' podman stats
      command would fail (#11909).
    - Fixed a bug where the podman play kube command did not properly handle
      environment variables whose values contained an = (#11891).
    - Fixed a bug where the podman generate kube command could generate
      invalid annotations when run on containers with volumes that use SELinux
      relabelling (:z or :Z) (#11929).
    - Fixed a bug where the podman generate kube command would generate YAML
      including some unnecessary (set to default) fields (e.g. user and group,
      entrypoint, default protocol for forwarded ports) (#11914, #11915, and #11965).
    - Fixed a bug where the podman generate kube command could, under some
      circumstances, generate YAML including an invalid targetPort field for
      forwarded ports (#11930).
    - Fixed a bug where rootless Podman's podman info command could, under
      some circumstances, not read available CGroup controllers (#11931).
    - Fixed a bug where podman container checkpoint --export would fail to
      checkpoint any container created with --log-driver=none (#11974).
    * API
    - Fixed a bug where the Compat Create endpoint for Containers could panic
      when no options were passed to a bind mount of tmpfs (#11961).


author: michael@stroeder.com
changelog:
  - Update to version 3.4.2:
    * Fixed a bug where podman tag could not tag manifest lists (#12046).
    * Fixed a bug where built-in volumes specified by images would not be
      created correctly under some circumstances.
    * Fixed a bug where, when using Podman Machine on OS X, containers in pods
      did not have working port forwarding from the host (#12207).
    * Fixed a bug where the podman network reload command command on containers
      using the slirp4netns network mode and the rootlessport port forwarding
      driver would make an unnecessary attempt to restart rootlessport
      on containers that did not forward ports.
    * Fixed a bug where the podman generate kube command would generate YAML
      including some unnecessary (set to default) fields (e.g. empty SELinux and
      DNS configuration blocks, and the privileged flag when set to false) (#11995).
    * Fixed a bug where the podman pod rm command could, if interrupted at the right moment,
      leave a reference to an already-removed infra container behind (#12034).
    * Fixed a bug where the podman pod rm command would not remove pods with
      more than one container if all containers save for the infra container
      were stopped unless --force was specified (#11713).
    * Fixed a bug where the --memory flag to podman run and podman create did
      not accept a limit of 0 (which should specify unlimited memory) (#12002).
    * Fixed a bug where the remote Podman client's podman build command could
      attempt to build a Dockerfile in the working directory of the podman
      system service instance instead of the Dockerfile specified by the user (#12054).
    * Fixed a bug where the podman logs --tail command could function improperly
      (printing more output than requested) when the journald log driver was used.
    * Fixed a bug where containers run using the slirp4netns network mode with
      IPv6 enabled would not have IPv6 connectivity until several seconds after they started (#11062).
    * Fixed a bug where some Podman commands could cause an extra dbus-daemon
      process to be created (#9727).
    * Fixed a bug where rootless Podman would sometimes print warnings
      about a failure to move the pause process into a given CGroup (#12065).
    * Fixed a bug where the checkpointed field in podman inspect on a container
      was not set to false after a container was restored.
    * Fixed a bug where the podman system service command would print
      overly-verbose logs about request IDs (#12181).
    * Fixed a bug where Podman could, when creating a new container without a name
      explicitly specified by the user, sometimes use an auto-generated name already
      in use by another container if multiple containers were being created in parallel (#11735).


author: michael@stroeder.com
changelog:
  - Update to version 3.4.3:
    * Security
    - This release addresses CVE-2021-4024, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
    - This release addresses CVE-2021-41190, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.
    * Features
    - The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).
    * Bugfixes
    - Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
    - Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
    - Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
    - Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
    - Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
    - Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
    - Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
    - Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
    - Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
    - Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
    - Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
    - Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
    - Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
    - Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
    - Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra " (#11416).
    * API
    - Updated the containers/image library to v5.17.0
    - The Libpod Play Kube endpoint now also accepts ConfigMap YAML as part of its payload, and will use provided any ConfigMap to configure provided pods and services.
    - Fixed a bug where the Compat Create endpoint for Containers would not always create the container's working directory if it did not exist (#11842).
    - Fixed a bug where the Compat Create endpoint for Containers returned an incorrect error message with 404 errors when the requested image was not found (#12315).
    - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the HostConfig.Mounts field (#12419).
    - Fixed a bug where the Compat Archive endpoint for Containers did not properly report errors when the operation failed (#12420).
    - Fixed a bug where the Compat Build endpoint for Images ignored the layers query parameter (for caching intermediate layers from the build) (#12378).
    - Fixed a bug where the Compat Build endpoint for Images did not report errors in a manner compatible with Docker (#12392).
    - Fixed a bug where the Compat Build endpoint for Images would fail to build if the context directory was a symlink (#12409).
    - Fixed a bug where the Compat List endpoint for Images included manifest lists (and not just images) in returned results (#12453).
    * Misc
    - Podman now builds by default with cgo enabled on OS X, resolving some issues with SSH (#10737).


author: michael@stroeder.com
changelog:
  - Update to version 3.4.4:
    * Bugfixes
    - Fixed a bug where the podman exec command would, under some circumstances,
      print a warning message about failing to move conmon to the appropriate cgroup (#12535).
    - Fixed a bug where named volumes created as part of container creation
      (e.g. podman run --volume avolume:/a/mountpoint or similar) would be
      mounted with incorrect permissions (#12523).
    - Fixed a bug where the podman-remote create and podman-remote run commands
      did not properly handle the --entrypoint="" option (to clear the container's entrypoint) (#12521).


author: dcermak@suse.com
changelog:
  - Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade
    path from podman < 3.1.2


author: bruno.leon@suse.com
changelog:
  - fix CVE-2021-41190 [bsc#1193273], opencontainers: OCI manifest and index parsing confusion
  - fix CVE-2021-4024  [bsc#1193166], podman machine spawns gvproxy with port binded to all IPs
  - fix CVE-2021-20199 [bsc#1181640], Remote traffic to rootless containers is seen as orginating from localhost


author: dcermak@suse.com
changelog:
  - Add patches to fix bsc#1196751:
    * 0002-Add-JSON-version-of-the-machine-list.patch
    * 0003-Add-completion-for-machine-list-format.patch
    * 0004-Not-all-fields-in-machine-list-were-set-properly.patch
    * 0005-Record-the-image-stream-along-with-the-path.patch
    * 0006-System-tests-fix-RHEL8-gating-tests.patch
    * 0007-buildah-bud-tests-skip-failing-tests.patch
    * 0008-Makefile-fix-darwin-detection.patch
    * 0009-Fix-images-since-after-tests.patch
    * 0010-Changes-of-docker-descriptions.patch
    * 0011-CI-DOCS-logformatter-handle-python-logs.patch
    * 0012-Disable-search-images-test.patch
    * 0013-v.3.4-vendor-containers-common-v0.44.5.patch
    * 0014-Bump-github.com-prometheus-client_golang-to-v1.11.1.patch
    * 0015-Backport-of-https-github.com-containers-podman-pull-.patch


author: dcermak@suse.com
changelog:
  - Update to version 3.4.7:
    * Bump to v3.4.7
    * Update release notes for v3.4.7
    * fix CVE-2022-1227
    * Update readme version
    * Bump to v3.4.7-dev
    * Bump to v3.4.6
    * Add release notes for v3.4.6
    * Bump golang.org/x/crypto to 7b82a4e
    * Bump to v3.4.6-dev
    * Bump to v3.4.5
    * test: fix podman run test as rootless
    * do not set the inheritable capabilities
    * Release notes for v3.4.5
    * Backport of https://github.com/containers/podman/pull/13536 to 3.4
    * Bump github.com/prometheus/client_golang to v1.11.1
    * [v.3.4] vendor containers/common@v0.44.5
    * Disable search-images test
    * [CI:DOCS] logformatter: handle python logs
    * Changes of docker descriptions
    * Fix images since/after tests
    * Makefile: fix darwin detection
    * buildah bud tests: skip failing tests
    * System tests: fix RHEL8 gating tests
    * Record the image stream along with the path
    * Not all fields in machine list were set properly
    * Add completion for machine list format
    * Add JSON version of the machine list
    * Bump to v3.4.5-dev
  - Remove merged patches:
    * 0002-Add-JSON-version-of-the-machine-list.patch
    * 0003-Add-completion-for-machine-list-format.patch
    * 0004-Not-all-fields-in-machine-list-were-set-properly.patch
    * 0005-Record-the-image-stream-along-with-the-path.patch
    * 0006-System-tests-fix-RHEL8-gating-tests.patch
    * 0007-buildah-bud-tests-skip-failing-tests.patch
    * 0008-Makefile-fix-darwin-detection.patch
    * 0009-Fix-images-since-after-tests.patch
    * 0010-Changes-of-docker-descriptions.patch
    * 0011-CI-DOCS-logformatter-handle-python-logs.patch
    * 0012-Disable-search-images-test.patch
    * 0013-v.3.4-vendor-containers-common-v0.44.5.patch
    * 0014-Bump-github.com-prometheus-client_golang-to-v1.11.1.patch
    * 0015-Backport-of-https-github.com-containers-podman-pull-.patch
  - Fixed security issues:
    * CVE-2022-1227: https://github.com/advisories/GHSA-66vw-v2x9-hw75 bsc#1182428
    * CVE-2022-27191: https://github.com/advisories/GHSA-8c26-wmh5-6g9v bsc#1197284
    * CVE-2022-21698: https://github.com/advisories/GHSA-cg3q-j54f-5p7p bsc#1196338


author: dcermak@suse.com
changelog:
  - Add fix for CVE-2022-2989 / bsc#1202809
    Add patch: 0001-Add-container-GID-to-additional-groups.patch


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-30
changelog:
  - semanage/seobject: Fix listing boolean values (#1391605)
  - sepolicy: Make policy files sorting more robust
  - semanage: Fix setting alternative policy store (#1558033)
  - semanage: Load a store policy and set the store SELinux policy root
  - sepolicy: Add sepolicy.load_store_policy(store)
  - semanage: import sepolicy only when it's needed
  - semanage: move valid_types initialisations to class constructors
  - semanage/seobject: Fix indentation issues
  - scripts/fixfiles: Do not fail on file_contexts.local (#1647714)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-31
changelog:
  - semanage: Start exporting "ibendport" and "ibpkey" entries (#1657196)
  - semanage: Do not show "None" levels when using a non-MLS policy (#1400482)
  - semanage: Include MCS/MLS range when exporting local customizations (#1400482)


author: Adrian Reber <areber@redhat.com> - 1.0.2-1
changelog:
  - new upstream release
  - split off protoc-c into protobuf-c-compiler to reduce runtime
    dependencies of the main package


author: Matt Domsch <mdomsch@fedoraproject.org> - 0.70-1
changelog:
  - Version 0.70 (2009-10-29)
    * New "major" version because it may break compatibility
    * Fix __cmp__(): IP('0.0.0.0/0') and IP('0.0.0.0') are not equal
    * Fix IP.net() of the network "::/0": "::" instead of "0.0.0.0".
      IPy 0.63 should fix this bug, but it wasn't.


author: Matt Domsch <mdomsch@fedoraproject.org> - 0.75-1
changelog:
  - Version 0.75 (2011-04-12)
   * IP('::/0').netmask() gives IP('::') instead of IP('0.0.0.0') (BZ#690625)
   * Fix tests for Python 3.1 and 3.2
   * ip.__nonzero__() and (ipa in ipb) return a bool instead of 0 or 1
   * IP('0.0.0.0/0') + IP('0.0.0.0/0') raises an error, fix written by Arfrever
   * Support Python 3: setup.py runs 2to3
   * Update the ranges for IPv6 IPs
   * Fix reverseName() and reverseNames() for IPv4 in IPv6 addresses
   * Drop support of Python < 2.5
   * Include examples and MANIFEST.in in source build (add them to MANIFEST.in)
   * Remove __rcsid__ constant from IPy module
   * Use xrange() instead of range()
   * Use isinstance(x, int) instead of type(x) == types.IntType
   * Prepare support of Python3 (use integer division: x // y)
   * Fix IP(long) constructor: ensure that the address is not too large
   * Constructor raise a TypeError if the type is not int, long, str or unicode
   * 223.0.0.0/8 is now public (belongs to APNIC)


author: hvogel@suse.com
changelog:
  - Updated to version 0.3.4 which fixes:
    - dockerpty causing docker-compose run to exit with return
      code 1?
      [https://github.com/d11wtq/dockerpty/issues/41]
      Which fixes:
    - docker-compose --rm always returns 1
      [https://github.com/docker/compose/issues/1424]
    - docker-compose run --rm does not remove container
      [https://github.com/docker/compose/issues/1483]


author: Nils Philippsen <nils@redhat.com> - 0.2.19-1
changelog:
  - allow service object methods to be called locally
  - preserve signature, docstrings, etc. of decorated methods


author: Nils Philippsen <nils@redhat.com> - 0.4.0-1
changelog:
  - version 0.4.0:
    - get rid of (ancient) PolicyKit-0.x support
    - add basic (experimental, unstable) dbus introspection support
    - learn to cope with polkitd being restarted


author: Charalampos Stratakis <cstratak@redhat.com> - 0.4.0-3
changelog:
  - Make firewalld to not log errors when running commands as root
  in the absence of polkitd.
  Resolves: rhbz#1393488


author: toddrme2178@gmail.com
changelog:
  - Fix license
  - Provides/Obsoletes python-SocksiPy, which this is an updated fork
    of and conflicts with.


author: arun@gmx.de
changelog:
  - specfile:
    * update copyright year
  - update to version 1.6.7:
    * Make SocksiPy legacy functions kwarg-compatible. See issue #71.
    * Use setuptools in setup.py to support wheel. See issue #73.
    * Test and logging enhancements


author: arun@gmx.de
changelog:
  - specfile:
    * update copyright year
  - update to version 1.6.8:
    * Remove support for EOL Python 3.3
    * Make create_connection() signature match socket module
    * Add python version classifiers
    * Include win_inet_pton when installing on Python 2.x under Windows
    * fix #937 getpeername() errror while using gevent
    * Update README.md
    * PEP8 fixes for line length, indentation, line breaks and other
      minor issues.
    * Normalize quoting.
    * Update socks.py


author: mardnh@gmx.de
changelog:
  - Update to 3.12
    - Adding an implicit resolver to a derived loader should not
      affect the base loader (fixes issue #57).
    - Uniform representation for OrderedDict? across different
      versions of Python (fixes issue #61).
    - Fixed comparison to None warning (closes issue #64).
  - fix Source URL


author: Tomáš Chvátal <tchvatal@suse.com>
changelog:
  - Update to 5.1:
    * many changes, see CHANGES
    * bsc#1099308 CVE-2017-18342 PyYAML: yaml.load() API could execute arbitrary code


author: Ondřej Súkup <mimi.vx@gmail.com>
changelog:
  - update to 5.1.1
    * Re-release of 5.1 with regenerated Cython sources to build properly for Python 3.8


author: Marketa Calabkova <mcalabkova@suse.com>
changelog:
  - update to 5.1.2
    * Re-release of 5.1 with regenerated Cython sources to build properly for Python 3.8b2+


author: Tina Müller <tina.mueller@suse.com>
changelog:
  - Add patch pyyaml-5.1.2.patch (bsc#1165439 CVE-2020-1747)
    Prevents arbitrary code execution during python/object/* constructors
    (This patch contains the git commits 8c5e47f and 5080ba5 applied to the 5.1.2 release)


author: tbechtold@suse.com
changelog:
  - update to 1.4.0:
    - [PR #42] AppAuthor is now optional on Windows
    - [issue 41] Support Jython on Windows, Mac, and Unix-like platforms. Windows
      support requires `JNA <https://github.com/twall/jna>`_.
    - [PR #44] Fix incorrect behaviour of the site_config_dir method
    - [Unix, issue 16] Conform to XDG standard, instead of breaking it for
      everybody
    - [Unix] Removes gratuitous case mangling of the case, since \*nix-es are
      usually case sensitive, so mangling is not wise
    - [Unix] Fixes the uterly wrong behaviour in ``site_data_dir``, return result
      based on XDG_DATA_DIRS and make room for respecting the standard which
      specifies XDG_DATA_DIRS is a multiple-value variable
    - [Issue 6] Add ``*_config_dir`` which are distinct on nix-es, according to
      XDG specs; on Windows and Mac return the corresponding ``*_data_dir``
  - Remove unzip as BuildRequires. tar.gz file now provided and used


author: jmatejek@suse.com
changelog:
  - update for single-spec
  - desetuptoolize.patch : switch from setuptools to distutils.core
    for installation, as this is now a setuptools dependency
  - ensure egg-info is a directory (distutils would install it as file)
  - update to 1.4.1
    * [issue 55] make appname optional


author: tbechtold@suse.com
changelog:
  - update to 1.4.3:
    - [PR #76] Python 3.6 invalid escape sequence deprecation fixes
    - Fix for Python 3.6 support
    - [PR #84] Allow installing without setuptools
    - [PR #86] Fix string delimiters in setup.py description
    - Add Python 3.6 support
  - drop desetuptoolize.patch . no longer needed.


author: arun@gmx.de
changelog:
  - update to version 0.23.0:
    * Backwards compatibility break: the tag_type, explicit_tag and
      explicit_class attributes on core.Asn1Value no longer exist and
      were replaced by the implicit and explicit attributes. Field param
      dicts may use the new explicit and implicit keys, or the old
      tag_type and tag keys. The attribute changes will likely to have
      little to no impact since they were primarily an implementation
      detail.
    * Teletex strings used inside of X.509 certificates are now
      interpreted using Windows-1252 (a superset of ISO-8859-1). This
      enables compatibility with certificates generated by
      OpenSSL. Strict parsing of Teletex strings can be retained by
      using the x509.strict_teletex() context manager.
    * Added support for nested explicit tagging, supporting values that
      are defined with explicit tagging and then added as a field of
      another structure using explicit tagging.
    * Fixed a UnicodeDecodeError when trying to find the (optional)
      dependency OpenSSL on Python 2
    * Fixed next_update field of crl.TbsCertList to be optional
    * Added the x509.Certificate.sha256_fingerprint property
    * x509.Certificate.ocsp_urls and x509.DistributionPoint.url will now
      return https://, ldap:// and ldaps:// URLs in addition to http://.
    * Added CMS Attribute Protection definitions from RFC 6211
    * Added OIDs from RFC 6962


author: arun@gmx.de
changelog:
  - update to version 0.24.0:
    * x509.Certificate().self_signed will no longer return "yes" under
      any circumstances. This helps prevent confusion since the library
      does not verify the signature. Instead a library like oscrypto
      should be used to confirm if a certificate is self-signed.
    * Added various OIDs to x509.KeyPurposeId()
    * Added x509.Certificate().private_key_usage_period_value
    * Added structures for parsing common subject directory attributes
      for X.509 certificates, including x509.SubjectDirectoryAttribute()
    * Added algos.AnyAlgorithmIdentifier() for situations where an
      algorithm identifier may contain a digest, signed digest or
      encryption algorithm OID
    * Fixed a bug with
      x509.Certificate().subject_directory_attributes_value not
      returning the correct value
    * Fixed a bug where explicitly-tagged fields in a core.Sequence()
      would not function properly when the field had a default value
    * Fixed a bug with type checking in pem.armor()


author: toddrme2178@gmail.com
changelog:
  -  %{python_sitelib}/backports is a namespace package, and so under
    python 2.x it must have a proper
    %{python_sitelib}/backports/__init__.py file.
    python-backports provides this __init__.py to prevent backports
    packages from conflicting.
    Please see the following links for more details:
      https://pypi.python.org/pypi/backports/
      https://www.python.org/dev/peps/pep-0420/%23namespace-packages-today


author: jacobwinski@gmail.com
changelog:
  - Update to version 2016.2.28
  - Update copyright year in spec file
  - Fix executable warning (fix taken from python3-certifi)


author: dmueller@suse.com
changelog:
  - require ca-certificates-mozilla, otherwise certifi does not
    provide any ca bundle (the bundled one that openSUSE patches
    out is the mozilla bundle as well)


author: arun@gmx.de
changelog:
  - updated patch
  - update to version 2017.7.27.1:
    * Use a more expressive API for getting the dir a path is in
    * set zip_safe=False to help out setuptools (#63)
    * Change license from ISC to MPL-2.0 in setup.py
    * Add trove classifiers for missing supported Python versions
    * Rename [wheel] section to [bdist_wheel] as the former is legacy


author: adrian.glaubitz@suse.com
changelog:
  - add patch to fix version string from 2017.07.27.1 to
    2017.7.27.1 to fix the build on SLE12_SP3 and earlier
    + python-certifi-fix-version-string.patch


author: dmueller@suse.com
changelog:
  - update to 2017.11.5:
    * Sync with bundle mozilla release
  - remove  python-certifi-fix-version-string.patch: obsolete


author: arun@gmx.de
changelog:
  - specfile:
    * update copyright year
  - update to version 2018.1.18:
    * Remove 1024-bit root certificates
    * Include license in the list of trove classifiers
    * Include license file in the generated wheel package


author: badshah400@gmail.com
changelog:
  - Add python-cffi-avoid-bitshifting-negative-int.patch to actually
    fix the "negative left shift" warning by replacing bitshifting
    in appropriate places by bitwise and comparison to self; patch
    taken from upstream git. Drop cffi-1.5.2-wnoerror.patch: no
    longer required.


author: jmatejek@suse.com
changelog:
  - update to 1.9.1
    - Structs with variable-sized arrays as their last field: now we track the
      length of the array after ffi.new() is called, just like we always tracked
      the length of ffi.new("int[]", 42). This lets us detect out-of-range
      accesses to array items. This also lets us display a better repr(), and
      have the total size returned by ffi.sizeof() and ffi.buffer(). Previously
      both functions would return a result based on the size of the declared
      structure type, with an assumed empty array. (Thanks andrew for starting
      this refactoring.)
    - Add support in cdef()/set_source() for unspecified-length arrays in
      typedefs: typedef int foo_t[...];. It was already supported for global
      variables or structure fields.
    - I turned in v1.8 a warning from cffi/model.py into an error: 'enum xxx' has
      no values explicitly defined: refusing to guess which integer type it is
      meant to be (unsigned/signed, int/long). Now I’m turning it back to a
      warning again; it seems that guessing that the enum has size int is a
      99%-safe bet. (But not 100%, so it stays as a warning.)
    - Fix leaks in the code handling FILE * arguments. In CPython 3 there is a
      remaining issue that is hard to fix: if you pass a Python file object to a
      FILE * argument, then os.dup() is used and the new file descriptor is only
      closed when the GC reclaims the Python file object—and not at the earlier
      time when you call close(), which only closes the original file descriptor.
      If this is an issue, you should avoid this automatic convertion of Python
      file objects: instead, explicitly manipulate file descriptors and call
      fdopen() from C (...via cffi).
    - When passing a void * argument to a function with a different pointer type,
      or vice-versa, the cast occurs automatically, like in C. The same occurs
      for initialization with ffi.new() and a few other places. However, I
      thought that char * had the same property—but I was mistaken. In C you get
      the usual warning if you try to give a char * to a char ** argument, for
      example. Sorry about the confusion. This has been fixed in CFFI by giving
      for now a warning, too. It will turn into an error in a future version.
    - Issue #283: fixed ffi.new() on structures/unions with nested anonymous
      structures/unions, when there is at least one union in the mix. When
      initialized with a list or a dict, it should now behave more closely like
      the { } syntax does in GCC.
    - CPython 3.x: experimental: the generated C extension modules now use the
      “limited API”, which means that, as a compiled .so/.dll, it should work
      directly on any version of CPython >= 3.2. The name produced by distutils
      is still version-specific. To get the version-independent name, you can
      rename it manually to NAME.abi3.so, or use the very recent setuptools 26.
    - Added ffi.compile(debug=...), similar to python setup.py build --debug but
      defaulting to True if we are running a debugging version of Python itself.
    - Removed the restriction that ffi.from_buffer() cannot be used on byte
      strings. Now you can get a char * out of a byte string, which is valid as
      long as the string object is kept alive. (But don’t use it to modify the
      string object! If you need this, use bytearray or other official
      techniques.)
    - PyPy 5.4 can now pass a byte string directly to a char * argument (in older
      versions, a copy would be made). This used to be a CPython-only
      optimization.
    - ffi.gc(p, None) removes the destructor on an object previously created by
      another call to ffi.gc()
    - bool(ffi.cast("primitive type", x)) now returns False if the value is zero
      (including -0.0), and True otherwise. Previously this would only return
      False for cdata objects of a pointer type when the pointer is NULL.
    - bytearrays: ffi.from_buffer(bytearray-object) is now supported. (The reason
      it was not supported was that it was hard to do in PyPy, but it works since
      PyPy 5.3.) To call a C function with a char * argument from a buffer
      object—now including bytearrays—you write lib.foo(ffi.from_buffer(x)).
      Additionally, this is now supported: p[0:length] = bytearray-object. The
      problem with this was that a iterating over bytearrays gives numbers
      instead of characters. (Now it is implemented with just a memcpy, of
      course, not actually iterating over the characters.)
    - C++: compiling the generated C code with C++ was supposed to work, but
      failed if you make use the bool type (because that is rendered as the C
      _Bool type, which doesn’t exist in C++).
    - help(lib) and help(lib.myfunc) now give useful information, as well as
      dir(p) where p is a struct or pointer-to-struct.
  - drop upstreamed python-cffi-avoid-bitshifting-negative-int.patch


author: jmatejek@suse.com
changelog:
  - do not generate HTML documentation for packages that are indirect
    dependencies of Sphinx
    (see docs at https://cffi.readthedocs.org/ )


author: tbechtold@suse.com
changelog:
  - update to 1.10.0:
    * Issue #295: use calloc() directly instead of PyObject_Malloc()+memset()
    to handle ffi.new() with a default allocator. Speeds up ffi.new(large-array)
    where most of the time you never touch most of the array.
    * Some OS/X build fixes (“only with Xcode but without CLT”).
    * Improve a couple of error messages: when getting mismatched versions of
      cffi and its backend; and when calling functions which cannot be called with
      libffi because an argument is a struct that is “too complicated” (and not
      a struct pointer, which always works).
    * Add support for some unusual compilers (non-msvc, non-gcc, non-icc, non-clang)
    * Implemented the remaining cases for ffi.from_buffer. Now all
      buffer/memoryview objects can be passed. The one remaining check is against
      passing unicode strings in Python 2. (They support the buffer interface, but
      that gives the raw bytes behind the UTF16/UCS4 storage, which is most of the
      times not what you expect. In Python 3 this has been fixed and the unicode
      strings don’t support the memoryview interface any more.)
    * The C type _Bool or bool now converts to a Python boolean when reading,
      instead of the content of the byte as an integer. The potential
      incompatibility here is what occurs if the byte contains a value different
      from 0 and 1. Previously, it would just return it; with this change, CFFI
      raises an exception in this case. But this case means “undefined behavior”
      in C; if you really have to interface with a library relying on this,
      don’t use bool in the CFFI side. Also, it is still valid to use a byte
      string as initializer for a bool[], but now it must only contain \x00 or
      \x01. As an aside, ffi.string() no longer works on bool[] (but it never made
      much sense, as this function stops at the first zero).
    * ffi.buffer is now the name of cffi’s buffer type, and ffi.buffer() works
      like before but is the constructor of that type.
    * ffi.addressof(lib, "name") now works also in in-line mode, not only in
      out-of-line mode. This is useful for taking the address of global variables.
    * Issue #255: cdata objects of a primitive type (integers, floats, char) are
      now compared and ordered by value. For example, <cdata 'int' 42> compares
      equal to 42 and <cdata 'char' b'A'> compares equal to b'A'. Unlike C,
      <cdata 'int' -1> does not compare equal to ffi.cast("unsigned int", -1): it
      compares smaller, because -1 < 4294967295.
    * PyPy: ffi.new() and ffi.new_allocator()() did not record “memory pressure”,
      causing the GC to run too infrequently if you call ffi.new() very often
      and/or with large arrays. Fixed in PyPy 5.7.
    * Support in ffi.cdef() for numeric expressions with + or -. Assumes that
      there is no overflow; it should be fixed first before we add more general
      support for arbitrary arithmetic on constants.


author: sean.marlow@suse.com
changelog:
  - Update to 1.11.0:
    * Support the modern standard types char16_t and char32_t. These
      work like wchar_t: they represent one unicode character, or when
      used as charN_t * or charN_t[] they represent a unicode string.
      The difference with wchar_t is that they have a known, fixed
      size. They should work at all places that used to work with
      wchar_t (please report an issue if I missed something). Note
      that with set_source(), you need to make sure that these types
      are actually defined by the C source you provide (if used in
      cdef()).
    * Support the C99 types float _Complex and double _Complex. Note
      that libffi doesn’t support them, which means that in the ABI
      mode you still cannot call C functions that take complex
      numbers directly as arguments or return type.
    * Fixed a rare race condition when creating multiple FFI instances
      from multiple threads. (Note that you aren’t meant to create
      many FFI instances: in inline mode, you should write
      ffi = cffi.FFI() at module level just after import cffi; and in
      out-of-line mode you don’t instantiate FFI explicitly at all.)
    * Windows: using callbacks can be messy because the CFFI internal
      error messages show up to stderr—but stderr goes nowhere in many
      applications. This makes it particularly hard to get started
      with the embedding mode. (Once you get started, you can at least
      use @ffi.def_extern(onerror=...) and send the error logs where
      it makes sense for your application, or record them in log
      files, and so on.) So what is new in CFFI is that now, on
      Windows CFFI will try to open a non-modal MessageBox (in addition
      to sending raw messages to stderr). The MessageBox is only
      visible if the process stays alive: typically, console
      applications that crash close immediately, but that is also the
      situation where stderr should be visible anyway.
    * Progress on support for callbacks in NetBSD.
    * Functions returning booleans would in some case still return 0
      or 1 instead of False or True. Fixed.
    * ffi.gc() now takes an optional third parameter, which gives an
      estimate of the size (in bytes) of the object. So far, this is
      only used by PyPy, to make the next GC occur more quickly
      (issue #320). In the future, this might have an effect on
      CPython too (provided the CPython issue 31105 is addressed).
    * Add a note to the documentation: the ABI mode gives function
      objects that are slower to call than the API mode does. For
      some reason it is often thought to be faster. It is not!
  - Update to 1.10.1:
    * Fixed the line numbers reported in case of cdef() errors. Also,
      I just noticed, but pycparser always supported the preprocessor
      directive # 42 "foo.h" to mean “from the next line, we’re in
      file foo.h starting from line 42”, which it puts in the error
      messages.


author: sean.marlow@suse.com
changelog:
  - Update pytest in spec to add c directory tests in addition to
    testing directory.
  - Omit test_init_once_multithread tests as they rely on multiple
    threads finishing in a given time. Returns sporadic pass/fail
    within build.
  - Update to 1.11.1:
    * Fix tests, remove deprecated C API usage
    * Fix (hack) for 3.6.0/3.6.1/3.6.2 giving incompatible binary
      extensions (cpython issue #29943)
    * Fix for 3.7.0a1+


author: arun@gmx.de
changelog:
  - update to version 1.11.2:
    * Fix Windows issue with managing the thread-state on CPython 3.0 to
      3.5


author: mcepl@suse.com
changelog:
  - Add dont-corrupt-memory.patch to fix boo#1111657 (originally
    from https://bitbucket.org/cffi/cffi/commits/7a76a3815340)


author: aloisio@gmx.com
changelog:
  - Update to version 2.3.0
    * Added support for CP932 detection (thanks to @hashy)
    * Fixed an issue where UTF-8 with a BOM would not be detected
      as UTF-8-SIG (#8)
    * Modified chardetect to use argparse for argument parsing
    * Moved docs to a gh-pages branch. You can now access them
      at http://chardet.github.io
  - Changelog on https://github.com/chardet/chardet/commits/2.3.0
  - Other minor changes


author: arun@gmx.de
changelog:
  - update to version 2.1.2:
    * Corrected a bug with the manylinux1 wheels where OpenSSL’s stack
      was marked executable.


author: arun@gmx.de
changelog:
  - update to version 2.1.3:
    * Updated Windows, macOS, and manylinux1 wheels to be compiled with
      OpenSSL 1.1.0g.


author: Matěj Cepl <mcepl@suse.com>
changelog:
  - bsc#1101820 CVE-2018-10903 GCM tag forgery via truncated tag in
    finalize_with_tag API
    * add disallow_implicit_tag_truncation.patch from
      https://github.com/pyca/cryptography/commit/688e0f673bfb.patch


author: Matej Cepl <mcepl@suse.com>
changelog:
  - Add openSSL_111d.patch to make this version of the package
    compatible with OpenSSL 1.1.1d, thus fixing bsc#1149792.


author: jmassaguerpla@suse.com
changelog:
  - Update to version 1.10.4
    Bugfixes
      Fixed an issue where RestartPolicy.condition_types.ON_FAILURE would yield an invalid value.
      Fixed an issue where the SSL connection adapter would receive an invalid argument.
      Fixed an issue that caused the Client to fail to reach API endpoints when the provided base_url had a trailing slash.
      Fixed a bug where some environment values in create_container containing unicode characters would raise an encoding error.
      Fixed a number of issues tied with named pipe transport on Windows.
      Fixed a bug where inclusion patterns in .dockerignore would cause some excluded files to appear in the build context on Windows.
    Miscellaneous
      Adjusted version requirements for the requests library.
      It is now possible to run the docker-py test suite on Windows.
  - Update to 1.10.3
    Bugfixes
      Fixed an issue where identity tokens in configuration files weren't handled by the library.
    Miscellaneous
      Increased the default number of connection pools from 10 to 25. This number can now be configured using the num_pools parameter in the Client constructor.
  - Update to 1.10.2
    Bugfixes
      Updated the docker-pycreds dependency as it was causing issues for some users with dependency resolution in applications using docker-py.
  - Update to 1.10.1
    Bugfixes
      The docker.utils.types module was removed in favor of docker.types, but some applications imported it explicitly. It has been re-added with an import warning advising to use the new module path.
  - Update to 1.10.0
    Features
      Added swarm mode and service management methods. See the documentation for details.
      Added support for IPv6 Docker host addresses in the Client constructor.
      Added (read-only) support for the Docker credentials store.
      Added support for custom auth_config in Client.push.
      Added support for labels in Client.create_volume.
      Added support for labels and enable_ipv6 in Client.create_network.
      Added support for force param in Client.disconnect_container_from_network.
      Added support for pids_limit, sysctls, userns_mode, cpuset_cpus, cpu_shares, mem_reservation and kernel_memory parameters in Client.create_host_config.
      Added support for link_local_ips in create_endpoint_config.
      Added support for a changes parameter in Client.import_image.
      Added support for a version parameter in Client.from_env.
    Bugfixes
      Fixed a bug where Client.build would crash if the config.json file contained a HttpHeaders entry.
      Fixed a bug where passing decode=True in some streaming methods would crash when the daemon's response had an unexpected format.
      Fixed a bug where environment values with unicode characters weren't handled properly in create_container.
      Fixed a bug where using the npipe protocol would sometimes break with ValueError: buffer size must be strictly positive.
    Miscellaneous
      Fixed an issue where URL-quoting in docker-py was inconsistent with the quoting done by the Docker CLI client.
      The client now sends TCP upgrade headers to hint potential proxies about connection hijacking.
      The client now defaults to using the npipe protocol on Windows.
  - Update to 1.9.0
    Features
      Added experimental support for Windows named pipes (npipe:// protocol).
      Added support for Block IO constraints in Client.create_host_config. This includes parameters blkio_weight, blkio_weight_device, device_read_bps, device_write_bps, device_read_iops and device_write_iops.
      Added support for the internal param in Client.create_network.
      Added support for ipv4_address and ipv6_address in utils function create_endpoint_config.
      Added support for custom user agent setting in the Client constructor. By default, docker-py now also declares itself in the User-Agent header.
    Bugfixes
      Fixed an issue where the HTTP timeout on streaming responses would sometimes be set incorrectly.
      Fixed an issue where explicit relative paths in .dockerignore files were not being recognized.


author: jmassaguerpla@suse.com
changelog:
  - add python-dockerpycreds dependency in the spec file
    rebase hide_py_pckgmgmt.patch
    add fix-requirements.patch: fix dependencies so that they match the
    ones we have packaged


author: kkaempf@suse.com
changelog:
  - Update to version 1.10.6
    Bugfixes
      Fixed an issue where setting a NpipeSocket instance to blocking mode would put it in non-blocking mode and vice-versa.
  - Update to version 1.10.5
    Bugfixes
      Fixed an issue where concurrent attempts to access to a named pipe by the client would sometimes cause recoverable exceptions to be raised.


author: toddrme2178@gmail.com
changelog:
  - Implement singlespec version
  - Fix source URL
  - Merge tests into main package.
  - Remove hide_py_pckgmgmt.patch
    Tests aren't being implemented that way


author: tbechtold@suse.com
changelog:
  - update to 2.4.2:
    * Add 'verbose' option for network inspect api
    * Fix misleading build method docs
    * Add support for ContainerSpec.TTY
    * Standardize handling of verbose param in inspect_network
    * Fix volume path passed by run to create_container
    * Only pull the 'latest' tag when testing images
    * Fix test cases for ``runtime`` config
    * Update image create error parsing
    * Improve robustness of remove_network integration test
    * Bump 2.2.0, update changelog
    * fix: Missing exception handling in split_port when no container port
    * Replace erroneous networks argument in containers.run with singular
    * Fix passing volumes to run with no host path
    * Update check_resource decorator to account for new resource names
    * Include tag in images.get after pulling if provided separately
    * Fix APIError status_code property for client/server errors
    * Ensure default timeout is used by API Client
    * Add prune_containers method
    * Add xfail mark to storageopt test
    * APIClient implementation of plugin methods
    * Add support for max_failure_ratio and monitor in UpdateConfig
    * Add appveyor.yml config
    * excludes requests 2.18.0 from compatible versions
    * Add prune_volumes method
    * fix #1625 where ImageCollection.build() could return early with incorrect
      image_id depending on docer build output
    * Ignore socket files in utils.tar
    * Add `target` argument to image building
    * Sorts model attributes in api docs alphabetically
    * Rewrite the split_port function using re
    * Add stop_timeout to create_container
    * Move reload_config func into the APIClient
    * Fix ImageNotFound detection
    * Update dockerVersions
    * Add missing support for `CpusetMems` parameter to HostConfig.
    * Implement cachefrom
    * Fix typo s/CpuSetCpus/CpusetCpus/
    * Add upgrade_plugin method
    * Handle multiple success messages during image building.
    * Add support for start_period in Healthcheck spec
    * Bump 2.0.2
    * removed duplicate mem_limit arg desc; type now consistent accross
      models (float->int)
    * added integration test for #1625 for ImageCollection.build() that verfies
      that the build method uses the last success message for extracting the image id
    * Allow events daemon command to read config.json
    * update docker-py test status code from 500 to 400
    * Adds a 'labels' property to the container model
    * Add support for recursive wildcard pattern in .dockerignore
    * Add missing secrets doc
    * init_path removed in Engine 17.05
    * Add prune_images method
    * Set infinite timeout for the `events` method
    * check NoneType before using
    * 2.3.0-dev
    * Add attributes for pickling
    * Allow configuring API version for integration test with env var
    * Correct the description of dns_opt option of create_container
    * Add support for ingress in create_network
    * DockerClient.secrets should be a @property
    * Adds a 'labels' property to the image model
    * Raise an error when passing an empty string to split_port
    * fix can't get a dict when Containers is None
    * new integration task linting for #1625
    * Adds an 'image' property to the container model
    * Add service_logs command to APIClient and logs command to models.Service
    * Fixed events command related unit tests by passing a timeout value
    * Compose 1.14.0 hack
    * Add service_logs integration test
    * Network model functions 'connect' and 'disconnect' did not accept or
      passthrough keyword arguments.
    * Modernize exec_api.py
    * Fix docstring of ImageCollection.get
    * removed unused/typoed param from models.containers.list docstring
    * Bump version 2.1.0
    * Plugins API documentation
    * Move default `timeout` into `from_env`
    * Fix _post_json behavior
    * Add prune_networks method
    * Allow port range like 8000-8010:80
    * Bump 2.3.0
    * Reference new methods in docs
    * Use experimental engine for testing in Jenkins/Makefile
    * update swarm remove test status code from 500 to >= 400
    * Bump dev version
    * Update services.py
    * Add support for volume_driver in HostConfig
    * Add support for auto_remove in HostConfig
    * Add 'force' parameter in remove_volume
    * passing flake8 test
    * Add a reload_config function to the DaemonApiMixin
    * Closes #1588, image.tag does not return anything
    * Add df method
    * Convert mode argument to valid structure in create_service
    * Fix test issues
    * Add cpu_count, cpu_percent, cpus parameters to container HostConfig.
    * Add cachefrom to build docstring
    * Improve build result detection
    * Documentation fixes for login func
    * Add integration tests
    * Add ContainerSpec mounts test
    * Add create_plugin implementation
    * Remove integration test for APIClient.search method
    * Make sure data is written in prune test so space can be reclaimed
    * Add ability to set 'Hostname' on a Service.
    * fix type checking for nano_cpus
    * Remove duplicate line in exec_run documentation
    * Optional name on VolumeCollection.create
    * Raising error in case of invalid value of since kwarg on Container.logs
    * Add support for force_update in TaskTemplate
    * Change "Remote API" to "Engine API"
    * Better error handling, itterate on json stream directly.
    * Add support for storage_opt in host_config
    * Add a specific unit test for splitting port with IPv6
    * Add support for secrets in ContainerSpec
    * Add init parameter to container HostConfig
    * dev version
    * exec: add support for `Env`
    * Update mentions of the default API version in docs
    * Remove unsupported --experimental flag from Jenkinsfile
    * Add License to PyPi metadata
    * documentation change
    * Support credHelpers section in config.json
    * Add plugin API implementation to DockerClient
    * Flake8: Fix indent.
    * Implement secrets API
    * Fix Swarm model init to correctly pass arguments through to init_swarm
    * Move LinksTest to appropriate file
    * Docstring fixes for init and init_path
    * Fix the way the list of mounts is made for service.
    * docs renames: cpu_group->cpu_period, cpu_period->cpu_quota
    * Adjust tests and add newest engine version to Jenkinsfile
    * split_port should not break when passed a non-string argument
    * Add network_mode support to Client.build
    * Add init_path parameter to container HostConfig
    * Add support for placement preferences and platforms in TaskTemplate
    * Makes docs builds faster and ensures proper ownership
    * Add support for ``runtime`` in container create and run API
    * Fix milestone link
    * Add Plugin.upgrade to documentation
    * Rename cachefrom -> cache_from
    * Formatting
    * Add 17.04 (CE) RC1 to list of engine versions to be tested
    * Fix if replicas is set to 0, Fixes #1572
    * cpus renamed to nano_cpus. Type and scale of nano_cpus are changed.
      Comments for new parameters are changed.
    * Bump test engine version
    * Minor typo correction
    * Update assert in test_create_with_restart_policy
    * Add reload() in docs for Container and Secret classes
    * Add tests for secret API implementation
    * Bump default API version to 1.26
  - python-docker-py got renamed to python-docker.


author: arun@gmx.de
changelog:
  - specfile:
    * added obsoletes %oldpython
  - update to version 2.5.1:
    * Bugfixes
      + Fixed a bug where patterns ending with ** in .dockerignore would
      raise an exception
      + Fixed a bug where using attach with the stream argument set to
      False would raise an exception
  - changes from version 2.5.0:
    * Features
      + Added support for the squash parameter in APIClient.build and
      DockerClient.images.build.
      + When using API version 1.23 or above, load_image will now return
      a generator of progress as JSON dicts.
      + remove_image now returns the content of the API's response.
    * Bugfixes
      + Fixed an issue where the auto_remove parameter in
      DockerClient.containers.run was not taken into account.
      + Fixed a bug where .dockerignore patterns starting with a slash
      were ignored.
      + Fixed an issue with the handling of ** patterns in .dockerignore
      + Fixed a bug where building FROM a private Docker Hub image when
      not using a cred store would fail.
      + Fixed a bug where calling create_service or update_service with
      task_template as a dict would raise an exception.
      + Fixed the handling of TTY-enabled containers in attach and
      exec_run.
      + DockerClient.containers.run will no longer attempt to stream
      logs if the log driver doesn't support the operation.
    * Miscellaneous
      + Added extra requirements for better TLS support on some
      platforms. These can be installed or required through the
      docker[tls] notation.


author: arun@gmx.de
changelog:
  - update to version 2.6.1:
    * Bugfixes
      + Fixed a bug on Python 3 installations preventing the use of the
      attach and exec_run methods.
  - changes from version 2.6.0:
    * Features
      + Added support for mounts in APIClient.create_host_config and
      DockerClient.containers.run
      + Added support for consistency, tmpfs_size and tmpfs_mode when
      creating mount objects.
      + Mount objects now support the tmpfs and npipe types.
      + Added support for extra_hosts in the build methods.
      + Added support for the configs API:
      o In APIClient: create_config, inspect_config, remove_config,
      configs
      o In DockerClient: configs.create, configs.get, configs.list
      and the Config model.
      o Added configs parameter to ContainerSpec. Each item in the
      configs list must be a docker.types.ConfigReference instance.
      + Added support for the following parameters when creating a
      ContainerSpec object: groups, open_stdin, read_only,
      stop_signal, helathcheck, hosts, ns_config, configs, privileges.
      + Added the following configuration classes to docker.types:
      ConfigReference, DNSConfig, Privileges, SwarmExternalCA.
      + Added support for driver in APIClient.create_secret and
      DockerClient.secrets.create.
      + Added support for scope in APIClient.inspect_network and
      APIClient.create_network, and their DockerClient equivalent.
      + Added support for the following parameters to create_swarm_spec:
      external_cas, labels, signing_ca_cert, signing_ca_key,
      ca_force_rotate, autolock_managers, log_driver. These additions
      also apply to DockerClient.swarm.init.
      + Added support for insert_defaults in APIClient.inspect_service
      and DockerClient.services.get.
    * Bugfixes
      + Fixed a bug where reading a 0-length frame in log streams would
      incorrectly interrupt streaming.
      + Fixed a bug where the id member on Swarm objects wasn't being
      populated.
      + Fixed a bug that would cause some data at the beginning of an
      upgraded connection stream (attach, exec_run) to disappear.


author: pablo.suarezhernandez@suse.com
changelog:
  - Fix package building for SLE15 (bsc#1091663)
  - Added:
    * 0001-Support-absolute-paths-for-in-context-Dockerfiles.patch


author: toddrme2178@gmail.com
changelog:
  - Implement single-spec version
  - Remove fix-requirements.patch
    This is only needed for setup.py test, which doesn't actually
    run the tests anyway so isn't used.


author: arun@gmx.de
changelog:
  - initial commit to d-p-l. Below are the previous Changelog entries
    * 0.6.1 Bugfix release.
    * 0.6.0 options_first parameter.
      Breaking changes: Corrected [options] meaning.
      argv defaults to None.
    * 0.5.0 Repeated options/commands are counted or accumulated into a
      list.
    * 0.4.2 Bugfix release.
    * 0.4.0 Option descriptions become optional,
      support for "--" and "-" commands.
    * 0.3.0 Support for (sub)commands like "git remote add".
      Introduce [options] shortcut for any options.
      Breaking changes: docopt returns dictionary.
    * 0.2.0 Usage pattern matching. Positional arguments parsing based on
      usage patterns.
      Breaking changes: docopt returns namespace (for arguments),
      not list. Usage pattern is formalized.
    * 0.1.0 Initial release. Options-parsing only (based on options
      description).


author: speilicke@suse.com
changelog:
  - Add LICENSE-MIT README.rst, use proper macros and use setuptools
    instead of distribte (upstreams merged)


author: tbechtold@suse.com
changelog:
  - update to version v2.5
    * only store scripts that are specifically referenced in logic
    * Fix validation for U+30FB KATAKANA MIDDLE DOT code point (#47)
    * range-based integer containment code
    * Documentation Updates
    * Make test runners Python 2.6 compatible (issue #20)
    * remove DISALLOWED codepoints from datafile, since they're unread
    * Avoid using bare 'except' (#39)
    * Add Python 3.5 support
    * Mark Python Wheels as universal (supports Python 2 and 3)
    * Skip tests that won't work on Python 2.6 (fixes #20)
    * Update Travis configuration to test against Python 2.6 and 3.6
    * Use relative imports (fixes #26)
    * Documentation tidy up
    * Revert to basing IDNAError on UnicodeError (issue #43) (#45)
    * rebuild idnadata
    * Update history with Java-related change
    * ignore vim swapfiles
    * Update Travis CI coverage to 3.6 and 3.7-dev
    * Reduce memory usage even further. (#41)
    * Update trove classifier for Python 3.6
    * Properly report label length exceptions (issue #36)
    * Segment uts46data to avoid Jython limits (#28)
  - Switch to singlespec approach


author: arun@gmx.de
changelog:
  - update to version 2.6:
    * Allows generation of IDNA and UTS 46 table data for different
      versions of Unicode, by deriving properties directly from Unicode
      data.
    * Ability to generate RFC 5892/IANA-style table data
    * Diagnostic output of IDNA-related Unicode properties and derived
      calculations for a given codepoint
    * Support for idna.__version__ to report version
    * Support for idna.idnadata.__version__ and
      idna.uts46data.__version__ to report Unicode version of underlying
      IDNA and UTS 46 data respectively.


author: saschpe@suse.de
changelog:
  - Re-generated spec file with py2pack
  - Run testsuite (using python-nose)
  - Fix non-executable script rpmlint warning


author: klaussfreire@gmail.com
changelog:
  Update to upstream ipaddr 2.1.10
  - i84, fix iterhosts for /31's or /127's
  - private method arg cleanup.
  - i83, docstring issue.
  - i87, new ipv4/ipv6 parser. patch from pmarks
  - i90, fix copyright.
  - bytes fix. patch from pmarks.-


author: klaussfreire@gmail.com
changelog:
  Update to upstream ipaddr 2.1.11
  - hostmask parsing bug fixed by pmarks (a nearly complete rewrite of the mask parsing code)
  - i97, incorrectly parses some v6 addresses.
  - docstring typos.
  - i95, refer to the nets in the exception raised by collapse_address_list
  - add license to boilerplate to test-2to3.sh


author: toddrme2178@gmail.com
changelog:
  - Add use_2to3.patch
    * Allows setup.py to automatically convert code with 2to3 instead
      of having to do it manually.


author: dmueller@suse.com
changelog:
  - update to 2.2.0:
    * Compile the host name regex (#127)
    * Allow arbitrary objects to be types (#129)
    * Support RFC 3339 datetimes in conformance with the spec
    * Fixed error paths for additionalItems + items (#122)
    * Fixed wording for min / maxProperties (#117)


author: tbechtold@suse.com
changelog:
  - update to version 2.4.0:
    * Added a CLI (#134)
    * Added absolute path and absolute schema path to errors (#120)
    * Added ``relevance``
    * Meta-schemas are now loaded via ``pkgutil``
    * Added ``by_relevance`` and ``best_match`` (#91)
    * Fixed ``format`` to allow adding formats for non-strings (#125)
    * Fixed the ``uri`` format to reject URI references (#131)
  - BuildRequires python-setuptools
  - Install /usr/bin/jsonschema with update-alternatives support


author: arun@gmx.de
changelog:
  - update to version 2.5.1:
    (no changelog available)
  - update to version 2.5.0:
    * Improved performance on CPython by adding caching around ref
      resolution (#203)
  - specfile:
    * add python-vcversioner
  - drop test requirements and %check section, which is broken
  - Fix update-alternatives usage


author: toddrme2178@gmail.com
changelog:
  - Update to 2.6.0
    * Improved performance on CPython by adding caching around ref resolution
      (#203)
  - Implement single-spec version


author: t.gruner@katodev.de
changelog:
  - Initial Version 0.4.0
    * Made dual compatible with Python 2 / 3.
    0.3.3
  -----
    * Fix to add in AnotherName for ``subjectAltNames`` field - added for support for CACert issued
    certs (thanks to Gu1).
    * Fix to HTTP Basic Auth option for ``ndg.httpsclient.utils.main``
    * Fix to ``ServerSSLCertVerification`` so that it can pass a function-based callback instead of using ``__call__``. In newer versions of OpenSSL (>= 0.14) the latter failed because of a request for ``__name__`` attribute.
    0.3.2
  -----
    * Fix to SubjectAltNames support check - should only be enabled if pyasn1 is
    installed.
    * Fix to open_url: HTTP Request object was being created inside if headers is
    None block - now corrected to create regardless.
    * Added http basic auth support to script. (Thanks to Willem van Engen)
    0.3.1
  -----
    * extended utils functions to support keyword for passing additional urllib2
    handlers.
    0.3.0
  -----
    * Added ndg.httpsclient.utils.fetch_stream_from_url function and added
    parameter for data to post in open_url and fetch_* methods.
    * fix to ndg.httpsclient.utils module _should_use_proxy and open_url functions
    0.2.0
  -----
    * added support for SSL verification with subjectAltNames using pyasn1
    * fixed minor bug - SSL cert DN prefix matching
    0.1.0
  -----
    Initial release


author: tbechtold@suse.com
changelog:
  - update to 15.2:
    * Fix an error where the arbitary specifier (``===``) was not correctly
      allowing pre-releases when it was being used.
    * Expose the specifier and version parts through properties on the
      ``Specifier`` classes.
    * Allow iterating over the ``SpecifierSet`` to get access to all of the
      ``Specifier`` instances.
    * Allow testing if a version is contained within a specifier via the ``in``
      operator.


author: tbechtold@suse.com
changelog:
  - update to 16.5:
    * Fix a regression in parsing requirements with whitespaces between the comma
      separators.
    * Fix a regression in parsing requirements like ``foo (==4)``.
    * Fix a bug where ``packaging.requirements:Requirement`` was overly strict when
      matching legacy requirements.
    * Add a function that implements the name canonicalization from PEP 503.
    * Implement requirement specifiers from PEP 508.
    * Relicense so that packaging is available under *either* the Apache License,
      Version 2.0 or a 2 Clause BSD license.
    * Support installation of packaging when only distutils is available.
    * Fix ``==`` comparison when there is a prefix and a local version in play.
      (:issue:`41`).
    * Implement environment markers from PEP 508.
  - Adjust Requires according to requires.txt


author: tbechtold@suse.com
changelog:
  - update to 16.7:
    * Add support for the deprecated ``python_implementation`` marker which was
      an undocumented setuptools marker in addition to the newer markers.
    * Add support for the deprecated, PEP 345 environment markers in addition to
      the newer markers.


author: tbechtold@suse.com
changelog:
  - update to 16.8:
    * Fix markers that utilize ``in`` so that they render correctly.
    * Fix an erroneous test on Python RC releases.


author: jmatejek@suse.com
changelog:
  - update for single-spec
  - drop setuptools dependency, as this is itself now a dependency
    of setuptools
  - run tests conditionally, to minimize dependency tree
  - ensure egg-info is a directory (distutils would install it as file)


author: stefan.bruens@rwth-aachen.de
changelog:
  - Cleanup specfile:
    * remove any conditionals for versions predating SLES 12/Leap 42.x
    * add Provides: protobuf-libs to fix rpmlint warning


author: stefan.bruens@rwth-aachen.de
changelog:
  - Update to protobuf v3.1.0. Protobuf v3.0.0 introduceced a new
    version of the protocol buffer language, proto3, which supersedes
    proto2.
    The protoc compiler is able to read old proto2 protocol definitions,
    and defaults to the proto2 syntax if a syntax is not specified, thus
    packages can be recompiled to link to the new library. For backwards
    compatibility, the old library version is available from the
    protobuf2 package.
    As the API for proto2 is not compatible to the proto3 API, proto3
    should only be used for new Protocol Buffers, whereas current users
    are advised to keep using proto2. For a detailed list of changes,
    see https://github.com/google/protobuf/releases
  - Drop no longer needed patches:
    * protobuf-setuptools-2.4.1.patch
    * protobuf-return-no-nonvoid.patch


author: stefan.bruens@rwth-aachen.de
changelog:
  - Fix an issue with setup.py where some files are built on the
    first invocation, but only copied on the second. This resulted
    in an incomplete protobuf-python package.


author: alarrosa@suse.com
changelog:
  - Update to 3.3.0 :
    * C++:
    * Fixed map fields serialization of DynamicMessage to correctly serialize
      both key and value regardless of their presence.
    * Parser now rejects field number 0 correctly.
    * New API Message::SpaceUsedLong() that’s equivalent to
      Message::SpaceUsed() but returns the value in size_t.
    * JSON support
    - New flag always_print_enums_as_ints in JsonPrintOptions.
    - New flag preserve_proto_field_names in JsonPrintOptions. It will instruct
      the JSON printer to use the original field name declared in the .proto
      file instead of converting them to lowerCamelCase when printing JSON.
    - JsonPrintOptions.always_print_primtive_fields now works for oneof message
      fields.
    - Fixed a bug that doesn’t allow different fields to set the same json_name
      value.
    - Fixed a performance bug that causes excessive memory copy when printing
      large messages.
    * Various performance optimizations.
    * Java:
    * Map field setters eagerly validate inputs and throw NullPointerExceptions
      as appropriate.
    * Added ByteBuffer overloads to the generated parsing methods and the Parser
      interface.
    * proto3 enum's getNumber() method now throws on UNRECOGNIZED values.
    * Output of JsonFormat is now locale independent.
    * Python:
    * Added FindServiceByName() in the pure-Python DescriptorPool. This works only
      for descriptors added with DescriptorPool.Add(). Generated descriptor_pool
      does not support this yet.
    * Added a descriptor_pool parameter for parsing Any in text_format.Parse().
    * descriptor_pool.FindFileContainingSymbol() now is able to find nested
      extensions.
    * Extending empty [] to repeated field now sets parent message presence.
  - Update to 3.2.0 :
    * Added protoc version number to protoc plugin protocol. It can be used by
      protoc plugin to detect which version of protoc is used with the plugin and
      mitigate known problems in certain version of protoc.
    * C++:
    * The default parsing byte size limit has been raised from 64MB to 2GB.
    * Added rvalue setters for non-arena string fields.
    * Enabled debug logging for Android.
    * Fixed a double-free problem when using Reflection::SetAllocatedMessage()
      with extension fields.
    * Fixed several deterministic serialization bugs:
    * MessageLite::SerializeAsString() now respects the global deterministic
      serialization flag.
    * Extension fields are serialized deterministically as well.  Fixed protocol
      compiler to correctly report importing-self as an error.
    * Fixed FileDescriptor::DebugString() to print custom options correctly.
    * Various performance/codesize optimizations and cleanups.
    * Java:
    * The default parsing byte size limit has been raised from 64MB to 2GB.
    * Added recursion limit when parsing JSON.
    * Fixed a bug that enumType.getDescriptor().getOptions() doesn't have custom
      options.
    * Fixed generated code to support field numbers up to 2^29-1.
    * Python:
    * You can now assign NumPy scalars/arrays (np.int32, np.int64) to protobuf
      fields, and assigning other numeric types has been optimized for
      performance.
    * Pure-Python: message types are now garbage-collectable.
    * Python/C++: a lot of internal cleanup/refactoring.
  - Increase soname to 13
  - Generate python2-protobuf and python3-protobuf packages in Factory
  - Make the python2-protobuf package provide and obsolete python-protobuf
    to make the transition smooth in Tumbleweed


author: jengelh@inai.de
changelog:
  - Update to new upstream release 3.5.0
    * Proto3 messages are now preserving unknown fields by default.
      If you rely on unknowns fields being dropped, use
      DiscardUnknownFields() explicitly.
    * Deprecated the unsafe_arena_release_* and
      unsafe_arena_add_allocated_* methods for string fields.
    * Added move constructor and move assignment to RepeatedField,
      RepeatedPtrField and google::protobuf::Any.
    * Added perfect forwarding in Arena::CreateMessage.
    * In-progress experimental support for implicit weak fields
      with lite protos. This feature allows the linker to strip out
      more unused messages and reduce binary size.
  - Rename %soname to %sover to better reflect its use.


author: tchvatal@suse.com
changelog:
  - Conditionalize python2 and python3 in order to be able to build
    without python2 present in distribution
    * Use singlespec macros to simplify the logic
  - Run fdupes on python modules to avoid duplicates
  - Remove shebangs from import-only code


author: mlin@suse.com
changelog:
  - Add adding-Release_CompareAndSwap-64-bit-variant.patch
    * Fix compile error undefined reference to
      `google::protobuf::internal::Release_CompareAndSwap(long volatile*, long, long)'
      on s390x https://github.com/google/protobuf/issues/3937


author: arun@gmx.de
changelog:
  - specfile:
    * updated url
  - update to version 1.5.2:
    * fix #169, #170: error importing py.log on Windows: no module named
      "syslog".
  - changes from version 1.5.1:
    * fix #167 - prevent pip from installing py in unsupported Python
      versions.


author: Ondřej Súkup <mimi.vx@gmail.com>
changelog:
  - update to 1.7.0
    * use ``shutil.get_terminal_size()`` in Python 3.3+ to determine the size of the
    terminal, which produces more accurate results than the previous method.
    * introduce new ``PY_IGNORE_IMPORTMISMATCH`` environment variable
    that suppresses ``ImportMismatchError`` exceptions when set to ``1``.
    * add ``TerminalWriter.width_of_current_line`` (i18n version of
    ``TerminalWriter.chars_on_current_line``), a read-only property
    that tracks how wide the current line is, attempting to take
    into account international characters in the calculation.


author: Tomáš Chvátal <tchvatal@suse.com>
changelog:
  - Make tests really pass on pytest 3.x series
  - Add patch to operate better with serparators (from upstream git):
    * separators.patch


author: Tomáš Chvátal <tchvatal@suse.com>
changelog:
  - Make tests never fail as they are borked on pytest-4 with
    most probably no intention of being ever fixed


author: Tomáš Chvátal <tchvatal@suse.com>
changelog:
  - Update to 1.8.0:
    * add ``"importlib"`` pyimport mode for python3.5+, allowing unimportable test suites
      to contain identically named modules.
    * fix ``LocalPath.as_cwd()`` not calling ``os.chdir()`` with ``None``, when
      being invoked from a non-existing directory.
  - Drop merged patch separators.patch


author: Tomáš Chvátal <tchvatal@suse.com>
changelog:
  - Update to 1.8.1:
    - Handle ``FileNotFoundError`` when trying to import pathlib in
      ``path.common`` on Python 3.4 (#207).
    - ``py.path.local.samefile`` now works correctly in Python 3 on
      Windows when dealing with symlinks.


author: toddrme2178@gmail.com
changelog:
  - Implement single-spec version
  - Fix source URL
  - Update to 17.0.0
    * Added ``OpenSSL.X509Store.set_time()`` to set a custom
      verification time when verifying certificate chains.
    * Added a collection of functions for working with OCSP stapling.
      None of these functions make it possible to validate OCSP
      assertions, only to staple them into the handshake and to
      retrieve the stapled assertion if provided.
      Users will need to write their own code to handle OCSP
      assertions.
      We specifically added: ``Context.set_ocsp_server_callback``,
      ``Context.set_ocsp_client_callback``, and
      ``Connection.request_ocsp``.
    * Changed the ``SSL`` module's memory allocation policy to
      avoid zeroing memory it allocates when unnecessary.
      This reduces CPU usage and memory allocation time by an amount
      proportional to the size of the allocation.
      For applications that process a lot of TLS data or that use
      very lage allocations this can provide considerable performance
      improvements.
    * Automatically set ``SSL_CTX_set_ecdh_auto()`` on
      ``OpenSSL.SSL.Context``.
    - Fix empty exceptions from ``OpenSSL.crypto.load_privatekey()``.
  - Rebase bug-lp-1265482.diff
  - Rebase rsa128-i586.patch
  - Rebase skip-networked-test.patch


author: dimstar@opensuse.org
changelog:
  - Add python-pyOpenSSL=replace-expired-cert.patch: the root cert
    expired, mking the test suite fail. Replace the certificate with
    a new one, valid for 20 years (gh#pyca/pyopenssl#637).


author: ro@suse.de
changelog:
  - add patch to always trigger overflow in the testsuite
    (gh#pyca/pyopenssl#657) b3460c6a9a45a016d1ab65c149c606fa3f07096d
    python-pyOpenSSL-always-overflow.patch


author: tbechtold@suse.com
changelog:
  - update to 17.2.0:
    - Deprecated ``OpenSSL.rand`` - callers should use ``os.urandom()`` instead.
    - Fixed a bug causing ``Context.set_default_verify_paths()`` to not work with
      cryptography ``manylinux1`` wheels on Python 3.x.
    - Fixed a crash with (EC)DSA signatures in some cases.
    - Removed the deprecated ``OpenSSL.rand.egd()`` function.
      Applications should prefer ``os.urandom()`` for random number generation.
    - Removed the deprecated default ``digest`` argument to ``OpenSSL.crypto.CRL.export()``.
      Callers must now always pass an explicit ``digest``.
    - Fixed a bug with ``ASN1_TIME`` casting in ``X509.set_notBefore()``,
      ``X509.set_notAfter()``, ``Revoked.set_rev_date()``, ``Revoked.set_nextUpdate()``,
      and ``Revoked.set_lastUpdate()``. You must now pass times in the form
      ``YYYYMMDDhhmmssZ``. ``YYYYMMDDhhmmss+hhmm`` and ``YYYYMMDDhhmmss-hhmm``
      will no longer work. `#612 <https://github.com/pyca/pyopenssl/pull/612>`_
    - Deprecated the legacy "Type" aliases: ``ContextType``, ``ConnectionType``,
      ``PKeyType``, ``X509NameType``, ``X509ExtensionType``, ``X509ReqType``,
      ``X509Type``, ``X509StoreType``, ``CRLType``, ``PKCS7Type``, ``PKCS12Type``,
      ``NetscapeSPKIType``.
      The names without the "Type"-suffix should be used instead.
    - Added ``OpenSSL.crypto.X509.from_cryptography()`` and ``OpenSSL.crypto.X509.to_cryptography()``
      for converting X.509 certificate to and from pyca/cryptography objects.
    - Added ``OpenSSL.crypto.X509Req.from_cryptography()``, ``OpenSSL.crypto.X509Req.to_cryptography()``,
      ``OpenSSL.crypto.CRL.from_cryptography()``, and ``OpenSSL.crypto.CRL.to_cryptography()``
      for converting X.509 CSRs and CRLs to and from pyca/cryptography objects.
    - Added ``OpenSSL.debug`` that allows to get an overview of used library versions
      (including linked OpenSSL) and other useful runtime information using
      ``python -m OpenSSL.debug``.
    - Added a fallback path to ``Context.set_default_verify_paths()`` to accommodate
      the upcoming release of ``cryptography`` ``manylinux1`` wheels.
  - Drop python-pyOpenSSL=replace-expired-cert.patch . Applied upstream.
  - Drop python-pyOpenSSL-always-overflow.patch. Applied upstream.


author: tchvatal@suse.com
changelog:
  - Update to 17.5.0:
    * The minimum cryptography version is now 2.1.4.
    * Fixed various memory leaks
    * Various fuzz fixes
    * See CHANGELOG.rst


author: Vítězslav Čížek <vcizek@suse.com>
changelog:
  - OpenSSL changed X509_STORE_add_cert in 1.1.0i such that it no longer
    raises an error if a duplicate cert is added (bsc#1110435)
    * https://github.com/pyca/pyopenssl/pull/787
    * add X509_STORE_add_cert.patch


author: Matej Cepl <mcepl@suse.com>
changelog:
  - Add fix-compilation-2020.patch (by Bernhard Wiedemann). Fixes
    bsc#1159989 (and its upstream equivalent
    gh#pyca/pyopenssl#735).


author: michael@stroeder.com
changelog:
  - updated to upstream release 0.3.1
  - do not ship doc/source/
    Revision 0.3.1, released 26-07-2017
  - ASN.1 types __init__(), .clone() and .subtype() signatures
    refactored into keyword arguments to simplify their signatures.
  - ASN.1 types initialization refactored to minimize the use of
    relatively expensive isNoValue() call
  - Lazily pre-populate list of values of Sequence/Set/Choice types
  - NamedTypes comparison made more efficient
  - More efficient constraints computation and code clean up
  - The __getitem__() implementation of some ASN.1 types & tag object
    refactored for better performance
  - BER/CER/DER value encoders refactored to produce either tuple of
    bytes or octet-stream depending on what is more optimal
  - Reduced the frequency of expensive isinstance() calls
  - Tag-related classes optimized, refactored into properties and
    documented.
  - The NamedValues implementation refactored to mimic Python dict, its use
    in ASN.1 types refactored into properties and better documented.
    WARNING: this change introduces a deviation from original API.
  - NamedType family of classes overhauled, optimized and documented.
  - The `componentType` attribute of constructed ASN.1 types turned
    read-only on instances.
  - Sequence/Set DER/CER/DER decoder optimized to skip the case of
    reordered components handling when not necessary.
  - Tags and constraints-related getter methods refactored into read-only
    instance attributes.
  - The .hasValue() method refactored into .isValue property. All ASN.1
    objects now support them, not just scalars.
  - The Real.{isInfinity, isPlusInfinity, isMinusInfinity} methods
    refactored into properties and renamed into IsInf, IsPlusInf and isMinusInf
  - The end-of-octets type refactored to ensure it is a singleton. Codecs
    changed to rely on that for better performance.
  - Codecs lookup made more efficient at BER/CER/DER decoder main loop by
    assigning `typeId` to every ASN.1 type, not just ambiguous ones.
  - The .getComponent*() methods of constructed ASN.1 types changed
    to lazily instantiate underlying type rather than return `None`.
    This should simplify its API as initialization like `X[0][1] = 2` becomes
    possible.
    WARNING: this change introduces a deviation from the original API.
  - The .setComponent*() methods of SetOf/SequenceOf types changed not
    to allow uninitialized "holes" inside the sequences of their components.
    They now behave similarly to Python lists.
    WARNING: this change introduces a deviation from the original API.
  - Default and optional components en/decoding of Constructed type
    refactored towards better efficiency and more control.
  - OctetsString and Any decoder optimized to avoid creating ASN.1
    objects for chunks of substrate. Instead they now join substrate
    chunks together and create ASN.1 object from it just once.
  - The GeneralizedTime and UTCTime types now support to/from Python
    datetime object conversion.
  - Unit tests added for the `compat` sub-package.
  - Fixed BitString named bits initialization bug.
  - Fixed non-functional tag cache (when running Python 2) at DER decoder.
  - Fixed chunked encoding restriction on DER encoder.
  - Fixed SET components ordering at DER encoder.
  - Fixed BIT STRING & OCTET STRING encoding to be always non-chunked (e.g.
    primitive) at DER encoder
  - Fixed `compat.integer.from_bytes()` behaviour on empty input.


author: michael@stroeder.com
changelog:
  - updated to upstream release 0.3.2
    Revision 0.3.2, released 04-08-2017
  - Fixed SequenceOf/SetOf types initialization syntax to remain
    backward compatible with pyasn1 0.2.*
  - Rectified thread safety issues by moving lazy, run-time computation
    into object initializer.
  - Fixed .isValue property to return True for empty SetOf/SequenceOf
    objects
  - Fixed GeneralizedTime/UTCTime CER/DER codecs to actually get invoked
  - Fixed DER/CER encoders handling optional SEQUENCE/SET fields containing
    nested SEQUENCE/SET with optional fields.
  - Fixed crash in SequenceOf/SetOf pretty printing and decoding (in some
    cases)
  - Fixed documentation markup issues.


author: michael@stroeder.com
changelog:
  - updated to upstream release 0.3.4
    Revision 0.3.4, released 07-09-2017
  - Fixed Native encoder to handle SEQUENCE/SET objects without
    the componentType property
  - Added missing component-less SEQUENCE/SET objects dict duck-typing support
  - Fixed unnecessary duplicate tags detection at NamesType.tagMap
  - Fixed crash at SEQUENCE and SEQUENCE OF CER encoder when running
    in schemaless mode
  - Fixed Character types instantiation from OctetString type -- double
    unicode decoding may have scrambled the data
    Revision 0.3.3, released 27-08-2017
  - Improved ASN.1 types instantiation performance
  - Improved BER/CER/DER decoder performance by not unconditionally casting
    substrate into str/bytes.
  - Fixed exponential index size growth bug when building ambiguous
    NamedTypes tree
  - Fixed constructed types decoding failure at BER codec if running
    in schema-less mode
  - Fixed crash on prettyPrint'ing a SEQUENCE with no defined components
  - Fixed SetOf ordering at CER/DER encoder
  - Fixed crash on conditional binascii module import
  - Fix to TagSet hash value build


author: michael@stroeder.com
changelog:
  - updated to upstream release 0.3.5
    - Codecs signatures unified and pass the options kwargs through the
      call chain
    - Explicit tag encoding optimized to avoid unnecessary copying
    - End-of-octets sentinel encoding optimized
    - Refactored ASN.1 codecs properties to silently enforce proper
      length and chunk size encoding modes
    - Fixed DER encoder to always produce primitive encoding
    - Fixed crash at SequenceOf native decoder
    - Fixed Real.prettyPrint() to fail gracefully on overflow
    - Fixed a couple of crashes when debug mode is enabled


author: michael@stroeder.com
changelog:
  - updated to upstream release 0.3.6
    * End-of-octets encoding optimized at ASN.1 encoders
    * The __getitem__/__setitem__ behavior of Set/Sequence and
      SetOf/SequenceOf objects aligned with the canonical Mapping
      and Sequence protocols in part
    * Fixed crash in ASN.1 encoder when encoding an explicitly tagged
      component of a Sequence


author: arun@gmx.de
changelog:
  - update to version 0.4.2:
    * Fixed explicit tag splitting in chunked encoding mode at
      OctetString and BitString encoders
  - changes from version 0.4.1:
    * ANY DEFINED BY clause support implemented
    * Encoders refactored to take either a value (as ASN.1 object) or a
      Python value plus ASN.1 schema
    * BitString decoder optimised for better performance when running on
      constructed encoding
    * Constructed types' .getComponentBy*() methods accept the `default`
      parameter to return instead if schema object is to be returned
    * Constructed types' .getComponentBy*() methods accept the
      `instantiate` parameter to disable automatic inner component
      instantiation
    * The ASN.1 types' `__repr__` implementation reworked for better
      readability at the cost of not being `eval`-compliant
    * Most ASN.1 types' `__str__` magic methods (except for OctetString
      and character types) reworked to call `.prettyPrint()` rather than
      `.prettyPrint` calling `__str__` as it was before. The intention
      is to eventually deprecate `.prettyPrint()` in favor of `str()`.
      The other related change is that `str()` of enumerations and
      boolean types will return string label instead of number.
    * Fixed Choice.clear() to fully reset internal state of the object
    * Sphinx documentation rearranged, simplified and reworded
    * The `isValue` singleton is now the only way to indicate ASN.1
      schema as opposed to ASN.1 schema instance. The legacy `None`
      initializer support has been removed.
    * Changed `Null` object initialization behaviour: previous default
      value (`''`) is not set anymore. Thus `Null()` call produces a
      ASN.1 schema object, while `Null('')` - value object.
    * Migrated all docs and references from SourceForge
    * Imports PEP8'ed
    * Fixed ASN.1 encoder not to omit empty substrate produced for inner
      component if the inner component belongs to the simple class (as
      opposed to constructed class)
    * Fixed CER/DER encoders to respect tagged CHOICE when ordering SET
      components
    * Fixed ASN.1 types not to interfere with the Pickle protocol
    * Fixed Sequence/SequenceOf types decoding heuristics in schema-less
      decoding mode


author: speilicke@suse.com
changelog:
  - Update to version 2.10:
    - A number of improvements in the handling of typedef-name ambiguities,
      contributed by Sye van der Veen in GitHub issue #1:
    * Allow shadowing of types by identifiers in inner scopes.
    * Allow struct field names to reside in a separate namespace and have
      the same names as types.
    * Allow duplicate typedefs in some cases to mimic real compiler behavior.
    - c_generator error for ExprList in expression context.
    - Assume default int type for functions whose argument or return types were
      not specified.
    - Relax the lexer a bit w.r.t. some integer suffixes and $ in identifier names
      (which is supported by some other compilers).
  - Package LICENSE


author: benoit.monin@gmx.fr
changelog:
  - update to version 2.12:
    * This is a fix release for 2.11; the memory optimization with
      __slots__ on Coord and AST nodes didn't take weakrefs into
      account, which broke cffi and its many dependents (issue #76).
      Fixed by adding __weakref__ to __slots__.
  - additional changes from version 2.11:
    * Add support for C99 6.5.3.7 p7 - qualifiers within array
      dimensions in function declarations. Started with issue #21
      (reported with initial patch by Robin Martinjak).
    * Issue #27: bug in handling of unified wstring literals.
    * Issue #28: fix coord reporting for 'for' loops.
    * Added ``examples/using_gcc_E_libc.py`` to demonstrate how ``gcc
    - E`` can be used instead of ``cpp`` for preprocessing.
    * Pull request #64: support keywords like const, volatile,
      restrict and static in dimensions in array declarations.
    * Reduce memory usage of AST nodes (issue #72).
    * Parsing order of nested pointer declarations fixed (issue #68).
  - update project URL
  - fix end of line encoding of LICENSE


author: mvyskocil@opensuse.org
changelog:
  - Update to version 2.14
    * Added CParser parameter to specify output directory for generated parsing
      tables (#84).
    * Removed lcc's cpp and its license from the distribution. Using lcc's cpp
      is no longer recommended, now that Clang has binary builds available for
      Windows.
    2.13:
    * Added support for offsetof() the way gcc implements it (special builtin
      that takes a type as an argument).
    * Added faked va_* macros (these are expected to come from stdarg.h)
    * Added a bunch more fake headers and typedefs to support parsing C projects
      like Git and SQLite without modifications to pycparser.
    * Added support for empty initializer lists (#79).
  - Package fake_libc_include
    * switch to github release as pypi tarball don't contains all files
  - Add 0002-Add-missing-typedef-sa_family_t-from-sys-socket.h.patch
    * upstream patch enhancing the fake_libc_include


author: jmatejek@suse.com
changelog:
  - update for multipython build
  - move fake_libc to site-packages, where it can be found by pkg_resources
    * this also prevents file conflict between python2 and python3
  - fix-lexer-build.patch: fix build process to better generate parser/lexer
    files


author: jmatejek@suse.com
changelog:
  - update to 2.17
    - PR #121: Update bundled PLY version to 3.8
    - Issue #117: Fix parsing of extra semi-colons inside structure declarations.
    - PR #109: Update c_generator to add {} around nested named initializers.
    - PR #101: Added support for parsing pragmas into the AST.
    - Additional fake headers and typedefs, manifest fixes (#97, #106, #111).
    - Testing with Python 3.5 instead of 3.3 now (3.4 and 3.5 are the 3.x versions
      tested).
    - PR #145: More complete support for offsetof()
    - Issue #116: Fix line numbers recorded for empty and compound statements.
    - Minor performance improvement to the invalid string literal regex.
  - drop upstreamed 0002-Add-missing-typedef-sa_family_t-from-sys-socket.h.patch
  - move source url to pypi


author: speilicke@suse.com
changelog:
  - Update to version 2.0.1:
    - Removed use of "nonlocal" that prevented using this version of
      pyparsing with Python 2.6 and 2.7. This will make it easier to
      install for packages that depend on pyparsing, under Python
      versions 2.6 and later. Those using older versions of Python
      will have to manually install pyparsing 1.5.7.
    - Fixed implementation of <<= operator to return self; reported by
      Luc J. Bourhis, with patch fix by Mathias Mamsch - thanks, Luc
      and Mathias!
  - Changes from version 2.0.0:
    - Rather than release another combined Python 2.x/3.x release
      I've decided to start a new major version that is only
      compatible with Python 3.x (and consequently Python 2.7 as
      well due to backporting of key features). This version will
      be the main development path from now on, with little follow-on
      development on the 1.5.x path.
    - Operator '<<' is now deprecated, in favor of operator '<<=' for
      attaching parsing expressions to Forward() expressions. This is
      being done to address precedence of operations problems with '<<'.
      Operator '<<' will be removed in a future version of pyparsing.


author: Greg.Freemyer@gmail.com
changelog:
  - update to v2.0.2
    - Extended "expr(name)" shortcut (same as "expr.setResultsName(name)")
    to accept "expr()" as a shortcut for "expr.copy()".
    - Added "locatedExpr(expr)" helper, to decorate any returned tokens
    with their location within the input string. Adds the results names
    locn_start and locn_end to the output parse results.
    - Added "pprint()" method to ParseResults, to simplify troubleshooting
    and prettified output. Now instead of importing the pprint module
    and then writing "pprint.pprint(result)", you can just write
    "result.pprint()".  This method also accepts addtional positional and
    keyword arguments (such as indent, width, etc.), which get passed
    through directly to the pprint method
    (see http://docs.python.org/2/library/pprint.html#pprint.pprint).
    - Removed deprecation warnings when using '<<' for Forward expression
    assignment. '<<=' is still preferred, but '<<' will be retained
    for cases whre '<<=' operator is not suitable (such as in defining
    lambda expressions).
    - Expanded argument compatibility for classes and functions that
    take list arguments, to now accept generators as well.
    - Extended list-like behavior of ParseResults, adding support for
    append and extend. NOTE: if you have existing applications using
    these names as results names, you will have to access them using
    dict-style syntax: res["append"] and res["extend"]
    - ParseResults emulates the change in list vs. iterator semantics for
    methods like keys(), values(), and items(). Under Python 2.x, these
    methods will return lists, under Python 3.x, these methods will
    return iterators.
    - ParseResults now has a method haskeys() which returns True or False
    depending on whether any results names have been defined. This simplifies
    testing for the existence of results names under Python 3.x, which
    returns keys() as an iterator, not a list.
    - ParseResults now supports both list and dict semantics for pop().
    If passed no argument or an integer argument, it will use list semantics
    and pop tokens from the list of parsed tokens. If passed a non-integer
    argument (most likely a string), it will use dict semantics and
    pop the corresponding value from any defined results names. A
    second default return value argument is supported, just as in
    dict.pop().
    - Fixed bug in markInputline, thanks for reporting this, Matt Grant!
    - Cleaned up my unit test environment, now runs with Python 2.6 and
    3.3.


author: benoit.monin@gmx.fr
changelog:
  - update to version 2.0.3:
    * Fixed escaping behavior in QuotedString. Formerly, only
      quotation marks (or characters designated as quotation marks in
      the QuotedString constructor) would be escaped. Now all escaped
      characters will be escaped, and the escaping backslashes will
      be removed.
    * Fixed regression in ParseResults.pop() - pop() was pretty much
      broken after I added *improvements* in 2.0.2. Reported by Iain
      Shelvington, thanks Iain!
    * Fixed bug in And class when initializing using a generator.
    * Enhanced ParseResults.dump() method to list out nested
      ParseResults that are unnamed arrays of sub-structures.
    * Fixed UnboundLocalError under Python 3.4 in oneOf method,
      reported on Sourceforge by aldanor, thanks!
    * Fixed bug in ParseResults __init__ method, when returning
      non-ParseResults types from parse actions that implement
      __eq__. Raised during discussion on the pyparsing wiki with
      cyrfer.
  - fix end of line encoding of every file in examples


author: toddrme2178@gmail.com
changelog:
  - update to version 2.0.7:
    * Simplified string representation of Forward class, to avoid memory
      and performance errors while building ParseException
      messages. Thanks, Will McGugan, Andrea Censi, and Martijn Vermaat
      for the bug reports and test code.
    * Cleaned up additional issues from enhancing the error messages for
      Or and MatchFirst, handling Unicode values in expressions. Fixes
      Unicode encoding issues in Python 2, thanks to Evan Hubinger for
      the bug report.
    * Fixed implementation of dir() for ParseResults - was leaving out
      all the defined methods and just adding the custom results names.
    * Fixed bug in ignore() that was introduced in pyparsing 1.5.3, that
      would not accept a string literal as the ignore expression.
    * Added new example parseTabularData.py to illustrate parsing of
      data formatted in columns, with detection of empty cells.
    * Updated a number of examples to more current Python and pyparsing
      forms.
  - update to version 2.0.6:
    * Fixed a bug in Each when multiple Optional elements are present.
      Thanks for reporting this, whereswalden on SO.
    * Fixed another bug in Each, when Optional elements have results
      names or parse actions, reported by Max Rothman - thank you, Max!
    * Added optional parseAll argument to runTests, whether tests should
      require the entire input string to be parsed or not (similar to
      parseAll argument to parseString). Plus a little neaten-up of the
      output on Python 2 (no stray ()'s).
    * Modified exception messages from MatchFirst and Or
      expressions. These were formerly misleading as they would only
      give the first or longest exception mismatch error message. Now
      the error message includes all the alternatives that were possible
      matches. Originally proposed by a pyparsing user, but I've lost
      the email thread - finally figured out a fairly clean way to do
      this.
    * Fixed a bug in Or, when a parse action on an alternative raises an
      exception, other potentially matching alternatives were not always
      tried.  Reported by TheVeryOmni on the pyparsing wiki, thanks!
    * Fixed a bug to dump() introduced in 2.0.4, where list values were
      shown in duplicate.
  - update to version 2.0.5:
    * (&$(@#&$(@!!!!  Some "print" statements snuck into pyparsing
      v2.0.4, breaking Python 3 compatibility! Fixed. Reported by
      jenshn, thanks!
  - changes from Version 2.0.4:
    * Added ParserElement.addCondition, to simplify adding parse actions
      that act primarily as filters. If the given condition evaluates
      False, pyparsing will raise a ParseException. The condition should
      be a method with the same method signature as a parse action, but
      should return a boolean. Suggested by Victor Porton, nice idea
      Victor, thanks!
    * Slight mod to srange to accept unicode literals for the input
      string, such as "[а-яА-Я]" instead of
      "[\u0430-\u044f\u0410-\u042f]". Thanks to Alexandr Suchkov for the
      patch!
    * Enhanced implementation of replaceWith.
    * Fixed enhanced ParseResults.dump() method when the results
      consists only of an unnamed array of sub-structure
      results. Reported by Robin Siebler, thanks for your patience and
      persistence, Robin!
    * Fixed bug in fourFn.py example code, where pi and e were defined
      using CaselessLiteral instead of CaselessKeyword. This was not a
      problem until adding a new function 'exp', and the leading 'e' of
      'exp' was accidentally parsed as the mathematical constant
      'e'. Nice catch, Tom Grydeland - thanks!
    * Adopt new-fangled Python features, like decorators and ternary
      expressions, per suggestions from Williamzjc - thanks William! (Oh
      yeah, I'm not supporting Python 2.3 with this code any more...)
      Plus, some additional code fixes/cleanup - thanks again!
    * Added ParserElement.runTests, a little test bench for quickly
      running an expression against a list of sample input
      strings. Basically, I got tired of writing the same test code over
      and over, and finally added it as a test point method on
      ParserElement.
    * Added withClass helper method, a simplified version of
      withAttribute for the common but annoying case when defining a
      filter on a div's class - made difficult because 'class' is a
      Python reserved word.


author: toddrme2178@gmail.com
changelog:
  - update to version 2.1.10:
    * Fixed bug in reporting named parse results for ZeroOrMore
      expressions, thanks Ethan Nash for reporting this!
    * Fixed behavior of LineStart to be much more predictable.
      LineStart can now be used to detect if the next parse position is
      col 1, factoring in potential leading whitespace (which would
      cause LineStart to fail). Also fixed a bug in col, which is used
      in LineStart, where '\n's were erroneously considered to be column
      1.
    * Added support for multiline test strings in runTests.
    * Fixed bug in ParseResults.dump when keys were not strings.  Also
      changed display of string values to show them in quotes, to help
      distinguish parsed numeric strings from parsed integers that have
      been converted to Python ints.
  - update to version 2.1.9:
    * Added class CloseMatch, a variation on Literal which matches
      "close" matches, that is, strings with at most 'n' mismatching
      characters.
    * Fixed bug in Keyword.setDefaultKeywordChars(), reported by
      Kobayashi Shinji - nice catch, thanks!
    * Minor API change in pyparsing_common. Renamed some of the common
      expressions to PEP8 format (to be consistent with the other
      pyparsing_common expressions):
      + signedInteger -> signed_integer
      + sciReal -> sci_real
      Also, in trying to stem the API bloat of pyparsing, I've copied
      some of the global expressions and helper parse actions into
      pyparsing_common, with the originals to be deprecated and removed
      in a future release:
      + commaSeparatedList -> pyparsing_common.comma_separated_list
      + upcaseTokens -> pyparsing_common.upcaseTokens
      + downcaseTokens -> pyparsing_common.downcaseTokens
    * Fixed Python3 compatibility bug when using dict keys() and
      values() in ParseResults.getName().
    * After some prodding, I've reworked the unitTests.py file for
      pyparsing over the past few releases. It uses some variations on
      unittest to handle my testing style. The test now:
      + auto-discovers its test classes (while maintining their order
      of definition)
      + suppresses voluminous 'print' output for tests that pass
  - update to version 2.1.8:
    * Fixed issue in the optimization to _trim_arity, when the full
      stacktrace is retrieved to determine if a TypeError is raised in
      pyparsing or in the caller's parse action. Code was traversing the
      full stacktrace, and potentially encountering UnicodeDecodeError.
    * Fixed bug in ParserElement.inlineLiteralsUsing, causing infinite
      loop with Suppress.
    * Fixed bug in Each, when merging named results from multiple
      expressions in a ZeroOrMore or OneOrMore. Also fixed bug when
      ZeroOrMore expressions were erroneously treated as required
      expressions in an Each expression.
    * Added a few more inline doc examples.
    * Improved use of runTests in several example scripts.
  - changes from version 2.1.7:
    * Fixed regression reported by Andrea Censi (surfaced in PyContracts
      tests) when using ParseSyntaxExceptions (raised when using
      operator '-') with packrat parsing.
    * Minor fix to oneOf, to accept all iterables, not just
      space-delimited strings and lists. (If you have a list or set of
      strings, it is not necessary to concat them using ' '.join to pass
      them to oneOf, oneOf will accept the list or set or generator
      directly.)
  - changes from version 2.1.6 :
    * *Major packrat upgrade*, inspired by patch provided by Tal Einat -
      many, many, thanks to Tal for working on this! Tal's tests show
      faster parsing performance (2X in some tests), *and* memory
      reduction from 3GB down to ~100MB! Requires no changes to
      existing code using packratting. (Uses OrderedDict, available in
      Python 2.7 and later.  For Python 2.6 users, will attempt to
      import from ordereddict backport. If not present, will implement
      pure-Python Fifo dict.)
    * Minor API change - to better distinguish between the flexible
      numeric types defined in pyparsing_common, I've changed "numeric"
      (which parsed numbers of different types and returned int for
      ints, float for floats, etc.) and "number" (which parsed numbers
      of int or float type, and returned all floats) to "number" and
      "fnumber" respectively. I hope the "f" prefix of "fnumber" will be
      a better indicator of its internal conversion of parsed values to
      floats, while the generic "number" is similar to the flexible
      number syntax in other languages. Also fixed a bug in
      pyparsing_common.numeric (now renamed to pyparsing_common.number),
      integers were parsed and returned as floats instead of being
      retained as ints.
    * Fixed bug in upcaseTokens and downcaseTokens introduced in 2.1.5,
      when the parse action was used in conjunction with results names.
      Reported by Steven Arcangeli from the dql project, thanks for your
      patience, Steven!
    * Major change to docs! After seeing some comments on reddit about
      general issue with docs of Python modules, and thinking that I'm a
      little overdue in doing some doc tuneup on pyparsing, I decided to
      following the suggestions of the redditor and add more inline
      examples to the pyparsing reference documentation. I hope this
      addition will clarify some of the more common questions people
      have, especially when first starting with pyparsing/Python.
    * Deprecated ParseResults.asXML. I've never been too happy with this
      method, and it usually forces some unnatural code in the parsers
      in order to get decent tag names. The amount of guesswork that
      asXML has to do to try to match names with values should have been
      a red flag from day one. If you are using asXML, you will need to
      implement your own ParseResults->XML serialization. Or consider
      migrating to a more current format such as JSON (which is very
      easy to do: results_as_json = json.dumps(parse_result.asDict())
      Hopefully, when I remove this code in a future version, I'll also
      be able to simplify some of the craziness in ParseResults, which
      IIRC was only there to try to make asXML work.
    * Updated traceParseAction parse action decorator to show the repr
      of the input and output tokens, instead of the str format, since
      str has been simplified to just show the token list content.
  - update to version 2.1.5:
    * Added ParserElement.split() generator method, similar to
      re.split().  Includes optional arguments maxsplit (to limit the
      number of splits), and includeSeparators (to include the
      separating matched text in the returned output, default=False).
    * Added a new parse action construction helper tokenMap, which will
      apply a function and optional arguments to each element in a
      ParseResults.
    * Added more expressions to pyparsing_common:
      + IPv4 and IPv6 addresses (including long, short, and mixed
      forms of IPv6)
      + MAC address
      + ISO8601 date and date time strings (with named fields for
      year, month, etc.)
      + UUID (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)
      + hex integer (returned as int)
      + fraction (integer '/' integer, returned as float)
      + mixed integer (integer '-' fraction, or just fraction,
      returned as float)
      + stripHTMLTags (parse action to remove tags from HTML source)
      + parse action helpers convertToDate and convertToDatetime to do
      custom parse time conversions of parsed ISO8601 strings
    * runTests now returns a two-tuple: success if all tests succeed,
      and an output list of each test and its output lines.
    * Added failureTests argument (default=False) to runTests, so that
      tests can be run that are expected failures, and runTests' success
      value will return True only if all tests *fail* as expected. Also,
      parseAll now defaults to True.
    * New example numerics.py, shows samples of parsing integer and real
      numbers using locale-dependent formats
  - changes from version 2.1.4:
    * Split out the '==' behavior in ParserElement, now implemented as
      the ParserElement.matches() method. Using '==' for string test
      purposes will be removed in a future release.
    * Expanded capabilities of runTests(). Will now accept embedded
      comments (default is Python style, leading '#' character, but
      customizable). Comments will be emitted along with the tests and
      test output. Useful during test development, to create a test
      string consisting only of test case description comments separated
      by blank lines, and then fill in the test cases. Will also
      highlight ParseFatalExceptions with "(FATAL)".
    * Added a 'pyparsing_common' class containing common/helpful little
      expressions such as integer, float, identifier, etc. I used this
      class as a sort of embedded namespace, to contain these helpers
      without further adding to pyparsing's namespace bloat.
    * Minor enhancement to traceParseAction decorator, to retain the
      parse action's name for the trace output.
    * Added optional 'fatal' keyword arg to addCondition, to indicate
      that a condition failure should halt parsing immediately.
  - changes from version 2.1.3:
    * _trim_arity fix in 2.1.2 was very version-dependent on Py 3.5.0.
      Now works for Python 2.x, 3.3, 3.4, 3.5.0, and 3.5.1 (and
      hopefully beyond).
  - changes from version 2.1.2:
    * Fixed bug in _trim_arity when pyparsing code is included in a
      PyInstaller, reported by maluwa.
    * Fixed catastrophic regex backtracking in implementation of the
      quoted string expressions (dblQuotedString, sglQuotedString, and
      quotedString). Reported on the pyparsing wiki by webpentest, good
      catch! (Also tuned up some other expressions susceptible to the
      same backtracking problem, such as cStyleComment, cppStyleComment,
      etc.)
  - update to version 2.1.1:
    * Added support for assigning to ParseResults using slices.
    * Fixed bug in ParseResults.toDict(), in which dict values were
      always converted to dicts, even if they were just unkeyed lists of
      tokens.  Reported on SO by Gerald Thibault, thanks Gerald!
    * Fixed bug in SkipTo when using failOn, reported by robyschek,
      thanks!
    * Fixed bug in Each introduced in 2.1.0, reported by AND patch and
      unit test submitted by robyschek, well done!
    * Removed use of functools.partial in replaceWith, as this creates
      an ambiguous signature for the generated parse action, which fails
      in PyPy. Reported by Evan Hubinger, thanks Evan!
    * Added default behavior to QuotedString to convert embedded '\t',
      '\n', etc. characters to their whitespace counterparts. Found
      during Q&A exchange on SO with Maxim.
  - update to version 2.1.0:
    * Modified the internal _trim_arity method to distinguish between
      TypeError's raised while trying to determine parse action arity
      and those raised within the parse action itself. This will clear
      up those confusing "<lambda>() takes exactly 1 argument (0 given)"
      error messages when there is an actual TypeError in the body of
      the parse action. Thanks to all who have raised this issue in the
      past, and most recently to Michael Cohen, who sent in a proposed
      patch, and got me to finally tackle this problem.
    * Added compatibility for pickle protocols 2-4 when pickling
      ParseResults.  In Python 2.x, protocol 0 was the default, and
      protocol 2 did not work.  In Python 3.x, protocol 3 is the
      default, so explicitly naming protocol 0 or 1 was required to
      pickle ParseResults. With this release, all protocols 0-4 are
      supported. Thanks for reporting this on StackOverflow, Arne
      Wolframm, and for providing a nice simple test case!
    * Added optional 'stopOn' argument to ZeroOrMore and OneOrMore, to
      simplify breaking on stop tokens that would match the repetition
      expression.
      It is a common problem to fail to look ahead when matching
      repetitive tokens if the sentinel at the end also matches the
      repetition expression, as when parsing "BEGIN aaa bbb ccc END"
      with:
      "BEGIN" + OneOrMore(Word(alphas)) + "END"
      Since "END" matches the repetition expression "Word(alphas)", it
      will never get parsed as the terminating sentinel. Up until now,
      this has to be resolved by the user inserting their own negative
      lookahead:
      "BEGIN" + OneOrMore(~Literal("END") + Word(alphas)) + "END"
      Using stopOn, they can more easily write:
      "BEGIN" + OneOrMore(Word(alphas), stopOn="END") + "END"
      The stopOn argument can be a literal string or a pyparsing
      expression.  Inspired by a question by Lamakaha on StackOverflow
      (and many previous questions with the same negative-lookahead
      resolution).
    * Added expression names for many internal and builtin expressions,
      to reduce name and error message overhead during parsing.
    * Converted helper lambdas to functions to refactor and add
      docstring support.
    * Fixed ParseResults.asDict() to correctly convert nested
      ParseResults values to dicts.
    * Cleaned up some examples, fixed typo in fourFn.py identified by
      aristotle2600 on reddit.
    * Removed keepOriginalText helper method, which was deprecated ages
      ago. Superceded by originalTextFor.
    * Same for the Upcase class, which was long ago deprecated and
      replaced with the upcaseTokens method.


author: jmatejek@suse.com
changelog:
  - update for single-spec
  - desetuptoolize.patch : switch from setuptools to distutils.core
    for installation, as this is now a setuptools dependency
  - ensure egg-info is a directory (distutils would install it as file)


author: dmueller@suse.com
changelog:
  - update to 2.2.0:
    - Bumped minor version number to reflect compatibility issues with
      OneOrMore and ZeroOrMore bugfixes in 2.1.10. (2.1.10 fixed a bug
      that was introduced in 2.1.4, but the fix could break code
      written against 2.1.4 - 2.1.9.)
    - Updated setup.py to address recursive import problems now
      that pyparsing is part of 'packaging' (used by setuptools).
      Patch submitted by Joshua Root, much thanks!
    - Fixed KeyError issue reported by Yann Bizeul when using packrat
      parsing in the Graphite time series database, thanks Yann!
    - Fixed incorrect usages of '\' in literals, as described in
      https://docs.python.org/3/whatsnew/3.6.html#deprecated-python-behavior
      Patch submitted by Ville Skyttä - thanks!
    - Minor internal change when using '-' operator, to be compatible
      with ParserElement.streamline() method.
    - Expanded infixNotation to accept a list or tuple of parse actions
      to attach to an operation.
    - New unit test added for dill support for storing pyparsing parsers.
      Ordinary Python pickle can be used to pickle pyparsing parsers as
      long as they do not use any parse actions. The 'dill' module is an
      extension to pickle which *does* support pickling of attached
  - drop desetuptoolize.patch: this is not needed


author: arun@gmx.de
changelog:
  - update to version 2.18.4:
    * Improvements
      + Error messages for invalid headers now include the header name
      for easier debugging
    * Dependencies
      + We now support idna v2.6.
  - changes from version 2.18.3:
    * Improvements
      + Running $ python -m requests.help now includes the installed
      version of idna.
    * Bugfixes
      + Fixed issue where Requests would raise ConnectionError instead
      of SSLError when encountering SSL problems when using urllib3
      v1.22.


author: aplanas@suse.com
changelog:
  - Recommends only for SUSE
  - In no SUSE evironments some tests related with certificates can
    fail. Skip the tests if this case.


author: stefan.bruens@rwth-aachen.de
changelog:
  - update to version 2.19.1:
    * Fixed issue where status_codes.py’s init function failed trying
      to append to a __doc__ value of None.
  - update to version 2.19.0:
    * Improvements
      + Warn about possible slowdown with cryptography version < 1.3.4
      + Check host in proxy URL, before forwarding request to adapter.
      + Maintain fragments properly across redirects. (RFC7231 7.1.2)
      + Removed use of cgi module to expedite library load time.
      + Added support for SHA-256 and SHA-512 digest auth algorithms.
      + Minor performance improvement to Request.content.
      + Migrate to using collections.abc for 3.7 compatibility.
    * Bugfixes
      + Parsing empty Link headers with parse_header_links() no longer
      return one bogus entry.
      + Fixed issue where loading the default certificate bundle from
      a zip archive would raise an IOError.
      + Fixed issue with unexpected ImportError on windows system
      which do not support winreg module.
      + DNS resolution in proxy bypass no longer includes the username
      and password in the request. This also fixes the issue of DNS
      queries failing on macOS.
      + Properly normalize adapter prefixes for url comparison.
      + Passing None as a file pointer to the files param no longer
      raises an exception.
      + Calling copy on a RequestsCookieJar will now preserve the
      cookie policy correctly.
    * We now support idna v2.7 and urllib3 v1.23.
  - Properly set idna/urllib3 dependency versions, runtime and buildtime
  - Spec cleanup, remove conditionals for ancient distro versions
  - Remove duplicates with fdupes


author: Arun Persaud <arun@gmx.de>
changelog:
  - specfile:
    * remove devel for noarch
    * remove restriction for urllib3 < 1.24
    * HISTORY and README changed from .rst to .md
  - update to version 2.20.0:
    * Bugfixes
      + Content-Type header parsing is now case-insensitive
      (e.g. charset=utf8 v Charset=utf8).
      + Fixed exception leak where certain redirect urls would raise
      uncaught urllib3 exceptions.
      + Requests removes Authorization header from requests redirected
      from https to http on the same hostname. (CVE-2018-18074)
      + should_bypass_proxies now handles URIs without hostnames
      (e.g. files).
    * Dependencies
      + Requests now supports urllib3 v1.24.
    * Deprecations
      + Requests has officially stopped support for Python 2.6.


author: Bryan Stephenson <bstephenson@suse.com>
changelog:
  - Update to version 2.20.1 (bsc#1111622)
    * Fixed bug with unintended Authorization header stripping for
      redirects using default ports (http/80, https/443).


author: arun@gmx.de
changelog:
  - update to version 39.0.0:
    * #1296: Setuptools now vendors its own direct dependencies, no
      longer relying on the dependencies as vendored by pkg_resources.
    * #296: Removed long-deprecated support for iteration on Version
      objects as returned by pkg_resources.parse_version. Removed the
      SetuptoolsVersion and SetuptoolsLegacyVersion names as well. They
      should not have been used, but if they were, replace with Version
      and LegacyVersion from packaging.version.
  - changes from version 38.7.0:
    * #1288: Add support for maintainer in PKG-INFO.
  - changes from version 38.6.1:
    * #1292: Avoid generating Provides-Extra in metadata when no extra
      is present (but environment markers are).


author: arun@gmx.de
changelog:
  - update to version 39.1.0:
    * #1340: Update all PyPI URLs to reflect the switch to the new
      Warehouse codebase.
    * #1337: In pkg_resources, now support loading resources for modules
      loaded by the SourcelessFileLoader.
    * #1332: Silence spurious wheel related warnings on Windows.


author: arun@gmx.de
changelog:
  - update to version 39.2.0:
    * #1359: Support using "file:" to load a PEP 440-compliant package
      version from a text file.
    * #1360: Fixed issue with a mismatch between the name of the package
      and the name of the .dist-info file in wheel files
    * #1364: Add __dir__() implementation to
      pkg_resources.Distribution() that includes the attributes in the
      _provider instance variable.
    * #1365: Take the package_dir option into account when loading the
      version from a module attribute.
    * #1353: Added coverage badge to README.
    * #1356: Made small fixes to the developer guide documentation.
    * #1357: Fixed warnings in documentation builds and started
      enforcing that the docs build without warnings in tox.
    * #1376: Updated release process docs.
    * #1343: The setuptools specific long_description_content_type,
      project_urls and provides_extras fields are now set consistently
      after any distutils setup_keywords calls, allowing them to
      override values.
    * #1352: Added tox environment for documentation builds.
    * #1354: Added towncrier for changelog managment.
    * #1355: Add PR template.
    * #1368: Fixed tests which failed without network connectivity.
    * #1369: Added unit tests for PEP 425 compatibility tags support.
    * #1372: Stop testing Python 3.3 in Travis CI, now that the latest
      version of wheel no longer installs on it.


author: arun@gmx.de
changelog:
  - update to version 40.0.0:
    * #1342: Drop support for Python 3.3.
    * #1366: In package_index, fixed handling of encoded entities in
      URLs.
    * #1383: In pkg_resources VendorImporter, avoid removing packages
      imported from the root.
    * #1379: Minor doc fixes after actually using the new release
      process.
    * #1385: Removed section on non-package data files.
    * #1403: Fix developer's guide.
    * #1404: Fix PEP 518 configuration: set build requirements in
      pyproject.toml to ["wheel"].


author: arun@gmx.de
changelog:
  - specfile:
    * removed devel for noarch package
  - update to version 40.1.0:
    * #1410: Deprecated upload and register commands.
    * #1312: Introduced find_namespace_packages() to find PEP 420
      namespace packages.
    * #1420: Added find_namespace: directive to config parser.
    * #1418: Solved race in when creating egg cache directories.
    * #1450: Upgraded vendored PyParsing from 2.1.10 to 2.2.0.
    * #1451: Upgraded vendored appdirs from 1.4.0 to 1.4.3.
    * #1388: Fixed "Microsoft Visual C++ Build Tools" link in exception
      when Visual C++ not found.
    * #1389: Added support for scripts which have unicode content.
    * #1416: Moved several Python version checks over to using six.PY2
      and six.PY3.
    * #1441: Removed spurious executable permissions from files that
      don't need them.


author: arun@gmx.de
changelog:
  - update to version 40.2.0:
    * #1466: Fix handling of Unicode arguments in PEP 517 backend
  - changes from version 40.1.1:
    * #1465: Fix regression with egg_info command when tagging is used.


author: Arun Persaud <arun@gmx.de>
changelog:
  - update to version 40.4.3:
    * #1480: Bump vendored pyparsing in pkg_resources to 2.2.1.
  - changes from version 40.4.2:
    * #1497: Updated gitignore in repo.
  - changes from version 40.4.1:
    * #1480: Bump vendored pyparsing to 2.2.1.
  - changes from version 40.4.0:
    * #1481: Join the sdist --dist-dir and the build_meta sdist
      directory argument to point to the same target (meaning the build
      frontend no longer needs to clean manually the dist dir to avoid
      multiple sdist presence, and setuptools no longer needs to handle
      conflicts between the two).
  - changes from version 40.3.0:
    * #1402: Fixed a bug with namespace packages under Python 3.6 when
      one package in current directory hides another which is
      installed.
    * #1427: Set timestamp of .egg-info directory whenever egg_info
      command is run.
    * #1474: build_meta.get_requires_for_build_sdist now does not
      include the wheel package anymore.
    * #1486: Suppress warnings in pkg_resources.handle_ns.
    * #1479: Remove internal use of six.binary_type.


author: Arun Persaud <arun@gmx.de>
changelog:
  - update to version 40.5.0:
    * #1335: In pkg_resources.normalize_path, fix issue on Cygwin when
      cwd contains symlinks.
    * #1502: Deprecated support for downloads from Subversion in
      package_index/easy_install.
    * #1517: Dropped use of six.u in favor of u"" literals.
    * #1520: Added support for data_files in setup.cfg.
    * #1525: Fixed rendering of the deprecation warning in easy_install
      doc.


author: dimstar@opensuse.org
changelog:
  - Delete the system egg-info during pre phase: older versions of
    the package installed it as a directory, the latest update
    creates a file, and rpm has known issues with replacing this.


author: mcihar@suse.cz
changelog:
  - Update to 1.10.0:
    - Issue #122: Improve the performance of `six.int2byte` on Python 3.
    - Pull request #55 and issue #99: Don't add the `winreg` module to `six.moves`
      on non-Windows platforms.
    - Pull request #60 and issue #108: Add `six.moves.getcwd` and
      `six.moves.getcwdu`.
    - Pull request #64: Add `create_unbound_method` to create unbound methods.


author: toddrme2178@gmail.com
changelog:
  - Run tests in -doc package to avoid dependency loops
    * python-setuptools -> python-six -> python-py -> python-setuptools
    * python-setuptools -> python-six -> python-pytest -> python-setuptools
  - Actually run the tests.  They weren't previously being run.


author: arun@gmx.de
changelog:
  - README->README.rst, add CHANGES
  - update to version 1.11.0:
    * Pull request #178: `with_metaclass` now properly proxies
      `__prepare__` to the underlying metaclass.
    * Pull request #191: Allow `with_metaclass` to work with metaclasses
      implemented in C.
    * Pull request #203: Add parse_http_list and parse_keqv_list to
      moved urllib.request.
    * Pull request #172 and issue #171: Add unquote_to_bytes to moved
      urllib.parse.
    * Pull request #167: Add `six.moves.getoutput`.
    * Pull request #80: Add `six.moves.urllib_parse.splitvalue`.
    * Pull request #75: Add `six.moves.email_mime_image`.
    * Pull request #72: Avoid creating reference cycles through
      tracebacks in `reraise`.


author: jmatejek@suse.com
changelog:
  - remove egg-info directory before installation if it exists,
    because setuptools produce directory and six switched to distutils
    that produce a file
    (and because rpm can't handle that by itself)
    fixes bsc#1057496


author: Tomáš Chvátal <tchvatal@suse.com>
changelog:
  - Do not cause buildcycle with previous change but rather
    install the egg-info prepared metadata from the tarball


author: mimi.vx@gmail.com
changelog:
  - update to 1.23
  - add 1414.patch - fix tests with new tornado
  - refresh python-urllib3-recent-date.patch
  - drop urllib3-test-no-coverage.patch
    * Allow providing a list of headers to strip from requests when redirecting
    to a different host. Defaults to the Authorization header. Different
    headers can be set via Retry.remove_headers_on_redirect.
    * Fix util.selectors._fileobj_to_fd to accept long
    * Dropped Python 3.3 support.
    * Put the connection back in the pool when calling stream()
    or read_chunked() on a chunked HEAD response.
    * Fixed pyOpenSSL-specific ssl client authentication issue when clients
    attempted to auth via certificate + chain
    * Add the port to the connectionpool connect print
    * Don't use the uuid module to create multipart data boundaries.
    * read_chunked() on a closed response returns no chunks.
    * Add Python 2.6 support to contrib.securetransport
    * Added support for auth info in url for SOCKS proxy


author: Tomáš Chvátal <tchvatal@suse.com>
changelog:
  - Update to 1.24:
    * Allow key_server_hostname to be specified when initializing a PoolManager to allow custom SNI to be overridden. (Pull #1449)
    * Test against Python 3.7 on AppVeyor. (Pull #1453)
    * Early-out ipv6 checks when running on App Engine. (Pull #1450)
    * Change ambiguous description of backoff_factor (Pull #1436)
    * Add ability to handle multiple Content-Encodings (Issue #1441 and Pull #1442)
    * Skip DNS names that can't be idna-decoded when using pyOpenSSL (Issue #1405).
    * Add a server_hostname parameter to HTTPSConnection which allows for overriding the SNI hostname sent in the handshake. (Pull #1397)
    * Drop support for EOL Python 2.6 (Pull #1429 and Pull #1430)
    * Fixed bug where responses with header Content-Type: message/* erroneously raised HeaderParsingError, resulting in a warning being logged. (Pull #1439)
    * Move urllib3 to src/urllib3 (Pull #1409)
  - Drop patch 1414.patch merged upstream
  - Refresh patches:
    * python-urllib3-recent-date.patch
    * urllib3-ssl-default-context.patch


author: Ralf Haferkamp <rhafer@suse.com>
changelog:
  - Update python-urllib3-recent-date.patch to have RECENT_DATE within
    the needed boundaries for the test suite.
  - Add urllib3-disallow-control-chars-in-http-urls.patch (bsc#1132663,
    CVE-2019-11236, bsc#1129071, CVE-2019-9740)
  - Skip test_source_address_error as we raise different error with
    fixes that we provide in new python2/3
  - Add urllib3-cve-2019-11324.patch. Don't load system certs unless
    there were no CA certs or SSLContext object specified manually.
    (bsc#1132900,CVE-2019-11324)


author: dmueller@suse.com
changelog:
  - update to 0.32.0 (bsc#954486):
    - fix http proxy bug (#189)
    - Avoid deprecated BaseException.message (#180)
    - Add travis builds (#182)
    - fixed wsdump to work with piped input (#183)
    - fixed output of wsdump.py with python3 (#185)
    - add raw mode to wsdump.py (#186)


author: dmueller@suse.com
changelog:
  - update to 0.37.0:
    - fixed fialer that `websocket.create_connection` does not accept `origin` as a parameter (#246 )
    - added support for using custom connection class (#235)
    - use Named logger (#238)
    - implement ping/pong timeout (#241)
    - Corrects the syntax highlight code (#243)
    - fixed failure to join thread before it is started (#242)
    - Prints timings in console (#217)
    - use inspect.getfullargspec with Python 3.x (#219)
    - Check that exception message is actually a string before trying for substring check (#224)
    - Use pre-initialized stream socket (#226)
    - fixed TypeError: cafile, capath and cadata cannot be all omitted (#227)
    - Change import style (#203)
    - fix attribute error on the older python. (#215)
    - fixed timeout+ssl error handling bug  on python 2.7.10 (#190)
    - add proxy support to wsdump.py (#194)
    - use wsaccel if available (#193)
    - add support for ssl cert chains to support client certs (#195)
    - fix string formatting in exception (#196)
    - fix typo in README.rst (#197)
    - introduce on_data callback to pass data type. (#198)
    - WebSocketBadStatusException for Handshake error (#199)
    - set close timeout (#192)
    - Map dict to headers list (#204)
    - support client certification (#207)
    - security improvement during handshake (#211)
    - improve logging of error from callback (#212)


author: tbechtold@suse.com
changelog:
  - update to 0.44.0:
    - renames key in sslopt dict (#326)
    - Unkown kwarg 'ca_cert' when calling ssl wrap_socket() (#326)
    - Race condition in WebSocket ping/pong (#327)
    - Implement simple cookie jar(#292)
    - fix: when using pppoe redial will block.(#301)
    - Fix insecure_pythons list in setup.py(#304)
    - Support WEBSOCKET_CLIENT_CA_BUNDLE being directory(#307)
    - WebSocketPayloadException under high traffic and limited network connection(#306)
    - Not working --nocert parameter in wsdump.py(#315)
    - Avoid the app to block on close on certain systems (#320)
    - Fix warning is not defined. (#323)
    - move to repository to https://github.com/websocket-client/websocket-client.git
    - _send_ping warning fails due to missing reference in _logging.__all__ (#294)
    - Fix opcode -> op_code (#286)
    - Shuffled around example code (#256)
    - _send_ping graceful error handling (#262)
    - Allow closing WebSocketApp with status/reason/timeout (#265)
    - Support universal wheels (#267)
    - _url: Added subnet IP address matching in no_proxy host detection (#270)
    - fixed Incorrect encoding in continued messages python3 (#261)
    - Pass headers for websocket handshake (#271)
    - setup.py: Import `logging` before calling it. (#272)
    - Implemented close code 1014 (#273)
    - Support CA bundle specified by environment variable (#279)
    - Response header values should not be converted to lower case (#264)
    - Exclude port 443 from host http header (#248)
    - Cleanup code (#249)
    - Modify a code block directive in README (#250)
    - fixed ping/pong timeouet (#253)
  - convert to singlespec
  - merge -test package


author: Nicola Sella <nsella@redhat.com> - 4.0.21-17
changelog:
  - offline-upgrade: add support for security filters (RhBug:1939975,2139324)
  - Move system-upgrade plugin to core (RhBug:2054235)


author: Jaroslav Rohel <jrohel@redhat.com> - 4.0.21-20
changelog:
  - versionlock: Use only the most specific NEVRA (RhBug:1961217)
  - Fix boot time derivation for systems with no rtc (RhBug:2166444,2182157)
  - Doc update for reposync (RhBug:2132383,2182004)
  - reposync: Implement --safe-write-path option (RhBug:1898089,2203766)


author: Jaroslav Rohel <jrohel@redhat.com> - 4.0.21-21
changelog:
  - Remove patch: "reposync: Implement --safe-write-path option (RhBug:1898089,2203766)" (RhBug:2208444)


author: jengelh@inai.de
changelog:
  - Update to new upstream release 3.9.1
    * Optimized the implementation of RepeatedPtrFieldBase.
    * Added delimited parse and serialize util.
    * Added FieldDescriptor::PrintableNameForExtension() and
      DescriptorPool::FindExtensionByPrintableName(). The latter
      will replace Reflection::FindKnownExtensionByName().
    * Created a new Add method in repeated field that allows adding
      a range of elements all at once.
    * Drop building wheel for Python 3.4.


author: mmnelemane@suse.com
changelog:
  - Updated to version 3.9.2 (bsc#1162343)
    (Objective-C)
    * Remove OSReadLittle* due to alignment requirements. (#6678)
    * Don't use unions and instead use memcpy for the type swaps. (#6672)


author: mlin@suse.com
changelog:
  - Fix incorrect parsing of nullchar in the proto symbol, CVE-2021-22570,
    bsc#1195258
    * Add protobuf-CVE-2021-22570.patch


author: mlin@suse.com
changelog:
  - Fix potential Denial of Service in protobuf-java in the parsing procedure
    for binary data, CVE-2021-22569, bsc#1194530
    * Add protobuf-improve-performance-of-parsing-unknown-fields-in-Java.patch


author: mlin@suse.com
changelog:
  - Fix a potential DoS issue in protobuf-cpp and protobuf-python,
    CVE-2022-1941, bsc#1203681
    * Add protobuf-CVE-2022-1941.patch
  - Fix a potential DoS issue when parsing with binary data in
    protobuf-java, CVE-2022-3171, bsc#1204256
    * Add protobuf-CVE-2022-3171.patch
  - Refresh protobuf-CVE-2021-22570.patch
  - Backport changes from 3.16.x tree for apply recent CVE patches
    * Add protobuf-51026d922970e06475f005b39287963594134b96.patch
    * Add protobuf-6ee16a9c60e734104aeb738503fe3f411c97bd88.patch
    * Add protobuf-73e0d748b9acdc40b693f2879ce82ecb1a849b81.patch
    * Add protobuf-7bff8393cab939bfbb9b5c69b3fe76b4d83c41ee.patch
    * Add protobuf-4f02f056b5cea99052bfdfb6698afe47a3cf2964.patch
    * Add protobuf-763c3588740b97e8e80b1b1a1a2dc4f417647133.patch
    * Add protobuf-6c92f9dff1807c142edf6780d775b58a3b078591.patch
    * Add protobuf-4e93585e8bb234efeacb7737b8d080968c5ab91e.patch
    * Add protobuf-58d4420e2dd8a3cd354fff9db0052881c25369ce.patch
  - Reorganize patch set ordering


author: jengelh@inai.de
changelog:
  - Update to new upstream release 3.8.0
    * Introduced new MOMI (maybe-outside-memory-interval) parser.
    * Added use of C++ override keyword where appropriate.
    * Always declare enums to be int-sized.
    * Append '_' to C++ reserved keywords for message, enum, extension.
  - Remove 0001-remove-PACKAGE_NAME-and-REPOSITORY_NAME-deprecated.patch
    (upstreamed)


author: Jindrich Novy <jnovy@redhat.com> - 1.0.0-68.rc10
changelog:
  - fix "RHEL 7.8: cleaning up mounts of Kubernetes service account secrets of deleted pods failing"
  - Resolves: #1823374


author: Jindrich Novy <jnovy@redhat.com> - 1.0.0-68.rc92
changelog:
  - update to https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc92
  - propagate proper CFLAGS to CGO_CFLAGS to assure code hardening and optimization
  - Related: #1821193


author: asarai@suse.com
changelog:
  - Use the upstream Makefile, to ensure that we always include the version
    information in runc. This was confusing users (and Docker). bsc#1053532
  - Add a backported patch to fix a Makefile bug.
    https://github.com/opencontainers/runc/pull/1555
    + bsc1053532-0001-makefile-drop-usage-of-install.patch


author: asarai@suse.com
changelog:
  - Use .tar.xz provided by upstream, as well as include the keyring to allow
    full provenance of the source.


author: asarai@suse.com
changelog:
  - Upgrade to runc v1.0.0~rc5. Upstream changelog is available from
    https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc5
  - Remove patch now merged upstream.
    - bsc1053532-0001-makefile-drop-usage-of-install.patch


author: asarai@suse.com
changelog:
  - Remove 'go test' from %check section, as it has only ever caused us problems
    and hasn't (as far as I remember) ever caught a release-blocking issue. Smoke
    testing has been far more useful. boo#1095817


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Upgrade to runc v1.0.0~rc6. Upstream changelog is available from
    https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc6


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Add fix for CVE-2019-5736 (effectively copying /proc/self/exe during re-exec
    to avoid write attacks to the host runc binary). bsc#1121967
    + CVE-2019-5736.patch


author: Lokesh Mandvekar <lsm5@fedoraproject.org> - 2:1.0.0-376.dev.git12644e6
changelog:
  - unversioned Provides: oci-runtime
  - runc package will also provide an unversioned Provides: oci-runtime.
  - user should pull in runc separately or else it will install crun by default
   (alphabetical order)
  - similar situation as caddy, httpd, lighttpd and nginx having Provides: webserver


author: asarai@suse.com
changelog:
  - Update to runc v1.0.1. Upstream changelog is available from
    https://github.com/opencontainers/runc/releases/tag/v1.0.1
    * Fixed occasional runc exec/run failure ("interrupted system call") on an
      Azure volume.
    * Fixed "unable to find groups ... token too long" error with /etc/group
      containing lines longer than 64K characters.
    * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is
      frozen. This is a regression in 1.0.0, not affecting runc itself but some
      of libcontainer users (e.g Kubernetes).
    * cgroupv2: bpf: Ignore inaccessible existing programs in case of
      permission error when handling replacement of existing bpf cgroup
      programs. This fixes a regression in 1.0.0, where some SELinux
      policies would block runc from being able to run entirely.
    * cgroup/systemd/v2: don't freeze cgroup on Set.
    * cgroup/systemd/v1: avoid unnecessary freeze on Set.
  - Remove upstreamed patches:
    + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch


author: asarai@suse.com
changelog:
  - Update to runc v1.0.2. Upstream changelog is available from
    https://github.com/opencontainers/runc/releases/tag/v1.0.2
    * Fixed a failure to set CPU quota period in some cases on cgroup v1.
    * Fixed the inability to start a container with the "adding seccomp filter
      rule for syscall ..." error, caused by redundant seccomp rules (i.e. those
      that has action equal to the default one). Such redundant rules are now
      skipped.
    * Made release builds reproducible from now on.
    * Fixed a rare debug log race in runc init, which can result in occasional
      harmful "failed to decode ..." errors from runc run or exec.
    * Fixed the check in cgroup v1 systemd manager if a container needs to be
      frozen before Set, and add a setting to skip such freeze unconditionally.
      The previous fix for that issue, done in runc 1.0.1, was not working.


author: asarai@suse.com
changelog:
  - Update to runc v1.0.3. Upstream changelog is available from
    https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784
    bsc#1193436
    * A potential vulnerability was discovered in runc (related to an internal
      usage of netlink), however upon further investigation we discovered that
      while this bug was exploitable on the master branch of runc, no released
      version of runc could be exploited using this bug. The exploit required
      being able to create a netlink attribute with a length that would overflow a
      uint16 but this was not possible in any released version of runc. For more
      information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784.
      Due to an abundance of caution we decided to do an emergency release with
      this fix, but to reiterate we do not believe this vulnerability was
      possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for
      discovering and reporting this vulnerability so quickly.
    * Fixed inability to start a container with read-write bind mount of a
      read-only fuse host mount.
    * Fixed inability to start when read-only /dev in set in spec.
    * Fixed not removing sub-cgroups upon container delete, when rootless cgroup
      v2 is used with older systemd.
    * Fixed returning error from GetStats when hugetlb is unsupported (which
      causes excessive logging for kubernetes).


author: asarai@suse.com
changelog:
  - Update to runc v1.1.0~rc1. Upstream changelog is available from
    https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.
    + Add support for RDMA cgroup added in Linux 4.11.
    * runc exec now produces exit code of 255 when the exec failed.
      This may help in distinguishing between runc exec failures
      (such as invalid options, non-running container or non-existent
      binary etc.) and failures of the command being executed.
    + runc run: new --keep option to skip removal exited containers artefacts.
      This might be useful to check the state (e.g. of cgroup controllers) after
      the container has￼exited.
    + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
      (the latter is just an alias for SCMP_ACT_KILL).
    + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
      users to create sophisticated seccomp filters where syscalls can be
      efficiently emulated by privileged processes on the host.
    + checkpoint/restore: add an option (--lsm-mount-context) to set
      a different LSM mount context on restore.
    + intelrdt: support ClosID parameter.
    + runc exec --cgroup: an option to specify a (non-top) in-container cgroup
      to use for the process being executed.
    + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
      machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
      run/exec now adds the container to the appropriate cgroup under it).
    + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
      behaviour.
    + mounts: add support for bind-mounts which are inaccessible after switching
      the user namespace. Note that this does not permit the container any
      additional access to the host filesystem, it simply allows containers to
      have bind-mounts configured for paths the user can access but have
      restrictive access control settings for other users.
    + Add support for recursive mount attributes using mount_setattr(2). These
      have the same names as the proposed mount(8) options -- just prepend r
      to the option name (such as rro).
    + Add runc features subcommand to allow runc users to detect what features
      runc has been built with. This includes critical information such as
      supported mount flags, hook names, and so on. Note that the output of this
      command is subject to change and will not be considered stable until runc
      1.2 at the earliest. The runtime-spec specification for this feature is
      being developed in opencontainers/runtime-spec#1130.
    * system: improve performance of /proc/$pid/stat parsing.
    * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
      the ownership of certain cgroup control files (as per
      /sys/kernel/cgroup/delegate) to allow for proper deferral to the container
      process.
    * runc checkpoint/restore: fixed for containers with an external bind mount
      which destination is a symlink.
    * cgroup: improve openat2 handling for cgroup directory handle hardening.
      runc delete -f now succeeds (rather than timing out) on a paused
      container.
    * runc run/start/exec now refuses a frozen cgroup (paused container in case of
      exec). Users can disable this using --ignore-paused.
  - Update version data embedded in binary to correctly include the git commit of
    the release.
  - Drop runc-rpmlintrc because we don't have runc-test anymore.


author: asarai@suse.com
changelog:
  - Update to runc v1.1.0. Upstream changelog is available from
    https://github.com/opencontainers/runc/releases/tag/v1.1.0.
    - libcontainer will now refuse to build without the nsenter package being
      correctly compiled (specifically this requires CGO to be enabled). This
      should avoid folks accidentally creating broken runc binaries (and
      incorrectly importing our internal libraries into their projects). (#3331)


author: asarai@suse.com
changelog:
  - Update to runc v1.1.1. Upstream changelog is available from
    https://github.com/opencontainers/runc/releases/tag/v1.1.1.
    * runc run/start can now run a container with read-only /dev in OCI spec,
      rather than error out. (#3355)
    * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)
      libcontainer systemd v2 manager no longer errors out if one of the files
      listed in /sys/kernel/cgroup/delegate do not exist in container's
      cgroup. (#3387, #3404)
    * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported"
      error. (#3406)
    * libcontainer/cgroups no longer panics in cgroup v1 managers if stat
      of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)


author: asarai@suse.com
changelog:
  - Update to runc v1.1.2. Upstream changelog is available from
    https://github.com/opencontainers/runc/releases/tag/v1.1.2.
    CVE-2022-29162 bsc#1199460
    * A bug was found in runc where runc exec --cap executed processes with
      non-empty inheritable Linux process capabilities, creating an atypical Linux
      environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and
      CVE-2022-29162. bsc#1199460
    * `runc spec` no longer sets any inheritable capabilities in the created
      example OCI spec (`config.json`) file.


author: asarai@suse.com
changelog:
  - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues
    with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by
    that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565
    + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch


author: asarai@suse.com
changelog:
  - Update to runc v1.1.3. Upstream changelog is available from
    https://github.com/opencontainers/runc/releases/tag/v1.1.3.
    (Includes a fix for bsc#1200088.)
    * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on
      s390 and s390x. This solves the issue where syscalls the host kernel did not
      support would return `-EPERM` despite the existence of the `-ENOSYS` stub
      code (this was due to how s390x does syscall multiplexing).
    * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as
      intended; this fix does not affect runc binary itself but is important for
      libcontainer users such as Kubernetes.
    * Inability to compile with recent clang due to an issue with duplicate
      constants in libseccomp-golang.
    * When using systemd cgroup driver, skip adding device paths that don't exist,
      to stop systemd from emitting warnings about those paths.
    * Socket activation was failing when more than 3 sockets were used.
    * Various CI fixes.
    * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.
    * runc static binaries are now linked against libseccomp v2.5.4.
  - Remove upstreamed patches:
    - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch


author: Jindrich Novy <jnovy@redhat.com> - 1:1.0.3-6
changelog:
  - Fix every podman run invocation generates two "Couldn't stat device
    /dev/char/10:200: No such file or directory" lines in the journal
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 1:1.1.3-3
changelog:
  - fix "Error: runc: exec failed: unable to start container process:
    open /dev/pts/0: operation not permitted: OCI permission denied"
  - Related: #2061390


author: fvogt@suse.com
changelog:
  - Update to runc v1.1.4. Upstream changelog is available from
    https://github.com/opencontainers/runc/releases/tag/v1.1.4.
    * Fix mounting via wrong proc fd. When the user and mount namespaces are
      used, and the bind mount is followed by the cgroup mount in the spec,
      the cgroup was mounted using the bind mount's mount fd.
    * Switch kill() in libcontainer/nsenter to sane_kill().
    * Fix "permission denied" error from runc run on noexec fs.
    * Fix failed exec after systemctl daemon-reload. Due to a regression
      in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and
      was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.
      (boo#1202821)


author: fvogt@suse.com
changelog:
  - Update to runc v1.1.4. Upstream changelog is available from
    https://github.com/opencontainers/runc/releases/tag/v1.1.4.
    bsc#1202021
    * Fix mounting via wrong proc fd. When the user and mount namespaces are
      used, and the bind mount is followed by the cgroup mount in the spec,
      the cgroup was mounted using the bind mount's mount fd.
    * Switch kill() in libcontainer/nsenter to sane_kill().
    * Fix "permission denied" error from runc run on noexec fs.
    * Fix failed exec after systemctl daemon-reload. Due to a regression
      in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and
      was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.
      (boo#1202821)


author: asarai@suse.com
changelog:
  - Update to runc v1.1.5. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.1.5>.
    Includes fixes for the following CVEs:
    - CVE-2023-25809 bsc#1209884
    - CVE-2023-27561 bsc#1208962
    - CVE-2023-28642 bsc#1209888
    * Fix the inability to use `/dev/null` when inside a container.
    * Fix changing the ownership of host's `/dev/null` caused by fd redirection
      (a regression in 1.1.1). bsc#1168481
    * Fix rare runc exec/enter unshare error on older kernels.
    * nsexec: Check for errors in `write_log()`.
  - Drop version-specific Go requirement.


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update to 0.4.1
    * Support specifying netns path (slirp4netns --netns-type=path PATH
      TAPNAME)
    * Support specifying --userns-path
    * Vendor https://gitlab.freedesktop.org/slirp/libslirp (QEMU v4.1+)
    * Bring up loopback device when --configure is specified
    * Support sandboxing by creating a mount namespace
      (--enable-sandbox)
    * Support seccomp (--enable-seccomp)
  - Add new build dependencies libcap-devel and libseccomp-devel


author: Sascha Grunert <sgrunert@suse.com>
changelog:
  - Update to 0.4.3
    * api: raise an error if the socket path is too long
    * libslirp: update to v4.1.0: Including the fix for libslirp
      sends RST to app in response to arriving FIN when containerized
      socket is shutdown() with SHUT_WR
    * Fix create_sandbox error


author: Ralf Haferkamp <rhafer@suse.com>
changelog:
  - Update to 0.4.4 (bsc#1167850)
    * libslirp: Update to v4.2.0:
    * New API function slirp_add_unix: add a forward rule to a Unix
      socket.
    * New API function slirp_remove_guestfwd: remove a forward rule
      previously added by slirp_add_exec, slirp_add_unix or
      slirp_add_guestfwd
    * New SlirpConfig.outbound_addr{,6} fields to bind output
      socket to a specific address
    * socket: do not fallback on host loopback if get_dns_addr()
      failed or the address is in slirp network
    * ncsi: fix checksum OOB memory access
    * tcp_emu(): fix OOB accesses
    * tftp: restrict relative path access
    * state: fix loading of guestfwd state


author: Ralf Haferkamp <rhafer@suse.com>
changelog:
  - Update to 0.4.5 (bsc#1170940)
    * libslirp: update to v4.3.0:
    * Fix use-afte-free in ip_reass() (CVE-2020-1983)


author: Ralf Haferkamp <rhafer@suse.com>
changelog:
  - Update to 0.4.7 (bsc#1172380)
    * libslirp: update to v4.3.1 (Fix CVE-2020-10756)
    * Fix config_from_options() to correctly enable ipv6


author: Jindrich Novy <jnovy@redhat.com> - 1.0.1-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/archive/v1.0.1.tar.gz
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.0-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.0
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.1-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.1
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.2-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.2
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.3-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.3
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.4-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.4
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.6-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.6
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.1.7-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.7
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.1.8-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.8
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.2.0-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.0
  - Related: #2061390


author: Paul Wouters <pwouters@redhat.com> - 1.7.2.2-2
changelog:
  - Resolves: rhel#1017015 Use readline, not compat-readline5-devel
  - Added two patches fixing -Wformat issues
  - Enable hardened build
  - Cleanup obsolete spec file lines


author: p.drouand@gmail.com
changelog:
  - Update to version 1.7.3.0
    * Too many changes to list; please read the CHANGES file for news
  - Remove redundant %clean section
  - Update fix-linux-errqueue.h-not-found.patch and socat-remove_date.patch


author: sweet_f_a@gmx.de
changelog:
  - remove socat-remove_date.patch, export BUILD_DATE instead
    (new feature since 1.7.2.4)
  - run tests, don't abort yet
  - require tcpd-devel only on SUSE systems at build time


author: sweet_f_a@gmx.de
changelog:
  - test-suite, use a small but safe subset of all tests
  - don't remove "example" scripts from builddir, they are needed for
    tests


author: sweet_f_a@gmx.de
changelog:
  - update to 1.7.3.1, security fixes:
    * Socat security advisory 7 and MSVR-1499: "Bad DH p parameter in
      OpenSSL" (bnc#938913 and CVE-2015-4000).
    * Socat security advisory 8: "Stack overflow in arguments parser"
      (bnc#964844)


author: sweet_f_a@gmx.de
changelog:
  - update to 1.7.3.2, bug fixes:
    * fixes uninterruptable hang / CPU loop on host resolution
      problems
    * some compile problems, and lots of other bugs and porting
      issues
  - remove fix-linux-errqueue.h-not-found.patch, this build issue
    was fixed by upstream


author: normand@linux.vnet.ibm.com
changelog:
  - Add socat-ignore-tests-failure-boo1078346.patch
    flaky test failures PowerPC and s390 , bypass boo#1078346


author: Paul Wouters <pwouters@redhat.com> - 1.7.3.2-1
changelog:
  - Resolves rhbz#1404290 socat build failure on rawhide
  - Resolves rhbz#1416597 socat-1.7.3.2 is available
  - Resolves rhbz#1417483 Failed DNS resolution causes SIGSEGV and endless loop
  - Removed obsoleted patch


author: Paul Wouters <pwouters@redhat.com> - 1.7.4.1-1
changelog:
  - Resolves: rhbz#1805132 socat does not recognize IP addresses of the SAN extensions in ssl mode
  - Resolves: rhbz#1870279 Transfer via socat fails with openssl enabled
  - Resolves: rhbz#1914989 Socat udp4-recvfrom cause endless loop error when target is not vaild


author: Joe Doss <joe@solidadmin.com> - 1.0.20200820-1
changelog:
  - Update to 1.0.20200820
  - ipc: split into separate files per-platform
  - wincompat: fold random into genkey
  - systemd: add reload target to systemd unit
  - man: wg-quick: use syncconf instead of addconf for strip example
  - pubkey: isblank is a subset of isspace
  - ctype: use non-locale-specific ctype.h
  - wg-quick: wait on process substitutions


author: Joe Doss <joe@solidadmin.com> - 1.0.20200827-1
changelog:
  - Update to 1.0.20200827
  - wg-quick: android: use iproute2 to bring up interface instead of ndc
  - wg-quick: Revert wait on process substitutions


author: Joe Doss <joe@solidadmin.com> - 1.0.20210223-1
changelog:
  - wg-quick: android: do not free iterated pointer
  - wg-quick: openbsd: no use for userspace support
  - embeddable-wg-library: sync latest from netlink.h
  - wincompat: recent mingw has inet_ntop/inet_pton
  - wincompat: add resource and manifest and enable lto
  - wincompat: do not elevate by default
  - completion: add help and syncconf completions
  - sticky-sockets: do not use SO_REUSEADDR
  - man: LOG_LEVEL variables changed name
  - ipc: do not use fscanf with trailing \n
  - ipc: read trailing responses after set operation


author: Joe Doss <joe@solidadmin.com> - 1.0.20210315-1
changelog:
  - Makefile: fix version indicator
  - wireguard-tools: const correctness
  - wireguard-tools: drag in headers for prototypes
  - ipc: uniformly ignore preshared keys that are zero
  - wg-quick: freebsd: add kernel support
  - ipc: freebsd: add initial FreeBSD support
  - wg-quick: freebsd: avoid writing private keys to /tmp


author: Joe Doss <joe@solidadmin.com> - 1.0.20210424-1
changelog:
  - wg-quick: freebsd: check for socket using -S, not -f
  - wg-quick: freebsd: do not assume point-to-point interface flag
  - wg-quick: freebsd: use ifconfig for determining if interface is up
  - wg-quick: kill route monitor when loop terminates


author: Joe Doss <joe@solidadmin.com> - 1.0.20210914-1
changelog:
  - contrib/launchd: fix xml syntax error
  - wg-quick: darwin: account for "link#XX" gateways
  - ipc: add wireguard-nt support
  - ipc: cache windows lookups to avoid O(n^2) with nested lookups
  - ipc: remove windows elevation
  - ipc: windows: don't display disabled adapters
  - ipc: windows: use devpkey instead of nci for name
  - wg-quick: android: adjust for android 12
  - wg-quick: openbsd: set DNS with resolvd(8)


